The present invention is directed to a method for validation of a time synchronization of at least two controllers connected to each other via a private bus, a master controller configured to be connected to a slave controller via a private bus and to carry out the method at least partly, a slave controller configured to be connected to a master controller via a private bus and to carry out the method at least partly, a communication network comprising the master and the slave controller, and a vehicle, e.g. a car, comprising the communication network.

With an increasing complexity of autonomous or automated vehicles, multiple communication busses are used by different electronic control units (ECUs) to ensure that autonomous or automated driving functions fulfill safety requirements, e.g. requirements needed to fulfill a so called Automotive Safety Integrity Level (ASIL).

The Automotive Safety Integrity Level is a risk classification scheme defined by ISO 26262 - Functional Safety for Road Vehicles. The ASIL classification comprises five safety levels, starting from QM with the lowest safety requirements to ASIL D having the highest safety requirements.

All related controllers which take part in critical decision making of automated driving functions need to have a synchronized time according to the other controllers. Time synchronization for highly automated vehicles, e.g. a car of a SAE Level 3 or Level 4 or higher (wherein the SAE J3016 standard describes classification and definition of terms for roadbound vehicles with automated driving systems), need to fulfill ASIL D.

In the state of the art, time synchronization of an Ethernet bus is done according to IEEE 802. IAS for a TSN (time sensitive network) and IEEE 1588 with respect to the PTP (Precision Time Protocol). However, for time synchronization via PTP there are several measures that can be taken in addition to the respective standards, so that the integrity of the synchronization process and thus the integrity of the distributed time-base can be ensured.

However, if the controllers are connected to each other by a private bus system (e.g. PCI Express, CAN-FD, MIPI, SERDES, SPI etc.) PTP implementation for time synchronization is not available. In the light of this state of the art, the object of the present invention is to provide a solution for validation of a time synchronization of at least two controllers connected to each other via a private bus, wherein it is ensured that a predefined safety integrity level is fulfilled, e.g. ASIL B or higher.

The object is solved by the features of the independent claims. The dependent claims contain preferred further developments of the invention.

More specifically, the object is solved by a method for validation of a time synchronization of at least two controllers connected to each other via a private bus, wherein one of the at least two controllers is a master controller and the other one of the at least two controllers is a slave controller.

The method comprises a plurality of cycles. Each cycle includes sending, from the master controller to the slave controller, a follow up message in response to a pull of a predefined pin of the master controller, wherein the follow up message includes a global time of the master controller when the predefined pin was pulled.

Each cycle further includes sending, from the slave controller to the master controller, a validation message in response to the received follow up message, wherein the validation message includes a global time of the slave controller when the pull of the predefined pin is detected by the slave controller.

Each cycle (except the initial/first cycle) further includes validating the time synchronization by checking, at the master controller and/or the slave controller, if a difference between the global time of the master controller when the predefined pin was pulled and the global time of the slave controller when the pull of the predefined pin is detected by the slave controller is smaller than a predefined first threshold. A pre-condition for doing this can be that the synchronized global time at the master controller is already validated.

The method can include capturing, at the master controller, a global time of the master controller when the predefined pin was pulled. The validation message can include a local hardware counter of the slave controller, wherein the local hardware counter corresponds to the global time of the slave controller when the pull of the predefined pin is detected by the slave controller.

The local hardware counter of the slave controller is a second source of time enabling the master and/or the slave controller to perform the following check.

That is, validating the time synchronization can further include checking, at the master controller, if a difference between a difference of the global time captured by the master controller when the predefined pin was pulled and a global time captured by the master controller when the predefined pin was pulled in a previous cycle, and a difference between the local hardware counter corresponding to the global time of the slave controller when the pull of the predefined pin is detected by the slave controller and a local hardware counter corresponding to a global time of the slave controller when the pull of the predefined pin is detected by the slave controller in the previous cycle is smaller than a predefined second threshold. This validation is not performed in the initial/first cycle of the method.

Additionally or alternatively, validating the time synchronization can include checking, at the slave controller, if a difference between a difference of the global time of the master controller received by the slave controller in the follow up message and a global time of the master controller received by the slave controller in the follow up message in a previous cycle, and a difference between the local hardware counter corresponding to the global time of the slave controller when the pull of the predefined pin is detected by the slave controller and the local hardware counter corresponding to the global time of the slave controller when the pull of the predefined pin is detected by the slave controller in the previous cycle is smaller than the predefined second threshold.

The validation message can include the difference between the local hardware counter corresponding to the global time of the slave controller when the pull of the predefined pin is detected by the slave controller and the local hardware counter corresponding to a global time of the slave controller when the pull of the predefined pin is detected by the slave controller in the previous cycle. That is, the validation message can already include the difference between the hardware counters, wherein the difference is computed by the slave controller. The master controller can be connected to a further bus. The further bus can also be called main bus.

The master controller can comprise a master port and a slave port, wherein the master controller is connected via its slave port to the further bus. The slave port and the master port can each comprise their own clock.

The method can comprise synchronizing a global time of the clock of the slave port of the master controller with a global time of the further bus and synchronizing a global time of the clock of the master port of the master controller to the global time of the clock of the slave port of the master controller, preferably after synchronizing the global time of the clock of the slave port to the global time of the further bus.

The method can further comprise capturing, at the master controller, a global time of the slave port when the predefined pin was pulled. Also this is preferably done after synchronizing the global time of the clock of the slave port to the global time of the further bus.

Due the above, the master controller can perform the following check. That is, validating the time synchronization can include checking, at the master controller, if a difference between the global time captured by the master controller at the master port, i.e. the global time of the clock of the master port of the master controller, when the predefined pin was pulled and the global time captured by the master controller at the slave port, i.e. the global time of the clock of the slave port of the master controller, when the predefined pin was pulled is smaller than a predefined third threshold.

The method can comprise, preferably after capturing the local hardware counter and the global time of the slave controller when the pull of the predefined pin is detected by the slave controller, updating a global time of the slave controller to the global time of the master controller included in the follow up message.

The validation message can include the global time sent from the master controller to the slave controller in the follow up message. Thus it is possible that validating the time synchronization includes checking, at the master controller, if a difference between the global time captured by the master controller when the predefined pin was pulled and the global time included in the validation message is smaller than a predefined forth threshold.

Furthermore, a master controller is provided, wherein the master controller is configured to be connected to a slave controller via a private bus.

The master controller is further configured to send a follow up message to the slave controller via the private bus in response to a pull of a predefined pin of the master controller and recording, i.e. capturing, the time when the pin was pulled, wherein the follow up message includes a global time of the master controller when the predefined pin was pulled.

The master controller is further configured to receive a validation message from the slave controller via the private bus in response to the sent follow up message, wherein the validation message includes a global time of the slave controller when the pull of the predefined pin is detected by the slave controller.

The master controller is further configured to validate a time synchronization of a global time of the slave controller to a global time of the master controller by checking if a difference between the global time of the master controller when the predefined pin was pulled and the global time of the slave controller when the pull of the predefined pin is detected by the slave controller is smaller than a predefined first threshold.

The validation message can include a local hardware counter of the slave controller as a second source of time, wherein the local hardware counter corresponds to the global time of the slave controller when the pull of the predefined pin is detected by the slave controller.

The master controller can be configured to capture a global time of the master controller when the predefined pin was pulled, i.e. the master controller can comprise at least one clock and the time of this clock is captured by the master controller when the predefined pin was pulled.

The master controller can be configured to validate the time synchronization of the global time of the slave controller to the global time of the master controller by checking if a difference between the global time captured by the master controller when the predefined pin was pulled and a global time captured by the master controller when the predefined pin was pulled in a previous cycle, and a difference between the local hardware counter corresponding to the global time of the slave controller when the pull of the predefined pin is detected by the slave controller and a local hardware counter corresponding to a global time of the slave controller when the pull of the predefined pin is detected by the slave controller in the previous cycle is smaller than a predefined second threshold.

The validation message can include the difference between the local hardware counter corresponding to the global time of the slave controller when the pull of the predefined pin is detected by the slave controller and the local hardware counter corresponding to a global time of the slave controller when the pull of the predefined pin is detected by the slave controller in the previous cycle.

The master controller can be configured to be connected to a further bus and synchronize its global time to a global time of the further bus.

More specifically, the master controller can comprise a master port and a slave port, wherein the slave port and the master port each comprise a clock. The master controller can be connected to the further bus, e.g. a main bus of a vehicle, via its slave port, and be configured to synchronize a global time of the clock of the slave port to a global time of the further bus. This can be done by using PTP. Preferably afterwards, the master controller synchronizes a global time of the clock of the master port to the global time of the clock of the slave port of the master controller and captures a global time of the slave port when the predefined pin was pulled.

The master controller can be configured to validate a time synchronization of the global time of the clock of its slave port and the global time of the clock of its master port by checking if a difference between the global time of the clock of its master port, preferably captured when the predefined pin was pulled, and the global time of the clock of its slave port, also preferably captured when the predefined pin was pulled, is smaller than a predefined third threshold.

This validation enables the master controller to check if a difference between its internal clocks is in an acceptable range.

Furthermore, a slave controller is provided, wherein the slave controller is configured to be connected to a master controller via a private bus. The slave controller is further configured to receive a follow up message from the master controller via the private bus in response to a pull of a predefined pin of the master controller, wherein the follow up message includes a global time of the master controller when the predefined pin was pulled.

The slave controller is further configured to detect the pull of the predefined pin of the master controller and capture a global time of the slave controller when the pull of the predefined pin is detected by the slave controller.

The slave controller is further configured to validate the time synchronization by checking if a difference between the global time of the master controller included in the follow up message and the global time captured by the slave controller when the pull of the predefined pin is detected by the slave controller, i.e. the global time of a clock of the slave controller at the time of detecting the pull of the predefined pin at the slave controller, is smaller than a predefined first threshold.

The slave controller can be configured to send a validation message to the master controller via the private bus in response to the received follow up message.

The validation message can include the global time of the slave controller when the pull of the predefined pin is detected by the slave controller such that the master controller can validate the time synchronization by checking, at the master controller, if a difference between the global time of the master controller when the predefined pin was pulled and the global time of the slave controller when the pull of the predefined pin is detected by the slave controller is smaller than the predefined first threshold. It is possible that the validation message also includes the global time of the master controller included in the follow up message.

The slave controller can be configured to capture a local hardware counter of the slave controller, wherein the local hardware counter corresponds to the global time of the slave controller when the pull of the predefined pin is detected by the slave controller.

The slave controller can be configured to validate the time synchronization of the global time of the slave controller and the global time of the master controller by checking if a difference between a difference of the global time of the master controller included in the follow up message and a global time of the master controller included in the follow up message in a previous cycle, and a difference between the local hardware counter corresponding to the global time of the slave controller when the pull of the predefined pin is detected by the slave controller and a local hardware counter corresponding to a global time of the slave controller when the pull of the predefined pin is detected by the slave controller in the previous cycle is smaller than a predefined second threshold.

The slave controller can be configured to send the validation message including the local hardware counter of the slave controller and the global time of the master controller included in the follow up message such that the master controller can validate the time synchronization of the global time of the slave controller and the global time of the master controller by checking if the difference between the difference of the global time of the master controller included in the validation message and a global time of the master controller included in the validation message in a previous cycle, and a difference between the local hardware counter corresponding to the global time of the slave controller when the pull of the predefined pin is detected by the slave controller and a local hardware counter corresponding to a global time of the slave controller when the pull of the predefined pin is detected by the slave controller in the previous cycle is smaller than the predefined second threshold. Both local hardware counters can be included in the validation message. It is also possible that solely the difference between the two local hardware counters is included in the validation message.

The slave controller can be configured to update a global time of the slave controller to the global time of the master controller included in the follow up message when the pull of the predefined pin is detected by the slave controller but after capturing the local hardware counter and the global time of the slave controller.

Furthermore, a communication network is provided, wherein the communication network can comprise the above described master controller, the above described slave controller, and a private communication bus connecting the master controller and the slave controller to each other. The private communication bus can comprise a connection between the predefined pin of the master controller and the slave controller. The communication network can comprise a further communication bus connected to the master controller, wherein the master controller is configured to synchronize its global time to a global time of the further bus.

Furthermore a vehicle, e.g. a car, can be provided, wherein the vehicle comprises the above described communication network.

In short, the basic principle of the invention is to emulate the PTP for the time synchronization of the controllers.

The time synchronization validation according to ASIL B or ASIL D can be ensured by virtue of different safety mechanisms. The controllers, e.g. microcontrollers, can be divided into a master controller with one or more slave controllers, where the master controller is connected to any communication bus (e.g. Ethernet, Flexray, CAN-FD) which allows standard time synchronization. Solely the master controller is connected to the further bus, i.e. the main bus, and therefore the master and the slave controller are part of a private network, i.e. a self- contained network.

The master controller can have only one time representation or can have a time synchronization slave port and multiple time synchronization master ports.

The master controller provides a follow up message with its global time when the predefined pin is pulled from the master controller, e.g. a general purpose input/output pin (GPIO). The slave controller can only have a time synchronization slave port.

A combined usage of the pin pulling or emulated pin pulling together with the time synchronization mechanism with a follow up message can be provided.

As close as possible to the point in time when the pull of the predefined pin at the master controller is detected on the slave controller side, the value of the local hardware counter as well as its associated global time can be captured.

The global time at the slave controller shall be captured before the global time on the slave controller is updated based on the new value received by the follow up message, i.e. the follow- up message sent from the master to the slave controller in response to the pull of the predefined pin.

After the capture of the hardware counter and the global time at the slave controller, the time synchronization mechanism can update the global time on the slave controller using the follow up message.

It is possible to use the local hardware counters with the time synchronization mechanism, i.e. the GPIO pull and the follow up message, to validate the system time on the slave controller side.

This concept enables different controllers which may be connected to each other by a communication channel to internally validate their time, wherein a standard synchronization and validation mechanism is not available.

For the time validation, no additional pin, e.g. GPIO, connection between the master and the slave controller is needed because the one pin connection for time synchronization which is commonly used can be shared between time synchronization and time validation at the master and the slave controller, respectively.

In the time between any two synchronizations a validation message, i.e. the validation message in response to the received follow up message, can be sent from the slave controller to the master controller.

This validation message can include the difference of the hardware counters of the slave controller in between two points of synchronization, the captured global time of the slave controller when the pull of the predefined pin was registered in the current communication cycle as well as the global time which was received inside the follow up message.

The master controller can capture the global time which is written into the follow up message very close to the point in time when the predefined pin was pulled.

The safety/validation checks can be performed on the master and the slave controller to include a leap detection on both sides. On the slave side, the difference of the global time captured at the slave controller at the point in time when the predefined pin was pulled and the global time which was received at the follow up message should be smaller than the predefined first threshold.

On the Master side, the difference of a global time which is written into the follow up message and the received global time on the slave side which is included in the validation message should be smaller than the predefined first threshold.

In the following, a description of an embodiment of the present invention is given with respect to figures 1 and 2.

Fig. 1 depicts schematically a communication network to be used in a method for validation of a time synchronization of at least two controllers connected to each other via a private bus.

Fig. 2 depicts schematically a flowchart of the method for validation of the time synchronization of the at least two controllers connected to each other via the private bus.

As can be gathered from figure 1, the communication network 1 comprises a master controller 2, a slave controller 3, and a private communication bus 4 connecting the master controller 2 and the slave controller 3 to each other.

The master controller 2 comprises a slave port 21 connected to a master port 51 of a master controller 5 of another, i.e. a further, communication network. The master controller 2 further comprises a master port 22 connected to a slave port 31 of the slave controller 3 via the private communication bus 4, wherein these ports 22, 31 are used for the time synchronization of the master and the slave controller 2, 3 described in detail in the following with respect to figure 2.

The further communication network, i.e. the further communication bus (e.g. Ethernet, Flexray, CAN-FD), allows standard time synchronization, such that the global time of the master controller 2 is synchronized to the global time of the further communication bus, e.g. by receiving a time synchronization message including a synchronized time t _a si from the master port 51 of the master controller 5 of the further communication network via the slave port 21 at the master controller 2.

More specifically, the master port 22 and the slave port 21 each comprise their own clock. The global time of the clock of the slave port 21 is synchronized to a global time of the further bus, e.g. by using PTP, and afterwards a global time of the clock of the master port 22 is synchronized to the synchronized global time of the clock of the slave port 21.

The method comprising a plurality of cycles, wherein two cycles are shown in figure 2. A start of each cycle is triggered by a pull of a predefined pin of the master controller 2, here a cyclic GPIO pull.

At first, i.e. after synchronizing the global time of the master controller 2 to the global time of the further bus, the master controller 2 sends a follow up message in response to the pull of the predefined pin of the master controller 2 via the private communication bus 4 to the slave port 31 of the slave controller 3.

The follow up message includes a global time taMi, taM2 of the master controller 2 when, i.e. at which, the predefined pin was pulled during the actual cycle of the method.

In response to the follow up message received at the slave controller 3, the slave controller 3 sends a validation message to the master controller 2 via its slave port 31 and the communication bus 4.

The validation message includes a global time tbsi, tbS2 of the slave controller 3 when the pull of the predefined pin is detected by the slave controller 3 in the actual/current cycle. The master controller 3 is configured to capture, i.e. save, the received global time tbsi, tbS2. The validation message further includes a local hardware counter Cbsi, CbS2 of the slave controller 3, wherein the local hardware counter Cbsi, CbS2 corresponds to the global time tbsi, tbS2 of the slave controller 3 when the pull of the predefined pin is detected by the slave controller 3 in the current cycle.

Therefore, the slave controller 3 captures the global time tbsi, tbS2 of the slave controller 3 together with the local hardware counter Cbsi, CbS2 when the pull of the predefined pin is detected by the slave controller 3. As can be gathered from figure 2, each value of the hardware counter Cbsi, CbS2 is directly linked to the global time tbsi, tbS2, i.e. the synchronized time, of the slave controller 3 of the respective cycle.

The slave controller 3 calculates a difference between the local hardware counter CbS2 corresponding to the global time tbS2 of the slave controller 3 when the pull of the predefined pin is detected by the slave controller 3 in the current cycle and the local hardware counter Cbsi corresponding to the global time tbsi of the slave controller when the pull of the predefined pin is detected by the slave controller 3 in the previous cycle. This difference is send from the slave controller 3 to the master controller 2 in the validation message. The values tbsi, Cbsi were captured in the previous synchronization cycle. Since it is not possible to calculate this difference in first cycle of the method (due to the missing local hardware counter corresponding to the global time of the slave controller when the pull of the predefined pin is detected by the slave controller 3 in the previous cycle) this value is set to zero during the first cycle, i.e. in the first validation message.

After capturing these values tbsi, Cbsi, tbS2, CbS2, the slave controller 3 updates, i.e. synchronizes, its global time to the global time t’aMi, t’aM2 received from the master controller 2 in the follow up message.

Furthermore, the slave controller 3 adds the global time t’aMi, t’aM2 to the validation message received from the master controller 2 in the follow up message and which is the time to which the global time of the slave controller 3 was updated. Sending the received global time t’aMi, t’aM2 from the follow up message back to the master controller 2 makes sure that the value was not falsified on the communication path, e.g at a sending communication stack of the master controller 2, during the transmission on the private bus 4, at a receiving communication stack of the slave controller 3, at a sending communication stack of the slave controller 3 and/or at a receiving communication stack of the master controller 2.

Since the software processing in the slave controller 3 takes some time, wherein this delay is indicated by At in figure 2, also other uncertainties are present in program and hardware handling, and the time synchronization of the master controller 2 and the slave controller 3 is handled with standard mechanisms which fulfill only ASIL QM safety requirements, it must be validated, i.e. it must be ensured, that the difference in the global time of the master controller 2 and the slave controller 3 is in a certain range. This could be done with safety requirements up to ASIL D.

Validating the time synchronization comprises checking, at the master controller 2 and the slave controller 3, if a difference between the global time t’aM2 of the master controller 2 when the predefined pin was pulled during the second cycle and the global time tbS2 of the slave controller when the pull of the predefined pin is detected by the slave controller 3 during the second cycle is smaller than a predefined first threshold. Therefore, the master controller 2 receives the global time t’aM2, which is included in the follow up message, as well as the global time tbS2 of the slave controller 3 in the validation message sent from the slave controller 3 to the master controller 2. In other words, the slave controller 3 sends back the global time t’aM2 to the master controller 2 in the validation message..

This check is performed to ensure that the global time of the master controller 2 and the global time of the slave controller 3 are synchronized such that they fulfill the above described safety integrity requirements, e.g. ASIL D.

Alternatively or additionally, the master controller 2 does not only send the global time t’aM2 of the master controller 2 when the predefined pin was pulled but also captures and saves the global time taM2 of the master controller 2 when the predefined pin was pulled.

Validating the time synchronization then also includes checking, at the master controller 2, if a difference between a difference of the global time taM2 captured by the master controller 2 during the second cycle and the global time taMi captured by the master controller 2 when the predefined pin was pulled during the first cycle, and a difference between the local hardware counter CbS2 received by the master controller 2 during the second cycle and the local hardware counter Cbsi also received by the master controller 2 during the second cycle and corresponding to the global time tbsi of the slave controller 3 when the pull of the predefined pin was detected by the slave controller 3 during the first cycle is smaller than a predefined second threshold.

Thereby it is possible to check if a time elapsed between the first and the second cycle on the slave controller 3 using the counter value, i.e. the difference between the local hardware counters CbS2 - Cbsi, and a time elapsed between the first and the second cycle on the master controller 2 using the time difference of the master port 31, i.e. taM2 - taMi, is synchronized, i.e. within the acceptable range (see above, e.g. ASIL D).

Validating the time synchronization can also include checking, at the slave controller 3, if a difference between a difference of the global time t’aM2 received by the slave controller 3 during the second cycle and the global time t’aMi received by the slave controller 3 during the first cycle, and a difference between the local hardware counter CbS2 captured by the slave controller 3 during the second cycle and the local hardware counter Cbsi captured by the slave controller 3 during the first cycle and corresponding to the global time tbsi of the slave controller 3 when the pull of the predefined pin is detected by the slave controller 3 during the first cycle is smaller than the predefined second threshold.

Thereby it is possible to check if a time elapsed between the first and the second cycle on the slave controller 3 using the counter value, i.e. the difference between the local hardware counters CbS2- Cbsi, and a time elapsed between the first and the second cycle on the master controller 2 using the time difference of the global time included in the follow up message, i.e. t’aM2 - t’aMi, is synchronized, i.e. within the acceptable range (see above, e.g. ASIL D).

It is also possible to check if the time synchronization of the master port 22 and the slave port 21 of the master controller 2 are synchronized, i.e. are within the acceptable range (see above, e.g. ASIL D). Therefore, validating the time synchronization can include checking, at the master controller 2, if a difference between the global time taM2 captured by the master controller 2 at the master port 22 when the predefined pin was pulled during the second cycle and the global time t _a s2 captured by the master controller 2 at the slave port 21 when the predefined pin was pulled during the second cycle is smaller than a predefined third threshold. This check can also be performed starting from the first cycle of the method (taMi - t _a si < third threshold).

Furthermore, to ensure the integrity of the communication path of the private bus 4 the captured time taM2 at master controller 2 (when the predefined pin was pulled and written to the follow up message to the slave controller 3) is compared by the master controller 2 to the global time t‘aM2 (which the slave controller 3 received in the follow up message and wrote into the validation message to the master controller 2), wherein the difference between these values should be smaller than a predefined forth threshold. taM2 and t’aM2 might be different due to the fact that a sending path of the master controller 3, a transmission path and a reception path of the slave controller 3 are only realized as ASIL QM using standard Autosar mechanism. This check can also be performed starting from the first cycle of the method (t‘aMi - taMi < forth threshold).

The above described checks can be summarized for the master controller 2 as follows: tbS2 - t’aM2 < first threshold taM2 - taMi- (cbS2 - Cbsi) < second threshold taM2 - t _a s2 < third threshold t‘aM2 - taM2 < forth threshold

The above described checks can be summarized for the slave controller 3 as follows: tbS2 - t’aM2 < first threshold t’aM2 - t’aMi- (cbS2 - Cbsi) < second threshold

Reference signs list

1 communication network

2 master controller

21 slave port of master controller

22 master port of master controller

3 slave controller

31 slave port of slave controller

4 private communication bus

5 further master controller of further communication network

51 master port of further master controller

GPIO general purpose input/output taMi, taM2 global time of a clock of the master port of the master controller when the predefined pin was pulled during first/second cycle t’aMi, t’aM2 global time of the master port of the master controller when the predefined pin was pulled during first/second cycle which is received by the slave controller tasi, t _a s2 global time of the slave port of the master controller

Cbsi, CbS2 local hardware counter corresponding to the global time of the slave controller when the pull of the predefined pin is detected by the slave controller in the first/second cycle tbsi, tbS2 global time of the slave controller when the pull of the predefined pin is detected by the slave controller in the first/second cycle