2024年2月22日发(作者：长义)

The macroticks are synchronized on a cluster-wide basis. Within tolerances, the duration of a macrotick is identicalthroughout all synchronized nodes in a cluster. The duration of each local macrotick is an integer number of microticks; thenumber of microticks per macrotick may, however, differ from macrotick to macrotick within the same node. The number ofmicroticks per macrotick may also differ between nodes, and depends on the oscillator frequency and the prescaler. Althoughany given macrotick consists of an integral number of microticks, the average duration of all macroticks in a given cycle maybe , it may consist of a whole number of microticks plus a fraction of a microtick).9089 The dark lines represent data flows between mechanisms that are relevant to this chapter. The lighter gray lines arerelevantto the protocol, but not to this chapter.A cycle consists of an integer number of macroticks. The number of macroticks per cycle shall be identical in all nodes in acluster, and remains the same from cycle to cycle. At any given time all nodes should have the same cycle number (except atcycle boundaries as a result of imperfect synchronization in the cluster).91 8.2.2Global and local timeThe global time of a cluster is the general common understanding of time inside the cluster. The FlexRay protocol does nothave an absolute or reference global time; every node has its own local view of the global local time is the time of the node's clock and is represented by the variables vCycleCounter, vMacrotick, and Counter and vMacrotick shall be visible to the application. The update of vCycleCounter at the beginning of a cycleshall be atomic with the update of vMacrotick.92The local time is based on the local view of the global time. Every node uses the clock synchronization algorithm to attemptto adapt its local view of time to the global precision of a cluster is the maximum difference between the local times of any two synchronized nodes in the cluster.8.2.3Parameters and variablesvCycleCounter is the (controller-local) cycle number and is incremented by one at the beginning of each communicationcycle. vCycleCounter ranges from 0 to cCycleCountMax. When cCycleCountMax is reached, the cycle counter

vCycleCounter shall be reset to zero in the next communication cycle instead of being tick represents the current value of the (controller-local) macrotick and ranges from 0 to (gMacro-PerCycle - 1).gMacroPerCycle defines the (integer) number of macroticks per tick represents the current value of the (controller-local) eT_Macrotick = Integerendsyntype;syntypeT_Microtick = Integerendsyntype;Definition 8-1: Formal definition of T_Macrotick and T_ FlexRay "timing" will be configured by:gMacroPerCycle andtwo of the three parameters pMicroPerCycle, gdCycle and pdMicrotick. pMicroPerCycle is the node specific number ofmicroticks per cycle, gdCycle is the cluster wide duration of one communication cycle, and pdMicrotick is the node specificduration of one microtick. The relation between these three parameters is:pMicroPerCycle = round(gdCycle / pdMicrotick)90 This is true even for the nominal (uncorrected) average duration of a macrotick (for example 6000 microticks distributedover137 macroticks).91 The cycle number discrepancy is at most one, and lasts no longer than the precision of the system.92 An atomic action is an action where no interruption is possible.8.3Synchronization processClock synchronization consists of two main concurrent processes. The macrotick generation process (MTG) controls thecycle and macrotick counters and applies the rate and offset correction values. This process is explained in detail in section8.7. The clock synchronization process (CSP) performs the initialization at

correction. FlexRay uses a combination of both methods. The following conditions must be fulfilled:?Rate correction andoffset correction shall be done in the same way in all nodes. Rate correction shall be performed over the entire correction shall be performed only during the NIT in the odd communication cycle, starts at gOffsetCorrectionStart,and must be finished before the start of the next communication changes (implemented by synchronizing the start time of the cycle) are described by the variable tCorrection indicates the number of microticks that are added to the offset correction segment of the network idle tCorrection may be negative. The value of vOffsetCorrection is determined by the clock synchronization algorithm. Thecalculation of vOffsetCorrection takes place every cycle but a correction is only applied at the end of odd commu-nicationcycles. The calculation of vOffsetCorrection is based on values measured in a singlecommunication cycle. Although the SDL indicates that this computation cannot begin before the NIT, an implementation maystart the computation of this parameter within the dynamic segment or symbol window as long as the reaction to thecomputation (update of the CHI and transmission of the SyncCalcResult and offset calc ready signals) is delayed until theNIT. The calculation must be complete before the offset correction phase (frequency) changes are described by the variable vRateCorrection. vRateCorrection is an integer number ofmicroticks that are added to the configured number of microticks in a communica-tion cycle (pMicroPerCycle)orrection may be negative. The value of vRateCorrection is determined by the clock synchronization algorithm and isonly computed once per double cycle. The calculation of vRateCorrection takes place following the static segment in an oddcycle. The calcula-tion of vRateCorrection is based on the values measured in an even-odd double cycle. Although the SDLindicates that this computation cannot begin before the NIT, an implementation may start the computation of this parameterwithin the dynamic segment or symbol window as long as the reaction to the computation (update of the CHI andtransmission of the SyncCalcResult and rate calc ready signals) is delayed until the NIT. The calculation must be completedbefore the next even cycle following data types will be used in the definition of the clock synchronization process:newtype T_EvenOddliterals even, odd;endnewtype;syntype

T_Deviation = T_Microtickendsyntype;Definition 8-2: Formal definition of T_EvenOdd and T_ protocol operation control (POC) process sets the operating mode for the clock synchronization process (CSP) (Figure8-4) into one of the following modes: the STANDBY mode the clock synchronization process is effectively the NOSYNC mode CSP performs clock synchronization under the assumption that it is not trans-mitting sync frames (i.e., it does not include its own clock in the clock correction computations). the SYNC mode CSP performs clock synchronization under the assumption that it is transmittingsync frames (i.e., it includes its own clock in the clock correction computations).Definition 8-3 gives the formal definition of the CSP operating e T_CspModeliterals STANDBY, NOSYNC, SYNC;endnewtype;newtype T_SyncCalcResultliterals WITHIN_BOUNDS, EXCEEDS_BOUNDS, MISSING_TERM;endnewtype;Definition 8-3: Formal definition of T_CspMode and T_ the POC sets the CSP mode to something other than STANDBY, the CSP waits in the CSP:wait for startup state untilthe POC forces the node to a cold start or to integrate into a cluster. The startup procedure, including its initialization andinteraction with other processes, is described in the macro INTEGRATION CONTROL, which is explained in section further explanation of the processes an array is defined (Definition 8-4) which is used to store the frame IDs of thereceived sync frames.93 pMicroPerCycle is the configured number of microticks per communication cycle without e T_ArrayIndex = Integerconstants 1 : 15endsyntype;syntype T_SyncNodes = Integerconstants 0 : cSyncNodeMaxendsyntype;newtype T_FrameIDTableArray(T_ArrayIndex, T_FrameID)endnewtype;Definition 8-4: Formal definition of T_ArrayIndex, T_SyncNodes, and T_FrameIDTable.

Figure 8-4: Clock synchronization process overview [CSP].After finishing the startup procedure a repetitive sequence consisting of cycle initialization (Figure 8-10), a measurementphase (Figure 8-11), and offset (Figure 8-14) and rate (Figure 8-15) calculation is executed. All elements of this sequence aredescribed below. The offset calculation will be done every cycle, the rate calculation only in the odd clock synchronization control (Figure 8-5) handles mode changes done by the POC. It also handles process terminationrequests sent by the 8-5: Clock synchronization control [CSP].8.4Startup of the clockThe startup of the node's internal synchronized clock requiresthe initialization and start of the MTG process andthe initialization and start of the CSP process. This process contains the repetitive tasks of measurement and storage ofdeviation values and the calculation of the offset and the rate correction values.

There are two ways to start the (synchronized) clock inside a node:The node is the leading coldstart node adopts the initialization values (cycle counter, clock rate, and cycle start time) of a running coldstart 8-6: Integration control [CSP].The startup procedure will be entered when the CSP receives the signal attempt integration from the POC (see Figure 8-4).The control of the node's startup is described in the INTEGRATION CONTROL macro depicted in Figure 8-6.8.4.1Cold start startupIf no ongoing communication on the channels is detected the POC may force the node to perform the role of the leadingcoldstart node of the cluster. This causes the following actions:The clock synchronization startup processes on channel A and B (CSS_A, CSS_B) will be INTEGRATION CONTROL macro will be left.

The macrotick generation process (MTG) (Figure 8-17) leaves the MTG:wait for start ing on the initialization values, macrotick and cycle start signals are generated and distrib-uted to other CSP waits for the cycle CSP and MTG processes continue their schedules until the POC changes the CSP mode to STANDBY or an error isdetected.8.4.2Integration startupIf ongoing communication is detected during startup, or if the node is not allowed to perform a coldstart, the node attempts tointegrate into the timing of the cluster by adopting the rate, the cycle number, and cycle start instant of a coldstart node. Toaccomplish this, the CSP process (Figure 8-6) instantiates the clock synchronization startup processes for channel A and B(CSS_A, CSS_B).After their instantiation, the CSS_A process (Figure 8-8) and the CSS_B process wait for a signal from the coding/decodingunit that a potential frame start was detected. The CSS process then takes a timestamp and waits for a signal indicating thata valid even startup frame was received. If no valid even startup frame was received the time stamp will be overwritten withthe time stamp of the next potential frame start that is a valid even startup frame is received the node is able to pre-calculate the initial values for the cycle counter and themacrotick counter. The node then waits for the corresponding odd startup frame. This frame is expected in a time a potential frame start is detected in this time window the tMicroInitial-Offset timer is started in the INTEGRATIONCONTROL macro. When this timer expires the MTG process (Figure 8-17) is started using the pre-calculated initial values. Asecond potential frame start inside the time window leads to a restart of the tMicroInitialOffset timer. Only one channel canstart the MTG process (the initial channel).94 Between the expiration of the timer tMicroInitialOffset and the reception of thecomplete startup frame, the other channel (the non-initial channel) can not start, stop, or change the MTG process, but it canreceive potential frame start events and can start its own tMicroInitialOffset timer. The behavior of the CSS process of thenon-initial channel is the same as the behavior of the CSS process of the initial channel except that the non-initial channel isunable to start the MTG process and is unable to terminate itself and the CSS process of the other channel.94 There is no configuration that selects the channel that starts the MTG process. The process is started by the first channelthatreceives a potential frame start in the expected time window after reception of a valid even startup frame on the samechannel (refer to Figure 8-8).Figure 8-7: Clock synchronization startup control [CSS_A].

Figure 8-8: Clock synchronization startup process on channel A [CSS_A] reception of the corresponding valid odd startup frame and the satisfaction of the conditions for integration leads to thetermination of the CSS process for this channel. Before termination a signal is sent indicating successful integration; thissignal causes the INTEGRATION CONTROL macro of CSP to terminate the CSS process for the other channel (see Figure8-6). This behavior of this termination is depicted in Figure timer tSecondFrame in Figure 8-8 is used to restart the clock synchronization startup process if the corresponding oddstartup frame was not received after an appropriate period of variable zID is used to prohibit attempts to integrate on a coldstart node if an integration attempt on this coldstart nodefailed in the previous cycle. The timer tID prevents this prohibition from applying for more than one double cycle.8.5Time measurementEvery node shall measure and store, by channel, the time differences (in microticks) between the expected and the observedarrival times of all sync frames received during the static segment. A data structure is introduced in section 8.5.1. This datastructure is used in the explanation of the initialization (section 8.5.2) and the measurement, storage, and deviationcalculation mechanisms (section 8.5.3).

95 The priority input symbol on the state CSS_A:wait for second startup frame has been included to resolve the ambiguitythatarises if the timer tSecondFrame expires at the same time a valid odd startup frame on A signal is 8-9: Data structure example used in the following explanations.8.5.1Data structureThe following data types are introduced to enable a compact description of mechanisms related to clock synchronization:newtype T_DevValidstructValue T_Deviation;Valid Boolean;Startup Boolean;endnewtype;Definition 8-5: Formal definition of T_e T_ChannelDevArray(T_Channel, T_DevValid)endnewtype;newtype T_EOChDevArray(T_EvenOdd, T_ChannelDev)endnewtype;newtype T_DevTable

Array(T_ArrayIndex, T_EOChDev)endnewtype;Definition 8-6: Formal definition of T_ChannelDev, T_EOChDev, and T_ structured data type T_DevTable is a three dimensional array with the dimensions line number (1 …15), communication channel (A or B), and communication cycle (even or odd). Each line is used to store the received data ofone sync node. If the node is itself a sync node the first line is used to store a deviation of zero, corresponding to thedeviation of its own sync frame. Each element in this three dimensional array contains a deviation value (the structureelement Value), a Boolean value indicating whether the deviation value is valid (the structure element Valid), and a Booleanvalue indicating whether the sync frame corre-sponding to this deviation was a startup frame (the structure element Startup).Figure 8-9 gives an example of this data structure.8.5.2InitializationThe data structure introduced in section 8.5.1 is used to instantiate a variable (zsDev). A portion of this variable will be resetat the beginning of every communication cycle; the even part at the beginning of an even cycle and the odd part at thebeginning of an odd cycle. Additionally, if the node is configured to transmit sync frames (mode SYNC), correspondingentries are stored in the variable as depicted in Figure 8-10: Initialization of the data structure for measurement [CSP].8.5.3Time measurement storageThe expected arrival time of a frame is the static slot action point, which is defined in Chapter 5. The MAC generates a signalwhen the static slot action point is reached. When the clock synchronization process receives this action point signal a timestamp is taken and the reception of a frame the decoding unit takes a time stamp when the secondary time reference point is time stamp is based on the same microtick time base that is used for the static slot action point time stamp. Thedecoding unit then computes the primary time reference point by subtracting a configurable offset value from the secondarytime reference point time stamp. This result is passed to the Frame and Symbol Processing process, which then passes theresults to CSP for each valid sync frame received. Further information on the definition of the reference points may be foundin section 3.2.5.

Figure 8-11: Measurement and storage of the deviation values [CSP].The difference between the action point and primary time reference point time stamps, along with Booleans indicating thatthe data is valid and whether or not the frame is also a startup frame, is saved in the appro-priate location in the previouslydefined data structure (see Figure 8-11). The measurement phase ends when the static segment reception of more than gSyncNodeMax sync frames per channel in one communication cycle indicates an error insidethe cluster. This is reported to the host and only the first gSyncNodeMax received sync frames are used for the correctionvalue calculation.8.6Correction term calculation8.6.1Fault-tolerant midpoint algorithmThe technique used for the calculation of the correction terms is a fault-tolerant midpoint algorithm (FTM). The algorithmworks as follows (see Figure 8-12 and Figure 8-13): algorithm determines the value of a parameter, k, based on the number of values in the sorted list(see Table 8-1).96Number of values k1 - 203 - 71> 72Table 8-1: FTM term deletion as a function of list size.

96 The parameter k is not the number of asymmetric faults that can be tolerated.97 The division by two of odd numbers should truncate toward zero such that the result is an integer number. Example: 17 / 2=8 and -17 / 2 = - 8-13: Fault Tolerant Midpoint Procedure.8.6.2Calculation of the offset correction valueThe offset correction value vOffsetCorrection is a signed integer that indicates how many microticks the node should shift thestart of its cycle. Negative values mean the NIT should be shortened (making the next cycle start earlier). Positive valuesmean the NIT should be lengthened (making the next cycle start later).In Figure 8-14 the procedure of the calculation of the offset correction value is described in detail. The following steps arecovered in the SDL diagram in Figure 8-14:ion of the previously stored deviation values. Only deviation values that were measured andstored in the current communication cycle are used. If a given sync frame ID has two deviation values (one for channel A andone for channel B) the smaller value will be number of received sync frames is checked and if no sync frames were received an error flag isset to true.

fault-tolerant midpoint algorithm is executed (see section 8.6.1). correction term is checked against specified limits. If the correction term is outside of the specifiedlimits an error flag is set to true and the correction term is set to the maximum or minimum value as appropriate (see section8.6.4). appropriate, an external correction value supplied by the host is added to the calculated and checkedcorrection term (see section 8.6.5).The following data structure is used to save and handle the selected data:newtype T_DeviationTableArray(T_ArrayIndex, T_Deviation)endnewtype;Definition 8-7: Formal definition of T_ 8-14: Calculation of the offset correction value [CSP].The SDL abstraction of execution in zero time could lead the reader to the conclusion that the calculation of the offsetcorrection value needs to complete in zero time. This is of course unachievable. It is anticipated that real implementations

may take substantial time to calculate the correction, and that implementations may begin the calculation earlier than isshown in Figure 8-4 (i.e., may begin the calculation during the measurement process). Therefore the following restriction onthe time required for offset correction calcu-lation is introduced:The offset correction calculation must be completed no later than cdMaxOffsetCalculation after the end of the static segmentor 1 MT after the start of the NIT, whichever occurs later.8.6.3Calculation of the rate correction valueThe goal of the rate correction is to bring the rates of all nodes inside the cluster close together. The rate correction value isdetermined by comparing the corresponding measured time differences from two successive cycles. A detailed description isgiven by the SDL diagram depicted in Figure 8-15.

2024年2月22日发(作者：长义)

The macroticks are synchronized on a cluster-wide basis. Within tolerances, the duration of a macrotick is identicalthroughout all synchronized nodes in a cluster. The duration of each local macrotick is an integer number of microticks; thenumber of microticks per macrotick may, however, differ from macrotick to macrotick within the same node. The number ofmicroticks per macrotick may also differ between nodes, and depends on the oscillator frequency and the prescaler. Althoughany given macrotick consists of an integral number of microticks, the average duration of all macroticks in a given cycle maybe , it may consist of a whole number of microticks plus a fraction of a microtick).9089 The dark lines represent data flows between mechanisms that are relevant to this chapter. The lighter gray lines arerelevantto the protocol, but not to this chapter.A cycle consists of an integer number of macroticks. The number of macroticks per cycle shall be identical in all nodes in acluster, and remains the same from cycle to cycle. At any given time all nodes should have the same cycle number (except atcycle boundaries as a result of imperfect synchronization in the cluster).91 8.2.2Global and local timeThe global time of a cluster is the general common understanding of time inside the cluster. The FlexRay protocol does nothave an absolute or reference global time; every node has its own local view of the global local time is the time of the node's clock and is represented by the variables vCycleCounter, vMacrotick, and Counter and vMacrotick shall be visible to the application. The update of vCycleCounter at the beginning of a cycleshall be atomic with the update of vMacrotick.92The local time is based on the local view of the global time. Every node uses the clock synchronization algorithm to attemptto adapt its local view of time to the global precision of a cluster is the maximum difference between the local times of any two synchronized nodes in the cluster.8.2.3Parameters and variablesvCycleCounter is the (controller-local) cycle number and is incremented by one at the beginning of each communicationcycle. vCycleCounter ranges from 0 to cCycleCountMax. When cCycleCountMax is reached, the cycle counter

vCycleCounter shall be reset to zero in the next communication cycle instead of being tick represents the current value of the (controller-local) macrotick and ranges from 0 to (gMacro-PerCycle - 1).gMacroPerCycle defines the (integer) number of macroticks per tick represents the current value of the (controller-local) eT_Macrotick = Integerendsyntype;syntypeT_Microtick = Integerendsyntype;Definition 8-1: Formal definition of T_Macrotick and T_ FlexRay "timing" will be configured by:gMacroPerCycle andtwo of the three parameters pMicroPerCycle, gdCycle and pdMicrotick. pMicroPerCycle is the node specific number ofmicroticks per cycle, gdCycle is the cluster wide duration of one communication cycle, and pdMicrotick is the node specificduration of one microtick. The relation between these three parameters is:pMicroPerCycle = round(gdCycle / pdMicrotick)90 This is true even for the nominal (uncorrected) average duration of a macrotick (for example 6000 microticks distributedover137 macroticks).91 The cycle number discrepancy is at most one, and lasts no longer than the precision of the system.92 An atomic action is an action where no interruption is possible.8.3Synchronization processClock synchronization consists of two main concurrent processes. The macrotick generation process (MTG) controls thecycle and macrotick counters and applies the rate and offset correction values. This process is explained in detail in section8.7. The clock synchronization process (CSP) performs the initialization at

correction. FlexRay uses a combination of both methods. The following conditions must be fulfilled:?Rate correction andoffset correction shall be done in the same way in all nodes. Rate correction shall be performed over the entire correction shall be performed only during the NIT in the odd communication cycle, starts at gOffsetCorrectionStart,and must be finished before the start of the next communication changes (implemented by synchronizing the start time of the cycle) are described by the variable tCorrection indicates the number of microticks that are added to the offset correction segment of the network idle tCorrection may be negative. The value of vOffsetCorrection is determined by the clock synchronization algorithm. Thecalculation of vOffsetCorrection takes place every cycle but a correction is only applied at the end of odd commu-nicationcycles. The calculation of vOffsetCorrection is based on values measured in a singlecommunication cycle. Although the SDL indicates that this computation cannot begin before the NIT, an implementation maystart the computation of this parameter within the dynamic segment or symbol window as long as the reaction to thecomputation (update of the CHI and transmission of the SyncCalcResult and offset calc ready signals) is delayed until theNIT. The calculation must be complete before the offset correction phase (frequency) changes are described by the variable vRateCorrection. vRateCorrection is an integer number ofmicroticks that are added to the configured number of microticks in a communica-tion cycle (pMicroPerCycle)orrection may be negative. The value of vRateCorrection is determined by the clock synchronization algorithm and isonly computed once per double cycle. The calculation of vRateCorrection takes place following the static segment in an oddcycle. The calcula-tion of vRateCorrection is based on the values measured in an even-odd double cycle. Although the SDLindicates that this computation cannot begin before the NIT, an implementation may start the computation of this parameterwithin the dynamic segment or symbol window as long as the reaction to the computation (update of the CHI andtransmission of the SyncCalcResult and rate calc ready signals) is delayed until the NIT. The calculation must be completedbefore the next even cycle following data types will be used in the definition of the clock synchronization process:newtype T_EvenOddliterals even, odd;endnewtype;syntype

T_Deviation = T_Microtickendsyntype;Definition 8-2: Formal definition of T_EvenOdd and T_ protocol operation control (POC) process sets the operating mode for the clock synchronization process (CSP) (Figure8-4) into one of the following modes: the STANDBY mode the clock synchronization process is effectively the NOSYNC mode CSP performs clock synchronization under the assumption that it is not trans-mitting sync frames (i.e., it does not include its own clock in the clock correction computations). the SYNC mode CSP performs clock synchronization under the assumption that it is transmittingsync frames (i.e., it includes its own clock in the clock correction computations).Definition 8-3 gives the formal definition of the CSP operating e T_CspModeliterals STANDBY, NOSYNC, SYNC;endnewtype;newtype T_SyncCalcResultliterals WITHIN_BOUNDS, EXCEEDS_BOUNDS, MISSING_TERM;endnewtype;Definition 8-3: Formal definition of T_CspMode and T_ the POC sets the CSP mode to something other than STANDBY, the CSP waits in the CSP:wait for startup state untilthe POC forces the node to a cold start or to integrate into a cluster. The startup procedure, including its initialization andinteraction with other processes, is described in the macro INTEGRATION CONTROL, which is explained in section further explanation of the processes an array is defined (Definition 8-4) which is used to store the frame IDs of thereceived sync frames.93 pMicroPerCycle is the configured number of microticks per communication cycle without e T_ArrayIndex = Integerconstants 1 : 15endsyntype;syntype T_SyncNodes = Integerconstants 0 : cSyncNodeMaxendsyntype;newtype T_FrameIDTableArray(T_ArrayIndex, T_FrameID)endnewtype;Definition 8-4: Formal definition of T_ArrayIndex, T_SyncNodes, and T_FrameIDTable.

Figure 8-4: Clock synchronization process overview [CSP].After finishing the startup procedure a repetitive sequence consisting of cycle initialization (Figure 8-10), a measurementphase (Figure 8-11), and offset (Figure 8-14) and rate (Figure 8-15) calculation is executed. All elements of this sequence aredescribed below. The offset calculation will be done every cycle, the rate calculation only in the odd clock synchronization control (Figure 8-5) handles mode changes done by the POC. It also handles process terminationrequests sent by the 8-5: Clock synchronization control [CSP].8.4Startup of the clockThe startup of the node's internal synchronized clock requiresthe initialization and start of the MTG process andthe initialization and start of the CSP process. This process contains the repetitive tasks of measurement and storage ofdeviation values and the calculation of the offset and the rate correction values.

There are two ways to start the (synchronized) clock inside a node:The node is the leading coldstart node adopts the initialization values (cycle counter, clock rate, and cycle start time) of a running coldstart 8-6: Integration control [CSP].The startup procedure will be entered when the CSP receives the signal attempt integration from the POC (see Figure 8-4).The control of the node's startup is described in the INTEGRATION CONTROL macro depicted in Figure 8-6.8.4.1Cold start startupIf no ongoing communication on the channels is detected the POC may force the node to perform the role of the leadingcoldstart node of the cluster. This causes the following actions:The clock synchronization startup processes on channel A and B (CSS_A, CSS_B) will be INTEGRATION CONTROL macro will be left.

The macrotick generation process (MTG) (Figure 8-17) leaves the MTG:wait for start ing on the initialization values, macrotick and cycle start signals are generated and distrib-uted to other CSP waits for the cycle CSP and MTG processes continue their schedules until the POC changes the CSP mode to STANDBY or an error isdetected.8.4.2Integration startupIf ongoing communication is detected during startup, or if the node is not allowed to perform a coldstart, the node attempts tointegrate into the timing of the cluster by adopting the rate, the cycle number, and cycle start instant of a coldstart node. Toaccomplish this, the CSP process (Figure 8-6) instantiates the clock synchronization startup processes for channel A and B(CSS_A, CSS_B).After their instantiation, the CSS_A process (Figure 8-8) and the CSS_B process wait for a signal from the coding/decodingunit that a potential frame start was detected. The CSS process then takes a timestamp and waits for a signal indicating thata valid even startup frame was received. If no valid even startup frame was received the time stamp will be overwritten withthe time stamp of the next potential frame start that is a valid even startup frame is received the node is able to pre-calculate the initial values for the cycle counter and themacrotick counter. The node then waits for the corresponding odd startup frame. This frame is expected in a time a potential frame start is detected in this time window the tMicroInitial-Offset timer is started in the INTEGRATIONCONTROL macro. When this timer expires the MTG process (Figure 8-17) is started using the pre-calculated initial values. Asecond potential frame start inside the time window leads to a restart of the tMicroInitialOffset timer. Only one channel canstart the MTG process (the initial channel).94 Between the expiration of the timer tMicroInitialOffset and the reception of thecomplete startup frame, the other channel (the non-initial channel) can not start, stop, or change the MTG process, but it canreceive potential frame start events and can start its own tMicroInitialOffset timer. The behavior of the CSS process of thenon-initial channel is the same as the behavior of the CSS process of the initial channel except that the non-initial channel isunable to start the MTG process and is unable to terminate itself and the CSS process of the other channel.94 There is no configuration that selects the channel that starts the MTG process. The process is started by the first channelthatreceives a potential frame start in the expected time window after reception of a valid even startup frame on the samechannel (refer to Figure 8-8).Figure 8-7: Clock synchronization startup control [CSS_A].

Figure 8-8: Clock synchronization startup process on channel A [CSS_A] reception of the corresponding valid odd startup frame and the satisfaction of the conditions for integration leads to thetermination of the CSS process for this channel. Before termination a signal is sent indicating successful integration; thissignal causes the INTEGRATION CONTROL macro of CSP to terminate the CSS process for the other channel (see Figure8-6). This behavior of this termination is depicted in Figure timer tSecondFrame in Figure 8-8 is used to restart the clock synchronization startup process if the corresponding oddstartup frame was not received after an appropriate period of variable zID is used to prohibit attempts to integrate on a coldstart node if an integration attempt on this coldstart nodefailed in the previous cycle. The timer tID prevents this prohibition from applying for more than one double cycle.8.5Time measurementEvery node shall measure and store, by channel, the time differences (in microticks) between the expected and the observedarrival times of all sync frames received during the static segment. A data structure is introduced in section 8.5.1. This datastructure is used in the explanation of the initialization (section 8.5.2) and the measurement, storage, and deviationcalculation mechanisms (section 8.5.3).

95 The priority input symbol on the state CSS_A:wait for second startup frame has been included to resolve the ambiguitythatarises if the timer tSecondFrame expires at the same time a valid odd startup frame on A signal is 8-9: Data structure example used in the following explanations.8.5.1Data structureThe following data types are introduced to enable a compact description of mechanisms related to clock synchronization:newtype T_DevValidstructValue T_Deviation;Valid Boolean;Startup Boolean;endnewtype;Definition 8-5: Formal definition of T_e T_ChannelDevArray(T_Channel, T_DevValid)endnewtype;newtype T_EOChDevArray(T_EvenOdd, T_ChannelDev)endnewtype;newtype T_DevTable

Array(T_ArrayIndex, T_EOChDev)endnewtype;Definition 8-6: Formal definition of T_ChannelDev, T_EOChDev, and T_ structured data type T_DevTable is a three dimensional array with the dimensions line number (1 …15), communication channel (A or B), and communication cycle (even or odd). Each line is used to store the received data ofone sync node. If the node is itself a sync node the first line is used to store a deviation of zero, corresponding to thedeviation of its own sync frame. Each element in this three dimensional array contains a deviation value (the structureelement Value), a Boolean value indicating whether the deviation value is valid (the structure element Valid), and a Booleanvalue indicating whether the sync frame corre-sponding to this deviation was a startup frame (the structure element Startup).Figure 8-9 gives an example of this data structure.8.5.2InitializationThe data structure introduced in section 8.5.1 is used to instantiate a variable (zsDev). A portion of this variable will be resetat the beginning of every communication cycle; the even part at the beginning of an even cycle and the odd part at thebeginning of an odd cycle. Additionally, if the node is configured to transmit sync frames (mode SYNC), correspondingentries are stored in the variable as depicted in Figure 8-10: Initialization of the data structure for measurement [CSP].8.5.3Time measurement storageThe expected arrival time of a frame is the static slot action point, which is defined in Chapter 5. The MAC generates a signalwhen the static slot action point is reached. When the clock synchronization process receives this action point signal a timestamp is taken and the reception of a frame the decoding unit takes a time stamp when the secondary time reference point is time stamp is based on the same microtick time base that is used for the static slot action point time stamp. Thedecoding unit then computes the primary time reference point by subtracting a configurable offset value from the secondarytime reference point time stamp. This result is passed to the Frame and Symbol Processing process, which then passes theresults to CSP for each valid sync frame received. Further information on the definition of the reference points may be foundin section 3.2.5.

Figure 8-11: Measurement and storage of the deviation values [CSP].The difference between the action point and primary time reference point time stamps, along with Booleans indicating thatthe data is valid and whether or not the frame is also a startup frame, is saved in the appro-priate location in the previouslydefined data structure (see Figure 8-11). The measurement phase ends when the static segment reception of more than gSyncNodeMax sync frames per channel in one communication cycle indicates an error insidethe cluster. This is reported to the host and only the first gSyncNodeMax received sync frames are used for the correctionvalue calculation.8.6Correction term calculation8.6.1Fault-tolerant midpoint algorithmThe technique used for the calculation of the correction terms is a fault-tolerant midpoint algorithm (FTM). The algorithmworks as follows (see Figure 8-12 and Figure 8-13): algorithm determines the value of a parameter, k, based on the number of values in the sorted list(see Table 8-1).96Number of values k1 - 203 - 71> 72Table 8-1: FTM term deletion as a function of list size.

96 The parameter k is not the number of asymmetric faults that can be tolerated.97 The division by two of odd numbers should truncate toward zero such that the result is an integer number. Example: 17 / 2=8 and -17 / 2 = - 8-13: Fault Tolerant Midpoint Procedure.8.6.2Calculation of the offset correction valueThe offset correction value vOffsetCorrection is a signed integer that indicates how many microticks the node should shift thestart of its cycle. Negative values mean the NIT should be shortened (making the next cycle start earlier). Positive valuesmean the NIT should be lengthened (making the next cycle start later).In Figure 8-14 the procedure of the calculation of the offset correction value is described in detail. The following steps arecovered in the SDL diagram in Figure 8-14:ion of the previously stored deviation values. Only deviation values that were measured andstored in the current communication cycle are used. If a given sync frame ID has two deviation values (one for channel A andone for channel B) the smaller value will be number of received sync frames is checked and if no sync frames were received an error flag isset to true.

fault-tolerant midpoint algorithm is executed (see section 8.6.1). correction term is checked against specified limits. If the correction term is outside of the specifiedlimits an error flag is set to true and the correction term is set to the maximum or minimum value as appropriate (see section8.6.4). appropriate, an external correction value supplied by the host is added to the calculated and checkedcorrection term (see section 8.6.5).The following data structure is used to save and handle the selected data:newtype T_DeviationTableArray(T_ArrayIndex, T_Deviation)endnewtype;Definition 8-7: Formal definition of T_ 8-14: Calculation of the offset correction value [CSP].The SDL abstraction of execution in zero time could lead the reader to the conclusion that the calculation of the offsetcorrection value needs to complete in zero time. This is of course unachievable. It is anticipated that real implementations

may take substantial time to calculate the correction, and that implementations may begin the calculation earlier than isshown in Figure 8-4 (i.e., may begin the calculation during the measurement process). Therefore the following restriction onthe time required for offset correction calcu-lation is introduced:The offset correction calculation must be completed no later than cdMaxOffsetCalculation after the end of the static segmentor 1 MT after the start of the NIT, whichever occurs later.8.6.3Calculation of the rate correction valueThe goal of the rate correction is to bring the rates of all nodes inside the cluster close together. The rate correction value isdetermined by comparing the corresponding measured time differences from two successive cycles. A detailed description isgiven by the SDL diagram depicted in Figure 8-15.