Method and master clock for generating fail-silent synchronization messages

1. A method for generating fail-silent synchronisation messages in a distributed real-time system,

the method comprising: receiving a time signal (S-signal) from a navigation satellite using a satellite receiver periodically generating an S-signal based upon the received S-signal using the satellite receiver, periodically producing an actual time signal (R-signal) using a reference clock wherein the nominal frequency and phase of the R-signal is substantially identical to the frequency and phase of the S-signal, determining a difference between the S-signal and the R-signal generated by the reference clock, adjusting the R-signal generated by the reference clock based upon the difference, determining whether a fault occurs in the generation of the S-signal by the satellite receiver using a central computer, generating a periodic synchronization message based upon the S-signal using the central computer in response to a determination that a fault has not occurred wherein the periodic synchronization message is generated in accordance with configuration parameters stored in a data block accessible by the central computer, adapting a state and a timing rate of the reference clock based upon the difference between the S-signal and R-signal in response to a determination that a fault has not occurred in the generation of the S-signal, suspending a timing rate adaptation of the reference clock in response to a determination of a fault in the generation of the S-signal, and generating a periodic synchronisation message based upon the R-signal using the central computer in response to a determination that a fault has occurred wherein the periodic synchronization message is generated in accordance with configuration parameters stored in a data block accessible by the central computer, determining whether the transmission time contained in the periodic synchronisation message matches the actual transmission time and whether the distance between two successive periodic synchronisation messages lies within a fixed tolerance interval using a monitoring system, and modifying the synchronisation message in such a way that each receiver identifies the synchronisation message as erroneous using the monitoring system in response to at least one of a determination that the transmission time in the periodic message does not match the actual transmission time and the distance is not with the fixed tolerance interval.

2. The method according to claim 1 , further comprising measuring the distance between two successive periodic synchronisation messages using the monitoring system during an initial phase and using the measured distance to identify an erroneous distance between two successive synchronisation messages using the monitoring system during an operating phase.

3. The method according to claim 1 , further comprising periodically generating a diagnosis message using the central computer where an operating state, anomalies, and faults of the overall system during a previous period are contained.

4. The method according to claim 1 , further comprising securing the data stored in the configuration data block with fault-identifying codes.

5. The method according to claim 1 , further comprising securing data stored in the configuration data block with fault-correcting codes.

6. The method according to claim 1 , permitting the parameters stored in the configuration data block to be changed only when a physical connection exists between an external input device and the central computer.

7. The method according to claim 1 , that permitting the parameters stored in the configuration data block to be changed via the Internet using a cryptographically secured protocol.

8. The method according to claim 1 , measuring a field strength of satellite signals using the satellite receiver and communicating the measured field strength from the satellite receiver to the central computer in order to be able to identify anomalies in the satellite signals.

9. The method according to claim 1 , further comprising securing a periodic synchronisation message by an electronic signature.

10. The method according to claim 1 , where a syntactic structure of the synchronisation message corresponds to SAE Standard AS6802.

11. The method according to claim 1 , where a syntactic structure of the synchronisation message corresponds to IEEE Standard 1588.

12. The method according to claim 1 , where the generating of the S-signals by the satellite receiver include generating the S-signals on the basis of satellite signals by the GPS system.

13. The method according to claim 1 , where the generating of the S-signals by the satellite receiver include generating the S-signals on the basis of the satellite signals by the Galileo system.

14. The method according to claim 1 , where the generating of the S-signals by the satellite receiver include generating the S-signals on the basis of satellite signals by the GLANOSS System.

15. The method according to claim 1 , where the generating of the R-signal generated by the reference clock is guided with a maximum predefined timing rate difference between the S-signal and the R-signal provided again in order to dispel the clock state difference between the R-signal and the S-signal accumulated during the failure.

16. An apparatus for carrying out a method according to claim 1 .

17. The apparatus according to claim 16 , further comprising a temperature-compensated quartz in the reference clock for deriving the R-signal.

18. The apparatus according to claim 16 , further comprising an atomic clock in the reference clock for deriving the R-signal.