20-EFT.WP.Metrology.TimeBase v1.0 | Chapter 10 — Distributed Systems & Graph Synchronization (GM / BCM / Failover)

Home ／ Docs-Technical WhitePaper ／ 20-EFT.WP.Metrology.TimeBase v1.0

Chapter 10 — Distributed Systems & Graph Synchronization (GM / BCM / Failover)

One-line objective: On a directed/undirected network G=(V,E), use Grandmaster election and Best Clock Master (BCM) policy as the entrypoint to build an auditable graph-wide synchronization and failover loop, keeping offset/skew/J bounded during failures and recovery and meeting publication contracts.

I. Scope & Targets

1. Covered
   • Graph synchronization: estimate node clocks t_i and edge delay/asymmetry d_ij / a_ij on G=(V,E).
   • Roles & hierarchy: GM (Grandmaster), BC (Boundary Clock), OC (Ordinary Clock), and the BCM election policy.
   • Failover: GM fault detection, failover/failback, holdover, and graceful takeover.
2. Inputs
   Edge measurement streams m_ij(k) = { sync, follow_up, delay_req/resp } or equivalent two-way probes; per-node local estimates of offset/skew/J; link-alarm events.
3. Outputs
   GM/topology & priorities, the synchronization graph G_sync, network-wide sequences of hat{t_i}, offset_i, skew_i, J_i; failover trajectories; manifest.sync.graph.*.

II. Terms & Variables

• Graph & gauges: G=(V,E), w_ij (edge weight/trust), cycle set C, paths P(i→j).
• Node clocks: t_i, hat{t_i}, offset_i = hat{t_i} - t_ref, skew_i, jitter J_i.
• Edge params: d_ij (two-way mean delay), a_ij (path asymmetry), uncertainties u(x) / U = k * u_c.
• Role priority: prio_i, clock quality q_i, class_i.
• Events & windows: tau_mono, ts, estimation window Delta_t, switch time T_sw.

III. Axioms P510- **

• P510-1 (Reachability): From GM to any i ∈ V there exists at least one valid path P(GM→i).
• P510-2 (Explicit measures): Edge metrics are built from two-way time messages ( ∆t_ij, ∆t_ji ); assumptions and measures must be stated when deriving d_ij, a_ij.
• P510-3 (Dimensional integrity): unit(offset)="s", unit(skew)="1", unit(J)="s"; run check_dim(expr) before publication.
• P510-4 (Traceable BCM): GM election must be reproducible under a total order over {prio,q,class} with tie-break rules; persist the comparison chain and TraceID.
• P510-5 (Cycle consistency): For any cycle ∈ C, the algebraic sum of measured offsets approximates zero; violations indicate anomalies or asymmetry leakage.
• P510-6 (Failover bounds): Enforce T_sw ≤ T_sw_max and offset_p99 ≤ bound_failover during switching.
• P510-7 (Unified time base): Estimate on tau_mono, publish on ts with offset/skew/J and warp(t).

IV. Minimal Equations S510- **

• S510-1 (Pairwise constraint)
  t_j - t_i = phi_ij = ( 1/2 ) * ( ( ∆t_ij - ∆t_ji ) - a_ij )。
  ( ∆t_ij, ∆t_ji ) are two-way differentials; set unknown a_ij=0 and absorb into residuals.
• S510-2 (Weighted graph synchronization)
  Let x = [t_1,...,t_n]^T with t_GM=0; minimize
  ( 1/2 ) * ∑_{(i,j)∈E} w_ij * ( ( t_j - t_i ) - phi_ij )^2，
  giving L_w x = b where L_w is the weighted graph Laplacian and b aggregates edge-side information.
• S510-3 (Cycle-consistency residual)
  r_cycle = ∑_{(i,j)∈cycle} ( ( t_j - t_i ) - phi_ij )；require | r_cycle | ≤ tol_cycle。
• S510-4 (Consensus iteration)
  t_i^{k+1} = t_i^{k} + alpha * ∑_{j∈N(i)} w_ij * ( ( t_j^{k} - t_i^{k} ) - phi_ij )，
  with convergence alpha < 1 / λ_max(L_w)。
• S510-5 (Asymmetry estimation)
  With one-way arrivals T_arr(i→j),
  a_ij ≈ T_arr(i→j) - T_arr(j→i) (dual forms per Chapter 9)。
• S510-6 (Failover window bounds)
  During switching: | offset_i(t) | ≤ | skew_i | * T_sw ⊕ J_i；
  under sustained unlock: holdover_drift(t) ≈ | skew_free | * t ⊕ J_free。
• S510-7 (Quality aggregation)
  Node score: q_i = f( class_i, u(offset_i), u(skew_i), loss_i ) for BCM ordering.

V. Metrology & Control Flow M50-10 (GM/BCM → Sync → Monitor → Switch → Restabilize)

• Topology ready
  Collect G, prio/q/class, link health; initialize L_w and the fault-tolerant edge set E_fail.
• BCM decision & GM election
  Order by q/prio/class + tie-breaks; produce GM and a hierarchy tree or a mesh-redundant topology.
• Graph sync solve
  On each Delta_t, form phi_ij, w_ij; solve L_w x=b or run consensus S510-4; obtain hat{t_i}, offset/skew/J.
• Audit & cycle checks
  Evaluate r_cycle; down-weight or mask anomalous edges; estimate a_ij and u(a_ij).
• Fault detection & switching
  Triggers: GM heartbeat loss, q_GM degradation, offset_GM breach; perform failover to the next candidate; measure T_sw.
• Restabilize & reset
  After switching, temporarily raise alpha or use adaptive schemes; allow failback with hysteresis after the original GM recovers and q crosses threshold.
• Publish & persist
  Emit manifest.sync.graph.*: GM, G_sync, method, overview of offset/skew/J, r_cycle, T_sw, TraceID, and signature.

VI. Contracts & Assertions

• C50-101 (Reachability): reach(GM, i)=true for all i; otherwise mark islands and degrade publication.
• C50-102 (Cycle consistency): | r_cycle | ≤ tol_cycle (P99).
• C50-103 (Sync offsets): offset_abs_p99 ≤ bound_sync; skew_abs_p99 ≤ bound_skew.
• C50-104 (Switch upper bound): T_sw ≤ T_sw_max and offset_p99_during_sw ≤ bound_failover.
• C50-105 (Units): check_dim( offset/skew/J )=pass.
• C50-106 (Traceable election): GM decision chain complete; tie-break recorded.
• C50-107 (Asymmetry control): | a_ij | ≤ a_max or move edge to correction/down-weight lists.

VII. Implementation Bindings I50-10*

• run_bcm(nodes, edges, policy) -> {GM, ranking, rationale}
• solve_graph_sync(edges, method, anchor) -> {t_hat, offset, skew, J, r_cycle} (method ∈ {wls, consensus})
• estimate_asymmetry(edge_stream) -> {a_ij, u}
• failover_controller(state, triggers, policy) -> {actions, T_sw}
• graph_health_monitor(metrics, thresholds) -> alerts
• emit_graph_manifest(state, results, signature) -> manifest.sync.graph
• Invariants: t_GM=0 (anchor) or ∑_i w_i t_i = 0 (gauge); L_w PSD; alpha within convergence bound; unique(TraceID).

VIII. Cross-References

• Protocol & servo details: Chapter 5 (NTP/PTP/SyncE) and Chapter 6 (robust estimation).
• Phase/time noise modeling: Chapter 7 (Allan family) for w_ij and q_i assessment.
• Buffering & time-base conversion: Chapter 8 (warp(t)) to smooth switch jitter.
• Arrival-time & asymmetry metrology: Chapter 9 (dual forms and a_ij sources).
• Cleaning & compliance models: Methods.Cleaning v1.0 Chapter 10 (contracts & release freeze).

IX. Quality Gauges & Risk Control

1. Primary metrics
   offset_abs_p50/p95/p99, skew_abs_p99, J_rms, r_cycle_p99, a_ij_p95, T_sw_p95, loss_rate, latency_ms_p99.
2. Risk policies
   • On cycle-residual breach: edge down-weight → asymmetry estimation → path reselection; persistent violations trigger GM re-election and gray switch.
   • Switch protection: dual-threshold hysteresis and cooldown; in holdover, enforce local bound |offset| ≤ bound_holdover.
   • Rollback & audit: persist failure playbooks and replay data, enabling TraceID-level reproduction.

Summary