20-EFT.WP.Metrology.TimeBase v1.0 | Chapter 12 — Boundaries & Anomalies (Leap Seconds / Virtualization / GNSS Events)

Home ／ Docs-Technical WhitePaper ／ 20-EFT.WP.Metrology.TimeBase v1.0

Chapter 12 — Boundaries & Anomalies (Leap Seconds / Virtualization / GNSS Events)

One-line objective: Under challenging boundary conditions—leap seconds, virtualized clocks, and GNSS source anomalies—preserve the monotonicity of tau_mono and consistency of the published ts, quantify risk, and deliver an auditable governance loop.

I. Scope & Targets

1. Covered
   • Time scales & leap seconds: mappings among TAI/UTC/GPS/UT1, leap_event ∈ {+1,-1,0}, and UTC_smear policies.
   • Virtualization & containers: vCPU preemption, TSC stability, guest↔host clock source switching, and monotonicity guarantees.
   • GNSS anomalies: spoof/jam, ionospheric disturbances, 1PPS/ToD mismatch, GPS week rollover, multi-constellation resilience.
2. Inputs
   Real-time observables: offset/skew/J, 1PPS bias, PDOP, CN0, stall_ms (guest clock stalls), wn_rx (GNSS week count).
3. Outputs
   • Policy & control: leap_apply or UTC_smear, holdover mode, source_fallback, adjustments to warp(t).
   • Manifest: manifest.time.boundary.* (events, thresholds, actions, and signature).

II. Terms & Variables

• Time scales & leap seconds: TAI, UTC, GPS, UT1, leap(t), Δ_leap ∈ {+1 s,-1 s}, window W_smear, UTC_smear(t).
• Virtualization: TSC (invariant_tsc ∈ {0,1}), ts_guest, ts_host, stall_ms, kvmclock_offset, host_skew.
• GNSS: t_sat, t_rx, d_prop, d_iono, d_trop, PDOP, CN0, 1PPS, ToD, wn_rx, WN_full.
• Gauges & contracts: offset, skew, J, lat, tol_*, q_score, TraceID.

III. Axioms P512- **

• P512-1 (Scale separation): Internal tau_mono is immune to leap seconds; UTC/TAI/GPS apply only at the ts mapping layer.
• P512-2 (Once-only leap application): Any leap_event must be applied exactly once within the system—no double compensation, no cross-window accrual.
• P512-3 (Virtual monotonicity): Under any vCPU preemption or migration, tau_mono must remain non_decreasing; degrade to a single-source TSC or monotonic_raw when required.
• P512-4 (GNSS admission control): A GNSS source must pass integrity and environment gates before driving the servo baseline—isolate first, admit later.
• P512-5 (Multi-source voting): Fuse GNSS/PTP/NTP/OCXO via robust voting/weighted median; no single source may directly cause a phase step.
• P512-6 (Dual arrival forms): Any path delay estimate must publish both T_arr forms and record delta_form.
• P512-7 (Traceability): All boundary events are written to manifest.time.boundary.* with raw observations, actions, and residual uncertainty.

IV. Minimal Equations S512- **

• S512-1 (Scale mappings)
  UTC(t) = TAI(t) - leap(t)；GPS(t) = TAI(t) - Delta_tai_gps；UT1(t) = UTC(t) + Delta_UT1(t)。
• S512-2 (Leap-second smearing)
  UTC_smear(t) = UTC(t) + ( Δ_leap ) * g( ( t - t0 ) / W_smear )，with g(x) ∈ [0,1], g(0)=0, g(1)=1, | d g / d x | ≤ k_smear。
• S512-3 (Virtualization stall detection)
  stall_ms = max( 0 , ( ts_host - ts_guest ) - expected_progress )；if stall_ms > stall_thr, trigger degradation。
• S512-4 (GNSS observation & bias)
  t_rx = t_sat + d_prop + d_iono + d_trop + eps_hw；offset_gnss = ( t_1pps - ts_ref )。
• S512-5 (Week rollover repair)
  WN_full = argmin_w | T_gps( wn_rx + w * WN_mod ) - T_ref |，WN_mod from GNSS spec。
• S512-6 (Holdover bound)
  | offset_holdover(t) | ≤ | offset0 | + | y0 | * t + 0.5 * | dy/dt | * t^2 + J_wander(t)。
• S512-7 (Robust fusion)
  offset_fused = median( { offset_src } )；skew_fused = median( { skew_src } )；down-weight abnormal sources via MAD。
• S512-8 (Jitter & monotonicity constraints)
  J = sqrt( Var( Delta_ts ) )；published streams satisfy non_decreasing(ts) and | d warp / dt - 1 | ≤ eps_warp。

V. Governance Flow M50-12 (Detect → Classify → Isolate → Correct → Reinstate → Audit)

1. Detection
   Continuously monitor offset/skew/J, 1PPS, PDOP/CN0, stall_ms, wn_rx.
2. Classification
   A: leap-second event; B: virtualization stall/migration; C: GNSS (spoof/jam/ionosphere/rollover).
3. Isolation
   Suspend phase steps; remove GNSS from servo (quarantine); in virtualization, switch to monotonic_raw and enter holdover.
4. Correction
   • Leap seconds: apply leap_step or UTC_smear(t) per policy;
   • Virtualization: limit frequency / pin CPUs / enable invariant_tsc or kvmclock corrections;
   • GNSS: reselect constellations, enforce PDOP/CN0 gates, repair WN_full, re-calibrate antenna/cable delays; re-admit after holdover reconvergence.
5. Reinstatement
   Using median/MAD, taper isolated-source weight to zero, then probe up; resume voting once contracts pass.
6. Audit
   Emit manifest.time.boundary.*: event, thresholds, actions, residual U, and signature.

VI. Contracts & Assertions

• C50-121 (Leap-second consistency): leap_event applied count = 1; for UTC_smear, | d UTC_smear / dt - 1 | ≤ eps_smear and completion within W_smear.
• C50-122 (Monotonicity): violations( non_decreasing(ts) ) = 0; warp obeys | d warp / dt - 1 | ≤ eps_warp.
• C50-123 (Virtualization bound): stall_ms_p99 ≤ bound_stall; invariant_tsc=1 or an equivalent guard is active.
• C50-124 (GNSS admission): PDOP ≤ pdop_max ∧ CN0 ≥ cn0_min ∧ spoof_score ≤ spoof_thr ∧ wnro_ok = true.
• C50-125 (1PPS alignment): | offset_1pps | ≤ tol_1pps; otherwise force holdover.
• C50-126 (Dual arrival forms): delta_form ≤ tol_Tarr sustained.
• C50-127 (Dimensional checks): check_dim( offset/skew/J ) = pass.

VII. Implementation Bindings I50-12*

• handle_leap_event(leap_table, policy, W_smear) -> plan (policy ∈ {step, smear_linear, smear_sine})
• apply_leap_smear(ts, plan) -> ts'
• virtual_clock_guard(env) -> {invariant_tsc, pinning, tick_hz}
• probe_tsc_stability(samples) -> report (tests for drift and stall_ms)
• detect_gnss_spoof(stream, rules) -> {spoof_score, flags}
• resolve_gps_week_rollover(wn_rx, ref) -> WN_full
• enter_holdover(clock, horizon) -> mode；switch_time_source(order) -> active_src
• fuse_multi_sources(offsets, skews, method) -> {offset_fused, skew_fused} (method = median_mad)
• emit_boundary_manifest(event, actions, U) -> manifest.time.boundary
• Invariants: unique(TraceID)；leap_applied_once=true；ts' monotone；source_fallback preserves the offset_p99 contract.

VIII. Cross-References

• Clocks & references: Chapter 3 (OCXO/Rb/GNSS holdover and re-calibration).
• Timestamp chains & latency budget: Chapter 4 (warp(t) and path corrections).
• Synchronization protocols & servos: Chapter 5 (step/smear strategies and loop parameters).
• Offset/skew/jitter estimation: Chapter 6 (stall_ms and skew estimation).
• Phase/time noise & Allan family: Chapter 7 (holdover drift bounds).
• Buffering & time-base conversion: Chapter 8 (monotonicity and resampling).
• Arrival-time metrology & path consistency: Chapter 9 (dual forms & delta_form).
• Streaming operations & backpressure: Chapter 11 (backpressure coordination during anomalies).

IX. Quality SLIs & Risk Control

1. SLIs
   • leap_applied_flag, smear_window_active, smear_slope_max;
   • stall_ms_p95/p99, guest_tsc_invariant, offset_1pps_p95;
   • gnss_use_ratio, spoof_alerts_count, wnro_events, holdover_duration_s.
2. Risk policies
   • Priority: holdover > multi-source median > PTP > NTP > GNSS (quarantined).
   • Gray re-admission: low-weight join → pass observability gates → increase weight.
   • Injection drills: periodic leap-second simulation, VM pause injection, spoof/jam sandbox—verify C50-121…127.

Summary