21-EFT.WP.Metrology.Sync v1.0 | Chapter 3 — Reference Hierarchy & Grandmaster Election (GM / BMCA)

Home ／ Docs-Technical WhitePaper ／ 21-EFT.WP.Metrology.Sync v1.0

Chapter 3 — Reference Hierarchy & Grandmaster Election (GM / BMCA)

One-line objective: With an auditable BMCA and reference-hierarchy policy, elect a single network-wide GM deterministically, and during faults/switchovers keep offset/skew/J and MTIE/tdev within budget.

I. Scope & Objects

1. Applicable systems
   • IEEE 1588 PTP/gPTP (with Boundary/Transparent Clocks), SyncE as the frequency underlay, GNSS/Rb/OCXO as upstream references.
   • Single and multi-domain deployments, cross-subnet transparent forwarding, custom priority policy, and security trust gating.
2. Inputs
   • Announce dataset: priority1, clockClass, clockAccuracy, offsetScaledLogVariance, priority2, clockIdentity, stepsRemoved, timeSource, domainNumber, grandmasterIdentity.
   • Path quality: delay_rt, asym, J_path, U(ts), U(asym); port roles and topology metadata.
   • Runtime policy: logAnnounceInterval, announceReceiptTimeout, holdover_limit, domainPriority, policy.weights.
3. Outputs
   • Election result & state: GM, BM/TC port roles, stepsRemoved updates, gm_switch_count.
   • Quality & uncertainty: T_switchover, U(offset), MTIE_delta, tdev_delta; signed manifest.sync.bmca.*.

II. Terms & Variables

• Core gauges: offset, skew, J, TIE, MTIE(tau), tdev(tau); bases tau_mono, ts.
• BMCA comparison vector: rank(c) for candidate c ∈ C; domainPriority; path penalty penalty(c).
• Messaging & timing: logAnnounceInterval, T_announce = 2^{logAnnounceInterval}, announceReceiptTimeout.
• Switchover budget: T_switchover = T_detect + T_bmca + T_servo_lock.
• Dual-form arrival: T_arr = ( 1 / c_ref ) * ( ∫ n_eff d ell ) and T_arr = ( ∫ ( n_eff / c_ref ) d ell ); difference delta_form.

*III. Axioms P603- **

• P603-1 (Domain isolation): unique(domainNumber, GM); cross-domain state must not bleed through.
• P603-2 (Deterministic ordering): The ordering of rank(c) and weights is fixed, published, and replayable; isomorphic implementations must converge to identical results.
• P603-3 (Liveness gating): Only candidates with is_alive(c)=true can compete; stale Announce frames must be evicted.
• P603-4 (Explicit path quality): asym, delay_rt, J_path (with uncertainties) enter election as gates or penalties.
• P603-5 (Debounce & hysteresis): Switchover requires time and quality thresholds; configure min_hold and hysteresis band hyst.
• P603-6 (Security & trust): Candidates must have trust=1 or a valid signature; unsigned external sources cannot be elected.
• P603-7 (Time-base continuity): After switch, MTIE(tau) and tdev(tau) must remain within budget envelopes.
• P603-8 (Dual-form consistency): Any path/arrival evaluation records both forms and publishes delta_form.
• P603-9 (Dimensional integrity): Run check_dim(expr) for all published equations.
• P603-10 (Traceability): TraceID, hash_sha256(blob), manifest.sync.bmca.*, and signature are mandatory.

*IV. Minimal Equations S603- **

• S603-1 (BMCA comparison vector)
  rank(c) = ( domainPriority, priority1, clockClass, clockAccuracy, offsetScaledLogVariance, priority2, clockIdentity )
• S603-2 (Lexicographic order)
  rank(c1) < rank(c2) iff the left-to-right lexicographic tuple is smaller.
  Gate: only if stepsRemoved(c) < 255 ∧ is_alive(c)=true.
• S603-3 (Liveness test)
  is_alive(c) = ( now - last_announce(c) ) ≤ ( announceReceiptTimeout * T_announce(c) )
• S603-4 (Path penalty & effective ordering)
  penalty(c) = w_delay * delay_rt(c) + w_asym * | asym(c) | + w_jit * J_path(c)
  effective_rank(c) = ( rank(c), penalty(c) ) (compare rank first, then penalty).
• S603-5 (Switchover time budget)
  T_switchover = T_detect + T_bmca + T_servo_lock ≤ T_budget
• S603-6 (StepsRemoved update)
  stepsRemoved(child) = min(255, stepsRemoved(parent) + 1); require non_decreasing(stepsRemoved) along the path.
• S603-7 (Fluctuation constraints)
  MTIE_delta(tau) = MTIE_post(tau) - MTIE_pre(tau) ≤ bound_mtie(tau)
  tdev_delta(tau) = tdev_post(tau) - tdev_pre(tau) ≤ bound_tdev(tau)
• S603-8 (Dual-form delta)
  delta_form = | ( 1 / c_ref ) * ( ∫ n_eff d ell ) - ( ∫ ( n_eff / c_ref ) d ell ) |
• S603-9 (Uncertainty release)
  U^2(GM) = U^2(src) + U^2(path) + U^2(servo)；publish U = k * u_c and k.

V. Metrology Flow M60-3 (BMCA & Hierarchy Election)

1. Ingest & standardize
   • Parse Announce and Sync/Follow_Up; normalize units/dimensions check_dim(all); align to tau_mono.
   • Build candidate set C, fill last_announce(c) and stepsRemoved(c).
2. Liveness & security gating
   • Evaluate is_alive(c) and trust(c); drop unsigned/stale candidates.
   • Apply path gates: delay_rt, |asym|, J_path, U must stay within policy.
3. Ordering & selection
   • Compute rank(c) and penalty(c); elect GM* via lexicographic effective_rank.
   • If the incumbent and GM* differ by less than hysteresis and thresholds are met, hold incumbent to debounce.
4. Publish & set roles
   • Update port states (Master/Slave/Passive/Disabled), refresh stepsRemoved.
   • Write manifest.sync.bmca.* with {GM, rank, penalty, U, TraceID, signature}.
5. Switchover & convergence
   On change, execute servo transition; measure T_switchover, MTIE_delta/tdev_delta; if over budget, trigger rollback or traffic throttling.
6. Dual-form arrivals
   For any path metric in the comparison, compute both forms and delta_form; persist and assert thresholds.

VI. Contracts & Assertions C60-3*

• C60-31 (Single GM): count_active_gm(domainNumber) = 1.
• C60-32 (Liveness): the incumbent GM satisfies is_alive(GM)=true, otherwise trigger failover.
• C60-33 (StepsRemoved): non_decreasing(stepsRemoved) ∧ stepsRemoved < 255.
• C60-34 (Switch budget): T_switchover ≤ T_budget, MTIE_delta(tau) ≤ bound_mtie(tau), tdev_delta(tau) ≤ bound_tdev(tau).
• C60-35 (Path gates): delay_rt ≤ delay_max, |asym| ≤ asym_max, J_path ≤ J_max, U ≤ U_max.
• C60-36 (Dual-form delta): delta_form ≤ tol_Tarr.
• C60-37 (Security): trust=1 or signature.valid=true to be electable.
• C60-38 (Dimensions): check_dim(all)=true.

VII. Implementation Bindings I60- (BMCA Layer)*

• collect_announce(stream) -> candidates
• is_alive(c, now, timeout) -> bool
• rank_vector(c, domainPriority) -> tuple
• path_penalty(metrics, weights) -> penalty
• elect_gm(candidates, policy) -> {gm, proofs} (returns ordering proof & replay evidence)
• apply_hysteresis(prev_gm, gm*, policy) -> gm_final
• failover_monitor(state, thresholds) -> events
• holdover_manager(state, holdover_limit) -> loop_cfg
• emit_bmca_manifest(result, meta) -> manifest.sync.bmca
• Invariants: unique(clockIdentity); announce_loss_rate ≤ tol_loss; sum(weights) > 0; delta_form ≤ tol_Tarr.

VIII. Cross-References

• Time-base, Allan, and stability: EFT.WP.Metrology.TimeBase v1.0 Chapters 7 & 14.
• Synchronization modeling baseline & uncertainty: this volume Chapter 2 (P602-* / S602-*).
• Cleaning & contract release: Methods.Cleaning v1.0 Chapter 10 and Appendix C.
• Statistical drift monitoring: Methods.CrossStats v1.0 Chapter 7, Appendix D.

IX. Quality SLIs & Risk Control

1. SLIs / indicators: gm_flaps_per_hour, T_switchover_p50/p95/p99, announce_stale_rate, stepsRemoved_max, mtie_after_switchover(tau), tdev_after_switchover(tau), asym_p95, delay_rt_p95, U(offset)_p95, delta_form_p99.
2. Risk policies:
   • Debounce via min_hold and hysteresis; on anomalies, roll back to the next-best GM.
   • Security: isolate unsigned sources; domain_collision_count > 0 → protection mode.
   • Observability: periodic calibration or online estimation for asym drift; path re-discovery on routing changes.

Summary