21-EFT.WP.Metrology.Sync v1.0 | Chapter 10 — Holdover & Failover

Home ／ Docs-Technical WhitePaper ／ 21-EFT.WP.Metrology.Sync v1.0

Chapter 10 — Holdover & Failover

One-line objective: When upstream references unlock or degrade, maintain the local time base with provable error bounds, and—subject to contract gates—execute safe fallback and switchover.

I. Scope & Objects

1. Applies to
   • Holdover and failover strategies for PTP/NTP/SyncE/White Rabbit when reference loss, path anomalies, or GM failures occur.
   • Single-node oscillators (TCXO/OCXO/Rb) and clustered multi-GM switchover/recovery.
2. Inputs
   • Current phase error x(t), fractional frequency y(t), servo state, noise typing and stability curves adev/mdev/tdev/hdev.
   • Candidate masters {GM_i} with quality/path metrics: class_i, priority_i, q_path_i, asym_i, sigma_t_i.
   • Time axis & arrivals: tau_mono, ts, dual-form T_arr with delta_form.
   • Local oscillator model with temperature/aging parameters.
3. Outputs
   • Forecast ete(t) and bound E_bound(t) over the holdover horizon; fallback decision and slew/step-limited switchover trajectory.
   • Manifests & audit: manifest.sync.holdover.*, manifest.sync.failover.*.

II. Terms & Variables

• x(t) time error (s); y(t) = d x(t) / d t (1).
• ete(t) estimated time error; E_bound(t) confidence bound (e.g., P95/P99).
• t_loss loss instant; Delta_t = t - t_loss elapsed holdover time.
• nu0 nominal frequency; D linear frequency drift (1/s).
• tau averaging time; tdev(tau) time stability (s).
• slew_max max slew rate (s/s); step_max max permitted jump (s).
• GM_i candidate GMs; score_i composite scores.
• Dimensional constraints: unit(x)="s", unit(y)="1", unit(tdev)="s", check_dim(expr) must pass.

III. Axioms P610- **

• P610-1 (Unified base): All estimation and windowing in holdover/failover are on tau_mono; publish on ts.
• P610-2 (No-step preference): Prefer slew with bounded rate; disallow step unless permitted by contracts and fully audited.
• P610-3 (Spectral–time concordance): Use Allan-family stability and oscillator models jointly to derive holdover error bounds; slopes must match tdev.
• P610-4 (Arrival consistency): Before/after switching, maintain dual-form T_arr logging and delta_form thresholds.
• P610-5 (Reversible fallback): Any failover must be idempotently replayable, support failback, and implement hysteresis and minimum dwell times.
• P610-6 (Minimum disturbance): The trajectory minimizes integrated phase error and business impact under slew_max and jerk_max.

IV. Minimal Equations S610- **

• S610-1 (Holdover dynamics)
  dx/dt = y(t)
  dy/dt = epsilon(t)
  With linear drift y(t) ≈ y0 + D * ( t - t_loss ) →
  x(t) = x0 + y0 * Delta_t + 0.5 * D * Delta_t^2
• S610-2 (Stability → error bound)
  Using tdev(tau) to approximate std. in the window:
  sigma_x(Delta_t) ≈ tdev(Delta_t)
  E_bound(Delta_t) = bias_bound + k_q * sigma_x(Delta_t)
  where k_q maps to the desired quantile (e.g., 1.96 for ~95%, 2.58 for ~99%).
• S610-3 (Quantization & slew-limiting)
  If a correction Delta_step is needed, slew time:
  T_slew ≥ | Delta_step | / slew_max
  Max instantaneous phase error during slewing:
  x_peak ≤ 0.5 * | Delta_step |
• S610-4 (Candidate GM composite score)
  score_i = w_c * class_i + w_p * priority_i + w_q * ( 1 / sigma_t_i ) + w_a * ( 1 / | asym_i | ) + w_r * q_path_i
  Choose arg max_i score_i with pre-switch consistency checks.
• S610-5 (Pre-switch consistency)
  With unicast/parallel probes Delta_t_i = t_ref(i) - t_local:
  pass_i ⇔ ( | median(Delta_t_i) | ≤ tol_pre_switch ) ∧ ( mad(Delta_t_i) ≤ tol_jitter )

V. Flow M60-10 (Holdover & Failover)

1. Trigger detection
   • Signals: upstream alarms, annTimeout, residual thresholds, q_path drops, delta_form breaches.
   • Mark t_loss; freeze current servo state and covariance.
2. Enter holdover
   • Switch to predictor: update ete(t) and E_bound(t) from y0, D and noise typing.
   • Compare E_bound(t) vs SLO; compute T_hold_max = sup { t : E_bound(t) ≤ tol_hold }.
3. Candidate evaluation
   • In parallel evaluate score_i and pass_i for {GM_i}; record each path’s asym_i and delta_form.
   • Continue holdover if none pass; if multiple pass, pick the best with hysteresis & min-dwell.
4. Execute switch
   • Compute Delta_step = median(Delta_t_i); if | Delta_step | ≤ step_max_forbidden, slew:
     craft constant-rate or S-curve trajectory obeying slew_max, jerk_max.
   • Apply new path corrections & asymmetry; keep tau_mono continuous.
5. Post-switch verification
   On window Delta_t_verify, check | x_res | ≤ tol_post_switch, tdev(tau_ref) ≤ tol_tdev_ref; failure → rollback or alternate GM.
6. Resume tracking
   • Ramp back to nominal bandwidth; refresh oscillator model (temp/aging); clear holdover flags.
   • Persist manifest.sync.failover.* and audit events.

VI. Contracts & Assertions

• C60-101 (Holdover bound): E_bound(Delta_t) ≤ tol_hold holds at P99 during holdover.
• C60-102 (Max hold time): T_hold ≤ T_hold_max; exceeding requires fallback or degraded publication.
• C60-103 (Switch consistency): Require pass_i and | Delta_step | ≤ tol_pre_switch to switch.
• C60-104 (Slew limits): slew_rate ≤ slew_max ∧ jerk ≤ jerk_max; no unaudited steps.
• C60-105 (Post-switch quality): tdev(tau_ref) ≤ tol_tdev_ref, adev(tau_ref) ≤ tol_adev_ref, maintain delta_form ≤ tol_Tarr.
• C60-106 (Audit & trace): Decisions, parameters, and trajectories of holdover/failover are signed in the manifest.

VII. Implementation Bindings I60-10*

• enter_holdover(state, x0, y0, D, t_loss, noise_profile) -> ho_ctx
• predict_holdover_error(ho_ctx, t) -> {ete, E_bound}
• score_gm(candidates, path_metrics, weights) -> ranking
• pre_switch_check(gm, probes, tol_pre_switch, tol_jitter) -> pass
• plan_slew(delta_step, slew_max, jerk_max) -> trajectory
• execute_failover(trajectory, gm, path_fix) -> result
• post_switch_verify(window, tol_post_switch, tol_tdev_ref) -> report
• emit_holdover_manifest(ctx) -> manifest.sync.holdover
• emit_failover_manifest(event) -> manifest.sync.failover
• Invariants: units/dimensions validated; tau_mono continuity; delta_form persisted; trajectories & decisions reproducible.

VIII. Cross-References

• Oscillators & stability modeling: this volume Chapter 7 and EFT.WP.Metrology.TimeBase v1.0 Chapter 7.
• Measurement links & timestamps: this volume Chapter 4; asymmetry modeling: Chapter 7.
• Servo filtering & estimation: this volume Chapter 6; GM hierarchy & BMCA: Chapter 3.
• Cleaning, manifests & compliance: Methods.Cleaning v1.0 Chapter 10 and manifest appendices.

IX. Quality Metrics & Risk Control

1. Metrics: E_bound(t)_p95/p99, T_hold_max, time_in_holdover_ratio, failover_count, post_switch_tdev(tau_ref), Delta_step.
2. Events: lost_sync, enter_holdover, switch_success, switch_rollback, over_budget.
3. Risk actions:
   • When E_bound nears threshold → proactive switch or degraded publication (publish ts only; suspend T_arr).
   • Repeated failovers → lock to local reference, raise alert level, and narrow service scope.
   • Post-switch quality shortfall → auto-rollback or switch to next-best GM with slew limiting.

Summary