White-Rabbit-Style Timing for Sub-ns Ethernet Synchronization
← Back to: Industrial Ethernet & TSN
H2-1 · Definition & Scope (WR-style, not “generic PTP/SyncE”)
Intent
Establish a clear and testable definition of “White-Rabbit-style timing,” explain why it can reach sub-nanosecond synchronization, and lock the page boundary so that PTP/SyncE/TSN details do not leak into this topic.
30-second definition (engineering view)
- White-Rabbit-style timing is an end-to-end control system that combines two-way delay measurement, link asymmetry calibration, and distributed frequency locking to keep time/phase aligned across a network link.
- Sub-ns performance is achieved by closing the loop on what cannot be cancelled by simple round-trip math: fixed device delays, asymmetry drift, and frequency wander.
- The deliverable of this page is a measurable path from architecture → calibration → verification, rather than protocol message-field walkthroughs.
The 3 closed loops (inputs → controls → outputs → failure modes → pass criteria)
Loop A · Two-way delay measurement
- Inputs: hardware timestamp events; stable measurement window (X ms).
- Controls: timestamp tap-point consistency; filtering/averaging policy; queue-noise isolation.
- Outputs: RTT; one-way delay estimate; delay jitter distribution.
- Failure modes: “looks stable but biased”; step changes after relock; queue-induced noise.
- Pass criteria: delay jitter ≤ X (p95) over Y minutes (placeholder).
Loop B · Asymmetry calibration
- Inputs: measured delay; fixed device delay components; temperature/profiles.
- Controls: calibration table; module/port binding; compensation triggers (temp ΔT, relock).
- Outputs: asymmetry estimate; corrected one-way delay; residual bias.
- Failure modes: module swap invalidates table; temperature drift unmodeled; path mismatch.
- Pass criteria: offset bias ≤ X over Y minutes across Z °C swing (placeholder).
Loop C · Distributed frequency lock (syntonization + holdover)
- Inputs: reference frequency; phase/frequency error measurements; lock-state signals.
- Controls: loop bandwidth; filter design; holdover policy on link loss.
- Outputs: frequency alignment; reduced wander; controlled relock behavior.
- Failure modes: bandwidth too wide amplifies noise; too narrow slows response; fast drift in holdover.
- Pass criteria: wander ≤ X and holdover drift ≤ Y over Z seconds (placeholder).
What this page will answer (and where)
How accurate can it get? → H2-2 (metrics) + later verification chapter (field acceptance).
What hardware is required? → hardware building blocks chapter (clock/timestamp/phase path).
How is asymmetry calibrated? → calibration chapter (tables, binding, temperature compensation).
How is it verified and monitored? → verification/monitoring chapter (KPIs, logs, failure isolation).
How should engineering decisions be made? → engineering checklist chapter (design → bring-up → production).
Stop line (not covered here)
Protocol message formats, standard clauses, and TSN scheduling tables are intentionally excluded here. This page focuses on the closed-loop timing architecture, calibration, and measurable verification.
- PTP mechanics (timestamp modes, E2E/P2P corrections) → PTP Hardware Timestamping
- SyncE templates and frequency distribution standards → Synchronous Ethernet (SyncE)
- TSN gate-control lists and shaping parameterization → TSN Switch / Bridge
- PoE/PoDL power path and surge protection design → PoE / Protection
H2-2 · Sub-ns Requirements & Success Criteria
Intent
Convert “sub-nanosecond” from a slogan into measurable KPIs, consistent definitions, and acceptance criteria that can be applied across lab, rack, and outdoor deployments.
Engineering definitions (no theory, only what can be verified)
- Accuracy: long-window mean time offset versus the reference.
- Precision: short-window spread (jitter) of time offset under steady conditions.
- Stability: how time offset changes with time and environment (wander, temperature drift, power events).
Mapping to the 3 loops:
two-way delay primarily improves precision;
asymmetry calibration sets accuracy;
distributed frequency lock and holdover sustain stability.
KPI stack (each KPI = what it means → how to observe → common traps → pass criteria)
KPI 1 · Time offset
- Meaning: instantaneous timing difference between a node and the reference.
- Observe: offset time-series from hardware timestamp events (consistent window definition).
- Trap: mismatched denominators or windowing makes “better” plots that are not comparable.
- Pass criteria: |offset| ≤ X (p95) over Y minutes (placeholder).
KPI 2 · Time wander (low-frequency drift)
- Meaning: slow changes in offset due to temperature, frequency error, or control-loop design.
- Observe: offset slope over long windows; compare before/after environmental steps.
- Trap: aggressive filtering hides wander while real systems still fail deterministic triggers.
- Pass criteria: |drift| ≤ X ns/min under defined ΔT and power events (placeholder).
KPI 3 · Phase noise / jitter (system-level)
- Meaning: short-term random variation that limits precision and trigger repeatability.
- Observe: phase-error distribution or equivalent short-window statistics from the timing loop.
- Trap: measurement settings or logging resolution creates “too clean” plots that miss real jitter.
- Pass criteria: jitter ≤ X (p95) in the target bandwidth (placeholder).
KPI 4 · Holdover drift (during link loss)
- Meaning: offset drift when the link is unavailable and the node must ride its local clock.
- Observe: offset trajectory in holdover state, tagged with temperature and power conditions.
- Trap: mixing “relock transient” samples with holdover samples breaks comparability.
- Pass criteria: drift ≤ X over Y seconds of holdover (placeholder).
Scenario layers (dominant error sources → first KPI to check)
Layer 1 · Bench / Lab
Dominant sources: reference quality, timestamp tap-point consistency, window/filter configuration.
First KPI: precision (short-window jitter) + delay jitter distribution.
First KPI: precision (short-window jitter) + delay jitter distribution.
Layer 2 · Rack / Chassis
Dominant sources: thermal gradients, airflow changes, power noise coupling, EMI-induced relock events.
First KPI: stability (wander slope) and relock step behavior.
First KPI: stability (wander slope) and relock step behavior.
Layer 3 · Outdoor / Long fiber
Dominant sources: medium delay temperature coefficient, asymmetry drift, maintenance and module replacement.
First KPI: accuracy (bias) + temperature-correlated drift (offset vs ΔT).
First KPI: accuracy (bias) + temperature-correlated drift (offset vs ΔT).
Metric definition guardrails (to avoid false “improvements”)
- Window lock: always compare KPIs under the same window length and sampling cadence.
- Percentile lock: use p95/p99 (not only mean) to protect deterministic triggering.
- State tagging: separate steady-state, relock transient, and holdover samples.
- Environment tagging: log temperature/power events alongside offset to validate compensation.
H2-3 · Timing Model: Delay Decomposition & Asymmetry Sources
Intent
Explain why timing accuracy degrades when the link gets longer, temperature changes, or optics/PHY modules are swapped. Build a practical delay budget that separates cancelable terms from terms that require calibration and compensation.
Why “longer / hotter / module swap” breaks sub-ns timing
- Longer: medium delay and asymmetry drift increase, and small non-determinism becomes visible.
- Hotter/colder: temperature coefficients change propagation and group delay; compensation becomes mandatory.
- Module swap: fixed delays and group delay shift, invalidating previously learned calibration tables.
Delay decomposition ledger (what it is → how it shows up → cancelability → control lever)
1) TX fixed delay
- What: deterministic latency from local clock domain to the TX timestamp tap.
- Shows up as: stable bias that steps after hardware/firmware changes.
- Two-way: not fully cancelable if tap differs between directions.
- Control: fixed-delay calibration + strict tap definition + version/port binding.
2) RX fixed delay
- What: deterministic latency from RX tap to the local timebase/servo measurement point.
- Shows up as: stable bias; often appears as a constant offset error.
- Two-way: not cancelable when TX/RX paths are not symmetric.
- Control: per-port calibration + thermal characterization where needed.
3) Timestamp tap offset
- What: physical location where timestamps are taken (MAC/PHY/SerDes boundary).
- Shows up as: “stable but wrong” measurements; relock creates repeatable steps.
- Two-way: cannot be cancelled if taps are inconsistent.
- Control: lock tap definition + verify tap-to-wire determinism in bring-up.
4) Medium propagation delay
- What: delay through fiber/copper, strongly tied to length and temperature.
- Shows up as: slow drift correlated with ambient changes on long links.
- Two-way: mostly cancelable if forward/reverse paths match.
- Control: asymmetry modeling + temperature tagging + periodic recalibration triggers.
5) Partner group delay
- What: TX/RX group delay of optics/PHY partner path (device-specific).
- Shows up as: offset steps after module replacement; temperature-dependent drift.
- Two-way: not cancelable when group delays differ by direction.
- Control: module/serial binding + calibration table invalidation rules.
6) Switch/bridge forwarding delay
- What: fixed + variable latency inside forwarding elements.
- Shows up as: jitter bursts under traffic load; multi-hop drift accumulation.
- Two-way: not cancelable when queueing dominates.
- Control: deterministic datapath + isolation of timing traffic (architecture constraint).
7) Queueing / contention noise
- What: load-dependent delay variation, often direction-dependent.
- Shows up as: widened offset distribution even when mean looks acceptable.
- Two-way: cannot be fixed by calibration if non-deterministic.
- Control: isolate timing traffic + limit burstiness + enforce deterministic forwarding rules.
8) Clock domain crossing effects
- What: synchronization and latency uncertainty between clock domains.
- Shows up as: repeatable “two-level” offset modes after reset or relock.
- Two-way: not cancelable when CDC latency is not fixed.
- Control: fixed-latency CDC design + measurement resolution matched to target.
Asymmetry sources (physical vs logical) and what can actually control them
Physical asymmetry
- Forward/reverse medium differences (connectors, splices, pair imbalance).
- Optics/PHY group delay mismatch by direction.
- Temperature coefficient mismatch (drift slope differs by direction).
Primary control: calibration tables + temperature-tagged compensation.
Logical asymmetry
- Direction-dependent queueing or shaping in forwarding elements.
- Timestamp tap-point not identical across TX/RX or across devices.
- Different CDC/synchronization paths per direction.
Primary control: deterministic datapath + strict tap definition + traffic isolation.
What two-way can cancel vs what must be calibrated (decision rules)
Cancelable (by symmetry)
- Common-mode medium changes when forward/reverse paths match.
- Stable fixed delays only if tap definitions are identical and deterministic.
- Random noise only when its distribution is symmetric and bounded.
Must be calibrated / constrained
- Tap-point mismatch (cannot be removed by any two-way math).
- Asymmetry drift with temperature or module replacement.
- Queueing/forwarding non-determinism (calibration cannot chase randomness).
First triage order (fastest to prove/disprove)
- Verify timestamp tap-point definition and determinism (TX/RX consistent).
- Confirm fixed delay tables are bound to port + module/serial and versioned.
- Check whether queueing noise dominates (traffic load correlates with offset spread).
- Validate temperature tagging and compensation slope (offset vs ΔT).
Pass criteria (placeholder):
under defined load and ΔT, offset distribution remains within X (p95) and drift slope within Y ns/min.
H2-4 · Reference Architecture & Roles (Node / Switch / Grandmaster-like Source)
Intent
Assemble a practical end-to-end system: define the roles, separate the clock path from the packet/time-correction path, and set clear hardware boundaries for timestamps, phase measurement, and servo loops.
Roles and responsibilities (architecture view)
Time source (grandmaster-like)
- Provides the reference timebase and a stable frequency anchor.
- Exposes lock/holdover state for system-level acceptance decisions.
- Defines the reference epoch used by endpoints (architecture-level agreement).
WR-capable switch / bridge
- Maintains a deterministic datapath for timing traffic (controls queue noise).
- Supports hardware timestamp and/or phase measurement primitives where required.
- Preserves a consistent timing model across multi-hop deployments.
End node (synchronized endpoint)
- Runs the frequency and phase/time servo loops against the reference.
- Applies fixed-delay and asymmetry calibration tables (with temperature tagging).
- Exports measurable KPIs (offset, wander, drift, lock state) for monitoring and field service.
Two parallel paths (clock distribution vs time/phase correction)
Clock path (thick line)
- Goal: distribute and lock frequency (syntonization) to suppress wander.
- Sensitive to: jitter injection, PLL bandwidth choices, and holdover behavior.
- Observable via: lock state, frequency error, holdover drift metrics.
Packet/time path (thin line)
- Goal: measure two-way delay and apply calibrated asymmetry compensation.
- Sensitive to: timestamp tap definition, queue noise, and multi-hop forwarding determinism.
- Observable via: delay jitter distribution and offset percentile stability.
Hardware boundaries (must be hardware-backed to reach sub-ns)
Boundary 1 · Hardware timestamp (fixed tap)
Timestamp events must be generated at a deterministic physical tap point with consistent TX/RX definitions.
Failure symptom: “stable but biased” offset; repeatable steps after relock.
Failure symptom: “stable but biased” offset; repeatable steps after relock.
Boundary 2 · Phase/frequency measurement
Phase/frequency error must be measured with resolution aligned to the target, feeding the servo loops.
Failure symptom: wander dominates; deterministic triggering fails despite “lock.”
Failure symptom: wander dominates; deterministic triggering fails despite “lock.”
Boundary 3 · Deterministic datapath (remove randomness)
Timing traffic must avoid queue-dominated latency; calibration cannot correct non-deterministic jitter.
Failure symptom: offset distribution widens under load; p95/p99 explode.
Failure symptom: offset distribution widens under load; p95/p99 explode.
Pass criteria (placeholder):
across defined load and temperature bands, the system remains locked with bounded p95 offset and bounded drift slope.
H2-5 · Bi-directional Delay Measurement Workflow (Two-way time transfer)
Intent
Clarify how two-way measurement uses four timestamps to estimate one-way delay and offset, and how to keep switch/queue noise from polluting sub-ns results.
Workflow overview (inputs → outputs → hard preconditions)
- Inputs: four timestamp events (t1, t2, t3, t4) captured at deterministic tap points.
- Outputs: round-trip delay (RTT), one-way delay estimate, and offset estimate used by the servo loops.
- Hard preconditions: fixed tap definitions, deterministic datapath for timing traffic, and bounded measurement jitter.
Acceptance gate (placeholder): offset distribution remains within X (p95) under defined load; measurement jitter does not scale with throughput.
Timestamp tap consistency (non-negotiable quality gate)
Rule 1 · Fixed tap definition
Timestamps must be taken at a deterministic physical boundary (MAC/PHY/SerDes boundary) with identical TX/RX tap semantics.
Rule 2 · Tap repeatability
After reset, relock, or retrain, the tap-to-wire latency must not jump between discrete “modes.”
Rule 3 · Tap-path alignment
Timestamp generation must follow the same datapath characteristics as the payload path; avoid “fast timestamp / slow payload” splits.
Fast validation (placeholder): under controlled traffic, offset width stays within X and remains insensitive to throughput steps.
Handling switch/queue noise (isolation + windowing + filtering)
A · Isolation
- Keep timing measurement traffic on a deterministic lane (avoid burst-driven queues).
- Prevent timing packets from competing with telemetry bursts or bulk transfers.
- Confirm that load changes do not widen the delay/offset distribution.
B · Windowing
- Measure during known steady phases; avoid burst boundaries.
- Use a defined sampling cadence and enforce a minimum sample count per window.
- Reject windows where delay jitter exceeds a threshold.
C · Filtering
- Filter reduces random noise only; it does not remove systematic bias.
- Track both mean and percentile spread (p50/p95) to detect hidden jitter.
- Separate short-term jitter from long-term drift (temperature/aging).
Acceptance gate (placeholder): delay jitter p95 ≤ X and remains stable across throughput steps; offset p95 ≤ Y in steady windows.
Common failure modes (symptom → first check → corrective direction)
Mode 1 · Stable-but-wrong (looks steady, absolute value is off)
- First check: tap definition mismatch or fixed delay table not bound to the correct port/module/version.
- Corrective direction: re-validate tap-to-wire determinism, then re-establish fixed-delay calibration and binding rules.
- Pass criteria: offset mean and p95 both fall within X after applying the correct table.
Mode 2 · Periodic wander (offset drifts in cycles)
- First check: measurement windows coupling to traffic cycles or servo/PLL interaction causing oscillation.
- Corrective direction: isolate timing traffic, adjust window selection, then revisit servo bandwidth / filtering policy.
- Pass criteria: wander slope and cycle amplitude remain below X across ΔT and load bands.
H2-6 · Calibration: Fixed Delays, Link Asymmetry & Temperature Compensation
Intent
Make sub-ns possible by defining what must be calibrated, how calibration is executed (factory / field / in-service), and how calibration tables remain valid across temperature and module swaps.
Calibration targets (table-item view: parameter → binding scope → drift driver → update policy)
1) Fixed delays (TX/RX)
- Binding: port + device version (+ module if applicable).
- Drift driver: firmware changes, ref-clock changes, module swap.
- Update policy: factory baseline + revalidate on version or module change.
2) Link asymmetry term
- Binding: link (fiber/cable path) + endpoint pair.
- Drift driver: temperature slope mismatch, path changes, connector aging.
- Update policy: field calibration + periodic/triggered refresh on drift indicators.
3) Group delay delta (module/PHY)
- Binding: module/serial (or PHY instance) + port.
- Drift driver: module replacement, temperature, vendor lot variation.
- Update policy: invalidate and rebuild on ID change unless equivalence is proven.
Acceptance gate (placeholder): after applying the correct table bindings, offset p95 ≤ X and drift slope ≤ Y within the qualified temperature band.
Calibration stages (factory → field → in-service)
Stage A · Factory calibration
- Goal: establish baseline fixed delays and stable bias terms.
- Output: baseline table + binding fields (port/module/version) + checksum.
- Gate: bias within X under controlled conditions and repeated power cycles.
Stage B · Field calibration
- Goal: capture installation-induced link asymmetry and site-specific deltas.
- Output: site delta + environment tags (path ID, length class, temperature band).
- Gate: stable percentiles across load windows; drift slope below X in qualified band.
Stage C · In-service recalibration
- Goal: maintain correctness through temperature swings, aging, and maintenance swaps.
- Triggers: ΔT > X, drift slope > Y, ID/version change, distribution widens (p95 jump).
- Gate: after update, offset p95 returns to ≤ X and remains stable across windows.
Temperature compensation (model + fit + online correction)
Model (engineering form)
- Use a low-order model for delay(T) and asym(T) (linear or piecewise-linear).
- Keep the model tied to binding scope: port/module/link as required.
- Track residual error, not just fitted slope.
Fit (data discipline)
- Collect samples across the qualified temperature band (not room-only).
- Record module ID, port ID, version, and traffic window state per sample.
- Reject samples captured during queue-dominated jitter windows.
Online correction
- Apply model-based compensation and monitor drift slope continuously.
- Trigger recalibration when residual error exceeds thresholds.
- Keep a rollback path (previous table) with audit fields.
Acceptance gate (placeholder): across ΔT band, compensated drift slope ≤ X and residual error p95 ≤ Y.
Calibration table lifecycle (swap / version change / invalidation rules)
Invalidate immediately
- Module/serial ID change where group delay equivalence is not proven.
- Tap definition change (firmware/hardware revision changes the timestamp boundary).
- Link path change (fiber reroute, connector replacement affecting asymmetry).
Reuse with fast revalidation
- Same module type but different serial: reuse only after passing quick offset/jitter gates.
- Minor firmware update: reuse only if tap semantics and CDC latency remain fixed.
- Temperature band expansion: reuse only after adding samples and refitting compensation.
Audit fields (must be stored)
- Port ID, module ID/serial, firmware/hardware version, and table checksum.
- Qualified temperature band and drift slope limits.
- Last validation timestamp and the acceptance results summary.
H2-7 · Distributed Frequency Lock (Syntonization) & Servo Loop Design
Intent
Explain why frequency must be locked first to prevent wander from dominating sub-ns timing, and how nested servo loops balance noise, response speed, and holdover stability without control-theory derivations.
Frequency lock vs phase alignment (what each fixes)
- Frequency lock (syntony): suppresses long-term slope (drift) so offset does not grow into wander.
- Phase/time alignment: corrects instantaneous residual offset after the slope is controlled.
- Engineering symptom: offset ramps linearly → treat as frequency/temperature/holdover problem first, not as a phase-only tuning issue.
Acceptance gate (placeholder): drift slope ≤ X over Y minutes before tightening phase-loop residual targets.
Servo structure (outer phase/time loop + inner frequency loop)
Inner loop · Frequency
- Measure: frequency error estimate from timing measurements and local clock observables.
- Filter: reject queue-dominated jitter; preserve drift information.
- Actuate: discipline DPLL/NCO/VCXO to control long-term slope.
Outer loop · Phase/Time
- Measure: offset/phase residual (after calibration and isolation policy).
- Filter: trade response speed against injecting noise into the disciplined clock.
- Actuate: apply fine phase/time correction to drive residual down.
Operational rule: stabilize the frequency slope first; then tighten outer-loop residual targets (p95) under defined measurement windows.
Filtering & bandwidth (noise vs response vs holdover)
If bandwidth is too wide
- Fast response, but measurement noise and queue jitter leak into the disciplined clock.
- Short-term jitter worsens; offset may look busy even in steady windows.
- Recovery can overshoot and oscillate after disturbances.
If bandwidth is too narrow
- Clean short-term behavior, but slow correction of temperature/aging drift.
- Wander slope increases during environmental changes.
- Reacquire time grows after link disturbances.
Tune against measurable KPIs
- Short-term: jitter / p95 spread in steady windows.
- Long-term: wander slope under ΔT and load changes.
- Resilience: holdover drift and reacquire time.
Acceptance gate (placeholder): in steady windows, jitter/p95 ≤ X; across ΔT, wander slope ≤ Y; after disturbance, reacquire ≤ Z.
Holdover (link loss / packet loss: short-term stability maintenance)
State machine
Lock → Tracking → Holdover → Reacquire. Each state must define what is frozen, what continues updating,
and what triggers exit conditions.
Engineering policy
- Preserve the best recent frequency estimate; avoid aggressive phase stepping during holdover.
- Monitor temperature and apply known compensation models (if qualified).
- On reacquire, ramp corrections to avoid overshoot and oscillation.
Acceptance gate (placeholder): holdover drift ≤ X over Y seconds; reacquire returns offset p95 ≤ Z within W seconds.
H2-8 · Hardware Building Blocks (Clock Tree / Phase Measurement / Timestamp Path)
Intent
Provide a hardware-first checklist for sub-ns timing: required clock-tree elements, phase measurement capability beyond basic timestamping, and deterministic timestamp paths with repeatable latency across resets, training, and load changes.
Clock tree essentials (reference → discipline → distribute → consume)
Reference source
Stable reference input with defined noise/jitter envelope and known temperature behavior.
PLL / DPLL discipline
The actuation point for syntony: resolution, tuning range, and stability determine drift slope and holdover behavior.
Distribution & consumers
Fanout to PHY/FPGA/SoC and to timestamp/phase blocks; manage noise coupling and preserve repeatable latency.
Selection hooks (placeholder): phase-noise/jitter budget, tuning resolution, and temperature sensitivity aligned to sub-ns KPIs.
Phase measurement (beyond basic timestamp resolution)
Why basic timestamps hit a limit
At sub-ns targets, the effective resolution and jitter of ordinary timestamp capture can become the bottleneck unless finer-grain
phase observability exists.
Engineering requirements
- Phase observables must share the same timebase as timestamp capture.
- Outputs must be calibratable and temperature-aware (residual error tracked).
- Repeatability matters more than raw “spec” resolution.
Acceptance gate (placeholder): phase/timestamp residual distribution stays within X in steady windows and remains stable across resets.
Timestamp path gates (tap point · CDC · FIFO · repeatable latency)
Tap point
Define where timestamps are taken (MAC/PHY/SerDes boundary) and keep TX/RX semantics consistent.
Clock domain crossing (CDC)
CDC must preserve ordering and determinism; timestamp capture must not become load-dependent.
FIFO / buffering
FIFO depth and arbitration must not alter timestamp-to-wire latency; avoid queue-state-dependent timing paths.
Repeatability
Latency must remain stable across resets, link training, temperature changes, and throughput steps.
Fast validation (placeholder): run reset/retrain cycles + throughput steps + ΔT sweep; confirm latency shows no discrete clusters and p95 ≤ X.
Hardware boundary (must be in HW vs can be in SW)
Must be hardware-supported
- Deterministic timestamp capture at a defined tap point.
- Clock discipline actuation (DPLL/NCO/VCXO control) with adequate resolution.
- Deterministic latency through CDC/FIFO paths (repeatable across states).
- Calibratable observables and stable timebase distribution.
Can be software-managed
- Measurement window selection and outlier rejection policy.
- Health monitoring, drift alarms, trigger-driven recalibration orchestration.
- Audit logs, binding checks, table lifecycle enforcement.
- Conservative ramping policies for reacquire stability.
Acceptance gate (placeholder): hardware provides deterministic capture and actuation; software policies keep windows stable and enforce table binding.
H2-9 · Network Topologies & Redundancy (and how to coexist with TSN)
Intent
Translate deployment reality into measurable design rules: topology choice, redundancy behavior, and TSN coexistence boundaries. TSN handles deterministic forwarding windows; WR-style timing maintains the timebase (no TSN GCL details here).
Topology selection (control vs calibration complexity)
Tree / Star
- Paths are stable and easy to segment into per-link budgets.
- Calibration table lifecycle is simpler (clear bindings and fewer path flips).
- Fault isolation is faster (branch-local diagnosis).
Ring
- Strong redundancy, but path flips can invalidate timing assumptions.
- Failover must define when to trust new asymmetry estimates.
- Reacquire policies must prevent thrash on marginal links.
Multi-segment chains
- Each added segment adds fixed delay + temperature drift + asymmetry terms.
- Segment-level calibration and binding become mandatory, not optional.
- End-to-end verification must include path-change scenarios.
Acceptance gate (placeholder): steady-topology offset p95 ≤ X; after path change, reacquire ≤ Y;
peak transient ≤ Z.
Redundancy strategies (paths, sources, and failover triggers)
Dual path
- Define main vs backup timing overlay paths.
- On switch, enter a protection window before trusting new offsets.
- Bind calibration tables to path identity (avoid stale compensation).
Dual time source
- Trigger on lock-status loss, drift slope breach, or offset instability.
- Use hysteresis to prevent rapid flapping between sources.
- After switch, ramp corrections to avoid overshoot.
Failover triggers
- Link-down / error spike / lock-status drop.
- Asymmetry estimate jump beyond threshold (table likely invalid).
- Offset p95 breach over a defined window (not a single sample).
Acceptance gate (placeholder): failover triggers are stable (no thrash);
source/path switch returns to lock within X; asymmetry stays bounded within Y.
Coexistence with TSN (strict boundary, no GCL detail)
Responsibility split
- TSN: deterministic forwarding windows and controlled queuing behavior.
- WR-style timing: timebase maintenance (frequency lock, phase/time residual control).
Minimal coexistence constraints
- Timing measurement windows must avoid queue-dominated latency regimes.
- Timestamp paths must remain deterministic across TSN load patterns.
- Path changes must be treated as calibration-binding events.
Acceptance gate (placeholder): under TSN high-load windows, offset p95 degradation ≤ X and no periodic wander amplification.
Common deployment pitfalls (avoid silent loss of sub-ns)
- Path changes without recalibration binding (stale tables applied to new routes).
- Failover triggers based on single samples (thrash and oscillation).
- “Stable but biased” offsets due to measuring at congested/edge windows.
- Using averages only; ignoring p95/peak/reacquire behaviors.
H2-10 · Verification, Monitoring & Field Service (make it measurable)
Intent
Turn “it works” into measurable acceptance, diagnosis, and reproducibility: verification ladder, minimal KPI set, black-box evidence, and field-service mechanisms (loopback/self-test/remote update and rollback) without management-protocol details.
Verification ladder (bench → system → environmental)
Bench
- Establish noise floor and baseline lock/reacquire behaviors.
- Validate timestamp path determinism under controlled traffic.
- Record baseline distributions (p50/p95/peak), not just averages.
System
- Stress under realistic switching and throughput steps.
- Detect “stable but biased” offsets caused by queuing regimes.
- Verify redundancy events (path/source switch) and recovery gates.
Environmental
- Temperature sweeps/steps, power disturbances, and mechanical vibration scenarios.
- Measure wander slope, holdover drift, and reacquire stability across ΔT.
- Confirm calibration binding rules remain correct under component swaps.
Acceptance gate (placeholder): offset p95 ≤ X; wander slope ≤ Y; holdover drift ≤ Z; reacquire ≤ W.
Measurement windows & reproducibility (avoid “stable but biased”)
Window rules
- Define sampling window length and denominators (p50/p95/peak).
- Align windows to events (failover, retrain, temperature step).
- Separate steady windows from transition windows.
Minimal reproducibility sequence
- Traffic step: low → high → low (capture distributions each phase).
- Environmental step: T1 → T2 (track wander slope and bias drift).
- Link event: holdover → reacquire (confirm ramping and no overshoot).
Acceptance gate (placeholder): consistent results across repeated runs with the same windows; no discrete “cluster jumps” after resets/retrain.
Minimal monitoring KPIs (only what is needed here)
offset
Use distribution (p95/peak) to detect noise injection and biased “stable” states.
wander
Track slope/trend across ΔT and load changes; diagnose frequency discipline weakness.
lock status
State snapshot (Lock/Tracking/Holdover/Reacquire) for event-aligned diagnosis.
asymmetry estimate
Watch for jumps and slow drift; treat jumps as table/path binding alarms.
holdover state
Identify protection windows and reacquire ramping; avoid thrash on marginal links.
Acceptance gate (placeholder): KPI stream remains consistent across resets; anomalies are event-aligned and explainable via state transitions.
Black-box evidence bundle (event + timestamp + environment)
Required fields
- Event type: link flap, failover, lock change, calibration update.
- Event timestamp + state snapshot timestamp (explicit).
- Environment: temperature, supply, airflow/fan state (as available).
- Window metadata: start/end, denominators, and thresholds in force.
Why it matters
Without event-aligned evidence, a clean-looking offset plot cannot be reproduced or used to isolate path changes,
table invalidation, or measurement-window artifacts.
Acceptance gate (placeholder): every anomaly includes a matching event record and state snapshot; evidence bundle supports replay-style analysis.
Field service mechanisms (loopback · self-test · remote update & rollback)
Loopback / self-test
- Fast split: link path vs timebase vs calibration binding issues.
- Run with known windows and export KPI snapshots and event markers.
Remote update & rollback
- Version binding: calibration tables and servo policies must match firmware versions.
- Rollback must restore prior known-good behavior with recorded gates.
- Change log must capture timing-relevant parameter diffs.
Acceptance gate (placeholder): self-test returns KPIs to thresholds within X; rollback restores reacquire ≤ Y and offset p95 ≤ Z.
