rfc1059.txt

来自「RFC 的详细文档！」· 文本 代码 · 共 1,404 行 · 第 1/5 页

   controlled oscillator.  This similarity is not accidental, since
   systems like this have been studied extensively [3], [4] and [5].

   The particular choice of offset measurement and computation procedure
   described in Section 3 is a variant of the returnable-time system
   used in some digital telephone networks [3].  The clock filter and
   selection algorithms are designed so that the clock synchronization
   subnet self-organizes into a hierarchical master-slave configuration
   [5].  What makes the NTP model unique is the adaptive configuration,
   polling, filtering and selection functions which tailor the dynamics
   of the system to fit the ubiquitous Internet environment.

2.  System Architecture

   The purpose of NTP is to connect a number of primary reference
   sources, synchronized to national standards by wire or radio, to
   widely accessible resources such as backbone gateways.  These
   gateways, acting as primary time servers, use NTP between them to
   cross-check the clocks and mitigate errors due to equipment or
   propagation failures.  Some number of local-net hosts or gateways,
   acting as secondary time servers, run NTP with one or more of the
   primary servers.  In order to reduce the protocol overhead the
   secondary servers distribute time via NTP to the remaining local-net
   hosts.  In the interest of reliability, selected hosts can be
   equipped with less accurate but less expensive radio clocks and used
   for backup in case of failure of the primary and/or secondary servers
   or communication paths between them.

   There is no provision for peer discovery, acquisition, or
   authentication in NTP.  Data integrity is provided by the IP and UDP
   checksums.  No circuit-management, duplicate-detection or
   retransmission facilities are provided or necessary.  The service can
   operate in a symmetric mode, in which servers and clients are
   indistinguishable, yet maintain a small amount of state information,
   or in client/server mode, in which servers need maintain no state
   other than that contained in the client request.  A lightweight
   association-management capability, including dynamic reachability and
   variable polling rate mechanisms, is included only to manage the
   state information and reduce resource requirements.  Since only a
   single NTP message format is used, the protocol is easily implemented
   and can be used in a variety of solicited or unsolicited polling
   mechanisms.

   It should be recognized that clock synchronization requires by its
   nature long periods and multiple comparisons in order to maintain
   accurate timekeeping.  While only a few measurements are usually
   adequate to reliably determine local time to within a second or so,



Mills                                                           [Page 6]

RFC 1059                 Network Time Protocol                 July 1988


   periods of many hours and dozens of measurements are required to
   resolve oscillator drift and maintain local time to the order of a
   millisecond.  Thus, the accuracy achieved is directly dependent on
   the time taken to achieve it.  Fortunately, the frequency of
   measurements can be quite low and almost always non-intrusive to
   normal net operations.

2.1.  Implementation Model

   In what may be the most common client/server model a client sends an
   NTP message to one or more servers and processes the replies as
   received.  The server interchanges addresses and ports, overwrites
   certain fields in the message, recalculates the checksum and returns
   the message immediately.  Information included in the NTP message
   allows the client to determine the server time with respect to local
   time and adjust the logical clock accordingly.  In addition, the
   message includes information to calculate the expected timekeeping
   accuracy and reliability, thus select the best from possibly several
   servers.

   While the client/server model may suffice for use on local nets
   involving a public server and perhaps many workstation clients, the
   full generality of NTP requires distributed participation of a number
   of client/servers or peers arranged in a dynamically reconfigurable,
   hierarchically distributed configuration.  It also requires
   sophisticated algorithms for association management, data
   manipulation and logical clock control.  Figure 2.1 shows a possible
   implementation model including four processes sharing a partitioned
   data base, with a partition dedicated to each peer and interconnected
   by a message-passing system.





















Mills                                                           [Page 7]

RFC 1059                 Network Time Protocol                 July 1988


                                +---------+
                                | Update  |
                     +--------->|         +----------+
                     |          |Algorithm|          |
                     |          +----+----+          |
                     |               |               |
                     |               V               V
                +----+----+     +---------+     +---------+
                |         |     |  Local  |     |         |
                | Receive |     |         +---->| Timeout |
                |         |     |  Clock  |     |         |
                +---------+     +---------+     +-+-----+-+
                  A     A                         |     |
                  |     |                         V     V
                ===========================================
                   Peers          Network          Peers

                     Figure 2.1. Implementation Model

   The timeout process, driven by independent timers for each peer,
   collects information in the data base and sends NTP messages to other
   peers in the net.  Each message contains the local time the message
   is sent, together with previously received information and other
   information necessary to compute the estimated error and manage the
   association.  The message transmission rate is determined by the
   accuracy expected of the local system, as well as its peers.

   The receive process receives NTP messages and perhaps messages in
   other protocols as well, including ICMP, other UDP or TCP time
   protocols, local-net protocols and directly connected radio clocks.
   When an NTP message is received the offset between the sender clock
   and the local clock is computed and incorporated into the data base
   along with other information useful for error estimation and clock
   selection.

   The update algorithm is initiated upon receipt of a message and at
   other times.  It processes the offset data from each peer and selects
   the best peer using algorithms such as those described in Section 4.
   This may involve many observations of a few clocks or a few
   observations of many clocks, depending on the accuracies required.

   The local clock process operates upon the offset data produced by the
   update algorithm and adjusts the phase and frequency of the logical
   clock using mechanisms such as described in Section 5.  This may
   result in either a step change or a gradual slew adjustment of the
   logical clock to reduce the offset to zero.  The logical clock
   provides a stable source of time information to other users of the
   system and for subsequent reference by NTP itself.



Mills                                                           [Page 8]

RFC 1059                 Network Time Protocol                 July 1988


2.2.  Network Configurations

   A primary time server is connected to a primary reference source,
   usually a radio clock synchronized to national standard time.  A
   secondary time server derives time synchronization, possibly via
   other secondary servers, from a primary server.  Under normal
   circumstances it is intended that a subnet of primary and secondary
   servers assumes a hierarchical master-slave configuration with the
   more accurate servers near the top and the less accurate below.

   Following conventions established by the telephone industry, the
   accuracy of each server is defined by a number called its stratum,
   with the stratum of a primary server assigned as one and each level
   downwards in the hierarchy assigned as one greater than the preceding
   level.  With current technology and available receiving equipment,
   single-sample accuracies in the order of a millisecond can be
   achieved at the radio clock interface and in the order of a few
   milliseconds at the packet interface to the net.  Accuracies of this
   order require special care in the design and implementation of the
   operating system, such as described in [15], and the logical clock
   mechanism, such as described in Section 5.

   As the stratum increases from one, the single-sample accuracies
   achievable will degrade depending on the communication paths and
   local clock stabilities.  In order to avoid the tedious calculations
   [4] necessary to estimate errors in each specific configuration, it
   is useful to assume the errors accumulate approximately in proportion
   to the minimum total roundtrip path delay between each server and the
   primary reference source to which it is synchronized.  This is called
   the synchronization distance.

   Again drawing from the experience of the telephone industry, who
   learned such lessons at considerable cost, the synchronization paths
   should be organized to produce the highest accuracies, but must never
   be allowed to form a loop.  The clock filter and selection algorithms
   used in NTP accomplish this by using a variant of the Bellman-Ford
   distributed routing algorithm [29] to compute the minimum-weight
   spanning trees rooted on the primary servers.  This results in each
   server operating at the lowest stratum and, in case of multiple peers
   at the same stratum, at the lowest synchronization distance.

   As a result of the above design, the subnet reconfigures
   automatically in a hierarchical master-slave configuration to produce
   the most accurate time, even when one or more primary or secondary
   servers or the communication paths between them fail.  This includes
   the case where all normal primary servers (e.g.,  backbone WWVB
   clocks) on a possibly partitioned subnet fail, but one or more backup
   primary servers (e.g., local WWV clocks) continue operation.



Mills                                                           [Page 9]

RFC 1059                 Network Time Protocol                 July 1988


   However, should all primary servers throughout the subnet fail, the
   remaining secondary servers will synchronize among themselves for
   some time and then gradually drop off the subnet and coast using
   their last offset and frequency computations.  Since these
   computations are expected to be very precise, especially in
   frequency, even extend outage periods of a day or more should result
   in timekeeping errors of not over a few tens of milliseconds.

   In the case of multiple primary servers, the spanning-tree
   computation will usually select the server at minimum synchronization
   distance.  However, when these servers are at approximately the same
   distance, the computation may result in random selections among them
   as the result of normal dispersive delays.  Ordinarily this does not
   degrade accuracy as long as any discrepancy between the primary
   servers is small compared to the synchronization distance.  If not,
   the filter and selection algorithms will select the best of the
   available servers and cast out outlyers as intended.

2.3.  Time Scales

   Since 1972 the various national time scales have been based on
   International Atomic Time (TA), which is currently maintained using
   multiple cesium-beam clocks to an accuracy of a few parts in 10^12.
   The Bureau International de l'Heure (BIH) uses astronomical
   observations provided by the US Naval Observatory and other
   observatories to determine corrections for small changes in the mean
   rotation period of the Earth.  This results in Universal Coordinated
   Time (UTC), which is presently decreasing from TA at a fraction of a
   second per year.  When the magnitude of the correction approaches 0.7
   second, a leap second is inserted or deleted in the UTC time scale on
   the last day of June or December.  Further information on time scales
   can be found in [26].

   For the most precise coordination and timestamping of events since
   1972 it is necessary to know when leap seconds were inserted or
   deleted in UTC and how the seconds are numbered.  A leap second is
   inserted following second 23:59:59 on the last day of June or
   December and becomes second 23:59:60 of that day.  A leap second
   would be deleted by omitting second 23:59:59 on one of these days,
   although this has never happened.  Leap seconds were inserted on the
   following fourteen occasions prior to January 1988 (courtesy US Naval
   Observatory):









Mills                                                          [Page 10]

RFC 1059                 Network Time Protocol                 July 1988


           1  June 1972                    8  December 1978
           2  December 1972                9  December 1979