Clock Ensemble: Multi-Source Clock Fusion Inside the Timebeat Agent

The problem Clock Ensemble solves

Every grandmaster has one primary time reference — usually GNSS — and every grandmaster has a single mode of failure when that reference degrades. The traditional mitigation is oscillator holdover: when GNSS fails, the local oscillator free-runs on its own inertia for minutes to hours depending on oscillator class, and downstream clients tolerate the gradual drift until GNSS is restored. This is a well-understood pattern and it works within the bounds of the oscillator's specification.

What it does not do is combine information from multiple sources while they are all healthy. If a site has three independent time inputs — say, a GNSS receiver, an upstream PTP feed from a neighbouring site, and a White Rabbit fibre reference — a traditional grandmaster picks one (via BMCA or static priority) and ignores the others. The other two are only activated as fallbacks if the primary fails. Two out of three potentially high-quality time signals are being thrown away at any given moment.

Clock Ensemble runs the other direction. All configured sources are consumed continuously, weighted by their current quality, and combined into a single fused output. The fused output is mathematically more stable than any single source because uncorrelated noise averages out; a single degraded input shifts its weight downward automatically, so the ensemble quietly re-balances without a transition event. Downstream clients see a smooth clock; the site is doing much more work to keep it that way than a traditional topology would.

How BIPM produces UTC — and why the same pattern works at a site

UTC itself — the civilian time reference every regulator cares about — is not produced by a single primary clock. It is produced by the Bureau International des Poids et Mesures (BIPM) as a weighted ensemble average of several hundred atomic clocks distributed across dozens of national metrology labs. No single clock is authoritative; every clock contributes to the average with a weight determined by its measured stability over recent months. UTC as a reference is, by design, the output of an ensemble — not the reading of any one clock.

The mathematical justification for this is that an ensemble of N independent clocks with uncorrelated noise has a combined stability better than any individual clock by approximately √N. Four clocks of equal quality produce a combined stability twice as good as any one of them. This is Allan variance arithmetic, and it is deeply non-intuitive until you see it graphed: the ensemble curve sits consistently below every individual clock curve across all averaging times. The ensemble is not better by a small margin — it is structurally better by a factor that scales with the number of independent sources.

Clock Ensemble applies the same principle at site scale. A site with GNSS plus two upstream PTP feeds plus a local oscillator has four independent time inputs (with caveats around correlation — GNSS receivers on the same roof may share some common-mode noise). The fused output is statistically tighter than the raw GNSS, statistically tighter than the raw PTP, and structurally more resilient because loss of any one input is a weight re-balancing rather than a failover event.

What inputs the Agent accepts

Clock Ensemble consumes the same inputs the Timebeat Agent already uses for primary and secondary clock configuration. Nothing special has to be configured beyond the standard input list — if the Agent has a source defined, Ensemble can use it.

How weighting and outlier rejection work

Every input gets a weight that reflects its recent measured stability. Weights are continuous (not binary on/off), computed per-cycle from the input's running Allan deviation at a configurable tau, and normalised so the weights across all inputs sum to one. A pristine GNSS signal with Allan deviation 10⁻¹² at τ=100s gets a high weight; a noisier PPS input at 10⁻¹⁰ gets a lower weight; the fused output is the weight-sum of the inputs' clock state estimates.

Outlier rejection is a separate mechanism that runs in front of the weighted average. Each cycle, every input's estimate is compared against the current fused output and the input's recent history. An input whose current estimate is more than N standard deviations from its own recent behaviour — a spike — is rejected for that cycle and its weight is driven to zero for the next several cycles while the rejection is evaluated. Transient outliers (GNSS multipath flash, PTP packet with abnormal delay) are filtered before they contaminate the fused output; sustained outliers (a receiver experiencing a jamming event that looks plausible on individual observations) are detected when the input's whole distribution shifts from its historical behaviour, and that input is de-weighted until the distribution returns to baseline.

The outcome is an ensemble output that is tight (low Allan deviation) and robust (short-duration anomalies don't propagate). This is substantially more resilient than the traditional 'primary + secondary + BMCA fallback' model, where the primary's outlier behaviour dominates the output until a manual or automatic failover triggers.

Behaviour during single-source degradation

The operational payoff of Ensemble is how it handles source degradation. Consider a site with three inputs: GNSS (primary), PTP from a neighbouring site (secondary), local oscillator (always active for short-term stability). Normal weights might be 0.7 / 0.2 / 0.1 reflecting GNSS as the dominant reference.

If the GNSS receiver experiences a jamming event, the outlier filter detects observations outside the receiver's recent distribution and starts rejecting them. Over the next few minutes, the GNSS input's weight decays towards zero. The PTP and oscillator weights re-normalise — something like 0.0 / 0.85 / 0.15. The fused output continues to serve clients, disciplined by the PTP upstream with the oscillator providing short-term smoothing. Downstream clients see no step change; they see the fused output, which is still well within tolerance.

When GNSS recovers, the outlier filter starts accepting its observations again and the weight climbs back toward 0.7. The re-entry is gradual — the input's weight ramps over minutes as the stability measurement re-stabilises — so there is no step when GNSS comes back either. The whole event is visible as a bump in the ensemble weighting dashboard in Sync Insight but is essentially invisible to the downstream clients getting disciplined time.

Configuration — the minimum useful deployment

Clock Ensemble is enabled by configuring multiple primary or secondary sources in the Timebeat Agent and letting the Agent fuse them. For a single-site deployment, the minimum useful configuration is three inputs. The specific inputs matter less than the principle — any three of the supported input types, provided they are physically and causally independent.

For a finance venue Shelf deployment, the pattern looks like: each Shelf unit has its own GNSS input plus PTP feeds from the other two Shelf units plus an upstream PTP from a White Rabbit distribution. That's 4–5 inputs per unit, heterogeneous (different physical receivers, different protocols), and the Ensemble output on each unit is both tight and extremely robust against single-source failure.

For an enterprise IT deployment replacing an NTP appliance with a single OTA unit, the pattern is: local GNSS plus an NTP upstream to a public pool plus the local oscillator. Three inputs, one of them a coarser NTP signal, but the principle still holds — loss of GNSS falls back cleanly to the NTP upstream weighted by the oscillator for short-term smoothing.

How Ensemble integrates with PTP² Mesh and Sync Insight

Clock Ensemble is a feature of the Timebeat Agent — it runs inside each Agent and produces the Agent's own fused clock. PTP² Mesh is a separate feature that operates at the topology level: multiple Agents coordinate as a mesh and serve downstream clients through a single virtual grandmaster interface. When Ensemble and Mesh run together, each Agent in the Mesh uses Ensemble to produce its own high-quality fused clock, then Mesh selects which Agent's output is currently serving downstream clients (with smooth failover between Mesh members).

Sync Insight surfaces the Ensemble state as telemetry. For each Agent, Sync Insight shows the active sources, their current weights, the rejection flags for the outlier filter, the fused output stability, and the Allan deviation trending for each input. An operator can see at a glance which sources are contributing what, and whether a weighting shift reflects a known upstream issue or an investigation item.

For audit purposes, the Ensemble weights and rejection events are signed into the UTC Verification attestation chain along with the fused output. A regulator examining the historical record can see not just what the fused clock was doing but how Ensemble was weighting its inputs at every second — useful context for understanding the clock's resilience posture in a post-incident investigation.