slot-timing (scenario kind)

Scenario kind of the engine v0.38.0, family Clocks, timing and holdover. Advisory: analysis output from a research and engineering tool, not type-approved navigation equipment and not a safety-of-life service. Every label here is the engine's or the verification matrix's; a kind is MODELLED unless the matrix says otherwise (how a label is earned: the README's Evidence section).

What it does#

Slot timing: seconds until a free-running clock leaves the guard of a time-indexed routing or tasking slot (the largest absolute time error the slot tolerates), the contribution of every term at that moment with the dominant one named (fix uncertainty, white phase noise, white, flicker, random-walk and random-run frequency noise, residual frequency offset, temperature, ageing), the time left since the last fix, and the largest fix interval that keeps the clock inside, net of the fix latency. The oscillator is a CLASS default (csac, uso, dsac, tcxo, ocxo or rafs: one cited one-second Allan deviation and an assumed red-noise floor), a telecom-timing DATASHEET PRESET or an inline DATASHEET (Allan-deviation maxima fitted as an envelope, plus ageing and a temperature coefficient), or an inline MEASURED PHASE RECORD (its overlapping Allan deviation fitted by weighted least squares in the white-phase and IEEE Std 1139 frequency-modulation basis, so the red-noise floor is measured rather than assumed). A breach beyond the longest averaging time the datasheet or record supports is flagged as extrapolated. An optional spoofing section adds the timing protection level for a receiver in orbit: orbital speed and period, how long a single ground spoofer can reach the satellite per pass, the clock-aided monitor floor and CUSUM detection latency, the conditional bound, the pull a spoofer at a stated maximum ramp rate accumulates before the satellite leaves its reach or an independent check runs, and whether each ground-contact or crosslink check is independent of that spoofer. VALIDATED: the holdover inversion from a fitted record, held out on a real caesium clock measured against a hydrogen maser (tests/slot_timing_cs5071a_holdout.rs, data-gated); on a measured crystal oscillator the held-out prediction is conservative but not within the bar, so the crystal case is MODELLED. MODELLED: class and datasheet sources, the deterministic terms and the spoofing assessment.

One run of scenarios/slot-timing-ocxo-leo.toml summarises as: slot-timing (datasheet source): guard 100.0 ns at k=3 breaks 650.8 s after a fix (50.8 s left); fix at least every 645.8 s (133.80 per day); dominant term: random-walk frequency noise

Inputs#

From the schema (kshana kinds --json):

• Required fields: oscillator, slot
• Optional fields: spoofing

The example scenarios/slot-timing-ocxo-leo.toml sets, among others:

Run it#

kshana scenarios/slot-timing-ocxo-leo.toml

What it gives#

The scalar results of that run, with the units the engine states:

Result label (the engine's): MODELLED — time until a free-running clock leaves a routing slot's guard, and the fix cadence that keeps it inside, from a stationary power-law clock model. A datasheet source is an envelope of its maxima, not a measurement of any unit; a class source rests on an assumed red-noise floor.

Evidence#

MODELLED 2 · VALIDATED 1: the verification matrix rows that name this kind.

• VALIDATED The slot-timing kind's measured-record path: the overlapping Allan deviation of a phase record fitted by edf-weighted non-negative least squares in the white-phase and IEEE Std 1139 frequency-modulation basis (slot_timing::fit_weighted), Tests: slot_timing_cs5071a_holdout.rs.
• MODELLED The slot-timing kind: the predicted error E(t) = k·√(σ₀² + σ_x²(t)) + (|y₀| + |c_T·ΔT|)·t + ½|D|t² inverted for the breach, the time left, the resynchronisation interval net of the fix latency and fixes per day, each term itemised with th Tests: slot_timing_igs_holdout.rs.
• MODELLED orbital_timing::orbital_timing, reachable as the slot-timing kind's spoofing section: circular-orbit speed and period, the longest time a ground spoofer can reach the satellite per pass, the clock-aided monitor floor and CUSUM detection l

The rows the run itself exercised, with the oracle the matrix gives each (the public sources are named there):

• MODELLED Deterministic, scenario-hashed, SBOM + cross-platform golden gates. Oracle (ExternalDataset): SBOM conformance to the official CycloneDX 1.5 JSON Schema (+ valid SPDX identifiers) — an external published standard, zero validation errors over the full dependency graph; the FoM-determinism / byte-reproducibility part remains a pinned self-consistency check, so the row stays MODELLED
• MODELLED The slot-timing kind: the predicted error E(t) = k·√(σ₀² + σ_x²(t)) + (|y₀| + |c_T·ΔT|)·t + ½|D|t² inverted for the breach, the time left, the resynchronisati. Oracle (InternalConsistency): Closed forms for each term alone and the independent holdover::holdover_seconds root-find; the datasheet figures are the named documents (docs/SLOT-TIMING.md). A class default rests on an assumed red-noise floor and a datasheet source is an envelope of maxima, so neither is a measurement of any unit
• MODELLED orbital_timing::orbital_timing, reachable as the slot-timing kind's spoofing section: circular-orbit speed and period, the longest time a ground spoofer can r. Oracle (InternalConsistency): Reduction to the existing timing protection level and the circular-orbit and spherical-Earth visibility closed forms. Conditional on detection, one terrestrial spoofer at a stated ramp rate, an overhead pass on a non-rotating Earth; not validated on a spoofed receiver in orbit

Limitations#

What the run's own report says is not modelled or not validated:

• frequency jumps, radiation effects and relativistic frequency offsets (result not_modelled[0])
• a thermal model: the temperature excursion is applied as a step at the fix (result not_modelled[1])
• the synchronisation protocol itself: a fix resets the error to fix_sigma_ns (result not_modelled[2])
• which wander metric a routing slot should be accepted against; see docs/SLOT-TIMING.md (result not_modelled[3])
• MODELLED — time until a free-running clock leaves a routing slot's guard, and the fix cadence that keeps it inside, from a stationary power-law clock model. A datasheet source is an envelope of its maxima, not a measurement of any unit; a class source rests on an assumed red-noise floor. (result label)
• The oscillator is a CLASS default (csac, uso, dsac, tcxo, ocxo or rafs: one cited one-second Allan deviation and an assumed red-noise floor), a telecom-timing DATASHEET PRESET or an inline DATASHEET (Allan-deviation maxima fitted as an envelope, plus ageing and a temperature coefficient), or an inline MEASURED PHASE RECORD (its overlapping Allan deviation fitted by weighted least squares in the white-phase and IEEE S (kind catalogue (kshana kinds --json))
• VALIDATED: the holdover inversion from a fitted record, held out on a real caesium clock measured against a hydrogen maser (tests/slot_timing_cs5071a_holdout.rs, data-gated); on a measured crystal oscillator the held-out prediction is conservative but not within the bar, so the crystal case is MODELLED. (kind catalogue (kshana kinds --json))
• MODELLED: class and datasheet sources, the deterministic terms and the spoofing assessment. (kind catalogue (kshana kinds --json))

See also#

• Family page: Clocks, timing and holdover
• All kinds: KINDS.md
• Topic page: LEO-PNT.md
• Topic page: DECEIVED-TIME.md