martino/MARTe-Integrated-Components
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(udpscope): bound the reconstructed timeline against the wall clock

Browse Source 
Round 3 of the Task 4 review. Three defects, all in FrameDecoder rule 3.

The resync backstop was one-directional. `predicted` is never below
lastEmittedEnd + dt, so rejecting a correction that would step backwards
meant only a LAGGING chain could ever be pulled back; a chain running fast
drifted ahead without bound. Two hosts' crystals differ by tens of ppm, so a
declared SamplingRate is always slightly wrong in one direction or the other
and this is certain on a long session. A leading timeline cannot be corrected
in one burst without going backwards -- lastEmittedEnd is by definition past
arrival -- so the excess is bled off by drawing each burst 10 % narrower until
the timeline is back inside the threshold.

A repeated packet counter was treated as a normal packet. The C client
de-duplicates fragments only, so an unfragmented update reaching a host that
joined the group on two interfaces was emitted twice, doubling the values and
advancing the timeline by a burst that never existed.

The samplingRate == 0 path differenced two HrtRateFit::toSeconds() results.
toSeconds() divides an absolute tick count -- ~1e11 on a producer that has
been up a day -- by a rate refitted on every packet, so its few-parts-in-1e4
wobble arrives multiplied by the whole elapsed epoch: tens of milliseconds of
jitter on a value whose consecutive difference is a few milliseconds. Raw
ticks are differenced instead, anchored on the first usable packet so the
wobble applies only to the interval since attach.

The existing hrt-gap test could not have caught the last one: its 10 ms
producer period made the expected answer exactly kDefaultDt, so a decoder
that derived nothing passed. It now uses 25 ms.

Four tests added, all sabotage-proven. The plan is updated to match.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Martino Ferrari
2026-08-27 21:55:33 +02:00
co-authored by Claude Opus 4.6
parent 7102412a9f
commit 3270284cfe
5 changed files with 478 additions and 66 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Client/udpscope/FrameDecoder.cpp
+97 -19
View File
@@ -22,6 +22,23 @@ static constexpr double kDefaultDt = 1.0e-3;
*/
static constexpr double kBurstResyncThresholdS = 0.5;
/**
* Largest counter gap still read as a loss count.
*
* A producer restart returns the counter to zero and a reordered datagram makes
* the unsigned gap wrap to near 2^32; multiplying either by a sample count and
* calling it elapsed time would fabricate centuries. A million lost updates is
* already far beyond any outage worth reconstructing.
*/
static constexpr uint32_t kMaxCounterGap = 1000000u;
/**
* Burst width, as a fraction of nominal, while a leading timeline is being
* pulled back. See the sole use site for why a leading chain cannot be
* corrected in one burst and must be bled off instead.
*/
static constexpr double kLeadBleedFactor = 0.9;
void FrameDecoder::setSignals(const std::vector<SignalMeta>& signals) {
signals_ = signals;
state_.assign(signals_.size(), SigState{});
@@ -73,6 +90,16 @@ bool FrameDecoder::timestamps(const FrameView& f, uint32_t idx,
const double wallNow = f.recvTime;
SigState& st = state_[idx];
/* A repeated counter is a duplicated datagram — the same update arriving
* twice because the host joined the multicast group on two interfaces, say.
* The C client only de-duplicates fragments, so an unfragmented update
* reaches us intact both times; emitting it again would double the values
* and advance the timeline by a burst that never existed. Counter zero is
* excluded because a producer that never sets one leaves it there. */
if (st.lastEmittedValid && f.counter != 0u && f.counter == st.lastCounter) {
return false;
}
/* hasTimeSignal() bounds the index against the FRAME's signal count, but
* the time signal's type code is read from our own table, whose size is
* independent — a frame carrying more signals than the installed table
@@ -147,11 +174,14 @@ bool FrameDecoder::timestamps(const FrameView& f, uint32_t idx,
* we saw. Reinstating that duration keeps the chain honest without
* consulting arrival time at all. */
double base = arrivalAnchor;
double step = dt;
if (st.lastEmittedValid) {
/* Unsigned subtraction wraps, so this stays right across the
* counter's own 2^32 rollover. */
* counter's own 2^32 rollover. A gap far larger than any real
* outage is a restart or a reordered datagram rather than a
* loss count; claim nothing and let the backstop below decide. */
const uint32_t gap = f.counter - st.lastCounter;
const double lost = (gap > 1u)
const double lost = (gap > 1u && gap <= kMaxCounterGap)
? static_cast<double>(gap - 1u) *
static_cast<double>(st.prevAccCount)
: 0.0;
@@ -164,17 +194,46 @@ bool FrameDecoder::timestamps(const FrameView& f, uint32_t idx,
if (std::fabs(predicted - arrivalAnchor) <= kBurstResyncThresholdS) {
base = predicted;
}
/* Re-anchoring must never move time backwards: the ring, the
* trigger and the exporter all assume a signal's timestamps
* increase. A backward resync would be indistinguishable from
* corruption downstream, so give up the correction instead. */
if (base <= st.lastEmittedEnd) {
base = st.lastEmittedEnd + dt;
/* Re-anchoring here would step backwards, and the ring, the
* trigger and the exporter all require a signal's stamps to
* increase. Rejecting the correction outright is not an
* option either: `predicted` is never less than
* lastEmittedEnd + dt, so rejection would make the backstop
* one-directional and let a timeline that runs FAST — two
* hosts' crystals differ by tens of ppm, so this is certain
* on a long session, not hypothetical — drift ahead of the
* wall clock without bound.
*
* So compress instead of stepping back: start immediately
* after the previous burst and spread this one out to
* arrival. A single packet is drawn narrower than its true
* width, and in exchange the timeline is back in step. */
if (wallNow > st.lastEmittedEnd) {
step = (wallNow - st.lastEmittedEnd) /
static_cast<double>(nElems);
base = st.lastEmittedEnd + step;
} else {
/* The timeline has run PAST arrival: our last burst is
* dated later than the moment this packet landed. There
* is no room to spread into, and no single burst can
* remove the excess without stepping back. So bleed it
* off — draw each burst a fixed fraction narrower than
* nominal until the timeline is back inside the
* threshold, then normal chaining resumes. The factor
* only has to shrink a burst faster than the clock
* mismatch grows it, and a 10 % squeeze outruns the
* tens-of-ppm crystal error that causes this by orders
* of magnitude. */
step = dt * kLeadBleedFactor;
base = st.lastEmittedEnd + step;
}
}
}
tsOut.resize(nElems);
for (uint32_t e = 0; e < nElems; e++) {
tsOut[e] = base + static_cast<double>(e) * dt;
tsOut[e] = base + static_cast<double>(e) * step;
}
st.lastEmittedEnd = tsOut[nElems - 1u];
st.lastCounter = f.counter;
@@ -184,29 +243,48 @@ bool FrameDecoder::timestamps(const FrameView& f, uint32_t idx,
}
/* No declared rate: need hrt-derived dt. */
if (!hrtFit_.ready()) {
if (!hrtFit_.ready() || f.hrt == 0u) {
return packetBurst(idx, nElems, wallNow, tsOut);
}
const double hrtSec = hrtFit_.toSeconds(f.hrt);
const double base = st.offset.map(hrtSec, wallNow);
const double rate = hrtFit_.ticksPerSecond();
double hrtDt;
if (st.lastAccValid && st.prevAccCount > 0u && hrtSec > st.lastAccHrtSec) {
/* Difference raw TICKS, never two toSeconds() results.
*
* hrt counts from the producer's boot, so it is already ~1e11 ticks when
* the scope attaches, while the fit is re-estimated on every packet and
* wobbles by a few parts in 1e4. toSeconds() multiplies that relative
* wobble by the whole elapsed epoch: tens of milliseconds of jitter on a
* value whose consecutive difference is a few milliseconds. Subtracting
* two such results measures the wobble, not the interval.
*
* Anchoring on the first usable packet keeps the wobble on the elapsed
* interval since attach, which is short, and ClockOffset absorbs the
* arbitrary epoch that anchoring leaves behind exactly as it would
* absorb the producer's boot epoch. */
if (!st.hrtRefValid) {
st.hrtRef = f.hrt;
st.hrtRefValid = true;
}
const double sinceRef = (f.hrt >= st.hrtRef)
? static_cast<double>(f.hrt - st.hrtRef) / rate
: -static_cast<double>(st.hrtRef - f.hrt) / rate;
const double base = st.offset.map(sinceRef, wallNow);
double hrtDt = kDefaultDt;
if (st.lastAccValid && st.prevAccCount > 0u && f.hrt > st.lastAccHrt) {
/* The flushes carry contiguous RT cycles, so the gap divided by the
* previous packet's sample count is exactly one cycle period. */
hrtDt = (hrtSec - st.lastAccHrtSec) /
hrtDt = (static_cast<double>(f.hrt - st.lastAccHrt) / rate) /
static_cast<double>(st.prevAccCount);
} else {
hrtDt = kDefaultDt;
}
tsOut.resize(nElems);
for (uint32_t e = 0; e < nElems; e++) {
tsOut[e] = base + static_cast<double>(e) * hrtDt;
}
st.lastAccHrtSec = hrtSec;
st.lastAccValid = true;
st.prevAccCount = nElems;
st.lastAccHrt = f.hrt;
st.lastAccValid = true;
st.prevAccCount = nElems;
return true;
}