During the lifetime of an association, which can be the lifetime of the computer and operating system on which it runs, there may come an hour, a day, or a week when one or another server becomes unreachable or shows only stale time values. What is a client to do when it has no time to chime? This happens often enough that a carefully engineered policy has been evolved. The following principles apply:
• A client starts out unsynchronized (leap indicator 3). When the client has synchronized for the first time, it can provide valid time (leap indicator 0) to its applications. It can continue to provide valid time forever, although it might not be very accurate.
• A statistic called the peer dispersion is initialized as each valid clock update is received from a server. The peer dispersion is a component of the root distance, which also depends on the root delay and residual jitter components. Both the root dispersion and root delay are included in the NTP packet header.
• Once initialized, the peer dispersion and thus the root distance increase at a fixed rate commensurate with the frequency tolerance of the disciplined oscillator, by default 15 PPM.
• NTP clients have a configurable parameter called the distance threshold, by default 1.5 s. If the root distance exceeds this threshold, it is no longer a selectable candidate for synchronization.
So, what happens when a server loses all synchronization sources? Assuming the server is reachable, a client sees increasing root distance until tripping over the threshold. After initialized by the latest update, the distance will increase by 15 PPM and trip in a little over 1 day. Since the round-trip delay to the Moon is much longer than on Earth, about 2 s, the threshold for clients on the Moon should be about 3.5 s.
Now, assume that the server has been working normally but then stops responding to polls. If the server does not respond after four polls, the peer dispersion is increased by a substantial amount at each subsequent poll. Eventually, the root distance exceeds the distance threshold and the server becomes unselectable for synchronization. If it does not reply within eight poll intervals, the poll interval is doubled at each subsequent poll until reaching the maximum poll interval, by default 1,024 s. This is done in the interest of reducing unneeded network traffic. Once the server is heard again, the poll interval resumes its normal value.
