receivers, time servers and the internet itself cannot be considered wholly reliable. While reliable
clock synchronization has been studied using agreement algorithms [LAM85], [SRI87], in practice
it is not possible to distinguish the truechimer clocks, which maintain timekeeping accuracy to a
previously published (and trusted) standard, from the falseticker clocks, which do not, on other than
a statistical basis. In addition, the algorithms and protocols discussed in the literature do not
necessarily produce the most accurate time on a statistical basis and may produce unacceptable
network overheads and instabilities in a large, diverse internet system.
The above approach was used in the design of the NTP synchronization mechanisms, which were
evolved as the result of numerous experiments, analyses and stepwise refinements over an eight-year
period. It became evident that accurate and reliable internet time synchronization can be achieved
only through a integrated approach to system design including the primary reference sources, time
servers, synchronization subnet, protocols and synchronization mechanisms which are at the heart
of this paper. From the analytical point of view the distributed system of NTP time servers operates
as a set of mutually coupled, phase-locked oscillators with phase comparisons exchanged by means
of update messages and a local clock at each time server functioning as a disciplined oscillator. The
principal features of this design, described in more detail later in this paper, can be summarized as
follows:
1. The synchronization subnet consists of a self-organizing, hierarchical network of time servers
configured on the basis of estimated accuracy and reliability.
2. The synchronization protocol operates in connectionless mode in order to minimize latencies,
simplify implementations and provide ubiquitous interworking.
3. The synchronization mechanism uses a returnable-time design which tolerates packet loss,
duplication and misordering, together with filtering algorithms based on maximum-likelihood
principles.
4. The local clock design is based on a first-order, adaptive-parameter phase-lock loop with
corrections computed using timestamps exchanged along the arcs of the synchronization subnet.
5. Multiply redundant time servers and multiply diverse transmission paths are used in the
synchronization subnet, as well as engineered algorithms which select the most reliable
synchronization source and path using a weighted voting procedure.
6. System overhead is reduced through the use of dynamic control of polling rates and association
management
2. Time Standards and Distribution
Since 1972 the time and frequency standards of the world have been based on International Atomic
Time (TAI), which is currently maintained using multiple cesium-beam clocks to an accuracy of a
few parts in 10
12
[BLA74]. The Bureau International de l’Heure (BIH) uses astronomical observa-
tions provided by the U.S. Naval Observatory and other observatories to determine corrections for
small changes in the mean solar rotation period of the Earth, which results in Coordinated Universal
Time (UTC). UTC is presently decreasing relative to TAI at a fraction of a second per year, so
RFC 1129 Network Time Synchronization October 1989
Mills Page 4