M1: standards-aligned PTP source defaults and fail-closed SV epoch startup

.github/workflows/esp32p4-ptp-lab.yml

@@ -122,7 +122,7 @@ jobs:
           set_config CONFIG_AR_PTP_VLAN_ID 100
           set_config CONFIG_AR_PTP_VLAN_PRIORITY 4
           set_config CONFIG_AR_PTP_ANNOUNCE_INTERVAL_MS 1000
-          set_config CONFIG_AR_PTP_SYNC_INTERVAL_MS 250
+          set_config CONFIG_AR_PTP_SYNC_INTERVAL_MS 1000
           set_config CONFIG_AR_PTP_RESPOND_PDELAY y
           set_config CONFIG_AR_PTP_PDELAY_REQUEST_INTERVAL_MS 1000
           set_config CONFIG_AR_PTP_PRIORITY1 120

.github/workflows/esp32p4-smv-injector.yml

@@ -73,7 +73,7 @@ jobs:
           grep -qx 'CONFIG_AR_PTP_DOMAIN=0' sdkconfig
           grep -qx 'CONFIG_AR_PTP_TRANSPORT_SPECIFIC=0' sdkconfig
           grep -qx 'CONFIG_AR_PTP_RESPOND_PDELAY=y' sdkconfig
-          grep -qx 'CONFIG_AR_PTP_SYNC_INTERVAL_MS=250' sdkconfig
+          grep -qx 'CONFIG_AR_PTP_SYNC_INTERVAL_MS=1000' sdkconfig
           grep -qx 'CONFIG_AR_PTP_ANNOUNCE_INTERVAL_MS=1000' sdkconfig
           echo 'Production timing profile: PASS · serialized shared EMAC TX · PTP-P2 LAB_SOURCE · HW timestamp adapter compiled'
 

.github/workflows/ptp-core-ci.yml

@@ -12,10 +12,12 @@ on:
       - 'tools/ptp_analyze.cpp'
       - 'tests/test_ptp.cpp'
       - 'tests/test_ptp_runtime.cpp'
+      - 'tests/test_ptp_power_profile.cpp'
       - 'tests/test_smp_synch_policy.cpp'
       - 'tests/test_smp_synch_wire_offset.cpp'
       - 'tests/test_ptp_discipline.cpp'
       - 'tests/test_ptp_p2_hardening.cpp'
+      - 'tests/test_sv_ptp_epoch.cpp'
       - 'tests/ptp_profile/**'
       - '.github/workflows/ptp-core-ci.yml'
   pull_request:
@@ -29,10 +31,12 @@ on:
       - 'tools/ptp_analyze.cpp'
       - 'tests/test_ptp.cpp'
       - 'tests/test_ptp_runtime.cpp'
+      - 'tests/test_ptp_power_profile.cpp'
       - 'tests/test_smp_synch_policy.cpp'
       - 'tests/test_smp_synch_wire_offset.cpp'
       - 'tests/test_ptp_discipline.cpp'
       - 'tests/test_ptp_p2_hardening.cpp'
+      - 'tests/test_sv_ptp_epoch.cpp'
       - 'tests/ptp_profile/**'
       - '.github/workflows/ptp-core-ci.yml'
 
@@ -107,9 +111,11 @@ jobs:
           Build-Target 'ptp_profile_core'
           Build-Target 'ptp_profile_tests'
           Build-Target 'ptp_runtime_tests'
+          Build-Target 'ptp_power_profile_tests'
           Build-Target 'smp_synch_policy_tests'
           Build-Target 'smp_synch_wire_offset_tests'
           Build-Target 'ptp_discipline_tests'
+          Build-Target 'sv_ptp_epoch_tests'
           Build-Target 'ptp_p2_hardening_tests'
           Build-Target 'ptp_profile_analyze'
 

apps/arstack_studio/qml/PtpExpertPanel.qml

@@ -197,7 +197,7 @@ SurfacePanel {
                             text: modeCombo.currentIndex === 0
                                 ? "PTP TX does not by itself change SV smpSynch."
                                 : modeCombo.currentIndex === 1
-                                    ? "AUTO smpSynch follows measured receiver evidence only."
+                                    ? "AUTO requires qualified PTP clock and independently verified SV sample phase."
                                     : "Useful for observing timing traffic without changing the network."
                             wrapMode: Text.WordWrap
                             color: panel.theme.muted
@@ -334,7 +334,7 @@ SurfacePanel {
                     Label { text: "Announce interval (ms)"; color: panel.theme.muted; font.family: panel.uiFont; font.pixelSize: 9 }
                     NumericField { id: announceField; theme: panel.theme; monoFont: panel.uiFont; text: "1000"; validator: IntValidator { bottom: 100; top: 10000 } }
                     Label { text: "Sync interval (ms)"; color: panel.theme.muted; font.family: panel.uiFont; font.pixelSize: 9 }
-                    NumericField { id: syncField; theme: panel.theme; monoFont: panel.uiFont; text: "250"; validator: IntValidator { bottom: 20; top: 5000 } }
+                    NumericField { id: syncField; theme: panel.theme; monoFont: panel.uiFont; text: "1000"; validator: IntValidator { bottom: 20; top: 5000 } }
                     CheckBox { id: vlanCheck; text: "VLAN"; font.family: panel.uiFont; font.pixelSize: 9 }
                     NumericField { id: vlanField; enabled: vlanCheck.checked; theme: panel.theme; monoFont: panel.uiFont; text: "100"; validator: IntValidator { bottom: 1; top: 4094 } }
                     Label { text: "VLAN PCP"; color: panel.theme.muted; font.family: panel.uiFont; font.pixelSize: 9 }
@@ -355,7 +355,7 @@ SurfacePanel {
                     Layout.fillWidth: true
                     ComboBox {
                         Layout.fillWidth: true
-                        model: ["AUTO — measured PTP only", "0 — Not synchronized", "1 — Local synchronized (simulation)", "2 — Global synchronized (simulation)"]
+                        model: ["AUTO — qualified PTP + SV timing", "0 — Not synchronized", "1 — Local synchronized (simulation)", "2 — Global synchronized (simulation)"]
                         currentIndex: panel.syncIndex(panel.device.smpSynchMode)
                         enabled: panel.session && panel.device.deviceVerified && !panel.session.updatingFirmware
                         font.family: panel.uiFont
@@ -372,7 +372,7 @@ SurfacePanel {
                 }
                 Label {
                     Layout.fillWidth: true
-                    text: "PTP Source transmission is not proof that the SV clock is externally synchronized. AUTO stays fail-closed unless receiver discipline is measured."
+                    text: "PTP traffic or clock lock alone does not prove SV sample synchronization. AUTO remains fail-closed until the SV timeline is independently qualified."
                     wrapMode: Text.WordWrap
                     color: panel.theme.textSoft
                     font.family: panel.uiFont

docs/IEC61850_PTP_SV_SOFTWARE_COMPATIBILITY_MATRIX.md

@@ -0,0 +1,56 @@
+# IEC 61850 PTP + SV interoperability — software-only evidence matrix
+
+Status: **in progress, not a conformance certificate.** This matrix is designed for teams without a reference IED or timing analyzer. A passing host/ESP-IDF build demonstrates software consistency, not physical accuracy or relay synchronization.
+
+## Sources and version boundaries
+
+- [IEC/IEEE 61850-9-3:2016](https://webstore.iec.ch/en/publication/24998): IEEE 1588-2008 L2 PTP / peer-to-peer delay profile.
+- [IEC 61850-9-2:2011 + AMD1:2020](https://webstore.iec.ch/en/publication/66549): Sampled Values Ethernet mapping.
+- [IEC 61869-9:2016](https://webstore.iec.ch/en/publication/24663): digital interfaces for instrument transformers and application-specific synchronization/sample behavior.
+- Later drafts or secondary summaries cannot silently override the approved 2016/2020 baselines. Verify profile-specific interpretations against controlled standards copies before making claims.
+
+## Evidence taxonomy
+
+- `STATIC`: inspected source and build configuration.
+- `SOFTWARE TEST`: decoded-wire regression driven by the actual portable encoder.
+- `EMBEDDED CI`: compilation for pinned ESP-IDF/ESP32-P4 SDK.
+- `PHYSICAL`: needs hardware/reference clock/IED; **not available in this phase**.
+- `GAP`: known missing/incomplete implementation or evidence; do not market as IEC conformance.
+
+| Feature / condition | Required contract or expectation | Evidence / state |
+| --- | --- | --- |
+| PTP transport | Ethernet L2 EtherType 0x88F7, multicast, v2 | SOFTWARE TEST: portable PTP frame roundtrip and Ethernet destination |
+| PTP delay mechanism | Peer-to-peer delay; reply carries valid RX and TX hardware timestamps | STATIC: Pdelay response path; SOFTWARE TEST frame fields; PHYSICAL pending |
+| Announce and Sync | 1 Hz nominal defaults (logMessageInterval=0) | STATIC + SOFTWARE TEST: both 1000 ms |
+| Pdelay_Req rate | Receiver requests 1 Hz; SOURCE answers correctly | STATIC for receiver and source; PHY timestamp proof pending |
+| PTP domain | Default 0, must match subscriber; 93 is a documented alternative to avoid collisions | STATIC + SOFTWARE TEST, never force one domain universally |
+| PTP transportSpecific/VLAN | Must agree with IED and network/engineering plan | Configuration preserved in codecs; no universal nibble or VLAN assumption |
+| Clock identity | Stable and nonzero source identity; Follow_Up sequence matches Sync | SOFTWARE TEST |
+| Clock class / traceability | No unproven grandmaster quality: lab oscillator is class 248, clockAccuracy unknown | STATIC, checked against encoded Announce |
+| PTP timescale and UTC properties | Timestamp in PTP/TAI seconds when epoch is available; truthful flagField and offset provenance | **PARTIAL SOFTWARE TEST**: bounded UTC-to-TAI conversion; EMAC seed from plausible local RTC; PTP-timescale flag; opt-in UTC-offset-valid flag. Traceability remains false. Unset RTC leads to no PTP-timescale claim. UTC accuracy, leap-offset currency and hardware evidence are **GAP**; no 9-3 conformance claim |
+| Full PTP ordinary-clock/BMCA behavior | Select/announce/step/holdover/recover according to applicable clock type | **GAP** for a standards-complete Grandmaster; current LAB_SOURCE is a limited laboratory source |
+| SV canonical Ethernet stream | 0x88BA, engineered destination, APPID, svID, confRev, VLAN, dataset ordering | Portable codec/profile tests exist; independent canonical-wire acceptance pending |
+| 4000/4800 sampling | Correct rational cadence and modulus for the **explicitly chosen** 80-samples/cycle family | SOFTWARE TEST: 120 s mathematical schedule, zero accumulated tick drift |
+| Higher IEC 61869-9 profiles | Correct samples/sec vs ASDUs/frame distinction, engineered nofASDU & payload type | **GAP** for embedded runtime generality. 4000 fps/1 ASDU is not a universal IEC 61869-9 profile |
+| Counter epoch | `smpCnt=0` at valid profile-specific synchronization event; consistent on loss/restart | M1 only coarse first-arm to EMAC second; **GAP** continuous timebase tracking |
+| `smpSynch` declaration | May not claim local/global qualified synchronization solely from PTP packet/clock lock | SOFTWARE TEST: AUTO fail-closed until sample phase is qualified |
+| SV hardware TX timing | Measured sample deadline vs actual MAC departure, including P95/P99 and drift | **GAP** without device timestamped SV evidence |
+| Actual IED acceptance/no alarm | Vendor IED locks PTP and accepts canonical SV continuously | PHYSICAL pending; cannot be inferred from builds or synthetic PCAP alone |
+
+## Software-only acceptance for the current PR
+
+1. Linux GCC and Clang; Windows MSVC: portable PTP, PTP power-profile wire test, epoch/schedule and sync-gate regressions.
+2. ESP32-P4 build matrices: normal SV + PTP enabled, SOURCE/RECEIVER/monitor variants, validated firmware contract.
+3. Native Qt ARStack Studio Windows build and installer packaging.
+4. Static checks: default Source Sync/Announce/Pdelay are 1 s, source class remains 248, AUTO `smpSynch` is fail-closed.
+5. No merged `main` or public title such as "fully 9-3 compliant" until remaining GAPs are fixed and physical evidence exists.
+
+## Next coding tranche, ordered by standards risk
+
+1. **PTP time-properties further hardening:** verify UTC-offset provenance against authoritative leap records, RTC synchronization, leap-second transitions and time steps; surface compact diagnostics in Studio. Pure software cannot attest absolute clock accuracy.
+2. **Reusable PTP/SV timeline authority:** continuously compare and correct GPTimer phase against EMAC hardware time at a bounded rate; handle drift, clock steps, PTP restart, source switches, and holdover without pretending alignment.
+3. **Profile-targeted SV compiler:** exact profile-specific sample counter reset, ASDU grouping, nofASDU, dataset layout and scaling from SCL + documented source profile. Do not hard-code 4000/4800 for arbitrary SCL.
+4. **Passive interoperability fixtures:** anonymous golden frames/PCAP and independent decoder checks for 9-2LE-compatible streams and a separately supported IEC 61869-9 variant. Report mismatches rather than automatic coercion.
+5. Hardware acceptance only when equipment becomes available.
+
+**Source-of-truth policy:** a standards-oriented claim is never promoted from STATIC/CI to PHYSICAL. The laboratory fallback `smpSynch=0` is deliberate and must not be overridden to silence an IED alarm.

docs/PTP_SV_EPOCH_M1_ACCEPTANCE.md

@@ -0,0 +1,51 @@
+# ESP32-P4 SV/PTP synchronization — M1 engineering evidence
+
+**Status: software integration candidate. NOT relay-accepted.** Base: `main@9e70a4937874`.
+
+## Scope / why alarms can still occur
+
+IEC 61850-9-2 Amendment 1:2020 specifies the meaning of SV synchronization declarations, but the counter reset event and acceptable sample-time error depend on the applicable application/product profile (e.g. IEC 61869-9). IEC/IEEE 61850-9-3:2016 is an L2/P2P PTP profile with 1-second Announce / Sync / Pdelay intervals and 3 Announce timeout intervals. A free-running local oscillator is **not** GNSS/UTC traceable; do not promote a lab source to `clockClass=6` or global `smpSynch=2`.
+
+Authoritative references:
+- https://webstore.iec.ch/en/publication/24998
+- https://standards.ieee.org/ieee/61850-9-3/6167/
+- https://www.omicron-lab.com/fileadmin/assets/Precision-Timing/Knowledge_Applications/Article_IEC_61850-9-3/IEC_61850-9-3_-_Will_simplicity_supersede_complexity_.pdf
+- https://docs.espressif.com/projects/esp-idf/en/v5.5/esp32p4/api-reference/peripherals/gptimer.html
+
+## M1 implemented
+
+1. Production PTP source defaults to 1 Hz Sync, 1 Hz Announce, and enables Pdelay response. Receiver Sync timeout increased to 3s because a 1s timeout with 1 Hz packets can falsely enter HOLDOVER due to modest scheduling jitter.
+2. Requested hardware Pdelay support must be active before PTP source reports ready; otherwise START fails closed. PTP TX failure clears readiness.
+3. When a verified LAB_SOURCE is already running **before** SV START, the initial `smpCnt=0` timer alarm is approximately aligned to the next whole second of the ESP32-P4 EMAC PTP clock by a bounded cross-clock observation and safe first-delay planning. **This is coarse initial alignment, not a disciplined/slewed long-term sample timebase**; GPTimer remains an independent oscillator.
+4. `smpSynch=AUTO` cannot promote a PTP clock lock into an SV synchronization claim without separately qualified SV timeline phase. This M1 does not yet produce that qualification. Forced 1/2 values are explicit laboratory injections and never evidence of measured synchronization.
+5. New headless tests cover the epoch arm maths, invalid clock reads, and fail-closed sync claim gating.
+
+## M2 required before claiming no synchronization alarm
+
+- Develop a bounded PTP↔GPTimer continuous clock bridge, with phase/frequency correction to keep sample time aligned for long runs, including restart and phase-step behavior.
+- Require the intended SV profile's exact `smpCnt` epoch policy, `smpSynch` meaning, payload order/quality/scaling, and PTP profile parameters from SCL plus applicable product standard.
+- Capture actual Ethernet TX hardware timing evidence for canonical SV (not diagnostic mirror), relative to EMAC PTP time; measure peak, P95/P99 and sustained drift at 4000 and 4800 fps. If timestamp APIs stall the real-time task, use bounded sampled evidence or an independent hardware analyzer rather than adding per-frame IOCTL overhead.
+- Promote AUTO to 1 **only** after local source/clock quality + sample timeline validity + profile-derived timing tolerance are measured and continuously monitored. Only a separately verifiable globally traceable source can authorize 2.
+- Source-loss, multiple grandmasters/BMCA, packet drop, wrong transportSpecific/domain/VLAN, Pdelay failure, holdover, link restart and bounded transmit failures must never falsely advertise lock.
+- Preserve 1h 4000 fps reference evidence, then independent 4800 fps acceptance; continuous counter and no missed slots/TX failures.
+- Use isolated laboratory IED and full record: IED model/firmware, SCL, PTP settings, firmware commit, `.pcapng`, IED time-lock state, SV acceptance and exact alarm text. Do not infer no-alarm from a successful CI build.
+
+## Operator sequencing for M1
+
+1. Use only isolated, non-production Ethernet and approved test IED.
+2. Match IED PTP mode (IEC/IEEE 61850-9-3 Layer 2, P2P), domain, transportSpecific, VLAN and multicast path. For current lab source, clockClass 248 is truthful (not externally traceable); some IEDs correctly refuse to treat this as a qualified protection-grade GM.
+3. In native ARStack Studio, start PTP before SV START. Wait for Announce + Sync + Follow_Up and Pdelay readiness. Then arm SV.
+4. Inspect independent canonical capture and IED diagnostics. If the IED still alarms, report the alarm rather than changing `smpSynch` or PTP clock quality to hide it.
+
+M1 improves interoperability defaults and synchronization safety; it does **not** certify IEC/IEEE 61850-9-3 performance or guarantee a locked IED. M2 + physical bench evidence are mandatory.
+
+
+## M1+ timeProperties / TAI hardening (software-only)
+
+- Portable PtpTimeProperties now encodes IEEE 1588v2 flagField bits explicitly in Announce, Sync, Follow_Up and Pdelay; packet visibility alone does not assert traceability.
+- ESP32-P4 LAB_SOURCE treats time(nullptr) as an untrusted candidate UTC clock, validates a plausible date and a bounded configured TAI-UTC offset, converts to TAI seconds, and checks the hardware seconds-register range. The EMAC PTP timescale flag is set only if the TAI epoch is actually seeded.
+- currentUtcOffsetValid is FALSE by default; CONFIG_AR_PTP_MANUAL_UTC_OFFSET_VALID=y requires explicit operator validation and a successful TAI seed. timeTraceable/frequencyTraceable remain FALSE. Local source remains clockClass=248, accuracy UNKNOWN, timeSource=INTERNAL_OSCILLATOR.
+- LAB_SOURCE rejects configuration that claims unverified higher grandmaster quality. Test vectors inspect wire octets independently of the existing PTP packet decoder.
+- Uninitialized RTC: run as a plainly non-timescale-validated laboratory source; **do not** market as a fully conformant IEC/IEEE 61850-9-3 grandmaster.
+
+Still missing: independent reference proving actual UTC time and leap-second offset, continuous phase/frequency coupling between EMAC PTP and SV GPTimer, mandatory clock-state/BMCA behaviors, and physical accuracy/IED acceptance.

embedded/esp32p4_smv_injector/main/Kconfig.projbuild

@@ -120,7 +120,7 @@ config AR_PTP_ANNOUNCE_INTERVAL_MS
 config AR_PTP_SYNC_INTERVAL_MS
     int "PTP Sync interval (ms)"
     range 20 5000
-    default 250
+    default 1000
     depends on AR_PTP_LAB_TX
     help
         LAB_SOURCE uses two-step Sync/Follow_Up so Follow_Up can carry the exact
@@ -190,6 +190,17 @@ config AR_PTP_CURRENT_UTC_OFFSET
     default 37
     depends on AR_PTP_LAB_TX
 
+config AR_PTP_MANUAL_UTC_OFFSET_VALID
+    bool "UTC offset manually verified (Announce currentUtcOffsetValid)"
+    default n
+    depends on AR_PTP_LAB_TX
+    help
+        Enable only after the operator checks the configured TAI-UTC offset
+        against a current authoritative leap-second record. This flag does
+        NOT imply UTC traceability, frequency lock, or high clock accuracy.
+        The runtime also requires a plausible system UTC epoch before it
+        advertises currentUtcOffsetValid.
+
 config AR_PTP_MAX_PATH_DELAY_NS
     int "TIME_RECEIVER maximum accepted peer path delay (ns)"
     range 1000 100000000
@@ -229,7 +240,7 @@ config AR_PTP_LOCK_REQUIRED_SAMPLES
 config AR_PTP_SYNC_TIMEOUT_MS
     int "TIME_RECEIVER Sync timeout before HOLDOVER/UNLOCKED (ms)"
     range 100 10000
-    default 1000
+    default 3000
     depends on AR_PTP_LAB_TX
 
 config AR_PTP_HOLDOVER_TIMEOUT_MS