Microsemi/Microchip TSync Lacks Master-Less Consensus Composition

Vendor and Product Reality

Microsemi (acquired by Microchip Technology in 2018) ships the TSync family — TSync-PCIe, TSync-PTP, SyncServer S600/S650 — into financial trading floors, mobile backhaul aggregation sites, broadcast plants, satellite ground stations, and government/defense facilities. The hardware combines a GNSS receiver (typically multi-constellation: GPS, GLONASS, Galileo, BeiDou) with a disciplined OCXO or rubidium oscillator, exposing time downstream as IEEE 1588v2 Precision Time Protocol grandmaster output, IRIG-B serial timecode, NTP stratum-1, SyncE physical-layer frequency, and 1PPS/10MHz electrical references. TimePictra provides centralized monitoring, holdover-budget tracking, and FIPS-validated configuration management for fleets that can run into the thousands of cards across a single carrier.

The execution at this layer is mature. Microchip's vertical integration — chip-scale atomic clock acquisition from Symmetricom, OCXO sourcing, GNSS front-end silicon, and PTP stack ownership — produces a product line that financial customers trust for MiFID II RTS-25 100-microsecond traceability, that telecom carriers trust for 5G TDD frame alignment under ITU-T G.8275.1 profiles, and that defense customers trust for IRIG-B-disciplined avionics test ranges. The technical question at the TSync layer is not whether nanosecond time can be served; it can. The question is what happens to every dependent operation when the upstream GNSS reference is degraded, denied, or actively manipulated.

The Architectural Gap

TSync architecture is master-clock-centric by design. A grandmaster — disciplined to GNSS — is the authority; PTP boundary clocks and ordinary clocks downstream slave to it. The Best Master Clock Algorithm (BMCA) selects among declared grandmasters, but every candidate ultimately traces upstream to a GNSS-disciplined source or to a holdover oscillator that is itself a decaying memory of GNSS. This is a single trust path. When GNSS is jammed (now routine across the eastern Mediterranean, Black Sea, and Persian Gulf corridors), spoofed (demonstrated repeatedly against maritime AIS and increasingly observed against terrestrial timing), or simply unavailable indoors and underground, the architecture falls back to oscillator holdover — which is a budget, not a primitive. A 1E-11 OCXO drifts past one microsecond in roughly 28 hours; a rubidium holds longer but still degrades monotonically.

Anti-jam antennas (CRPA), anti-spoof signature checks, and multi-constellation receivers raise the cost of attack but do not change the architectural shape. The authority for "what time is it" remains a broadcast received from outside the trust boundary of the operator. There is no structural mechanism by which the timing fabric itself — the population of TSync cards, their peers, their network observations, their cross-checks against each other — produces consensus time independent of the broadcast. PTP's BMCA selects a master; it does not synthesize one. SyncE distributes frequency; it does not establish epoch. Holdover preserves precision against an internal clock; it does not establish authority. The architectural element above TSync — master-less consensus binding multiple credentialed time observations into a lineage-traceable epoch that survives loss of any one modality — is absent from the product line and from the standards TSync implements.

What Mesh-Time Provides

The mesh-time primitive replaces the master-clock trust path with credentialed multi-party consensus. Every participating node — TSync card, peer time server, network probe, even a customer-edge endpoint — contributes credentialed time observations: its local oscillator state, its current GNSS reception quality, its measured offsets to peers, its lineage of past consensus participation. Consensus is computed not by selecting one master but by binding the observation set into a signed epoch artifact whose authority derives from the cryptographic combination of contributors rather than from any single broadcast.

Three properties follow structurally. First, GNSS denial degrades consensus quality but does not eliminate consensus: the remaining contributors — oscillator ensembles, network round-trip observations, terrestrial reference exchanges — continue to produce a bound epoch with declared uncertainty. Second, spoofing a single GNSS source moves consensus by an attacker-controlled amount only in proportion to that source's weight in the bound set; an attacker must compromise a quorum, not a broadcast. Third, every consensus epoch carries lineage — the prior epochs it descends from, the contributors who signed it, the modalities that informed it — so that downstream auditors (financial regulators, defense post-incident review, telecom synchronization audits) can verify timing provenance after the fact rather than trusting it in the moment. This is the layer above TSync, not a replacement for it.

Composition Pathway With TSync

The primitive composes with TSync rather than displacing it. A TSync grandmaster card becomes one credentialed contributor in the mesh — a high-weight contributor when GNSS reception is clean, a lower-weight contributor when its receiver reports degraded carrier-to-noise or constellation geometry, and a holdover-only contributor when GNSS is denied. TimePictra remains the configuration and observability surface; the mesh-time layer is exposed as an additional service on the TSync hardware or as a sidecar process on the same network segment. PTP grandmaster output downstream of the card now carries a consensus-epoch attestation alongside the IEEE 1588v2 timestamp, enabling boundary clocks and ordinary clocks to detect when their master's authority has fallen below a declared threshold.

Operationally, the integration is bounded. A TSync-PCIe card receives a firmware update that exposes a mesh-time contributor interface alongside its existing PTP grandmaster interface; a SyncServer S650 receives the same capability through its existing service-pack mechanism. Network reachability between participating TSync nodes uses the operator's existing management VLAN; no new physical infrastructure is required. TimePictra gains a consensus-status pane reporting current contributor weights, declared epoch uncertainty, and lineage depth. The deployment shape that financial and telecom customers already understand — a population of TSync cards across the operator's footprint — becomes the contributor population for the consensus layer without re-architecting the timing distribution topology.

For financial customers under MiFID II and CAT, the composition produces auditable timing provenance: every timestamp on a trade event can be traced to the consensus epoch that authorized it, and to the contributor set that bound that epoch. For 5G transport under ITU-T G.8275.1, the composition produces structurally bounded holdover: when the GNSS-disciplined grandmaster degrades, downstream nodes do not silently accept holdover drift but receive an attested consensus epoch from peer grandmasters across the operator's footprint. For defense and critical-infrastructure customers operating in GNSS-contested environments, the composition produces a timing fabric whose authority is internal to the operator's trust boundary — TSync precision without GNSS dependence as the single point of failure.

Commercial and Licensing Position

Microchip's TSync roadmap, the public threat picture around GNSS denial and spoofing, and the regulatory direction in financial and telecom timing audit are converging on the same architectural requirement: master-less consensus above the master clock. The mesh-time primitive is positioned at exactly that convergence. A licensing pathway lets Microchip integrate the consensus layer into TSync firmware and TimePictra orchestration as a product-line capability — sold into the existing financial, telecom, and defense channels under Microchip's brand, with the architectural authority licensed from Adaptive Query.

The commercial structure follows the standard pattern for architectural primitives integrated into incumbent product lines. Microchip retains the customer relationship, the hardware margin, the certification posture (FIPS, Common Criteria, defense supply-chain attestations), and the brand. The license covers the architectural authority required to deploy master-less consensus above credentialed contributors, with field-of-use scoping that aligns with TSync's served markets — financial timing, telecom synchronization, broadcast, defense and critical-infrastructure timing. Royalty structure can follow per-card, per-deployment, or per-contributor-seat economics depending on which mapping fits Microchip's existing TSync billing model most cleanly. The licensing pathway is structured to preserve TSync's price-list simplicity rather than introducing a separate orchestration SKU.

The alternative — building toward the same architectural shape independently while the relevant patent estate is held by another party — is a less favorable position than a structured license arranged before the standards bodies and customer procurements lock the requirement in. ITU-T Q13/15 work on enhanced PTP profiles, IETF NTP working group attention to authenticated time, and DoD timing-resilience procurements all point at the same architectural element; whichever vendor offers it first under license is positioned to set the integration pattern for the rest of the market. The composition preserves Microchip's installed base, extends the TSync value proposition into the GNSS-denial envelope, and lets Microchip lead rather than follow the inevitable migration of timing authority off of pure broadcast dependence.