Normalize a clock without creating an event relationship

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Public activity · 30d

—Participating browsers

—Page views

—Reading sessions

—Exercise opens

Counts reflect browsers that allowed analytics. A reading session requires 30 seconds on a visible page. Browsers are not people.

Day 12 — Normalize a clock without creating an event relationship

Mechanism. A clock correction changes a representation of time; it does not add identity fields. Define the sign before calculating: offset = device reading − reference UTC. A clock four minutes slow has offset −4 minutes. Therefore estimated UTC = raw device time − offset = 08:54 − (−00:04) = 08:58. Retain the raw value, correction, source of the correction and resulting estimate. Overwriting 08:54 with 08:58 would hide the transformation a reviewer needs to inspect.

Assumptions and evidence. The exercise supplies one fixed offset for this synthetic snapshot. It does not establish that the device remained four minutes slow throughout the day or that its reference comparison was exact. The cards have minute precision; the equality of two displayed minutes cannot order the events within that minute. In a real case, ask how the offset was measured, when it was measured, which timezone applies and whether clock adjustment or drift occurred between the event and measurement. NIST SP 800-92 supplies log-management context; these arithmetic choices depend on the given clock convention.

Worked contrast. With the supplied offset, C04 and C03 both display 08:58 after normalization. That supports “coincident at the supplied precision,” not “same session.” With the wrong sign, 08:54 − 00:04 produces 08:50. The error would make a browser appear eight minutes earlier than the correctly derived estimate and could distort the investigation. Yet correcting the arithmetic still does not provide the missing session/request key.

For a separate uncertainty illustration, suppose an offset measurement is −4 minutes ±1 minute, and raw 08:54 is known to be rounded to the nearest minute. The true raw reading could be approximately 08:53:30–08:54:30, and the correction could be +3 to +5 minutes. The possible UTC interval is approximately 08:56:30–08:59:30. These are invented uncertainty assumptions, not additional C04 measurements. They show why point estimates can hide overlap: a nominal 08:58 does not imply exact simultaneous execution.

Decision. Use the corrected estimate to choose bounded questions and source windows. Request enough context to account for known uncertainty; justify the proposed 08:50–09:05 selection rather than calling it guaranteed complete. Ask the custodian about delayed ingestion and event-time selectors before interpreting an empty result. Separately enforce release: C06's source time 08:50 cannot make it available to a 09:09 analyst when its release is 09:10. C3 tests correction; C3X tests release. Neither program joins records.

Practice. Complete EX012, predict and execute C3, and compare the sign-error variant. Explain why C3's final literal line is not a computed join test. Use C3X to reject an early C06/C08 citation, then compare the worked answer. Limit: interval overlap is temporal compatibility, not causation; an in-memory parser cannot validate source clocks or a real query's completeness.

Continue studying — course Day 12: Previous: Day 11 · Week 3 index · Course index · Next: Day 13.

Exercise for this lesson

EX012 — Clock reconciliation. Objective: correct a clock without inventing correlation. Input: C03/C04 and the complete C3 fixture in §3.5. Give the raw/normalized pair, define the sign convention and calculate C04's UTC estimate. In two sentences explain the supplied precision and why coincidence cannot establish order, actor or a session/request join. Keep both original and derived values; do not import an uncertainty measurement from the separate Day 12 illustration. Rubric: 0 = wrong correction or claimed causal join; 1 = 08:58 with incomplete provenance/precision explanation; 2 = inspectable +4-minute transformation, stated uncertainty limits and no unsupported join. Worked answer.

Practice the exercises

Open a prompt, write your response, then compare it with the worked answer. Five-choice practice appears where a reviewed question is available.

EX012

Open the prompt →Compare with the worked answer →

Opens in 30 days: — · browsers: —

Checking for a reviewed five-choice question…

Worked answers

EX012 — Model clock calculation. C04 device displays 08:54 while measured four minutes slow; adding four minutes yields approximately 08:58 UTC. C03's reported sign-in also occurred at 08:58, so the events are temporally coincident at the given minute precision. Because C04 lacks a session ID and the offset's uncertainty is not specified, coincidence neither proves a shared transaction nor orders the two within that minute.

Additional worked reasoning (EX012 — Clock arithmetic and causality.): For C04 measured four minutes slow, normalized UTC = 08:54 + 00:04 = 08:58. The equality with C03 holds only at the presented minute precision. There is no evidence of exact order, identity or session/request linkage. In the original C3 lab, reversing the sign gives 08:50; C3X separately shows why an older event timestamp cannot waive the release gate. Neither mutation changes canonical C04.

C3 worked offline result: The Chapter 3 Python fixture prints four lines:

C3|C04|08:58 UTC|clock_correction=+4m
C3|C03|08:58 UTC|clock_correction=+0m
C3|C05|09:01 UTC|clock_correction=+0m
C3|C04_C03_same_minute=True|direct_join=False

The final line is an explicit classroom interpretation, not a verified join. In the negative-control copy, changing C04's correction to -4 makes its displayed 08:54 become 08:50, revealing the sign error. Changing C05's event time does not supply a missing session/request key. Full credit requires the correct raw-to-UTC transformation and the unsupported-causation limit.

Week 3 Day 12 — worked transformation check. Define offset = device − UTC = −00:04; hence UTC estimate = raw − offset = 08:54 + 00:04 = 08:58. Preserve raw, derived and offset metadata. C03 and corrected C04 coincide at supplied minute precision, while within-minute order and a common session remain unknown. C3's first three lines execute the transformation; its fourth line is a printed interpretation, not a tested join. Reversing the sign yields 08:50 and fails the expected correction. C3X keeps C06/C08 out of 09:09 despite their source metadata. In the separate uncertainty illustration only, raw rounding ±30 seconds plus correction 3–5 minutes yields approximately 08:56:30–08:59:30; that interval must not be inserted into canonical C04 as a measurement. Two points require the inspectable calculation and inference limits, not the optional invented interval.