The boundary that hides the burst

Of the four arrival patterns driven through a block-window summary, three behave as expected. The evenly spaced one gives blocks of identical duration, which is the control. The Poisson one gives a spread of 1.16, which is the fluctuation of five hundred independent gaps. The drifting one gives a spread of 26, which is the rate ratio arriving in the duration.

The bursty one gives 1.00. Exactly one — every block covering 4,543 ticks, to the tick, over thirty-nine blocks — on a stream that is silent for stretches and then floods, and whose index of dispersion measured over the same intervals is 0.57.

A boundary that fires on a count is a sampler #

The mechanism is short and it generalises past this structure.

A block retires when a fixed number of arrivals have gone into it. So the boundary advances through the stream at whatever rate the stream is arriving at, and the sequence of boundary times is the arrival times at positions $s, 2s, 3s, \ldots$ for a block of $s$ arrivals.

That is a sampler whose sampling instants are chosen by the signal being sampled. Against a pattern with a period of its own it will do what any sampler does at a commensurate rate: return the same value every time, and the value it returns will be the average over one period.

The burst pattern used here has a period of sixty-four arrivals — a rapid burst followed by the silence that restores the mean rate. A block of five hundred and twelve arrivals is exactly eight periods, so every block covers eight complete cycles, so every block covers the same duration.

The structure is not failing to notice the burstiness. It is reporting, correctly, the duration of eight complete cycles, which is the same for all of them because the pattern repeats.

The sweep, and where the spread appears #

Moving the block off the period brings the variation back.

At a hundred and twenty-five arrivals — a little under two cycles — the blocks run from 700 to 1,276 ticks, a spread of 1.82. At a hundred and seventy-five, 1.43. At two hundred and twenty-five, 1.30. At two hundred and fifty, 1.29. At three hundred and seventy-five, 1.18. At five hundred and twelve, 1.00.

The trend is what a sampler does: the more cycles a block contains, the more of the pattern it averages over, and the less any offset between blocks can move the total. A block holding a hundred cycles would be flat whether or not the count divided the period.

So the spread reported by an arrival-counted window is not a property of the stream. It is a property of the ratio between the block size and whatever period the stream has, and both of those are things a deployment sets or inherits without considering the other.

Not integer bursts. Integer cycles. #

The obvious statement of the rule is that a block holding a whole number of bursts is blind, and it is not quite right.

Sweeping block sizes of a hundred, a hundred and fifty, two hundred, three hundred, four hundred and five hundred and twelve gives spreads of 1.85, 1.44, 1.00, 1.22, 1.00 and 1.00. Two hundred arrivals is 3.125 bursts and four hundred is 6.25, and both are flat.

The reason is that the commensurability that matters is between the block and the repeat, over the whole run of blocks rather than within one. Two hundred arrivals is twenty-five sixty-fourths of a cycle times eight; after eight blocks the offset returns to where it started, and the eight offsets turn out to cover equal durations because the pattern is exactly periodic and the offsets tile it.

That refinement matters because it makes the failure harder to avoid by inspection. Do not set the block to a multiple of the burst size is a rule somebody could follow. Do not set the block to any value whose ratio to the burst size is a fraction with a small denominator is not, and a real stream does not announce its period anyway.

What the structure could have been asked #

There is a version of this that is not a defect: a structure that reports a rate over a window is supposed to average, and averaging over whole cycles is the best kind of averaging.

The trouble is what the structure is asked. It is not asked for the mean rate. It is asked what happened in the last four thousand events, and the answer is being read as what happened in the last forty-five seconds, and the substitution’s error is exactly what this plate family measures.

On the bursty stream that substitution happens to be safe, and it is safe by accident. Move the block size, or let the burst size drift — a real burst is not sixty-four events every time — and the same substitution acquires an error of 1.8 times with nothing changing in the code or in the load.

A quantity that is stable because of a coincidence is not a stable quantity. It is an unstable one that has not yet been perturbed, and the perturbation here is a configuration change nobody would think to review.

The answers are still right #

It would be easy to read all this as an accuracy problem and it is not one. The structure’s answers about keys are unaffected.

A block-window summary is asked which keys are heavy over the last $W$ arrivals, and it answers that question over between $W$ and $W + W/b$ of them, always, whatever the timing. The slack bound holds on the bursty stream exactly as it does on the even one, and it is checked rather than assumed. The window that is not full has the argument for why that bound is the tight one and what it costs to tighten.

What is wrong is not the answer but a statement about the answer — the sentence that converts the last four thousand events into the last forty-five seconds. That sentence lives in an alert, a dashboard label or a runbook, and no gate anywhere reads it.

This is why the failure belongs in the same group as the count somebody chose and the model a bound was quoted in rather than among the accuracy results. In all three the computation is right and the sentence attached to it is about a different quantity, and in all three the sentence is the thing anybody acts on.

The other instrument sees it #

The time window over the same stream reports a spread of 1.14 in its occupancy: 449 to 511 items in a window matched to the block’s mean duration. Small, and not one.

So the two models disagree about whether the stream is uneven, and the one that says it is is right. That is a rare and useful thing — the dual that the window that is even in the wrong currency sets out holds on the other three streams and breaks here, in a direction that identifies which instrument is aliasing.

Why the time window is not aliasing is worth a sentence. Its boundary advances with the clock rather than with the arrivals, so its sampling instants are independent of the pattern, and a fixed duration that is not a multiple of the cycle will contain a varying number of cycles. It has its own commensurability problem — a duration exactly one cycle long would be flat too — and the difference is that its period is set by a parameter rather than by the stream.

The statistic that does not see it either #

The warning statistic offered for a different failure has the same blind spot, and the coincidence is instructive.

Elsewhere in this collection a merge-damage prediction is checked against a statistic that splits a stream in half and reports how much the top keys change between the halves. On the bursty stream that statistic reads 0.195 — the same as the well-behaved streams — while the prediction is two and a half times out, because the flooding key is heavy in both halves and the split does not resolve what happens inside one.

Both of those are cases where an instrument’s grain decides what it can report, in the way the count somebody chose is about a unit of cost deciding what a measurement can say. Two different instruments, two different failures, one cause: each samples at a grain, and a structure whose behaviour is set at a finer grain is not described by it. The dispersion measure has the same property, which is why every plate here that prints one also prints the interval it was measured over.

The period is not usually sixty-four #

A reader could reasonably object that the burst pattern here is unrealistically regular, and the objection is worth taking because it changes what the finding claims.

A generator that emits sixty-four arrivals and then exactly the silence needed to restore the mean rate is periodic by construction. A real bursty load is not — its bursts vary in size, its silences vary in length, and no block size will be commensurate with anything for long.

So the exact 1.00 is an artefact of a clean generator. What is not an artefact is the shape around it: the spread falls monotonically as the block grows relative to the pattern’s scale, from 1.85 at one and a half cycles to 1.18 at six, and it would keep falling on an irregular stream too. A block that is long compared with whatever timescale the load varies on will report a stable duration whether or not the load is stable.

That is the same conclusion arrived at from the other side by a window that is a duration, where the two window models were found to diverge when the window is short compared with the timescale the rate varies on and to agree when it is long. Agreement in that setting is not the two instruments both being right; it is both of them averaging the variation away.

A long window is a low-pass filter, and a low-pass filter reports quiet. The block sizes at which the aliasing is exact are a sharp special case of that, and the general case is on every plate in this group.

What to do about it #

The repair is not a better block size, because the period being aliased against is a property of a load nobody controls.

Report the spread, not a spread. A structure that retires blocks knows the arrival index of every boundary it crosses. If it also knows the time — one stamp per block, which is $b$ stamps rather than one per key — it can report the durations its blocks actually covered, and the flat line above becomes evidence rather than silence. What a window costs in bits has the accounting that makes this cheap: the expensive stamps are the per-key ones.

Compare two instruments. The disagreement between the arrival window’s spread and the time window’s occupancy spread is exactly the signal that one of them is aliasing, and it costs a second cheap structure rather than a redesign.

And do not read a flat measurement as a flat stream. The general form of that is the oldest habit on this site — an assertion that has never rejected anything proves nothing — and it applies to a measurement as much as to a check. A number that does not move is either evidence of stability or evidence that the instrument cannot move, and the two are distinguished by perturbing the instrument rather than by looking at the number.

The condition, stated exactly, and the repair it hands over #

A fraction with a small denominator is the right instinct and it is not a rule anybody can apply. The two sweeps between them hold eleven block sizes and their spreads, which is enough to state the condition exactly — and the exact form comes with a repair the loose form cannot suggest.

Sort the eleven by whether they are flat. Flat: 200, 400, 512. Not flat: 100, 125, 150, 175, 225, 250, 300, 375.

Every flat size is divisible by eight and no other size is. Eleven points, no exceptions.

Eight is not a property of the stream. It is the number of blocks the window holds, and eight blocks of $s$ arrivals span $8s$ of them, so $8 \mid s$ is exactly the statement that $8s$ is a multiple of the burst’s sixty-four. The condition is that the whole run of blocks covers an integer number of cycles, not that any one block does — which is the refinement this page reaches for and states qualitatively.

Written that way it generalises to a formula. With $b$ blocks and a period of $p$ arrivals, the blind sizes are the multiples of $p/\gcd(b,p)$. At $b = 8$ and $p = 64$ that is every multiple of eight — one block size in eight is blind, which is a lot of exposure for a parameter chosen for memory.

And the formula is a dial. Move the block count to seven and $\gcd(7,64) = 1$, so the blind sizes are the multiples of sixty-four — one in sixty-four. Move it to nine, eleven, thirteen: the same. Any block count sharing no factor with the period reduces the exposure by the whole of that factor, and a period in a real stream is far more likely to be a round number of events than an odd one.

So a block count coprime to whatever the load repeats at is a repair, and it is free. It changes no bound: the slack a block window promises is between $W$ and $W + W/b$ arrivals, so seven blocks is a slightly looser bound than eight and nine a slightly tighter one, and neither costs anything the structure was not already paying. The window that is not full has that bound and its tightness; nothing in it prefers a power of two.

That is worth putting beside the two repairs above, because it is cheaper than both. Reporting the durations costs $b$ timestamps and a plate to read them on. Running a second instrument costs a second structure. Choosing an odd block count costs nothing and removes seven eighths of the block sizes at which the instrument can go blind — and the reason nobody does it is that eight is the number a person picks when the parameter is about memory, which is what what a window costs in bits says it is about.

The honest limit on this is the one the section above already states: a real burst has no exact period, so no block count makes a real stream exactly flat and none makes it exactly safe either. What the formula describes is the sharp special case, and what it recommends survives the general one — a schedule whose parameters share factors with a load’s timescale will lock onto it more readily than one whose parameters do not, and coprimality is the cheapest way to arrange that.

The same trap in a different instrument #

The block boundary is a sampler because it fires on a count. Two other things in this collection fire on a count and have the same exposure, and naming them is cheaper than rediscovering the effect twice more.

A decayed counter fires on nothing — it fades continuously with the clock — and is immune, which is one more entry on the ledger the counter with no window in it opened. A block-window summary fires on arrivals and is exposed. A summary that compresses every fixed number of updates, which is how the quantile structures keep their size down, fires on arrivals too: its compression instants are chosen by the stream, and a stream with a period could in principle be compressed always at the same point of its cycle.

Whether that matters for the quantile structures is not measured here and is not obviously nothing. The compression schedule decides which tuples are candidates for folding at each pass, so a schedule locked to a periodic feature of the values would fold the same regions repeatedly. It is named here as an open question with a mechanism rather than as a finding, because the measurement that would settle it — sweeping the compression period against a periodic value stream — has not been made.

What is settled is the general rule, and it is short. Anything whose schedule is set by the data can alias against the data. The instruments that fire on a clock cannot; the ones that fire on a count can, and all of them are cheaper for exactly that reason.

What the flat line was worth #

The measurement that opened this essay is a structure reporting, correctly and precisely, that a stream has no variation in it — over thirty-nine blocks, to the tick, on arrivals that a raster plot shows to be grossly bunched.

There was no bug. Every block covered eight complete cycles and eight complete cycles take the same time. The failure is that the question how long did five hundred and twelve arrivals take was being used as a proxy for is this stream steady, and the proxy is exact at some block sizes and useless at others, with nothing in the output to say which case is in hand.

That is worth keeping beside the other cases where an instrument’s silence was mistaken for a finding. It is the same shape as a check that has stopped rejecting anything: the output looks like the output of a working instrument, and the way to find out is to feed it something it must respond to. That is the discipline counting instead of timing established for this collection’s measurements and it turns out to apply to the instruments as readily as to the algorithms.