Having outlined the evolution of Time Machine to its current support for backing up to APFS volumes in Big Sur, I’m next going to add some detail to that brief summary of what happens when an Intel or M1 Mac running Big Sur backs up to an APFS volume, in this and subsequent articles.

Early versions of Time Machine started making backups when they were run by launchd scheduling (rather than cron), exactly every hour. When Apple introduced its new scheduling system with DAS (Duet Activity Scheduler) and CTS-XPC (Centralized Task Scheduling), Time Machine backups were among the first to take advantage of it. Since then, instead of backups being made at exactly hourly intervals, they’re more flexible in timing, accommodating to environmental conditions such as thermal pressure and power state.

Unfortunately, this also made backups prone to failure in macOS Sierra, where the DAS and CTS-XPC system stopped working after several days of continuous running. That bug was fixed in High Sierra, since when it appears to have been generally reliable even in Macs which run for weeks between restarts.

When a Mac first starts up, it normally has many immediate functions to perform, including syncing with iCloud, which can take many minutes. Although DAS still assesses whether to run an initial backup, it has a BootTimePolicy that at least 5 minutes must elapse after boot before the first backup can start.

Once that period has elapsed, when DAS next rescores the 200+ activities which it dispatches, it’s likely that the backupd-auto task will achieve a score close enough to 1 to allow it to be dispatched. DAS then makes the decision to run the backup, passing that on to CTS-XPC to dispatch as an XPC Activity. backupd-auto is then run, but appears to be a trigger task which initiates the full backup process and quits. CTS-XPC is notified of this, tells DAS that the activity is no longer running, and reschedules it for 60 minutes time, at a priority of 30. That makes it highly likely that it will be run again in 58-65 minutes time.

Although I suspected recently that a backup may have been triggered by a very large number of FSEvents, reflecting intensive and extensive disk activity, that isn’t the case. Time Machine doesn’t monitor FSEvents and bring forward backups on demand. Indeed, until it’s already well into the backup process, it doesn’t even know whether it’s going to refer to FSEvents to determine what needs to be backed up. Time Machine to APFS remains a time-based not demand-driven system.

The events that I’ve described so far all take place before Time Machine even notes that it’s starting its next backup. Around the time that Time Machine announces that it’s starting an automatic backup, another backup activity may also begin, one which I’ve not noticed before, the daemon sbd, and its sub-system com.apple.SecureBackupDaemon. Little seems known about this, which also runs on iOS and uses Wi-Fi connections. I’ll report more about it in a future article, but for now I’ll tempt you with some of its areas of interest: AccessoryPairing, AppleTV, BackupBag, ContinuityUnlock, CreditCards, HomeKit, NanoRegistry, CloudKit, Feldspar, Maildrop, MasterKey, Notes, Photos, iCloudDrive, iMessage, Passwords, WatchMigration, and iCloudIdentity.

As far as I’m aware, sbd and the com.apple.SecureBackupDaemon sub-system are concerned with backing up what we share and do in iCloud. They’re also not related to, connected with, or scheduled alongside Time Machine backups.

In the next article, I’ll look at what happens during backing up to an APFS volume. Here’s a convenient chart summarising the processes and sub-systems involved in initiation of an automatic backup.

Finally, systems like DAS and CTS don’t normally get involved when you elect to start a backup manually, or a third-party scheduling app is managing your backups. One of the limitations of my utility for checking Time Machine and its backups, T2M2, is that it can’t parse the log entries which are generated by a different scheduling system, as most of the log entries are completely different, although the outcome may appear very similar.

Afternote: in the original version of this article, I was confused into believing that Secure Backup has some relationship with Time Machine. It doesn’t, and it was only by virtue of the fact that I saw both occurring at the same time that I erroneously assumed that they are related. More tomorrow about Secure Backup.