Paul Robertson, Ken Fodero, Christopher Huntley, Motaz Elshafi, Dustin Williams
GPSs are among the most widely available global navigation satellite systems (GNSSs) in use today. This free technology provides high-accuracy positioning, navigation, and timing (PNT) services that enable many applications. Many critical infrastructure systems and assets depend on PNT services, which include electrical power grid, telecommunication infrastructure, financial, transportation, agriculture, and emergency response systems.
Since GNSSs rely on the recovery of low-amplitude signals transmitted by orbiting satellites, GPS receivers are susceptible to both unintentional and intentional interference and jamming. Existing papers about GPS spoofing include demonstrable examples showing how spoofed signals can be used to trick the GPS receiver into reporting a false position or time reference. GNSSs are also vulnerable to disruption by solar flares.
U.S. Executive Order 13905 was published on 18 February 2020 in response to the growing concern over the potential impact to critical infrastructure caused by the widespread adoption of PNT services. The executive order set a timeline for a series of initiatives to implement non-GNSS-based secure PNT services, including a GNSS-independent source of Coordinated Universal Time (UTC).
This article discusses how terrestrial time distribution methods in combination with GNSS-based time references can offer solutions to mitigate the vulnerabilities of discrete GNSS-based time references. Technologies available today can be applied to implement a more resilient precise time distribution architecture capable of maintaining submicrosecond time accuracy after a wide area loss of GPS for significant periods of time. Although the application usage cases center on the electric power system, the approaches discussed are applicable to many other industries that rely on precise time.
To give context, it is helpful to provide some background on common time measures and references that are used for timekeeping. There are two types of time standards. The first is referred to as astronomical time and is referenced to Earth’s rotation, and the second is atomic time, which is based on the oscillation of atoms to provide a frequency reference.
Universal Time (UT1) is an astronomical timescale and referenced to Earth’s rotation. International Atomic Time (TAI) is an extremely accurate timescale based on a weighted time average of nearly 450 atomic clocks in more than 80 national laboratories worldwide. Most of the atomic clocks used are cesium clocks. The TAI is used by the science and research community. The International Bureau of Weights and Measures, near Paris, France, is the organization responsible for the International System of Units and the international reference timescale (the UTC). The UTC is an atomic timescale that is derived from the TAI and includes the insertion of leap seconds based on data from the International Earth Rotation and Reference Systems Service to ensure that there is agreement between atomic time and the rotation of Earth. The UTC is the international standard for civil and legal time.
GPS time is an atomic timescale with an origin that started on 6 January 1980. The time reference is generated by the U.S. Naval Observatory. There are no leap seconds used in the GPS time system, so it is referred to as a continuous timescale. GPS time is always 19 s behind the TAI and is also offset from the UTC by a number of seconds. The UTC offset is contained in the navigation message. On recovery of the GPS signal, a GPS receiver applies the UTC offset correction contained in the navigation message during the lock sequence. In 2022, GPS time was ahead of the UTC by 18 s, as demonstrated in Figure 1.
The UTC is kept within 0.9 s of UT1 by adding (or subtracting) a whole second. These single-second adjustments are called leap seconds and applied relatively infrequently. The last leap second adjustment was on 31 December 2016. This leap second adjustment ensures that there is agreement between the atomic and astronomical timescales. The International Earth Rotation and Reference Systems Service has the responsibility of determining when to apply a leap second correction. Without the addition of leap seconds, the position of the sun would start to shift in relation to the observed time of day, and after a few millennia, the midday sun position could occur at midnight.
The electric power industry has adopted the UTC for substation protection and control applications. Using local time for power system applications can be challenging with the large number of different time zones that exist. There are 24 different 1-h time zones across Earth plus nine additional fractional (half- and quarter-hour) time zones. Many utilities operate across different time zones and handle daylight saving time seasonal adjustments. The UTC provides a standard time reference that is independent of time zone and daylight saving time changes.
For a GPS receiver to calculate its position in three coordinates (latitude, longitude, and altitude), it needs to correctly receive a signal from three different GPS satellites. To calculate time, it requires the correct reception of a signal from a fourth satellite. Commercially available GPS receivers can generate a time reference with an accuracy of 40 ns relative to the UTC. Achieving this level of accuracy has enabled all the advanced power system applications discussed later in this article.
GPS signals are transmitted in the 1,575.42-MHz (L1) frequency band for free commercial applications and 1,227.6 MHz (L2), with encryption, for U.S. Department of Defense applications. GPS relies on communication from satellites 12,000 mi from Earth and has a typical received signal power of –127 dBm, or ${2}\,{\bullet}\,{10}^{{-}{16}}{\text{ W}}$. Considering the low signal levels, GPS is incredibly reliable.
Most commercially available GPS receivers use 12-channel receivers, which means they can track and receive signals from up to 12 GPS satellites, as shown in Figure 2. The U.S. Air Force manages the GPS satellite constellation. The original GPS system consisted of 24 satellites, with six orbital planes that each had four satellites. In 2011, the U.S. Air Force made improvements by including three additional satellites, increasing the total number of satellites to 27. This change means that GPS is now able to provide consistent coverage to the entire planet, and it ensures that a GPS receiver can receive signals from at least four satellites at any given time.
Precisely calculating the position of a GPS receiver to an accuracy of several meters requires the arrival time of each satellite signal to be determined with a very high accuracy. Precisely calculating the position of a GPS receiver requires each GPS satellite to be time aligned to a common reference. The U.S. Naval Observatory provides an atomic reference to which the atomic clocks on each GPS satellite are synchronized. The GPS civilian code (L1 frequency) operates with an accuracy specification of 340 ns [two standard deviations
According to “The Perfect Time: An Examination of Time-Synchronization Techniques,” which was written by Ken Behrendt and Ken Fodero, of Schweitzer Engineering Laboratories, the time accuracy specifications of commercially available GPS clocks range from 50 ns to 1 ms. These accuracy ratings are based on statistical probability and are not absolute values. These ratings represent one standard deviation of a sample population of time values reported by a GPS clock. For example, a clock with a 50-ns, ${1}{-}{\sigma}$ time accuracy specification will have a clock output that will be within 50 ns of the time reference 66% of the time. It is easier to see this represented visually. Figure 3 provides a plot of the 34-ns, ${2}{-}{\sigma}$ GPS time reference broadcast by each satellite and the 50-ns, ${1}{-}{\sigma}$ time accuracy of the time output from the GPS receiver.
The electric power industry uses precise time for a wide range of applications that manage and control the power system. The time references are typically provided by GPS clocks. In early applications, the GPS clocks provided a time reference to synchronize the internal clocks of substation intelligent electronic devices (IEDs) for sequential event recording and oscillography reports. The GPS clocks allowed the IED reports to be analyzed and compared to a common time reference. These reporting applications require a timing accuracy of only 1 ms or better. The event report data are used to perform postevent analysis, and the timing accuracy has no effect on the performance of the system.
The availability of low-cost, reliable, and accurate GPS clocks has helped enable more advanced power system applications. The following applications are all arguably useful, with a time accuracy of 100 μs, adding about 4% to a time-synchronized phasor (synchrophasor) total vector error, 2° to the phase angle of a 60-Hz current, and 12 mi to the location accuracy of a traveling-wave fault location. Nevertheless, due to the ability of GPS receivers to easily provide a time reference with better than 1-μs accuracy under normal conditions, an accuracy goal of 1 μs is highly desirable to increase the accuracy and reduce the uncertainty of the following measured power system quantities:
The preceding advanced applications, with the exception of fault location, can be used in real-time systems that directly control the electric power system. The GNSS time reference used to provide device synchronization becomes a critical function in the overall system. It is common practice to engineer redundancy into the systems that manage and operate the power grid. While the primary control system may require a precise time reference, the backup system does not.
The question of how vulnerable the electric power system is to a GNSS disruption is a widely discussed topic among industry experts, power system operators, and national security officials. From a power system protection perspective, the relay protection schemes are designed to cope with a loss of precise time. If a relay loses its time reference, it falls back to a secondary protection method, such as distance protection, that does not require a precise time reference. The tradeoff is that these secondary methods may not operate as quickly as the more advanced schemes that rely on precise time, resulting in slower fault detection and clearing times. Line current differential systems can detect a fault in less than half of a 60-Hz cycle (one cycle is 16.7 ms), and time-domain relay systems can operate as fast as 1 ms. There is no question that a wide area loss of GPS would have a serious impact on many services and industries, but it is reassuring to know that the integrity and safe operation of the electric power system would be maintained.
Obtaining a common time reference from GPS is just the start. Next, we need a means to distribute the time reference to downstream devices and substation IEDs.
The most common method used to distribute synchronized time information within a substation is using the Inter-Range Instrumentation Group standard (IRIG-B).
The IRIG-B is a widely used format for distributing time signals within a substation to IEDs. Time is provided once per second and formatted in seconds, minutes, hours, and the day of the year in a binary-coded decimal and can include an optional binary seconds-of-the-day count field. The IRIG-B time signal is typically carried over a shielded coaxial cable.
The IEEE 1588 standard defines a method to distribute precise time over an Ethernet network. The standard defines a precision time protocol (PTP) that is used to calibrate and remove the transmission delays introduced by the communication network media and pass-through delays of each network device.
Figure 4 displays the hierarchy of a PTP network. The grandmaster clock receives signals from a GNSS satellite constellation and distributes time to the entire network. The boundary clock helps in scaling the network and handles all the requests from the downstream devices connected to its master port. The slave clocks are IEDs that are typically at the edge of the network.
The IEEE 1588 precise time distribution method eliminates the need for the separate dedicated cables that are required for IRIG-B. It also supports redundant clock sources by allowing more than one master clock to be deployed in the network.
However, since it is an Ethernet-based protocol, it does not support legacy IRIG-B devices or products that are not Ethernet capable. The IEEE 1588 standard defines different profiles to address the specific requirements of different industries.
The PTP power profile was developed for power system applications. The original power profile standard was IEEE C37.238-2011, and the following two standards evolved from splitting the IEEE C37.238-2011 power profile into the following:
The titles for each standard are as follows:
Any device compliant with IEEE C37.238-2017 is automatically compliant with IEC/IEEE 61850-9-3.
Electromagnetic storms created by solar flares are disruptive to GNSS signals, making it difficult or impossible for the receiver to recover them. A solar flare creates a release of high-energy radiation from the surface of the sun that travels across space. Depending on the direction and orientation of the solar flare, the high-energy particles can reach Earth. The electromagnetic fields created by the charged particles look like high-level background noise or high-amplitude in-band signals to the GNSS receiver and swamp the low-level GNSS satellite signals, preventing them from being received. The electromagnetic storm that occurred on 28 and 29 October 2003 caused some GPS receivers to lose satellite reception for 19 h. Organizations that monitor space weather, such as the National Oceanic and Atmospheric Administration, provide forecasts to warn of high-sun-activity events that may cause disruption to radio and satellite systems. These forecasts can predict a potential disruption event anywhere from several hours to a few days ahead of time.
Due to GNSS signals having a very low signal level (–127 dBm), GNSS receivers are relatively easy to block or jam by transmitting a higher-amplitude signal in or adjacent to the L1 frequency band. The blocking signal prevents the intended satellite signals from reaching the GPS receiver.
GPS jammers are readily available and vary in size and shape. Most GPS jammers work over a short range and can be powered by a USB port or cigarette lighter in a car. Most vehicle fleet organizations, such as rental car, package delivery, trucking, and taxi firms, use GPS to track the location of their vehicles. Some employees view these tracking devices as an invasion of their privacy or a means to limit the number of hours they can work or distance they can drive. Although the intended target of the jammer may be the vehicle-based GPS tracker in a delivery truck, the range of the jammer has the potential to block other nearby GNSS receivers, such as a substation GPS clock, if, for example, the driver decides to take a lunch break near a substation site.
Another source of GPS interference can be the federal government. The following is an excerpt from the “Overview of the US Federal Government’s Policy on Activities Which May Cause Interference to GPS”:
On occasion, the US Federal Government is required to conduct GPS tests, training activities, and exercises that involve interfering with GPS receivers. These events go through a lengthy coordination process involving the Federal Aviation Administration (FAA), the US Coast Guard (USCG), the Department of Defense (DoD) and other government agencies. Due to the fact that these training and testing activities can involve a number of aircraft, ships and/or other military equipment and up to hundreds of personnel, cancellation or postponement of a coordinated test should only occur under compelling circumstances. In general, only safety-of-life/safety-of-flight issues will warrant the cancellation or postponement of an approved, coordinated GPS test.
GPS jamming typically affects only individual GPS receivers in a localized area.
Most of the common hardware-related problems in building-based GNSSs are caused by failures in the GPS antenna and radio-frequency (RF) cable components. For applications that require having a GNSS clock within a building, such as a substation facility, the GPS antenna is placed on the roof, and an RF cable is used to carry the signal to the GPS receiver. Due to the low level of the satellite signal and the need to distribute it across an antenna cable (with a typical loss of 1 dB/m), it is common practice to use an active antenna. An active antenna contains an amplifier to boost the received signal and requires a power source to operate. Active antennas can provide 30- to 40-dB gain, and in most cases, the GPS clock provides a 3- or 5-Vdc source over the RF cable to power the antenna.
The components within active antenna systems can age over time, causing signal degradation that negatively impacts the integrity of the satellite signal that is passed to the GNSS receiver. It is also possible for GPS antennas to be prone to lightning strikes, causing damage to the electronics.
It is not uncommon for antennas to be used for target practice, and in areas where this is a risk, it is worth taking the precaution to camouflage the antenna or consider placing a dummy antenna to act as a decoy.
Multipath errors can affect the accuracy of the position or time determined by the GNSS receiver. A multipath signal is a signal that has taken a longer path to reach the receiver because it has been reflected off a building or mountain. The extra delay caused by the signal taking a longer path introduces an error in the observed time of arrival determined by the GPS receiver, which results in an error in the time or position reference reported by the receiver. Most GPS receivers can handle multipath signals, but the effects of multipath signals can be minimized by good antenna placement. Antennas should be placed where they have an unobstructed view of the sky to ensure they can receive direct path signals from as many satellites as possible.
GPS spoofing involves generating a fake GNSS signal to fool the receiver into believing it is receiving valid satellite signals, which forces the GPS receiver into reporting the wrong position or time.
There are several types of spoofing attacks:
Spoofing is probably the most significant vulnerability to consider, due to the potential impact to power system applications. The loss of GPS timing is relatively straightforward to detect and manage, as relay protection systems regress to methods that do not require precise time after detecting a timing loss. A deliberately manipulated signal that fools a GPS receiver into reporting the wrong time is potentially more dangerous; if not detected, it has the potential to cause a relay protection scheme to falsely report a power system fault condition that triggers a breaker to open, resulting in a power outage.
Holdover oscillators provide a solution for maintaining time after a temporary loss of a GNSS signal caused by a jammer or solar flare. A high-stability oscillator is used to provide a holdover reference after the GNSS signal is lost.
Common holdover oscillator implementations include oven-controlled crystal oscillators and atomic-based (rubidium or cesium) clocks.
The GNSS time signal is used to frequency lock the holdover oscillator, and after detecting a GNSS loss, the holdover oscillator provides the frequency reference for the clock. An oven-controlled crystal oscillator can maintain better than 1-μs accuracy for several hours, a rubidium oscillator can maintain 1-μs accuracy for several days, and a cesium oscillator can maintain better than 1-μs accuracy for several weeks.
Many GNSS clock solutions now provide the ability to simultaneously receive signals from different GNSS constellations. There are several GNSSs in operation today. These include the U.S. GPS, the Russian GNSS, the Chinese BeiDou system, and the European Galileo system. All these GNSSs operate in the 1,200- to 1,800-MHz frequency range.
Monitoring and comparing time and position data from different GNSSs demonstrates to the GNSS receiver that the satellite signals being received are valid and that they have not been manipulated or compromised. Attempting to spoof signals for multiple GNSS constellations and having each signal match with the same position and time is an order of magnitude more difficult than generating spoofed signals for a single system. It is possible to shift the time reported by the receiver and have it match across multiple GNSS signals by adding a simple delay between the spoofer’s receive and delay antennas. However, this typically causes a change in the calculated position, which can be another indication that the GNSS signals have been compromised. Any clock that is installed in a fixed position, such as a substation, will not change its position over time. It is therefore possible to use location change as a spoofed or compromised signal indication.
Although multiconstellation GNSS receivers are unable to detect every type of spoof attack, they do provide an effective layer of defense.
Avoiding single points of failure is a well-established best practice when designing critical systems. This objective can be achieved by using redundant GNSS receivers. Figure 5 explains how two clocks with an IRIG-B source selector can provide GPS clock redundancy. Although it achieves redundancy from a clock hardware perspective, the IRIG-B source selector still introduces a single point of failure. Figure 6 addresses this issue by allowing each clock to accept a timing signal from the other clock. Each clock generates a local timing output based on its own internal reference and uses the signal from the other clock only if it detects a problem with its own internal timing system.
Both methods shown in Figures 5 and 6 provide some level of hardware redundancy that includes the clock, antenna, and RF cabling. In the event of a catastrophic failure, such as a power supply failure, the IEDs that receive timing information from the affected clock(s) will lose their time source.
Terrestrial time distribution involves using media, such as fiber-optic cables or radio transmitters, to distribute precise time. These methods, particularly fiber-optic communications, can be more resilient against jamming and spoof attacks.
By separating two or more GPS receivers by physical location and providing a mechanism to distribute time across a wide area communications network, it is possible to overcome localized GPS disruptions caused by jamming and hardware failures.
Many electric power utilities use telecommunication networks to support the real-time protection and control applications that run the power system. These telecommunication networks are typically provided by private fiber-optic-connected wide area communications networks owned and maintained by the power utility. These networks are purpose built to provide low-latency and high-availability communications over a wide area.
Both synchronous optical network (SONET) and Ethernet-based network technologies can distribute precise time across a wide area.
SONET is a time-division multiplexing technology that was introduced in the 1980s, and even though SONET has been replaced in many telecommunication networks outside the power system industry, it is still used by many power utilities for time-critical substation applications. Time-division multiplexing-based telecommunication networks are frequency synchronized (syntonized) by design. GPS clocks are typically used to provide the frequency synchronization source for time-division multiplexing-based wide area networks (WANs).
In timekeeping systems, the term stratum is used to define the distance from an authoritative time source. Each stratum level is assigned a number, starting with zero for the reference clock at the top of the hierarchy. A stratum 0 device is connected directly to a high-precision time source to provide a reference clock. An example stratum 0 device would be an atomic clock or a GNSS. A stratum 1 device obtains time by synchronizing to a stratum 0 reference, and an example would be a GPS clock that obtains time from a GNSS that is synchronized to an atomic stratum 0 reference.
A typical SONET always has one stratum 1 (±10 parts per trillion) clock and, most likely, a second stratum 1 clock for redundancy or backup. Because the SONET is frequency synchronized, it is possible to build a precise distribution system. We can build upon the SONET time distribution model by allowing each node to support a local GPS reference, and some solutions embed a GPS receiver into each node, as in Figure 7. The ability of each node to support a GPS reference increases the resiliency of the system by allowing high-accuracy time synchronization to be maintained in the event of GPS signal disruption to one or more GPS clocks.
For Ethernet-based networks, the IEEE 1588 PTP provides a solution for distributing time across a WAN using the International Telecommunication Union G.8275.1 telecom profile that is now widely used for delivering time that is accurate to the submicrosecond, which is needed for cell sites. Many network implementations also make use of synchronous Ethernet to provide frequency alignment in combination with a PTP to provide high-accuracy time synchronization and distribution. Figure 8 presents an IEEE 1588 PTP network implementation over a packet-switched network. Figure 8 shows dual grandmaster clocks providing a primary and redundant secondary clock reference to the network. These clock references are typically referred to as primary reference clocks or primary reference time clocks (PRTCs).
Since commercially available jammers can generate a signal only over a localized area, it is very difficult to attack a timing system that has placed multiple GNSS receivers across a wide geographical area. In the network in Figure 7, it is possible to implement a timing system that averages all the active timing sources that are being received at each node to generate the network time, which can then be compared to the time output of individual local GPS receivers. If the local GPS receiver time reference has a skew greater than a few microseconds away from the network time, it can be assumed that the time is either unreliable or compromised. In this situation, the local clock reference can be flagged as suspect, and its time reference is not used. This approach can detect a spoofed receiver, alert the system manager, and ensure that the timing output is not used in the network.
As discussed earlier, location change detection can provide another layer of spoof detection. Since the physical location of the individual receivers used in power system substation applications is fixed, it is possible to use this information to qualify the time source. When each receiver acquires a lock to the GNSS network, the longitude and latitude coordinates of the antenna location can be saved as a reference. The manipulation of the GNSS signal information, either by introducing a delay or changing data content, typically introduces a change in the reported position of the receiver. Depending on the sophistication of the spoof attack, the position change could be the location of the attacker’s signal generator (if using a simple single-delay approach) or will be the estimated position of the target GPS antenna. This situation provides a good reason to camouflage real antennas and install dummy ones that are more visibly prominent. Figure 9 details how a location threshold can be applied to the position that is determined for the GNSS receiver. The radius threshold is then used to trigger an alert if the calculated position moves outside this range. Once the threshold has been crossed, an alarm can be raised and the clock output prevented from being used to provide time to the network.
Critical infrastructure telecommunication networks have adopted the use of atomic time references based on cesium clocks to provide an enhanced primary reference clock. The standards that define the specifications for telecommunication primary reference clocks were extended to define a higher level of performance to address concerns over the vulnerabilities of GNSSs. These standards define an enhanced PRTC that can operate autonomously and maintain a high-accuracy frequency reference after the loss of a GNSS signal. By providing a colocated atomic reference, the enhanced PRTC can operate as an autonomous time standard after the loss of a GNSS.
Taking the concept of an autonomous time reference one step further, the National Institute of Standards and Technology (NIST) released a publication that discusses resilient time distribution architectures for critical infrastructure applications. One approach discussed in technical note 2187 is to use a nationwide fiber-optic network to distribute time using a PTP from a centralized terrestrial site based on an atomic reference that is independent from a GNSS. Critical infrastructure industries would be able to access this time reference as an alternate non-GNSS time source. In theory, this solution would allow a critical infrastructure entity, such as an electric power utility, to obtain a time reference using a PTP from NIST by accessing the fiber network.
We have discussed how GNSSs have provided a solution for delivering precise time to a broad spectrum of industry applications and explained how GNSS-based clocks are vulnerable to intentional and unintentional interference. The discussion then moved on to explain how these vulnerabilities can be addressed using a combination of geographically distributed clock sources, terrestrial-based atomic clocks, and WAN telecommunications.
Although many of these solutions exist today, the power utility industry is still in the early stages of implementation with multi-GNSS receivers and redundant time sources being the most widely implemented mitigation approaches.
Today, the power utility industry predominantly uses discrete GPS clocks in each substation to provide a high-accuracy time reference for power system applications, as shown in Figure 10.
The architecture in Figure 11 brings together all the concepts discussed in the preceding to show a systemwide implementation that can maintain precise time distribution in the event of a complete loss of GNSS.
The implementation in Figure 11 introduces an additional network device called a time distribution gateway (TDG). The TDG is a device capable of receiving and comparing time from a variety of sources to ensure that the time signal being used for time distribution within the substation is referenced to the highest-time-quality signal available and has passed a time validity check to ensure that it has not been compromised. It accepts time from a built-in GNSS receiver or local external clock or via an IEEE 1588 PTP over the WAN.
In addition to providing time source redundancy, the TDG has the ability to compare each time input against a weighted average of all time inputs across every TDG in the network. It implements a timing system flywheel that weighs and averages all the active time source inputs across each site to generate the network time, which is used to compare and validate each time input. The timing system flywheel provides a method to detect a compromised timing source input that has a time skew larger than a specified threshold from the weighted average.
The atomic time references provide time that is traceable to the UTC, with accuracy in the tens of nanoseconds. In the event of a wide area GNSS outage, the atomic references would maintain a time with better than ±100-ns accuracy to the UTC for several weeks and better than ±1-μs accuracy for several months. The most demanding applications used in the electric power system require a timing accuracy of better than 1 μs, so this timing system architecture would survive a complete loss of GPS for over a month and maintain traceability to the UTC, with better than 1-μs accuracy.
It should be noted that for applications that require the UTC (which include power utility applications), PTP networks should also provide the current UTC–TAI (leap seconds) offset; one possible method is the addition of an IEEE C37.238a-2023 time length value to the PTP announce messages.
Although a PTP provides many advantages when it comes to delivering precise time over modern packet-switched networks, it does have limitations with the number of network hops that PTP packets can be transported over before the timing accuracy falls outside the International Telecommunication Union limits on the maximum time interval error.
In network implementations where PTP maximum time interval errors are a concern, the addition of boundary clocks can resolve these issues. Boundary clocks can be deployed closer to the substation edge devices to allow PTP packets to be delivered within International Telecommunication Union specifications.
Figure 11 describes how the use of a locally connected GPS reference to a TDG provides another stratum 0 traceable source within the substation in case the network connection to the master clock is interrupted by a fiber outage or another network issue.
With the widespread reliance on GNSS-based PNT services for many critical infrastructure applications, citizens and system operators should rightly be concerned about the impact caused by a disruption to these satellite-based services.
The good news is the electric utility industry has a wealth of experience implementing precise time systems for existing substation applications and private telecommunication networks. Key industry players, including consultants, solution manufacturers, and utilities, are already working together to apply the latest advancements in enhanced PRTC technology. These solutions include methods to detect and mitigate jamming and spoof attacks. Utilities are applying cesium-based timing references to maintain precise time in the event of a wide area loss of GPS.
As Executive Order 13905 begins to take effect and demand GNSS-independent sources of time, utilities will be ready with advanced solutions and tertiary connections to NIST.
Although the solution approaches that were discussed focus on what a resilient timing architecture would look like when implemented in the electric power industry, they can be extended to apply to other critical infrastructure industries that rely on precise time.
National Coordination Office for Space-Based Positioning, Navigation, and Timing. “Space segment.” GPS.gov. [Online] . Available: https://www.gps.gov/systems/gps/space/
D. Goward, “DHS report on Denver jamming – More questions than answers,” GPS World, Jan. 2023. [Online] . Available: https://www.gpsworld.com/dhs-report-on-denver-jamming-more-questions-than-answers/
K. Behrendt and K. Fodero, “The perfect time: An examination of time-synchronization techniques,” in Proc. 32nd Annu. Western Protective Relay Conf., Spokane, WA, USA, Oct. 2005. [Online] . Available: https://selinc.com/api/download/3686
D. Williams, M. Elshafi, K. Fodero, C. Huntley, and P. Robertson, “Using wide-area precise time distribution to increase dependability and security of substation time synchronization,” in Proc. 75th Annu. Conf. Protective Relay Eng., College Station, TX, USA, Mar. 2022. [Online] . Available: https://selinc.com/api/download/136425
C. Huntley, “It’s about time to have a good time,” PAC World, no. 52, Jun. 2020. [Online] . Available: https://www.pacw.org/its-about-time-to-have-a-good-time
M. Weiss, A. Silverstein, F. Tuffner, and Y. Li-Baboud, “The use and challenges of precise time in electric power synchrophasor systems,” in Proc. Int. Tech. Meeting Inst. Navigation, Monterey, CA, USA, 2017. [Online] . Available: https://www.nist.gov/publications/use-and-challenges-precise-time-electric-power-synchrophasor-systems
IEEE Guide for Designing a Time Synchronization System for Power Substations, IEEE Standard 2030.101-2018, Jul. 2018.
M. L. Psiaki and T. E. Humphreys, “GNSS spoofing and detection,” Proc. IEEE, vol. 104, no. 6, pp. 1258–1270, Jun. 2016, doi: 10.1109/JPROC.2016.2526658.
Paul Robertson is with Schweitzer Engineering Laboratories, Pullman, WA 99163 USA.
Ken Fodero is with Schweitzer Engineering Laboratories, Pullman, WA 99163 USA.
Christopher Huntley is with Schweitzer Engineering Laboratories, Burnaby, BC V5G 1H3, Canada.
Motaz Elshafi is with Schweitzer Engineering Laboratories, Pullman, WA 99163 USA.
Dustin Williams is with Burns & McDonnell, Kansas City, MO 64114 USA.
Digital Object Identifier 10.1109/MPE.2023.3288593
Date of current version: 21 August 2023
1540-7977/23©2023IEEE