This presentation walks through secure and dependable time sources on land and through space.

Time
is the most measured quantity in the world. It is used in many applications, and power systems are no
exception.

Precise and accurate time synchronization has lots of important applications for power systems. The
accuracy requirements range from milliseconds for synchronizing substation computers to
submicroseconds for more demanding applications like traveling wave fault location, Sampled Values
(based on IEEE Standard 61850-9-2), and synchrophasors (based on IEEE C37.118). There are also
other applications, such as disturbance recording, revenue metering, and end-to-end relay testing, that
require millisecond synchronization accuracies.
This presentation looks at how to address these applications with time synchronization solutions.

When it comes to time synchronization, there are two elements to consider. The first is the time source
itself, and the second is the time distribution methodology. Both of these elements play an important
role in the overall performance of time synchronization applications.

There are very accurate time sources available today.

The picture on the left of this slide shows the first atomic clock from the National Institute of
Standards and Technology (NIST) in 1949. This had an accuracy of 1 in 20 million parts. Atomic
clocks keep time based on the natural oscillations of atoms, which are much more stable than any
mechanical device.
The picture on the right of this slide shows an example of a Global Navigation Satellite System
(GNSS), which provides very accurate time information with global coverage by using on-board
atomic clocks on satellites in space.

In 1967, the natural frequency of cesium-133 atoms selected by the International Committee for
Weights and Measures as the basis of the international unit of timeone second.
The picture on this slide shows a diagram of an atomic clock based on cesium. Cesium atoms are
introduced into a vacuum chamber. Six lasers push the cesium atoms through a microwave cavity,
cooling them. Then the atoms get tossed up and come back down due to gravity. These oscillations of
the cesium atoms are used to develop the frequency, or timing standard, because these oscillations are
extremely stable.
Since the 1960s, atomic clock technology has continued to improve.

Around 2000, atomic clocks were developed that used laser-cooling technology with cesium atoms.
The first clock in this category is NIST-F1, which keeps time accurate to within 1 second in 100 million
years.
NIST-F2, introduced in early 2014, improved accuracy to three times better than NIST-F1, keeping
time accurate to within 1 second in 300 million years.
As this technology continues to push the limits, several applications and industries such as
telecommunications, Global Positioning System (GPS), and financial sectors are taking advantage of
this accurate time keeping.

A GNSS is a global satellite system that broadcasts information via radio signals to devices on earth.
This information can be used to very precisely determine the time of day, the position of the receiver
in three dimensions, and velocity of the receiver. It is interesting to note that these systems make use of
atomic clocks and the advances in atomic clock technology to provide this information to users. There
are several systems operated by different nation states. A GNSS has many applications, both civil and
military. The following slide provides a look at some of the GNSS systems available today.

Currently, only GPS and GLONASS have global operation. The rest of the systems are still being
developed for global coverage.
The following slide provides an example of a GNSS.

GPS is the most popular and successful GNSS available today and has seen tremendous growth in
several business sectors since its inception. The free, global availability of this technology has enabled
many applications across a diverse range of industries, including aviation, public safety, recreation,
telecommunications, transportation, surveying mapping, finance, and power utilities.
GPS consists of three segments: the space segment, the control segment, and the user segment. The
space segment consists of 24 satellites orbiting earth in 6 orbital planes to ensure that at least 4 satellites
can be seen from any point on earth at any instant. These satellites carry very accurate atomic clocks and
are continuously monitored and calibrated from the ground station, which is part of the control segment.
The ground station also uploads information into each satellite, such as the orbital data of all the
satellites, and communicates information, such as satellite health and clock errors.
The satellites in the space segment transmit information in the form of radio frequency (RF) energy
(1.575 MHz, L1 signal), known as the navigation message, at a rate of 50 bits per second. This message
also consists of unique identifiers (IDs) for each satellite, which allow the receivers to identify the
satellite that they are receiving signals from.
The user segment consists of devices and technologies that receive GPS signals and use them for
various applications. The receivers need to obtain signals from at least 3 satellites to determine their
three-dimensional positions and a signal from an additional satellite to obtain timing information. There
are commercially available GPS receivers that can simultaneously track up to 12 satellites. The receivers
have the same IDs programmed into them as those contained in the GPS signals. Receivers use these
IDs to recover timing signals from the GPS signals they receive from the satellites. This gives each GPS
receiver the capability to generate a time reference with the same accuracy as that of the atomic clocks
used inside each of the GPS satellites. The next slide provides a look at the timing performance of two
commercially available GPS receivers.

Due to the vast proliferation of GPS technology, there are receivers available commercially for a low
cost. These can be very accurate. The receivers shown on this slide are both accurate to less than 100 ns
Coordinated Universal Time (UTC).
Receiver B has a slightly tighter control on the accuracy compared with Receiver A.
Note that UTC = TAI (10 + m), where m is a leap second insertion or deletion, and that GPS time =
TAI 19 s (epoch is January 1, 1980).

10

GNSS relies on communication from satellites 12,000 miles away from earth, and the signal strength
when received is extremely weak. GNSS has some vulnerabilities that are important to understand.
One vulnerability is atmospheric interference, primarily caused by solar flares. Solar flares are the
sudden brightening on the surface of the sun due to a large release of energy (up to 6 1025 joules).
X-rays and ultraviolet (UV) radiation emitted by solar flares can affect the ionosphere, which is a layer
53 to 370 miles above the earth. Large solar flares that can impact the GPS signal occur randomly, but
average out to one to two times per year. They tend to concentrate at the end of each 11-year solar
cycle. Solar flares can last anywhere from a few seconds to an hour and can temporarily prevent a GPS
receiver from receiving a signal.
GPS receivers can also be blocked by jamming, which is noise in the 1.57542 GHz frequency range
used for civilian GPS. GPS jamming devices are illegal in the United States, but can be purchased
internationally for under $100. If a GPS jamming device is near a GPS receiver, it prevents the
receiver from maintaining a GPS lock.
GPS spoofing has been gaining some media attention recently. Because GPS signals for civilian use
are not encrypted, it is feasible for an attacker to mimic, manipulate, and replay an L1 GPS signal.
Spoofing is when an attacker intentionally generates signals that closely mimic GPS signals and
transmits them at a slightly higher power. When this is done, a civilian GPS receiver may lock on to
the spoofed signal and be susceptible to intentional shifts in the GPS timing and positioning
information created by the attacker. When spoofed, the receiver continues to operate with the
assumption of a good GPS signal. However, this signal could be manipulated significantly, causing the
receiver to output incorrect timing and position information.
This phenomenon has been demonstrated in a lab environment, but it is somewhat difficult to spoof
because the spoofer could self-spoof. Additionally, the spoofer needs to know the precise location of
the victim receiver GPS antenna.
11

Now that some of the important time sources have been discussed, it is time to look at some important
time distribution protocols available for substations.
IRIG-B is a serial protocol, while Network Time Protocol (NTP) and Precision Time Protocol (PTP)
are Ethernet, packet-based protocols.

12

IRIG-B is the de facto timing standard for substations. It is a serial time code that contains all the
information related to time and date. It is easy to design, characterize, troubleshoot, and understand.
The time information is sent using pulse-coded digital or amplitude-modulated analog signals.
An IRIG-B signal also contains bits that can be used for describing control functions to communicate
special information to the intelligent electronic devices (IEDs) using this time code. One example of
this is Time Quality and Continuous Time Quality bits that indicate whether the time source is locked
to a UTC source and indicate the accuracy when locked to a UTC source. It is important to note that
some clocks, when turned on, incorrectly advertise best time quality while sending inaccurate time
signals to downstream devices. A well-designed clock will wait to ensure that it is locked to the
UTC-traceable source and has the best time accuracy before it advertises this information to
downstream IEDs.
Note the following facts about IRIG-B:

The serial time code is 100 pulses per second.

The update rate is once per second.

Time data are sent in three words.

Binary-coded decimal (BCD) encodes seconds, minutes, hours, and the day of year.

Control function (CF) encodes years and user-defined control functions.

Straight binary seconds (SBS) encodes time of day in straight binary seconds.

13

NTP is a message-based time transfer protocol intended to synchronize computers to within a few
milliseconds.
A typical NTP server device receives time from either a GPS system or an atomic clock and outputs
time using Transmission Control Protocol/Internet Protocol (TCP/IP) or User Datagram Protocol
(UDP) over Port 123. Time is always in UTC format and includes information such as accuracy and
origin of time being transmitted.
Stratum levels define the distance from the reference clock. Stratum 0 devices are assumed to be
accurate and have no or little delay associated with them. These are usually atomic clocks or a GNSS.
A device directly receiving time from a Stratum 0 device is known as a Stratum 1 device. As the
stratum number increases, the accuracy of the devices in the stratum degrades.

14

PTP is a message-based Ethernet time transfer protocol based on the IEEE 1588 standard. This
protocol was developed with the goal of achieving submicrosecond time synchronization over packetbased networks.
In PTP, master clocks send time to slave clocks via packet-based networks. Both masters and slaves
run PTP applications in their systems. The time synchronization errors between masters and slaves
depend on the message time-stamp accuracy, both at the masters and the slaves.

15

A master device sends a synchronization message at time t1. This can be done in either a one-step or a
two-step way.
The one-step way embeds the time stamp t1 in the synchronization message and send it.
The two-step way send the synchronization message first, and send the time stamp information as a
follow-up message. The slave receives the synchronization message at time t2 and records both the
time stamps t1 and t2.
With the master sending the synchronization message, the slave cannot correct its time accurately
because of the message path delay. In order to truly compute the offset between the master and slave,
the path delay needs to be computed.
For this purpose, the slave sends a message called delay-req to the master at time t3. The master
receives this message at t4 and sends back a message called delay-resp with t4 embedded in that
message.
At the end of these message exchanges, the slave has the t1, t2, t3, and t4 time stamps. Using this, the
slave computes its time offset from the master.

16

When it comes to synchronization accuracy, IRIG-B is very accurate and can achieve <100 ns
accuracy.
PTP improves upon NTP and enables submicrosecond accuracies, but all the devices on the network
must be PTP-aware and support hardware time-stamping. Otherwise, PTP is no different than NTP.
Both PTP and NTP promise scalability of time distribution to lots of end devices, but it is important to
note the tradeoffs between proper network design and the required performance.
Finally, PTP was designed to distribute time using the same Ethernet network that carries Sampled
Values per IEEE Standard 61850. Although it eliminates the extra cable that IRIG-B requires, it is not
a plug-and-play protocol.
Following are the details of the implementation of each of these protocols:

IRIG-Bpoint-to-point connections with dedicated cable.

PTPmany-to-many connections with network design.

NTPmany-to-many connections with network design.

17

When it comes to dependable and secure time synchronization, there are three key attributes to
consider: precision and accuracy, cybersecurity, and reliability.
Time synchronization should be precise and accurate. Accuracy is how close something is to a
reference. The best way to understand this is that the average of some number of measurements used
as a reference defines the accuracy. Precision is how close each of the individual measurements are to
each other and to the average. Precision defines how tightly controlled an observed or measured
quantity is. Accuracy defines how close each individual measurement is to the reference value.
Cybersecurity is an important feature for time synchronization in substations. This has to do with how
users interface with these clocks, how the clocks respond to events that occur during their operation,
and so on.
Time synchronization should be reliable and should have the same levels of reliability as other
protection devices, such as relays in a substation.

18

This slide shows the precision and accuracy for an IRIG-B signal for two clocks that specify 40 ns of
average accuracy in their datasheets.
The top graph is the IRIG-B output accuracy measurement with respect to UTC for the SEL-2488
Satellite-Synchronized Network Clock. The zero mark represents the reference. As is shown on the
graph, the SEL-2488 is very accurate and precise during multiple measurements taken over
50,000 seconds.
The bottom graph is the IRIG-B performance of a Brand X clock, measured using exactly the same
setup. As is shown on the graph, the IRIG-B output is less accurate than what is specified, but it also
lacks tighter control, i.e., it has lower precision.

19

This slide shows the same data in a different format. Again, the top graph is IRIG-B output for the
SEL-2488, which is very close to the reference zero and is also more precise.
The bottom graph is the IRIG-B performance of a Brand X clock with less precision (control) and less
accuracy than the specified 40 ns accuracy in the product literature.

20

Another important feature for substation clocks is the holdover accuracy.

Holdover is defined as the ability of the clock to keep accurate time in the event of losing its primary
time source (e.g., loss of GPS signal due to antenna failures, jamming, and so on).
Two SEL-2488 clocks (one with TCXO and the other with OCXO) were disconnected from their time
source (GPS) after locking onto the GPS signals. The table on this slide shows the SEL-2488 holdover
performance for two the options after the GPS was disconnected.
The first option is a standard TCXO (temperature-compensated crystal oscillator) that has a holdover
performance of 36 s per day compared to a reference time (at a constant temperature) and about 300 s
per day when the temperature changes within 1C.
With an OCXO (oven-controlled crystal oscillator) option, the performance is improved drastically. The
SEL-2488 can keep time to within 5 s UTC after 24 hours in holdover.

21

In the event that a clock loses its GPS signal, it will switch to its holdover oscillator as the time source.
In this test, after one hour of GPS signal loss, Brand X drifted by over 47 s. The SEL-2488 standard
TCXO maintained accuracy within 1 s due to an innovative patented holdover algorithm. The OCXO
performed even better, with a holdover error of only 136 ns. With either holdover option, the SEL-2488
has far superior accuracy while in holdover mode compared with Brand X.

22

The SEL ICON has the ability to distribute time over a wide-area network (WAN) with better than 1 s
accuracy.
The ICON accepts a signal from a GPS antenna or an IRIG-B signal from a satellite clock, such as the
SEL-2488. The ICON also provides two IRIG-B output signals at every node.
In the example shown on this slide, one ICON receives a signal directly from a GPS antenna, while
another ICON receives its time from an IRIG-B signal from a satellite clock. Each ICON not directly
connected to a time source provides 1 s accuracy IRIG-B signals from the distributed network timing to
the IEDs within their substations.
The availability of high-accuracy time at each node in the network also allows the ICON to provide
channel latency monitoring of all time-division multiplexing (TDM) circuits, which is an industry first.
Channel latency measurements are available down to the Digital Signal 0 (DS0) level for each individual
channel.

The GPS receivers in the ICON also provide primary and backup Stratum 1 clocks for synchronous
optical network (SONET) transport.

23

In the event of a GPS signal failure, the ICON network maintains relative time with an accuracy of 1 s.
This allows devices at all substations to continue to receive time signals.
When the SEL-2488 is used, the system will maintain 1 s accuracy to UTC for up to 4.8 hours.
A GPS signal failure at one or all of the sites will not result in the isolation of this site from a timing
perspective. The system will maintain relative synchronism. In large networks that are sufficiently
interconnected, very large geographic areas can maintain synchronism.
When GPS connectivity is restored, the system automatically drifts back into UTC in a coordinated
fashion.
The following are some reasons that GPS signals might be lost:

Solar flares.

GPS jammers.

GPS spoofing.

24

25

When it comes to security, it is important to follow the defense-in-depth principle.

The SEL-2488 can track two independent satellite constellations simultaneously in real time,
extracting time signals independently from these two constellations. The SEL-2488 compares the
variety of information received from these two constellations, and in the event of mismatch between
the time information reported by these constellations, it alerts the user and, in certain cases, switches
into holdover.
The SEL-2488 also come with a secure web interface with X.509 certificate authentication for secure
access to the device.
Another important feature is user authentication with role-based access. Any user who interfaces with
this device must create and enter a user ID and password that is stored in centralized authentication
servers. Additionally, any interactions with this device that include logging in, changing settings, and
so on are time-stamped and sent to a central syslog server.

Any events that happen within the device (e.g., device losing satellite lock, change in settings, leap
second event) are also logged both locally to the device and on a syslog server with accurate time
stamps for traceability.

26

This slide shows a screenshot for the SEL-2488 dashboard. This interactive dashboard shows the
satellite signal strengths along with SkyView, where a user can look at the live satellite positions as
seen by the antenna. This helps with antenna installation for optimal performance of the SEL-2488.

27

Reliability is a very important feature for a substation clock and the SEL-2488 meets and exceeds the
IEEE 1613 standard for networking and communications equipment for substations. It also has a wide
operating temperature range of 40 to +85C, which is not common in substation clocks.
The product can be configured to have dual-redundant, hot-swappable power supplies to provide
power from two independent sources.

28

To build secure and dependable time synchronization, users need to do the following:

Pick the right time source with security and reliability for the application.

Pick an accurate and effective time distribution protocol.

Understand accuracy requirements and know that specifications might not tell the
full story.

Understand cybersecurity needs.

Insist on reliability, because reliability is as important for time synchronization as for protective
relays.

29

There is technology available today with satellite signal verification (Multi-GNSS support), precision
and accuracy, long holdover stability, time code outputs, security features, and so on.

30

31

32