Substation GNSS clock: holdover, redundancy and risks

Short answer

A substation clock takes its time from GNSS satellites. When it loses the signal it goes into holdover: it keeps delivering time from its internal oscillator, which drifts little by little. How long it lasts depends on the oscillator and on the accuracy the applications require. To avoid depending on a single receiver, two clocks are used, with automatic best master selection in PTP, protected antennas and alarms that reach SCADA.

Why the clock matters

Every device in a substation needs the same time. Ordering events needs accuracy in the order of one millisecond; sampled values, synchrophasors and traveling-wave fault location need accuracy in the order of one microsecond. Time synchronization in substations explains the accuracy classes and distribution methods (IRIG-B, SNTP and PTP).

The reference is almost always a clock with a GNSS receiver (GPS and other constellations) and its antenna on the control house roof. That dependence on a very weak radio signal arriving from space is the weak point of the system.

Holdover: what happens when the satellites are lost

If the antenna is damaged, the cable is cut, construction work blocks the sky or there is interference, the clock stops receiving the signal. It does not shut down: it goes into holdover and keeps delivering time from its internal oscillator, which was disciplined by GNSS while the signal was there.

From that moment the oscillator drifts. How much it drifts depends on its technology: a basic quartz drifts faster than an oven-controlled crystal oscillator (OCXO), and that one faster than a rubidium oscillator. The clock data sheet states this performance as the error accumulated after a given time without signal.

Whether holdover is acceptable is defined by the most demanding application:

Event recording: tolerates millisecond drift, which a good oscillator takes a long time to accumulate.
Sampled values and synchrophasors: need microseconds. With a modest oscillator, that margin runs out much sooner.

Clock states after losing the GNSS signal

01SynchronizedThe oscillator follows GNSS and the error is minimal
02Holdover within specificationWithout satellites, the oscillator keeps the declared accuracy
03Holdover out of specificationAccumulated drift exceeds what the applications require
04Synchronized devicesFlag the time as unreliable, and functions that compare samples block

In PTP, the master clock reports its state by changing its clock class. Under the IEC/IEEE 61850-9-3 power profile, a synchronized master announces class 6; in holdover within specification it moves to 7, and once out of specification it moves to a degraded class. IEDs and merging units see it and act according to their configuration.

Redundant clocks and best master selection

A single clock is a single point of failure. In high and extra-high voltage substations, and in every digital substation, two clocks with independent antennas are installed.

With PTP, both clocks announce their quality and the network applies the IEEE 1588 best master clock algorithm (BMCA). If the main clock loses the satellites and its class worsens, devices switch to following the other one without manual intervention.
With IRIG-B, redundancy requires physical switching of the output or devices with two time inputs, because each relay usually has a single input.
With PRP, the clock can be connected to both LANs, so that the failure of one network does not interrupt the time.

Two clocks with their antennas on the same mast and the same cable share the failure. Real redundancy calls for separate antennas and, if possible, receivers that use several constellations.

Jamming and spoofing

The GNSS signal arrives very weak, below the noise floor. That exposes it to two threats:

Jamming: a stronger radio signal in the same band prevents the satellites from being received. It can be intentional or accidental. The effect is the same as losing the antenna: the clock goes into holdover.
Spoofing: a transmitter imitates the satellite signals so that the receiver computes a false time. It is more dangerous, because the clock may keep reporting itself as synchronized.

The U.S. Department of Homeland Security (DHS) best practices for time sources in fixed locations, now published by CISA, broadly recommend protecting the antenna location and cabling, having a backup source with enough holdover for the expected outages, monitoring the receiver alarms and logging every outage. Some substation clocks also include detection of time or position jumps and comparison between constellations.

Time over the wide area network as a backup

When two substations are linked by fiber, time can be distributed over the wide area network as a backup reference. The technical report IEC TR 61850-90-12, wide area network engineering guidelines, includes clock synchronization among the design topics of those networks. The delicate point is path asymmetry: if the delay in each direction is not the same, the error carries over to the received time.

Which alarms to bring to SCADA

A clock in holdover can go unnoticed for days if the alarm only appears on its front panel. The minimum that should reach the SCADA system and the control center:

Loss of GNSS signal and low number of satellites.
Entry into holdover and holdover out of specification.
Change of the PTP master clock class and change of active master.
Failure of the device or its power supply.
Synchronization status reported by the critical IEDs.

If the clock has already lost synchronization and the reason is unclear, the diagnosis is in loss of PTP or IRIG-B time synchronization.

We help with time synchronization

Tiza Group designs the time synchronization of high and extra-high voltage substations and industrial plants as part of our communications engineering: redundant clocks, PTP profiles, IRIG-B distribution, alarms to SCADA and holdover tests. If a relay does not take the right time, we review its settings through remote relay configuration. Contact us.

Time synchronization in substations: GNSS, IRIG-B and PTP
PTP IEEE 1588 and the IEC/IEEE 61850-9-3 power profile
IRIG-B and SNTP
SEL-2488 clock
Meinberg, Tekron and Arbiter clocks
PTP, NTP or IRIG-B: which synchronization each application uses
Substation communications by voltage level
Substation network redundancy: RSTP, PRP, HSR or MRP
IEC 61850 transfer time: classes and measurement

References

IEC/IEEE 61850-9-3:2016, Precision time protocol profile for power utility automation.
IEEE C37.238-2017, Standard Profile for Use of IEEE 1588 Precision Time Protocol in Power System Applications.
IEEE 1588, Standard for a Precision Clock Synchronization Protocol for Networked Measurement and Control Systems.
IEC TR 61850-90-12:2020, Wide area network engineering guidelines.
U.S. Department of Homeland Security, Best Practices for Improved Robustness of Time and Frequency Sources in Fixed Locations, 2015 (published by CISA).

Frequently asked questions

How long can a substation clock work without a GNSS signal?

It depends on the oscillator and on the accuracy needed. A basic quartz oscillator keeps the millisecond accuracy of event records for much longer than the microsecond accuracy required by sampled values or synchrophasors. The figure comes from the clock data sheet, which states it as drift over a given period.

What is GNSS spoofing and why does it affect a substation?

It is the transmission of false signals that imitate the satellites so that the receiver computes a wrong time or position. The clock would keep reporting itself as synchronized with an incorrect time, which affects time stamps, synchrophasors and protection functions that rely on synchronized samples.

Which clock alarms should reach SCADA?

At least loss of GNSS signal, entry into holdover, holdover out of specification and device failure. With PTP, also a change of the master's clock class. An alarm that only shows on the clock front panel can go unattended for days.