Timing Resilience from the Ground Up
Designing resilient timing systems is essential in today’s interconnected world, where precise position, navigation, and timing (PNT) support critical industries like defense, telecommunications, and transportation. Major headlines today focus on the rise of GNSS jamming and spoofing incidents, impacting the GNSS signals that so many systems rely on PNT services.
However, resilience spans beyond jamming and spoofing. It also addresses potential adversities such as antenna/receiver hardware failure, cyberattacks, multipath effects, and space-based events like solar storms or ionospheric disruptions. These effects can lead to costly outages and even dangerous incidents, e.g., train derailments from navigation errors or cell tower failures, impacting the response of emergency services.
The rise in GNSS jamming and spoofing incidents and the potential devastating effects of losing timing underscore the importance of designing resilient timing systems.
IEEE P-1952 Levels of Resilience
An emerging guidepost for designing resilient timing systems is the IEEE P-1952 standard, which categorizes five levels of resilience for PNT user equipment (Fig. 1). System architects and designers should use these resilience levels as benchmarks for their PNT system designs.
The idea is that it’s not enough to simply keep working. Rather, a system should intelligently evaluate the integrity of its timing sources and dynamically adapt to emerging threats.
Understanding GNSS Disciplined Oscillators
With the P-1952 levels of resilience in mind, a practical starting point to a resilient timing system is a GNSS Disciplined Oscillator (GNSSDO) module, a widely adopted timing system that can work as standalone user equipment (UE) or be embedded into a larger system design.
A GNSS Disciplined Oscillator module starts with the clock and timing function, which comes from the GNSS receiver, an external reference like a cesium atomic clock, or a local oscillator — often a crystal oscillator (OCXO or TCXO) or an embedded atomic clock (e.g., Chip-Scale Atomic Clock, CSAC).
The system operates by using the received GNSS signals from constellations like GPS or Galileo and extracts timing data to correct the local oscillator’s inherent drift. The GNSS receiver or external frequency reference generates a 1-pulse-per-second (PPS) signal, which steers the local oscillator. GNSSDO modules typically output coherent 1-PPS and 10-MHz signals for use by downstream users, systems, and sensors. Figure 2 presents a block diagram of a typical GNSSDO.
In this common design, timing primarily depends on the received GNSS signals. However, with GNSS jamming and spoofing on the rise, users can’t trust these signals to always be available.
One method for achieving resilience during GNSS denial is to use local oscillators that have good holdover, which means that the local oscillator can maintain timing in relation to the GNSS signal within a certain degree for a specified period of time. Generally, atomic clocks offer better holdover than crystal oscillators, so many designers will add atomic clocks, such as a CSAC or rubidium miniature atomic clock (MAC), to their timing system.
The quality of the clock and the required precision for your application will determine the length of holdover that can be achieved with these clocks. When evaluating an OCXO versus an atomic clock for use in a timing system, designers should consider the tradeoff between power, cost, size, and performance.
OCXOs offer excellent short-term stability and phase-noise performance, which is useful in applications that need clean signal generation and temporary holdover is acceptable. Atomic clocks provide long-term stability, enabling longer and more accurate holdover during GNSS outages. However, they can be higher power and more expensive than OCXOs. The choice of local oscillator will also determine if a system meets P-1952 resilience levels 2 and 3.
Clocking and Holdover Algorithms
An important notion to understand is a system that just uses the timing signal directly from the GNSS receiver isn’t a resilient timing system; it’s just a timing reference. Rather, resilient timing should be based on the combination of a local clock, a clocking algorithm, and the reference signal.
In the case of GNSSDOs, the reference is GNSS. The clocking algorithm should continuously observe the local clock and the GNSS reference signal and subsequently model the states of these variables to have a better understanding of the ongoing relationship between the two.
The algorithm will model the expected performance of the GNSS reference. Therefore, if the reference becomes unavailable, the system will hold over time more precisely and for longer.
When the GNSS reference becomes available again, the system is likely to be closer in phase and frequency to the GNSS reference. Thus, the system can steer back to it faster than if it only considered the characteristics of the local oscillator, such as aging or correction. The ability for a system to recover quickly from a threat or adversity meets the P-1952 level 2 requirement.
GNSS Anomaly Detection
Another important tenet of timing resilience is the ability to detect when a GNSS receiver is being jammed or spoofed. This can be done in several ways, such as looking at the observables coming out of the receiver, including signal-to-noise ratio (SNR), carrier phase, or time offset anomalies.
For instance, a sudden drop in SNR or an unexpected shift in carrier phase could suggest potential jamming, while a consistent time offset misaligned with the local clock may suggest spoofing. An advanced detection technique is leveraging the local clock as a high-precision reference.
By comparing the GNSS-derived 1-PPS signal against the local oscillator’s predicted time, which can be done with nanosecond resolution, the system is able to flag discrepancies that are difficult to replicate with jamming or spoofing at such granularity. This approach, supported by the algorithms modeling GNSS and local clock states, is a robust anomaly detector, as it meets the level 1 and level 5 P-1952 requirements.
Alternative PNT (ALT PNT)
As GNSS vulnerabilities persist, ALT PNT represents a new frontier in timing resilience. Significant research and capital are being invested into GNSS alternatives, with low-Earth-orbit (LEO) satellite constellations leading the charge. Due to their low orbit, LEO satellites provide much higher signal strength compared to the GNSS constellation, making it harder to jam or spoof, while also allowing the signal to be acquired by an indoor antenna.
When considering the use of these alternatives, it’s important to recognize that these LEO constellations tend to have inferior timing performance than GNSS. Consequently, they should serve as an aid to enhance the ability to detect jamming and spoofing and act as a fallback when GNSS signals aren’t available, rather than a primary reference source.
The addition of ALT PNT to the timing system adds yet another layer of resiliency. Other ALT PNT technologies being investigated include eLORAN, geostationary satellites, and signals of opportunity, such as broadcast TV and FM radio.
It’s widely understood that there’s no silver bullet when it comes to ALT PNT. Emerging technologies will contribute to the layered approach for resilience, with each technology having unique advantages and disadvantages, just like GNSS. The ability to fall back to these alternative methods during GNSS adversities provides new methods of achieving resilience.
Summary
The pursuit of resilient timing systems is more critical than ever as the RF spectrum becomes more contested by the day, threatening the backbone of PNT-dependent industries. By leveraging high-performance local oscillators with advanced clocking and holdover algorithms, GNSS anomaly detection, and diverse reference sources, designers can field systems that meet the levels of protection outlined in the IEEE P-1952 standard.
Microchip Technology offers many of the products and technology solutions described in this article, including systems with clocking and holdover algorithms, BlueSky software, and GNSSDO modules. Timing failures aren’t going away, but systems armed with the right layers of resilience can help prevent disasters.