Secure Timing Infrastructure For Power Utilities - App Note
Technical & Application Notes
ABSTRACT
A crucial system of any power utility substation and network equipment, is the timing system. Most modern timing systems are dependent on GPS reference which is extremely vulnerable to interference both malicious and unintentional. In this application note we discuss how to implement White Rabbit timing protocol to securely and reliably protect critical power grid monitoring and protection systems that use GPS as a reference, from interference that could cause serious damage to grid infrastructure and interrupt service.
Timing systems are used to timestamp measurements of (SCADA) control system and its activities across the power grid. A reliable timing system also helps synchronize critical equipment – both within substations, as well as among substations across the grid – to align their data for centralized analysis and control. As automation gets deployed, timing becomes even more critical given automated actions by next generation systems are all based on sensors that measure and perform their functions based on time. (ex. Temperature measurements happen every “x” seconds or fractions of a second).
Because current configurations of substation networks rely on multiple GPS antennas and clocks at each substation, they are vulnerable to radio signal interference including Jamming and Spoofing attacks from malicious actors and unintentional Interference, as well as lightning strikes and other environmental effects (sun, wind, ice etc..). These types of interference with the GPS signal and other signals can potentially cause outages as well as cause damage to the grid and are a security risk to grid systems.
SUBSTATION TIMING INFRASTRUCTURE TODAY
The current configuration of timing technology inside a substation includes a group of important devices that control the operation of the grid as well as electricity flow. Some of the main elements in the grid that perform critical functions and are dependent on timing include:
• GPS based clocks
• GPS Antenna(s)
• PMU – Phasor Measurement Units
• Protection Relays
• Others
A Phasor Measurement Unit (PMU) performs frequency measurements in real time for monitoring, protection and control of the power grid. PMUs require microsecond-level time synchronization to perform their core function: calculating synchronized phasors (magnitude and phase angle) of voltage and current waveforms across geographically dispersed locations. Deviations in timing reference propagate into critical errors across grid operations.
MPACT OF TIMING ERRORS ON PMU PERFORMANCE
- Measurement Uncertainty and Phasor Estimation
• Timing errors introduce phase angle deviations in phasor calculations. A 1 ms (Millisecond) timing offset can cause a 38% Total Vector Error (TVE), while 26 µs (Microseconds) corresponds to 1% TVE at 60 Hz.
• A 38% Total Vector Error (TVE) in phasor measurement units (PMUs) would cause severe disruptions to power grid operations, including mis operation of protective devices, inaccurate grid modeling, and increased risk of cascading failures. This level of error far exceeds the IEEE C37.118 standard’s 1% TVE threshold, indicating catastrophic timing or measurement failures.
• Phase errors distort representations of grid conditions (e.g., misrepresenting power flow direction or magnitude) and compromising situational awareness. - Grid Monitoring and Control Applications
• Fault Detection: Timing inaccuracies delay or misidentify fault locations, hindering rapid isolation of disturbances.
• Power Flow Calculations: Microsecond-level time shifts alter phase angles, leading to incorrect power flow analysis and transmission loss estimates.
• Synchrophasor Networks: Desynchronized PMUs produce inconsistent data, undermining wide-area monitoring systems designed to prevent cascading failures. - Vulnerability to Cyber Threats
• GPS spoofing/jamming can manipulate PMU timing by injecting false signals. This enables “delay attacks,” where adversarial time shifts corrupt phase angles, falsifying grid analytics (e.g., hiding line congestion or inducing false alarms) .
• GPS signal weakness makes PMUs susceptible to low-cost easy to perform “jammer” radio attacks, risking uncontrolled grid behavior from easily obtained jamming equipment. - Mitigation Strategies
• Redundant Timing Sources: Combining GPS with atomic clocks or terrestrial networks (e.g., White Rabbit and other network based timing technologies) reduces dependency on vulnerable GPS satellite signals.
• Anomaly Detection: Monitoring timing integrity (e.g., abrupt phase jumps) helps identify spoofing.
• Standardization: IEEE C37.118 mandates ≤1 µs timing accuracy for PMUs, while White Rabbit timing protocol can deliver assured (deterministic) timing reference over optical networks that are impervious to satellite (radio based) interference.
Consequences of Timing Failures
Historical events, like the 2003 Northeast Blackout, underscore the role of timing in grid resilience. (What Really Happened During the 2003 Blackout? — Practical Engineering) The northeast blackout cascade could have been avoided if the protection systems were appropriately synchronized.
Desynchronized monitoring impedes real-time diagnostics, allowing localized faults to cascade. Without precise time, grid operators lose the ability to:
• Coordinate and trigger protective relays.
• Validate system stability.
• Reconstruct events post-disturbance.
Timing accuracy is non-negotiable for PMUs, as microsecond errors propagate into phasor inaccuracies, flawed grid models, and exploitable vulnerabilities. Secure, multi-layered timing architectures and adherence to IEEE standards are critical to maintaining grid reliability. White Rabbit timing technology ensures timing availability and accuracy so PMUs can perform as per their design, independent of GPS and its inherent interference vulnerability to jamming and spoofing.
Impact of Timing Errors on Protection Relay Performance
Precise timing is critical for power grid protection relays, as even microsecond-level errors can cause miscoordination, delayed fault response, and system instability.
GPS jamming and Spoofing
- GPS Dependency Risks: Over 90% of grid timing relies on GPS signals, which are weak and vulne-rable to jamming/spoofing. Spoofing attacks can induce deliberate timing errors, falsifying relay data and triggering incorrect operations.
- Inherent Relay Timing Errors: Standard relays exhibit intrinsic timing inaccuracies:
These errors compound during fault conditions, requiring timing safety margins.
PROTECTION RELAY TIMING ERROR:
All protection relays have errors in their timing in comparison to the ideal protection characteristic as specified in IEC 60255. For a protection relay defined to IEC 60255, a protection relay error index is cited that fixes the maximum timing error of the protection relay. The timing error has to be taken into consideration when finding out the grading margin.
PROTECTION RELAY OVERSHOOT
When the protection relay is de-energized, tripping may continue for a little longer until any kept energy has been released. To illustrate, an induction disc protection relay will have kept kinetic energy in the motion of the disc; static protection relay circuits may have energy kept in capacitors. Protection relay design is aimed to minimize and absorb these energies, but some adjustment is typically required. The overshoot time is determined as the difference between the tripping time of a protection relay at a defined value of input current and the maximum duration of input current, which when abruptly decreased below the protection relay tripping level, is insufficient to cause protection relay function.
PROTECTION RELAY TIME GRADING MARGIN
The time interval that must be granted between the tripping of two nearby protection relays to accomplish correct discrimination between them is known as the grading margin. If a grading margin is not given, or is not enough, more than one protection relay will enter a short circuit, leading to troubles in finding out the position of the short circuit and unneeded loss of supply to some devices.
Mitigation Strategies
• White rabbit Timing Protocol: Implementing White Rabbit timing protocol reduces time transfer errors to <1 ns, guaranteeing accurate event sequencing and fault analysis. White rabbit can be converted to IRIG, PTP, 1PPS and other timing protocols as needed by PMU equipment.
• Redundant Timing Architectures: Combining GPS and terrestrial sources (e.g., fiber-optic White Rabbit and atomic clocks) protects from radio based satellite signal vulnerabilities.
• Anomaly Detection: High accuracy monitoring for abrupt phase-angle shifts or timing discontinuities (e.g., leap seconds) identifies spoofing attempts quickly and safely.
Systemic Risks
• Cascading Failures: Desynchronized relays during the 2003 Northeast Blackout delayed fault isolation, expanding the outage.
• Cyber-Physical Threats: GPS spoofing induces relay misoperations, hiding line congestion or creating false disturbances.
Timing accuracy is non-negotiable for protection relays, as errors directly compromise fault response, grid stability, and cybersecurity. Adherence to IEEE standards (e.g., C37.118) and deploying assured resilient timing architectures are critical to ensure operations and protection.
HOW TO SECURELY PROTECT SUBSTATIONS IF GPS IS LOST?
Both PMUs and advanced protection relays rely on GPS for precise time synchronization.
If malicious actors intentionally use a GPS jamming transmitter near a substation, or if nearby vehicles are carrying a GPS jammer, it will cause the GPS signal at the substation to be lost due to interference (Figure 2). If PMU drifts outside for the 26 ms (1% TVE) threshould, the PMU could indicate a fault and trigger protection equipment erroneously. This time error can also impact other equipment such as event & disturbance recorders, frequency measurements, sampled values and travelling fault locators. Without correct timestamps, the PMUs data can no longer be trusted by other devices in the network infrastructure. SCADA engineers working at the control centers may not be able to determine the substation system’s state which can lead to missed warnings.
LEGACY SUBSTATION TIMING
Substations are usually connected by an optical fiber ring. Each has its own master clock and GPS antenna. Failure at any one of these points could potentially cause a disruption to the substation and distribution area. In parallel, a fault in a substation must be isolated so as to not cause disruption to adjacent substations (cascade effect). This prompts the need for a secure, resilient timing reference solution that is not affected by GPS interference.
LEGACY SUBSTATION TIMING
A spoofing attack might cause the protection relay to trip unnecessarily, causing outages and broader failures. Improperly synchronized protection relays might refuse to trip because calculations are based on incorrect time, phase and frequency measurements, risking damage to infrastructure and potentially service outage.
If the protection scheme can’t confirm when key events are happening, and power flow, it may ground the incoming power to prevent feeding power incorrectly into a faulted or unstable grid. This is a protective measure—but effectively, it means taking the substation offline temporarily.
As you can see, most of the equipment controlling a substation relies on GPS satellite signals. Because GPS satellites are very far away from Earth’s surface (12,550 miles AGL) their signal strength is weak and can be easily manipulated. Tampering with GPS signals comes in primarily two forms:
• 1. Jamming, whereby the substation antenna only receives signal noise, or,
• 2. Spoofing, whereby a malicious transmitter sends a signal to the substation antenna, pretending to be a satellite signal, and controls what the antenna sees and provides it with the incorrect time and position data.
GNSS interference can cause substation clocks to use a secondary reference that is lower accuracy (PTP over long distances or T1 frequency). This is not ideal as substations may be separated by large distances and the accuracy of PTP degrades the farther it must travel. T1 frequency is only available in older locations. Legacy equipment is being upgraded to ethernet (PTP) and fewer substations will support this technology over time.
THE ROLE OF RESILIENT TIMING (E.G. WHITE RABBIT PROTOCOL)
SECURE NEXT-GEN SUBSTATION TIMING UPGRADE – STEP 1
Because GPS can be a single point of failure, power utilities are investing in redundant, resilient time distribution systems that support White Rabbit protocol (a sub-nanosecond accurate Ethernet-based timing system that guarantees the delivery of time, frequency and phase). Figure 4.
As mentioned above, White Rabbit (WR) is an ultra accurate time transfer protocol that achieves sub-nanosecond accuracy over optical networks. It can synchronize substations and network equipment with extreme precision. Because White Rabbit can distribute the timing signal using a dedicated optical fiber link, it can eliminate the need for GPS antennas at each substation.
How does WR work?
WR uses layer 1 syntonization and existing optical fiber links to guarantee time delivery. PTP, by contrast, is affected by network traffic and not guaranteed. The White Rabbit Time Protocol is characterized by being highly deterministic, meaning it’s a guaranteed delivery of time data from connected nodes. Figure 5.
White Rabbit can transfer the time signal much faster and with higher accuracy than precision time protocol, PTP. Reaching sub-nanosecond accuracy, connected network nodes leveraging the White Rabbit time protocol can maintain a better accuracy than PTP over significantly longer distances. Figure 6.
PTP POWER PROFILE NETWORK MODEL FOR SUBSTATION (IEC 61850-9-3)
SECURE NEXT-GEN SUBSTATION TIMING UPGRADE – STEP 2
Once White Rabbit switches with dual references have been implemented at each substation, you can re-move the antennas at substation (Figures 7 and 8) protecting them from any jamming or spoofing attacks.
In step 3 of a secure timing for substation migration, as substation clocks age, then can be removed and White Rabbit timing switches can convert Whitte Rabbit timing from the network to substation timing protocols. This allows for legacy equipment to continue to use their timing singals, but removes the risk of failure of the substation clock. Since substation clocks have oscillators that are the main cause of clock failure over time, migrating to the White Rabbit switch provides reduced component failure risk and reduces the cost of replacing legacy clocks. As substation expansion occurs, deploying White Rabbit switches enables lower OPEX of the equipment but also lowers the cost of installing and maintaining GPS antennas.
SECURE NEXT-GEN SUBSTATION TIMING UPGRADE – STEP 3
It is important to note that this upgraded system architecture DOES NOT require the replacement of legacy hardware.
COST OF INSTALLATION AND MAINTENANCE OF GPS ANTENNA
Maintenance is variable based on the number of years antennas, arrestors and cable is deployed, but is a cost added to the above. By migrating to the implementation of White Rabbit timing over the optical network, these costs are eliminated.
CONCLUSION
Implementing White Rabbit deterministic timing delivery technology such as the Safran WR-Z16 guarantees timing performance and service. It protects against GPS interference by separating the points of failure to only the reference nodes which can be geographically far apart for redundancy.
The White Rabbit Secure Timing for Power Utilities solution presents other advantages:
• Fewer antennas reduce risk of GNSS interference.
• No antennas at substations means no risk of outage due to lightning strikes, antenna aging or other environmental impacts.
• Fewer antennas to install and maintain reduces costs.
• Fewer GPS references in the network mean fewer points of failure/risk.
• Fewer GPS references means a more simple timing distribution architecture.
• Simplified timing architecture means easier identification of faults/troubleshooting and increases re-liability. You will have time synchronization for your substation network equipment – even without GPS.
• It will entail a more secure and tamper-resistant timing infrastructure.
• White Rabbit reduces complexity, risk and cost.
REDUCE YOUR RISK OF OUTAGES DUE TO GNSS INTERFERENCE & CONTACT US TODAY
If you have a unique requirement for power utilities timing or substation timing and synchronization, reach out to us directly. We can provide both precision timing products as well as custom synchronization tech-nology solutions. Request a quote today.