Trusted time: the clock behind every observation

01A value is also a moment

An observation answers two questions at once: what was measured, and when. Rainfall totals, grid phase, vessel positions and seismic arrivals all lose their meaning when the clock behind them drifts.

A few microseconds rarely matter to a reader of a weather report. They matter a great deal to a radio network sharing spectrum, a grid comparing phase across a region, or an analyst lining up arrivals from many sensors.

Coordinated Universal Time is the international reference scale that national laboratories realise and compare, and it is the moment every network ultimately points to¹.

National metrology institutes keep official time and distribute it by radio, internet services and satellite time transfer, so traceability starts in a laboratory and ends at a field instrument².

For an observing network, trusted time means three things. The clock is traceable to that reference, its error is known and bounded, and anyone using the data can see both facts.

02Where field time comes from

Most field sites take time from navigation satellites, because a small antenna delivers it almost anywhere. Telecom networks then carry phase and time across fibre with the precision time protocol and its telecom profiles³.

Reference clocks at the top of that chain have defined timing characteristics, and enhanced reference clocks add atomic stability so they can hold time much longer without satellites⁴⁵.

Between the reference and the edge, boundary clocks and end clocks are specified so the error each one adds stays within a known allowance⁶.

The network as a whole is planned against a time and phase budget, which sets how much error the applications at the end can tolerate⁷.

Each step in this chain is a contract between neighbours. The reference promises a bounded error to the boundary clock, the boundary clock promises one to the site, and the site inherits the sum.

A field site sits at the end of all this, often far from fibre. It usually combines what it can reach: a satellite antenna on the mast, network time where a link exists, and its own oscillator for the moments when both are gone.

03Why satellite time alone is fragile

Satellite signals arrive very weak, which makes them easy to drown out or imitate. Aviation regulators now treat jamming and spoofing as a growing safety risk rather than a rare event⁸.

Airline data showed GPS signal loss events rising by 220 per cent between 2021 and 2024, and the same interference reaches every receiver in range, not only aircraft⁸.

Governments have asked owners of critical infrastructure to describe how they use positioning and timing services and how each system handles their disruption or manipulation⁹.

Interference is also local and patchy. One site may lose its signal while a neighbour a short distance away keeps it, which is why comparing sources across a network is so revealing.

For an observing site the lesson is simple. A single time source is a single point of failure, and a silent failure is worse than a loud one.

Loud failures are easy to handle: the clock knows it has lost its reference and says so. Silent failures are the dangerous ones, when a receiver keeps reporting confident time that has been quietly pulled away from the truth.

04Keeping honest time through an outage

When every reference is lost, a site clock keeps counting on its own oscillator. This is holdover, and its quality depends on how stable that oscillator is.

Telecom time budgets bound how far a clock may drift before applications at the end start to fail⁷. Enhanced reference clocks exist precisely to stretch that window⁵.

The simulator shows the trade. A small frequency offset adds error slowly, and a tight time budget runs out sooner. Choose the oscillator for the longest outage the site must ride through.

Power and temperature play their part too. An oscillator kept warm and powered through an outage holds time far better than one that restarts cold, so timing and power design belong together.

Honest holdover matters as much as long holdover. The site should mark every value taken while holding over, and widen its stated time error as the hours pass.

05Proving the time, not only keeping it

Time signals can now carry their own evidence. Network Time Security adds cryptographic protection to the network time protocol, so a client can tell a genuine server from an impostor¹⁰.

Galileo offers navigation message authentication on its open service, so receivers can check that the navigation data they decode was really broadcast by the system¹¹.

At the site, the clock compares its sources continuously. A sudden jump in satellite time that the network and the local oscillator do not share is a sign of interference, and the site can reject it.

Each check becomes part of the record. The authentication result and the source comparison sit beside the timestamp, so a value carries the proof of its own moment.

Authentication does not replace layering. A genuine signal can still be blocked, so a site needs both proof that its sources are real and another source for the moments they disappear.

06Designing a site for trusted time

Start from the applications, not the clock. Work out the time error each application at the site can tolerate, then plan the whole chain against that budget⁷.

Give the site more than one way to learn the time. A satellite antenna with a clear view of the sky, network time where a link exists, and a local oscillator sized for the longest outage the site must survive³.

Place the antenna with interference in mind. Mount it high and clear, keep it away from transmitters on the same mast, and log the signal quality it sees so that changes stand out.

Protect the time path as carefully as the data path. Authenticate network time where the protocol allows it, check satellite navigation data where the system offers authentication, and treat a disagreement between sources as an event to record¹⁰¹¹.

Test the design before relying on it. Disconnect each source in turn, watch how the clock behaves, and confirm that the record reports every change of state as it happens.

Finally, publish what the clock knows about itself. Source, state and estimated error belong in the record beside every value, in open terms that any user can read.

07Time quality that travels with the data

A timestamp without its quality forces every user to guess. A timestamp with its source, clock state and estimated error lets each user decide whether it is good enough for their purpose.

Grid operators, radio networks and transport systems ask different questions of the same moment. Shared descriptions of time quality let them answer those questions from the data itself⁷.

It also changes how problems are found. When many sites publish their time quality, a sudden drop across one region points to interference there, and the network itself becomes a sensor for threats to timing.

This is also how many networks become one. When stations owned by different operators publish time quality in the same open terms, their observations can be compared, merged and audited across borders.

Auditors gain as much as engineers. When a decision rests on a sequence of events, the record shows not only the order in which things happened but how certain that order is.

Nexus Observatory Inc. builds observing sites and data services on this principle: every value leaves the site with the evidence of when it was measured and how well that moment is known.