The Global Positioning System (GPS) is a global navigation satellite system that has found prolific use in applications such as navigation, construction, and precise time synchronization. As this technology has become a large part of power system applications for time synchronization in the past several years, threats and vulnerabilities have been identified, such as jamming, solar flares, and spoofing, that can affect the proper operation of power systems. This issue of The Synchrophasor Report explores concepts of designing resilient time-distribution systems for power system applications.
One of the key requirements for synchrophasors is the precise time synchronization of the devices that are sampling the analog and digital quantities across the power system. IEEE C37.118.1 for synchrophasors recommends this accuracy requirement to be less than 1 microsecond. Note that a time error of 1 microsecond corresponds to a phase error of 0.022 degrees for a 60 Hz system and 0.018 degrees for a 50 Hz system. The synchrophasor standard calls for a total vector error (TVE) of less than 1 percent. This corresponds to a maximum time error of ±26 microseconds for a 60 Hz system and ±31 microseconds for a 50 Hz system.
However, the TVE is a summation of errors from time synchronization, instrumentation conversion, and phasor measurement processing. This time synchronization accuracy of less than 1 microsecond can be achieved with time sources such as GPS and distribution methods such as IRIG-B or the Precision Time Protocol (PTP).
GPS (shown in Figure 1) provides a high-accuracy time signal. GPS technology has seen tremendous growth in several business sectors since its inception and has become an essential part of information infrastructure across the globe. The free availability of this technology has enabled many applications for aviation, public safety, recreation, telecommunications, transportation, mapping and surveying, financial networks, and precise time for power systems.
Fig. 1. The Global Positioning System. This image is provided courtesy of the U.S. Department of Defense.
GPS comprises three segments: space, control, and the user. Figure 2 shows how these three segments form the GPS system.
Fig. 2. The three segments of GPS.
GPS relies on communication from satellites 12,000 miles from the earth and has a received signal power of –127.5 dBm, or 178 • 10-18 watts. Considering these facts, GPS is remarkably reliable, but it does have some vulnerabilities. There are several specific vulnerabilities worth considering.
There is no record of GPS spoofing attacks on clocks in electric utilities to date; however, GPS spoofing is potentially the most serious GPS vulnerability because the clock continues to operate as if it is locked to GPS, without switching into holdover mode (using the internal clock).
SEL offers several solutions that address these potential GPS vulnerabilities.
First, most modern GPS receivers have technology built in to address multipath errors. For solar flares, GPS jamming, and antenna failures, the clock will sense a loss of the GPS signal and switch to its internal holdover oscillator. For synchrophasors, SEL recommends the SEL-2488 Satellite-Synchronized Network Clock with an OCXO holdover option. This oscillator provides holdover accuracy within 5 microseconds per day and on average maintains 1-microsecond accuracy for a 4.8-hour loss of GPS signals. The OCXO oscillator is oven-controlled, and its performance is immune to temperature variations between 0° and 50°C.
In addition, the SEL-2488 provides protection from GPS spoofing attacks. The SEL-2488 with the dual constellation antenna accessory receives signals from two satellite constellations, GPS and the Russian Global Navigation Satellite System (GLONASS), to validate GPS time signals (see Figure 3). If the SEL-2488 senses a discrepancy between GPS and GLONASS, the device alarms, notifies the user via automatic Syslog messages, and goes into the holdover mode. The SEL-2488 is the first clock in the industry to provide such capabilities.
Fig. 3. SEL-2488 satellite signal verification.
As another layer of protection, the SEL-3400 IRIG-B Distribution Module supports redundant time sources (see Figure 4). If the time quality from the primary source degrades, the SEL-3400 will switch to the second input time source. In January 2015, SEL will also add a capability to the SEL-3400 that will compare time signals from the two independent IRIG-B input sources for phase errors between the top-of-second reference pulses and the frame data between the two IRIG-B inputs. This IRIG-B authentication will provide a layer of protection from GPS spoofing attacks, signal loss, etc.
Fig. 4. Two sources connected to an SEL-3400 for redundancy.
An SEL ICON Integrated Communications Optical Network will also help protect your system. The ICON can be configured so that each node has its own local GPS receiver (internal clock). The network will select the most accurate time source based on evaluating the accuracy of a predefined hierarchy of assigned clock sources. This mitigates several GPS vulnerabilities, including antenna failures and GPS jamming at a single node. The nodes will distribute the best time based on all the time inputs they receive to the downstream devices.
Fig. 5. Typical SEL ICON SONET ring network.
With all the clocks in the system networked, the loss of one or multiple time references will not disrupt the distribution of high-accuracy timing information. This allows high-accuracy time to be distributed across a wide area, enabling control systems to continue receiving high-accuracy time references after a temporary or sustained loss of GPS timing.
GPS is a remarkably effective source for precise timing, but for important applications, such as synchrophasors, GPS vulnerabilities should be considered and the mitigation techniques that are offered in several SEL solutions should be evaluated.