Note : Les descriptions sont présentées dans la langue officielle dans laquelle elles ont été soumises.
CA 02892153 2015-05-21
WO 2014/113240 Multi-Constellation GNSS Integrity
CheckPcuus2014/010507
for Detection of Time Signal Manipulation
Technical Field
[0001] This disclosure relates to a satellite synchronized clock capable of
detecting
manipulated satellite signals. More particularly, this disclosure relates to
detecting
manipulation of a first satellite constellation using a second satellite
constellation.
Brief Description of the Drawings
[0002] Non-limiting and non-exhaustive embodiments of the disclosure are
described,
io including various embodiments of the disclosure with reference to the
figures, in which:
[0003] Figure 1 illustrates a simplified one-line diagram of an electric power
delivery
system.
[0004] Figure 2 illustrates an example system of reliable, redundant, and
distributed
time distribution devices.
[0005] Figure 3 illustrates GNSS receiver in communication with subsets of two
GNSS
satellite constellations.
[0006] Figure 4 illustrates a time distribution device for providing a time
signal to one
or more consuming devices.
[0007] Figure 5 illustrates a timing diagram of two GNSS constellations.
[0008] Figure 6 illustrates a phase error plot of two GNSS constellations.
[0009] Figure 7 illustrates an example of a time quality module configured to
detect
manipulation of a GNSS signal based on phase error.
[0010] Figure 8 illustrates a plot showing possible manipulation of a single
GNSS
constellation.
[0011] Figure 9 illustrates a method for detecting manipulated GNSS signals
using
event times.
[0012] Figure 10 illustrates a method for determining integrity of a time
signal using
an internal time reference.
Detailed Description
1
CA 02892153 2015-05-21
[01w0.2o14n1324o)odiments of the disclosure will be best
understocPcups2o14/o1o5o7) the
drawings, wherein like parts are designated by like numerals throughout. It
will be
readily understood that the components of the disclosed embodiments, as
generally
described and illustrated in the figures herein, could be arranged and
designed in a
wide variety of different configurations. Thus, the following detailed
description of the
embodiments of the systems and methods of the disclosure is not intended to
limit the
scope of the disclosure, as claimed, but is merely representative of possible
embodiments of the disclosure. In addition, the steps of a method do not
necessarily
need to be executed in any specific order, or even sequentially, nor need the
steps be
executed only once, unless otherwise specified.
[0014] In some cases, well-known features, structures, or operations are not
shown or
described in detail. Furthermore, the described features, structures, or
operations may
be combined in any suitable manner in one or more embodiments. It will also be
readily understood that the components of the embodiments as generally
described
and illustrated in the figures herein could be arranged and designed in a wide
variety of
different configurations.
[0015] Several aspects of the embodiments described may be illustrated as
software
modules or components. As used herein, a software module or component may
include any type of computer instruction or computer executable code located
within a
memory device and/or transmitted as electronic signals over a system bus or
wired or
wireless network. A software module or component may, for instance, comprise
one or
more physical or logical blocks of computer instructions, which may be
organized as a
routine, program, object, component, data structure, etc., that performs one
or more
tasks or implements particular abstract data types.
[0016] In certain embodiments, a particular software module or component may
comprise disparate instructions stored in different locations of a memory
device, which
together implement the described functionality of the module. Indeed, a module
or
component may comprise a single instruction or many instructions, and may be
distributed over several different code segments, among different programs,
and across
several memory devices. Some embodiments may be practiced in a distributed
computing environment where tasks are performed by a remote processing device
2
CA 02892153 2015-05-21
linVVO 2014/19240 communications network. In a distributed
compwcrys2o14/o1o5o7it,
software modules or components may be located in local and/or remote memory
storage devices. In addition, data being tied or rendered together in a
database record
may be resident in the same memory device, or across several memory devices,
and
may be linked together in fields of a record in a database across a network.
[0017] Embodiments may be provided as a computer program product including a
machine-readable medium having stored thereon instructions that may be used to
program a computer (or other electronic device) to perform processes described
herein.
The machine-readable medium may include, but is not limited to, hard drives,
floppy
diskettes, optical disks, CD-ROMs, DVD-ROMs, ROMs, RAMs, EPROMs, EEPROMs,
magnetic or optical cards, solid-state memory devices, or other types of non-
transitory
machine-readable media suitable for storing electronic instructions.
[0018] Figure 1 illustrates a simplified diagram of an example of an electric
power
delivery system 100 consistent with embodiments disclosed herein. The systems
and
methods described herein may be applied and/or implemented in the electric
power
delivery system 100 illustrated in Figure 1. Although illustrated as a one-
line diagram
for purposes of simplicity, an electrical power delivery system 100 may also
be
configured as a three-phase power system. The electric power delivery system
100 may
include electric generators 130 and 131 configured to generate an electrical
power
output, which in some embodiments may be a sinusoidal waveform.
[0019] Generators 130 and 131 may be selectively connected to the electric
power
delivery system using switches or circuit breakers 111 and 171, respectively.
Step-up
transformers 114 and 115 may be configured to increase the output of the
electric
generators 130 and 131 to higher voltage sinusoidal waveforms. Buses 122 and
123
may distribute the higher voltage sinusoidal waveform to a transmission line
120
between buses 122 and 123. Step-down transformer 146 may decrease the voltage
of
the sinusoidal waveform from bus 123 to a lower voltage suitable for electric
power
distribution on line 142. Distribution line 142 is further selectively
connectable to bus
123 via circuit breaker or switch 144, and may distribute electric power to a
distribution
bus 140. Load 141 (such as a factory, residential load, motor, or the like)
may be
selectively connected to distribution bus 140 using switch or circuit breaker
170. It
3
CA 02892153 2015-05-21
Sh(WO 2014/113240 that additional transformers or other equipment PC
T/US2014/010507
further step down a voltage from the distribution bus 140 to the load 141.
[0020] Various other equipment may be included in the electric power delivery
system.
Also illustrated is switched capacitor bank ( "SCB" ) 174 selectively
connectable to
transmission bus 123 using circuit breaker or switch 172. Other equipment that
may be
included in the electric power delivery system may include, for example,
static VAR
compensators, reactors, load tap changers, voltage regulators,
autotransformers, and
the like. Some of these are considered as included in the electric power
system 100
such as, for example, load tap changers can be considered as part of the load
141.
Generators 130 and 131 may be any generator capable of providing electric
power to
the electric power delivery system and may include, for example, synchronous
generators, turbines (such as hydroelectric turbines, wind turbines, gas-
fired, coal-fired,
and the like), photovoltaic electric generators, tidal generators, wave power
generators,
and the like. Such generation machines may include components such as power-
electronically coupled interfaces, for example, doubly-fed induction machines,
direct
coupled AC-DE/DE-AC transfer devices, and the like. It should be noted that
these are
not exhaustive lists, and other equipment, machines, and connected devices may
be
considered under this disclosure.
[0021] Modern electric power delivery systems (which may include electric
power
generation systems, transmission systems, distribution systems, and
consumption
systems) are typically controlled using intelligent electronic devices (IEDs).
Figure 1
illustrates several IEDs 160-167 that may be configured to control one or more
elements of the electric power delivery system. An IED may be any processor-
based
device that controls monitored equipment within an electric power delivery
system (e.g.,
system 100). In some embodiments, the IEDs 160-167 may gather equipment status
from one or more pieces of monitored equipment (e.g., generator 130).
Equipment
status may relate to the status of the monitored equipment, and may include,
for
example, breaker or switch status (e.g., open or closed), valve position, tap
position,
equipment failure, rotor angle, rotor current, input power, automatic voltage
regulator
state, motor slip, reactive power control set point, generator exciter
settings, and the
like. Further, the IEDs 160-167 may receive measurements concerning monitored
4
CA 02892153 2015-05-21
MEW 2o14/1132ttoipment using sensors, transducers, actuators, and
PCT/US2014/010507
Measurements may relate to a measured status of the machine or equipment, and
may
include, for example, voltage, current, temperature, pressure, density,
infrared
absorption, viscosity, speed, rotational velocity, mass, and the like. With
the equipment
status and/or measurements, IEDs may be configured to derive or calculate
derived
values, for example, power (real and reactive), magnitudes and angles of
voltages and
currents, frequency, rate of change of frequency, phasors, synchrophasors,
fault
distances, differentials, impedances, reactances, symmetrical components,
alpha
components, Clarke components, alarms, and the like.
[0022] According to certain embodiments, IEDs 160-167 may issue control
instructions
to the monitored equipment in order to control various aspects relating to the
monitored equipment. Some examples of actions to control equipment include:
opening a breaker which disconnects a generator with a rotor angle moving
towards
instability; opening a breaker which sheds load that is causing a voltage to
decline
towards a collapsing condition; opening a breaker to remove an asset when the
asset,
such as a line or transformer, is exceeding its safe operating limits; opening
a breaker
which sheds load that is causing the frequency of the system to decline such
that it is
exceeding predefined operating limits; inserting shunt capacitance with the
effect of
increasing the voltage on an electric power line so that the reactive
requirements on a
generator are not exceeded and therefore preemptively preventing the generator
from
being removed from service by a reactive power control; activating a dynamic
brake
which counters the acceleration of a machine rotor; adjusting a set-point on a
governor
to limit the power output of a synchronous machine so that it does not exceed
the safe
operating limits; simultaneously adjusting set-points of other synchronous
machines so
that they pick-up the new load; and, adjusting a voltage regulation set-point
of an
automatic voltage regulator such that a voltage at a more distant point in the
power
system does not exceed its maximum or minimum voltage threshold; and the like.
[0023] An IED (e.g., IED 160) may be in communication with a circuit breaker
(e.g.,
breaker 111), and may be capable of sending an instruction to open and/or
close the
circuit breaker, thus connecting or disconnecting a portion of a power system.
In
another example, an IED may be in communication with a recloser and capable of
5
CA 02892153 2015-05-21
coWo2o14/11324o3ing operations. In another example, an IED may
PCT/US2014/010507tion
with a voltage regulator and capable of instructing the voltage regulator to
tap up
and/or down. Information of the types listed above, or more generally,
information or
instructions directing an IED or other device or equipment to perform a
certain action,
may be generally referred to as control instructions.
[0024] IEDs 160-167 may be communicatively linked together using a data
communications network, and may further be communicatively linked to a central
monitoring system, such as a supervisory control and data acquisition (SCADA)
system
182, and/or a wide area control and situational awareness (WACSA) system 180.
In
io certain embodiments, various components of the electrical power
generation and
delivery system 100 illustrated in Figure 1 may be configured to generate,
transmit,
and/or receive GOOSE messages, or communicate using any other suitable
communication protocol. For example, an automation controller 168 may
communicate
certain control instructions to IED 163 via messages using a GOOSE
communication
protocol.
[0025] The illustrated embodiments are configured in a star topology having an
automation controller 168 at its center, however, other topologies are also
contemplated. For example, the IEDs 160-167 may be communicatively coupled
directly to the SCADA system 182 and/or the WACSA system 180. Certain IEDs,
such as
IEDs 163 and 164, may be in direct communication with each other to effect,
for
example, line differential protection of transmission line 120. The data
communications
network of the system 100 may utilize a variety of network technologies, and
may
comprise network devices such as modems, routers, firewalls, virtual private
network
servers, and the like. Further, in some embodiments, the IEDs 160-167 and
other
network devices (e.g., one or more communication switches or the like) may be
communicatively coupled to the communications network through a network
communications interface.
[0026] Consistent with embodiments disclosed herein, IEDs 160-167 may be
communicatively coupled with various points to the electric power delivery
system 100.
For example, IEDs 163 and 164 may monitor conditions on transmission line 120.
IED
160 may be configured to issue control instructions to associated breaker 111.
IEDs
6
CA 02892153 2015-05-21
16w0 2014/113240y monitor conditions on buses 122, and 123. IED
PCT/US2914/010507 and
issue control instructions to the electric generator 130. IED 162 may monitor
and issue
control instructions to transformer 114. IED 166 may control operation of
breaker 172
to connect or disconnect SCB 174. IED 165 may be in communication with load
center
141, and may be configured to meter electric power to the load center. IED 165
may be
configured as a voltage regulator control for regulating voltage to the load
center using
a voltage regulator (not separately illustrated).
[0027] In certain embodiments, communication between and/or the operation of
various IEDs 160-167 and/or higher level systems (e.g., SCADA system 182 or
WACSA
io 180) may be facilitated by an automation controller 168. The automation
controller 168
may also be referred to as a central IED, communication processor, or access
controller.
In various embodiments, the automation controller 168 may be embodied as the
SEL-
2020, SEL-2030, SEL-2032, SEL-3332, SEL-3378, or SEL-3530 available from
Schweitzer
Engineering Laboratories, Inc. of Pullman, WA, and also as described in U.S.
Patent No.
5,680,324, U.S. Patent No. 7,630,863, and U.S. Patent Application Publication
No.
2009/0254655, the entireties of which are incorporated herein by reference.
[0028] The IEDs 160-167 may communicate a variety of types of information to
the
automation controller 168 including, but not limited to, operational
conditions, status
and control information about the individual IEDs 160-167, event (e.g., a
fault) reports,
communications network information, network security events, and the like. In
some
embodiments, the automation controller 168 may be directly connected to one or
more
pieces of monitored equipment (e.g., electric generator 130 or breakers 111,
or 172).
[0029] The automation controller 168 may also include a local human machine
interface (HMI) 186. In some embodiments, the local HMI 186 may be located at
the
same substation as automation controller 168. The local HMI 186 may be used to
change settings, issue control instructions, retrieve an event report (which
may originate
from a specified IED), retrieve data, and the like. The automation controller
168 may
further include a programmable logic controller accessible using the local HMI
186.
[0030] The automation controller 168 may also be communicatively coupled to a
common time source (e.g., a clock) 188. In certain embodiments, the automation
controller 168 may generate a time signal based on the common time source 188
that
7
CA 02892153 2015-05-21
MENy0 2014/113240A to communicatively coupled IEDs 160-167.
AltPcuus2o4io1o5o7lay
be individually connected to a common time source. Based on the time signal,
various
IEDs 160-167 may be configured to collect and/or calculate time-aligned
operational
conditions including, for example, synchrophasors, and to implement control
instructions in a time coordinated manner. IEDs may use the time information
to apply
a time stamp to operational conditions and/or communications. In some
embodiments,
the WACSA system 180 may receive and process the time-aligned data, and may
coordinate time synchronized control actions at the highest level of the
electrical power
generation and delivery system 100. In other embodiments, the automation
controller
io 168 may not receive a time signal, but a common time signal may be
distributed to IEDs
160-167.
[0031] The common time source 188 may also be used by the automation
controller
168 for time stamping information and data. Time synchronization may be
helpful for
data organization, real-time decision-making, as well as post-event analysis.
Time
synchronization may further be applied to network communications. The common
time
source 188 may be any time source that is an acceptable form of time
synchronization,
including, but not limited to, a voltage controlled temperature compensated
crystal
oscillator, Rubidium and Cesium oscillators with or without digital phase
locked loops,
microelectromechanical systems (MEMS) technology, which transfers the resonant
circuits from the electronic to the mechanical domains, or a Global
Navigational
Satellite System (GNSS) such as a Global Positioning System (GPS) receiver
with time
decoding. In the absence of a discrete common time source 188, the automation
controller 168 may serve as the common time source 188 by distributing a time
synchronization signal.
[0032] Several different GNSS systems (also referred to as GNSS
constellations) are
available or planned to be available. Some examples of a currently operational
GNSS
include the United States NAVSTAR Global Positioning System (GPS) system and
the
Russian GLONASS. Some examples of a GNSS planned for future operation include
China' s Beidou Navigation Satellite System (BDS), and the European Union' s
Galileo
positioning system. It should be noted that a single GNSS system may include
separate
8
CA 02892153 2015-05-21
COW 2o14/1132joich as, for example, the BDS including a limited
tePc'rjus2o14/010507,t
constellation as well as a system being constructed at a second
constellation).
[0033] As is detailed above, the electric power delivery system 100
illustrated in Figure
1 includes local control and protection using IEDs 160-167, and wide-area
control using
the automation controller 168 and/or WACSA 180 and/or SCADA 182.
[0034] Figure 2 illustrates system 200 configured to be a highly reliable,
redundant,
and distributed system of time distribution devices 204, 206, and 208 capable
of
providing a precision time reference to various time dependent IEDs 212, 214,
and 216.
Each time distribution device 204, 206, and 208 may be configured to receive
and
communicate time signals through multiple protocols and methods. While the
system
200 is described as being capable of performing numerous functions and
methods, it
should be understood that various systems are possible that may have
additional or
fewer capabilities. Specifically, a system 200 may function as desired using
only one
protocol, or having fewer external or local time signal inputs.
[0035] As illustrated in Figure 2, three time distribution devices 204, 206,
and 208 have
WAN capabilities and are communicatively connected to a WAN 218, which may
comprise one or more physical connections and protocols. Each time
distribution
device 204, 206, and 208 may also be connected to one or more IEDs within a
local
network. For example, time distribution device 204 is connected to IED 212,
time
distribution device 206 is connected to IEDs 214, and time distribution device
208 is
connected to IEDs 216. A time distribution device may be located at, for
example, a
power generation facility, a distribution hub, a substation, a load center, or
other
location where one or more IEDs are found. In various embodiments, an IED may
include a WAN port, and such an IED may be directly connected to WAN 218. IEDs
may
be connected via WAN 218 or LANs 210. Time distribution devices 204, 206, and
208
may establish and maintain a precision time reference among various system
components. Each time distribution device 204, 206, and 208 may be configured
to
communicate time information with IEDs connected on its LAN through one or
more
time distribution protocols, such as IEEE 1588.
[0036] Each time distribution device 204, 206, and 208 is configured to
receive time
signals from a variety of time sources. For example, as illustrated, time
distribution
9
CA 02892153 2015-05-21
dewo 2014/113240ieS an antenna 220 and is configured to receive a
PCT/US20J4/0105071 a
GNSS repeater or satellite 202. Time distribution device 204 is also
configured to
receive a second time signal 221 from an external time source 201. The
external time
source may comprise one or more voltage-controlled temperature-compensated
crystal
oscillators (VCTCX05), phase locked loop oscillators, time locked loop
oscillators,
rubidium oscillators, cesium oscillators, NIST broadcasts (e.g., WWV and
WWVB), and/or
other devices capable of generating precise time signals. In the illustrated
embodiment,
time distribution device 208 includes an antenna 220 configured to receive a
GNSS
signal from the GNSS repeater or satellite 202. As illustrated, time
distribution device
io 206 does not directly receive an external time signal, however,
according to alternative
embodiments, any number and variety of external time signals may be available
to any
of the time distribution devices.
[0037] According to one embodiment, WAN 218 comprises a synchronous optical
network (SONET) configured to embed a precision time reference in a header or
overhead portion of a SONET frame during transmission. Alternatively, a
precision time
reference may be conveyed using any number of time communications methods
including IRIG protocols, NTP, SNTP, synchronous transport protocols (STP),
and/or IEEE
1588 protocols. According to various embodiments, including transmission via
SONET,
a precision time reference may be separated and protected from the rest of the
WAN
network traffic, thus creating a secure time distribution infrastructure.
Protocols used
for inter IED time synchronization may be proprietary, or based on a standard,
such as
IEEE 1588 Precision Time Protocol (PTP).
[0038] According to various embodiments, time distribution devices 204, 206,
and 208
are configured to perform at least one of the methods of detecting failure of
a time
source described herein. System 200 may utilize a single method or combination
of
methods, as described herein.
[0039] It is of note that even the most precise time signals may exhibit small
discrepancies. For example, depending on the length and routing of the GNSS
antenna
cable, various clocks may exhibit microsecond level time offsets. Some of
these offsets
may be compensated for by the user entering compensation settings, or may need
to
be estimated by the time synchronization network. Estimation may be performed
CA 02892153 2015-05-21
duwo}o14Ip.324o)ds of "quiet" operation (i.e., periods with no
faPCTTS2014/010507
individual source results stored locally in a nonvolatile storage register.
[0040] As can be seen, IEDs may receive time signals from one or more GNSS
signals.
Different IEDs may receive time signals from one or more GNSS signal sources
that are
different from the GNSS signal sources for other IEDs. That is, several
different GNSS
sources are available. The GPS system, for example, consists of around 32
satellites that
orbit the Earth twice per sidereal day. Accordingly, several satellites are
visible to each
receiver at any given time, and different satellites may be visible to
different receivers at
different times each day.
[0041] Signals from the GNSS satellites arrive at the receivers, and may be
used by the
receivers to calculate position as well as time. Receivers in the systems of
Figures 1 and
2 are typically stationary, using the GNSS signals to calculate time, and
provide a
common time to devices on the system.
[0042] Receivers of such signals may be vulnerable to attacks or manipulation
such as
blocking, jamming, and spoofing. In some cases, the GNSS receiver may continue
to
indicate that the signal is good, and signal lock may be maintained. Such
attacks may
attempt to prevent a position lock, or feed a receiver false information such
that the
receiver calculates a false position and/or time. Spoofing, or other
manipulation, of
time information in a system such as those of Figures 1 and 2 may introduce
errors in
the derived values by the IEDs, and/or errors into time stamps of equipment
status,
measurements, derived values, and communications among the devices. Such
errors
may result in improper control of the electric power delivery system.
Accordingly, what
is needed is detection of, and mitigation against such attacks.
[0043] Figure 3 illustrates a representation of a number of satellites (310-
317)
positioned around the Earth 302. A GNSS receiver 304 may be located at a
stationary
position, or may be mobile upon the Earth 302. The satellites 310-317 may
constitute
multiple constellations. As illustrated, a first constellation includes
satellites 310, 312,
314, and 316, where a second constellation includes satellites 311, 313, 315,
and 317.
GNSS receiver 304 may be configured to receive signals from satellites of the
first and
second constellations via an antenna 306. For example, the first constellation
may
11
CA 02892153 2015-05-21
incW0 2014/113240 of the GPS system, and the second constellation
PcTius2014/oloso7lites
of the GLONASS system.
[0044] Figure 4 illustrates a time distribution device 404, according to one
embodiment, for providing a time signal to one or more consuming devices. In
various
embodiments, time distribution device 404 may include more or less
functionality than
the illustration. For example, time distribution device 404 may include an
interface for
monitoring equipment in an electric power delivery system in certain
embodiments.
Accordingly, in various embodiments, time distribution device 404 may be
implemented
either as an IED or as a network device. As illustrated, time distribution
device 404
io includes a local time source 402 such as a voltage-controlled
temperature-
compensated crystal oscillator (VCTCXO), temperature-compensated crystal
oscillator
(TCXO), oven-controlled crystal oscillator (OCX0), or the like, that provides
a local time
signal and a time quality module 405 for establishing a precision time
reference. Time
distribution device 404 further includes a pair of line ports 412 and 414 for
communications with a WAN or LAN. Time information may be shared over a
network
and may also be fed into the time quality module 405. Further, time
distribution device
404 includes a GNSS signal receiver 410 for receiving a precision time signal,
such as
time from a GNSS via a GNSS antenna 420. Time distribution device 404 also
includes a
WWVB receiver 430 for receiving an NIST broadcast, which can be used as a
precision
time signal, via an external antenna 440. The received precision time signal
from either
source is communicated to the time quality module 405 for use in determining
and
distributing the precision time reference.
[0045] Another time source that may be fed to the time quality module 405
includes
an external time source 406 that may conform to a time distribution protocol,
such as
IRIG. The external time source 406 may communicate with another time port such
as an
IRIG input 408.
[0046] The various time information from the WAN (from line ports 412 and/or
414),
GNSS signal receiver 410, WWVB receiver 430, and IRIG input 408 are input into
the
time quality module 405. In one embodiment, the inputs may be fed into a
multiplexer
(not shown) prior to being input into the time quality module 405. The time
quality
module 405 functions to determine a precision time reference for use by the
various
12
CA 02892153 2015-05-21
dewo 2014/113240d to the GNSS receiver 404. The precision time
ro'cuus2014/010507
communicated from the time quality module 405 to the various devices 422 using
IRIG
protocol (via the IRIG-B output 416) or to various Ethernet devices 425 using
another
protocol 413 such as IEEE 1588 using Ethernet Drop Ports 418. The Ethernet
Drop Ports
418 may also include network communications to the various devices connected
to
GNSS receiver 404. GNSS receiver 404 may further include connections to SONETs
and
transmit the precision time reference in a header or overhead portion of SONET
frames.
[0047] Time distribution device 404 may also comprise a time signal adjustment
subsystem 424. Time signal adjustment subsystem 424 may be configured to track
drift
io rates associated with various external time sources with respect to
local time source
402. Time signal adjustment subsystem 424 may also communicate time signals
according to a variety of protocols. Such protocols may include inter-Range
Instrumentation Group protocols, IEEE 1588, Network Time Protocol, Simple
Network
Time Protocol, synchronous transport protocol, and the like. In various
embodiments,
time signal adjustment subsystem 424 may be implemented using a processor in
communication with a computer-readable storage medium containing machine
executable instructions. In other embodiments, time signal adjustment
subsystem 424
may be embodied as hardware, such as an application specific integrated
circuit or a
combination of hardware and software.
[0048] As mentioned above, the time distribution device 404 may obtain GNSS
signals
from multiple GNSS systems or constellations. For example, the GNSS signal
receiver
410 may be configured to obtain satellite signals from GPS, GLONASS, Galileo,
BDS, and
the like. The GNSS systems may provide a time signal such as a pulse-per-
second (PPS)
signal. Using the PPS signal from each of the constellations, time
distribution device
404 may determine a phase error between the time signals of two or more of the
constellations. If the phase error changes, time distribution device 404 may
be
configured to determine that one of the signals has been manipulated.
[0049] Figure 5 illustrates a timing diagram 502 of a PPS signal from the GPS
system,
and another timing diagram 504 of a PPS signal from the GLONASS system. As can
be
seen, the rising edge 506 of the first PPS of the GPS signal is slightly ahead
of the rising
edge 508 of the first PPS signal from the GLONASS signal. The time quality
module 405
13
CA 02892153 2015-05-21
of WO 2014/113240,iver 404 may calculate a phase error as a
differenRcuus2014/010507in
these rising edges. In another embodiment, the time quality module 405 may use
a
time signal from the local time source to determine a phase error of any GNSS
PPS by
comparing the PPS with, for example a local oscillator. The time quality
module 405
may continue to calculate the phase error for each subsequent PPS signal from
the GPS
system 510 and from the GLONASS system 512.
[0050] If the time quality module detects a drift in the phase error between
the two
signals, the time quality module may determine that one of the GNSS signals
received
by the GNSS receiver 410 may be manipulated. Accordingly, the time quality
module
io 405 may continue to monitor the phase error between two GNSS signals.
When the
phase error drifts beyond a predetermined threshold, the time distribution
device 404
may take a remedial action.
[0051] According to various embodiments, the time quality module 405 computes
the
phase error between the two rising edges (e.g., 506 to 508 and 510 to 512) of
the
timing signals. In one embodiment, an average of the phase errors may be
calculated.
The average may be calculated using a moving average window and stored in
memory.
In the event that one of the GNSS signals is being manipulated, the signal
from the
manipulated constellation may begin drifting and the phase error between the
signals
may change. For example, if the GLONASS signal 504 of Figure 5 were being
manipulated, the rising edges of its PPS may begin to lag further behind the
rising
edges of the GPS PPS signal 502. Accordingly, the phase error between the
signals
would increase. Alternatively, if the GPS PPS signal 502 were being
manipulated, the
rising edges of its PPS may slow down, which would decrease the phase error
between
the GPS signal 502 and the GLONASS signal 504 for a period of time, until the
rising
edges were coincident, after which the phase error would increase. Phase error
changes
may further be brought about by a manipulated signal increasing a rate of PPS
rising
edges.
[0052] Figure 6 illustrates an example change in phase error over time of the
signals
illustrated in Figure 5 during normal operation 602 and during manipulation of
one of
the signals 604. Also illustrated is a manipulation detection threshold 606
that may be
14
CA 02892153 2015-05-21
a 1W0 2014/113240 threshold. Once the phase error crosses the
throcTius2014t010507\ISS
receiver 404 may take the remedial action.
[0053] In one embodiment, the time quality module 405 may determine the
initial
phase error 602 and store the initial phase error 602 in memory. The time
quality
module 405 may continuously monitor the phase error between the two GNSS
constellations. The phase error may be calculated in real time and filtered
for several
samples to avoid false positives. Once the filtered absolute phase error is
determined
to exceed a pre-determined threshold, the time quality module 405 may detect
manipulation. The threshold may be an absolute phase error. The threshold may
be,
for example, approximately 1 microsecond.
[0054] In one example, the time quality module 405 may determine the initial
phase
error to be 50 nanoseconds. The time quality module 405 may continuously
monitor
the phase error. Once the phase error exceeds a threshold (such as, for
example, 1
microsecond), the time quality module 405 may detect the manipulation, and
take a
is remedial action.
[0055] In one embodiment, the time distribution device 404 may receive GNSS
signals
from more than two constellations. In such an embodiment, the time quality
module
405 may calculate initial phase errors between each of the signals from each
of the
GNSS constellations, and monitor such phase errors. When one of the GNSS
constellations is manipulated, its phase error relative to the other GNSS
constellation
signals may change. The time quality module 405 may detect such a change and
determine that the signal has been manipulated. The time quality module 405
may
further determine which GNSS constellation signal is being manipulated using a
voting
scheme. For example, if three GNSS constellations are monitored, the time
quality
module 405 may determine that the two GNSS constellations with the smallest
(or no)
relative phase error are not the manipulated GNSS constellations.
[0056] As introduced above, when the time quality module 405 has detected
manipulation, the time distribution device 404 may take remedial action to
avoid
propagating inaccurate time data. The remedial action may include, for
example:
ceasing to rely on the GNSS signals and instead distribute time from its own
local time
source; switching to a non-GNSS signal such as WWVB, or another external time
source;
CA 02892153 2015-05-21
dewo 2014/113240:h GNSS signal is being manipulated and ceasing
PCT/US2014/010507
signal; use an accurate internal time source such as a crystal oscillator or a
Cesium
standard; sending an alarm to an operator; communicating to receiving devices
that the
time signal may have been manipulated (by setting an error bit or the like);
and the like.
[0057] Figure 7 illustrates an example of a time quality module configured to
detect
manipulation of a GNSS signal based on phase error. The time quality module
may
include a phase detector 702, a filter 704, a comparator 706, a pick-up and
drop-out
timer block 710, and enablement logic 712. In various embodiments, the
components
of the time quality module may be implemented as software instructions carried
out by
io a processor, dedicated hardware, and/or firmware. In one embodiment, the
components are implemented by one or more FPGAs. In the example of Figure 7,
the
phase detector 702 is configured to receive time signals, for example, a pulse-
per-
second (PPS) signal from two GNSS constellations (e.g., GPS and GLONASS). The
phase
detector is configured to determine a phase error between the two time
signals. For
example, in one embodiment, the phase detector 702 may include a clock, or
receive a
clock signal, and determine an error (or difference) in clock counts between
the two
time signals.
[0058] The phase error determined by the phase detector 702 may be passed
through
a filter 704 to smooth out any abrupt variations in the detected phase error.
In one
embodiment, filter 704 may be a low pass filter. In another embodiment, the
filter 7084
may be a simple moving average filter with saturation limits. The filtered
phase error
may be passed to a comparator 706 configured to compare the phase error with a
manipulation threshold value. The manipulation threshold value, as described
above,
may be user defined or determined based on historical phase error data. As
shown in
the example of Figure 7, the comparator may be enabled by enablement logic 712
when the time distribution module has a lock on both of the first and the
second GNSS
constellation in order to reduce the risk of a false manipulation signal when
a GNSS lock
has been lost.
[0059] The output of comparator 706 indicates whether possible manipulation of
one
of the GNSS constellations has been detected. For example, the comparator 706
may
output a logic '1' when the filtered phase error exceeds the manipulation
threshold
16
CA 02892153 2015-05-21
valwo 2014/1132_40 '0' otherwise. In one embodiment, the
outpuPcuus2o14/olo5o7tor
706 may be used directly to indicate manipulation. However, this may lead to
frequent
false manipulation alerts due to a noisy time signal, for example. Timer block
710
provides some hysteresis to help smooth out some of the possible false
manipulation
alerts. The timer block 710, in the example of Figure 7, may be configured to
track the
output of the comparator, which has a refresh rate of 1Hz, and indicate
manipulation if
a defined number of cycles that the comparator has detected the phase error
exceeds
the threshold (i.e., outputs a logic '1' ). In one embodiment, the pick-up
(PU) of the
timer block 710 may be set such that detecting ten consecutive samples of a
logic
io '1' results in the timer block 710 outputting a manipulation alert. The
drop-out (DO)
of the timer block may be set, for example, such that detecting three
consecutive
samples of a logic '0' results in the timer block ceasing to output the
manipulation
alert.
[0060] Figure 8 illustrates a method for detecting manipulation of a GNSS
constellation signal according to the techniques introduces herein. The method
800
may start with the time distribution device 404 receiving a PPS rising edge
signal from a
first GNSS constellation 804 and receiving a PPS rising edge signal from a
second GNSS
constellation 806. As described above, the time quality module 405 may
calculate the
phase error 808. Although not specifically illustrated, the PPS rising edges
from the first
and second GNSS constellations may continue to be received, and a phase error
may be
calculated for each.
[0061] The time quality module 405 may calculate an average phase error for a
moving window 810 using the calculated phase errors. The phase error may be
compared with a threshold 812. If the phase error exceeds the threshold 814,
manipulation may be detected, an alarm may be sent (via a human-machine
interface
(HMI), over a communications network, or the like) and an alternate time
source may be
used 816. The alternate time source may be an internal time source, another
external
time source, or the like.
[0062] The method may include other remedial actions as described above
including,
for example, determining which GNSS constellation signal is manipulated, and
the like.
Additionally, the time quality module may be able to determine which GNSS
17
CA 02892153 2015-05-21
cowo 2014/11324pal has been manipulated by calculating a
locatiorPcuus2014/010507\ISS
constellation signal. In various embodiments, the time distribution device is
at a fixed
location. The GNSS receiver may calculate a location based on the GNSS
constellation
signal and the time quality module may compare the calculated location to the
known
fixed location of the time distribution device. If the calculated location and
the fixed
location vary beyond a defined threshold, the time quality module may
determine that
the GNSS constellation signal has been manipulated.
[0063] According to one embodiment, the time distribution device 404 may be
configured to detect manipulation of a time signal using a local time source.
As
io described above, the time distribution device 404 may include a local
time source 402
such as a crystal oscillator. The local time source 402 may be selected for a
very good
short term frequency stability. The local time source 402 may be configured to
produce
a time signal such as a free running counter (FRC) that runs continuously. The
FRC may
count the number of clock counts between the rising edges of each incoming PPS
pulses.
[0064] As noted above, the time distribution device 404 may include a number
of time
signal inputs. Each time signal input may undergo an integrity check in the
time quality
module 405. The integrity check may use the local time source 402 to perform
the
integrity check. In one embodiment, the time quality module 405 receives the
FRC from
the local time source. For each time input signal, the time quality module may
store the
FRC time stamp with each rising edge of the input signal. Under normal
operating
conditions, the FRC count value grows linearly with time.
[0065] Figure 9 illustrates how the FRC count values grow linearly with time
under
normal conditions, and that the growth may vary when a time source, such as a
GNSS
constellation, is being manipulated. The time stamps t1 through t11 correspond
with
the rising edges of a GNSS PPS signal and a particular FRC count value at that
time.
Between time stamp t1 and t7, the count value of the FRC between time stamps
is
constant (i.e., the slope of the plot is constant). However, in the example of
Figure 9,
the slope of the plot changes at some point between t7 and t8, representing a
change
in the number of FRC counts between each time stamp.. A change in the number
of
18
CA 02892153 2015-05-21
FRwo 2014/113240een rising edges of a PPS signal (i.e., change in
thPcTips2o14/010507ie v.
FRC count plot) may indicate manipulation of the GNSS signal.
[0066] The time quality module 405 may maintain a moving window to eliminate
long
term aging effects of the local time source 402. It should be noted that the
slope
change due to possible manipulation may be an increase or a decrease in slope,
depending on whether the manipulation increases or decreases the rate of the
manipulated PPS signal. That is, the number of FRC count values between the
PPS
pulses may increase or decrease for a manipulated signal. In one embodiment
the FRC
count value accumulates as the PPS pulses are received. Figure 8 illustrates
this as a
positive slope. In one embodiment, the FRC count value may be reset
periodically (i.e.,
a moving window).
[0067] In one embodiment, the time quality module 405 may maintain such a
profile
for multiple time sources. Given the FRC count vs. rising edge detection
profile for a
single time input, a change in slope may indicate either manipulation of the
time signal
or local time source degradation (e.g., oscillator degradation). For an
embodiment
where the time quality module 405 maintains such profiles for multiple time
source
inputs (for example, for GPS and for GLONASS), when a change in slope in one
of the
signals is detected, the time quality module 405 may compare the profiles of
both
signals. Then, if only one of the profiles shows the slope change, the time
quality
module 405 may determine that the time signal with the slope change is the
manipulated time signal. Alternatively, if both of the profiles show the slope
change
(and further if the slope change occurs at the same FRC count), then the time
quality
module 405 may determine that some oscillator degradation has occurred.
[0068] Figure 10 illustrates a method that may be used by a time distribution
device
for detecting manipulation of a time input signal by comparison against other
time
signals. The method 1000 may start with a time distribution device receiving a
PPS
rising edge signal from a first GNSS constellation 1002, as well as receiving
an FRC
count from a local time source 1004. The time distribution device may maintain
a
profile of FRC count vs. the PPS rising edge signal 1006 and calculate an
average slope
over a moving window 1008. Using the profile, the time distribution device may
detect
a change in slope 1010. If a change in slope is not detected 1012, the method
returns
19
CA 02892153 2015-05-21
to wo2ouni324olange in slope is detected 1012, the time
distribu1PcTius2o14/o1oo7
compare the profile with a profile of a second time input 1014. The second
time input
may include another GNSS constellation, a time signal according to IEEE 1588,
or the
like. If the second profile includes a slope change that matches the slope
change of the
first profile 1016, then the time distribution device determines that there is
an internal
time source degradation 1018 and ends 1022. If, however, the second profile
does not
include a slope change that matches the slope change of the first profile
1016, then the
time distribution device determines that there has been a manipulation of the
first
GNSS constellation signal 1020. The time distribution device may then take
remedial
io actions as described above, such as, for example, ceasing to use the
manipulated GNSS
constellation signal, sending an alarm, or the like. The method may return and
continually monitor GNSS constellation signals for manipulation 1022.
[0069] While specific embodiments and applications of the disclosure have been
illustrated and described, it is to be understood that the disclosure is not
limited to the
precise configuration and components disclosed herein. Various modifications,
changes, and variations apparent to those of skill in the art may be made in
the
arrangement, operation, and details of the methods and systems of the
disclosure
without departing from the spirit and scope of the disclosure.
[0070] What is claimed is:
