Time synchronization: from single constellation to multi-source consensus
When a second is no longer a second
In modern telecommunications systems from digital terrestrial broadcasting to 5G broadcast networks, from metrology laboratories to distributed test equipment, time synchronization is not a detail: it is the condition that allows the system to exist. A DVB-T2 or DAB transmitter that lags by a few microseconds with respect to the others in the same single-frequency network is not simply “late”: it is a source of interference that degrades the signal for every user in the coverage area. A test station acquiring data at geographically distant locations, without a common time reference, produces measurements that cannot be correlated.
For this reason, for over two decades the de facto reference has become the PPS (Pulse Per Second) generated by GNSS receivers: a once-per-second pulse, derived from the atomic oscillators on board the satellites, used to discipline a local oscillator, typically at 10 MHz, reproducing on the ground the same time quality that the constellation maintains in orbit (through atomic clocks). The principle is elegant: instead of triangulating delays to compute a position, as a navigator does, you place yourself at a known fixed point and use the time arriving from the satellites to align your local reference. This is how, in Italy, thousands of broadcast transmitters distributed from the Alps to Sicily are synchronized.
The limit of the single reference
For years, “GNSS” effectively meant “GPS”. This is no longer the case: GPS, Galileo, GLONASS, BeiDou, and Japan's QZSS are distinct constellations, with different frequencies, codes, and orbital dynamics. Most multi-constellation receivers currently on the market combine them internally, but the criterion by which the radio decides which satellite to consider and which to discard is rarely documented and almost never modifiable. From the outside, the user sees a single PPS at the output: a black box.
This opacity would not be a problem in a perfect world. But the real world tells another story:
- Satellite replacements that, during the transition between the previous satellite and the new-generation one, can introduce variations of tens of nanoseconds lasting hours.
- Poorly documented system anomalies such as the activation, years ago, of a new GPS military frequency that triggered false anti-spoofing alarms in the most sophisticated receivers, sending thousands of stations across Italy into holdover at the same time.
- Intentional spoofing: the generation of counterfeit GNSS signals to induce a receiver to compute an incorrect time or position. A threat that today appears not only in military scenarios, but also near sensitive civilian infrastructure.
- Jamming and local interference, particularly insidious at mountain sites where signal quality is already marginal for geographical reasons.
In all of these cases, relying on a single GNSS receiver, however certified, means accepting a single point of failure on which the entire installation depends.
A paradigm shift: from reference to consensus
The approach we propose flips the perspective: rather than trusting a reference, we measure it. Instead of a single PPS, we acquire several simultaneously, coming from different receivers, ideally from different manufacturers, locked to different constellations and we compare them in real time.
The apparatus developed at IPSES is, in its base form, a four-input PPS phase comparator: one of the signals is taken as the trigger reference, and the other three are measured against it, with resolution down to 10 nanoseconds. The observation window is adjustable (typically from 10 to 1000 nanoseconds) and allows us to determine visually first, then algorithmically, which signals are “respecting consensus” and which are drifting away from it.
When a PPS exceeds a defined tolerance window (for example ±300 ns relative to the group), it is automatically excluded from the pool. A receiver that enters holdover, that is being spoofed, or that experiences a transient anomaly is flagged as unreliable until it returns within specification.
On the surviving signals, the apparatus computes in real time an aggregate reference, a sort of “median signal” synthesized from the set of validated sources, statistically more stable than any individual PPS. This reference does not coincide with any of the physical sources, but represents all of them, and is what disciplines the local oscillator, providing the system with a robust time base even in the presence of fluctuations in individual sources.
Extending the concept: cascade and distributed topology
The base apparatus handles four inputs. But in real laboratories, and in nationwide broadcast networks, the number of useful references can be greater and geographically dispersed. For this reason the architecture is designed to be scalable through cascading: the “consensus” output of one unit can become one of the inputs of a higher-level unit, building up to a tree topology in which a master apparatus collects results already pre-processed by peripheral units, each of which has already performed its own statistical cleanup of the local signals.
The same principle allows the integration of references that are not GNSS: PTP (IEEE 1588) distributed over Ethernet, dedicated optical signals over fiber, references carried by geostationary satellites. All of them become, from the system's point of view, “candidates” to be measured and compared. What matters is not the nature of the source: it is its coherence with the others.
The result is a system that is plural by construction: not based on GPS, nor on Galileo, nor on GLONASS specifically, but on their convergence and extendable, going forward, to any other time reference that becomes part of the metrological ecosystem. And it is precisely in this convergence between independent constellations and signals that the robustness of the entire architecture lies. A spoofing attack capable of simultaneously fooling three distinct orbital systems, operated by different powers and working on different frequencies, is a qualitatively different event from the disturbance of a single constellation; and even more so when, alongside satellite references, the apparatus is also comparing in real time a PTP signal carried over fiber, a dedicated optical reference, or a geostationary signal, sources that travel over physical channels and infrastructures entirely different from GNSS, and that would all have to be compromised at the same time for the deception to go unnoticed. The plurality of constellations is already a good level of protection; the plurality of the means by which time is distributed, radio waves from space, packets on Ethernet, pulses over optical fiber is what makes the system genuinely resistant.
Applications: from broadcast to the laboratory
In broadcast environments, the system addresses a concrete need: ensuring the synchrony of DVB-T2, DAB, and 5G Broadcast networks while preserving a safety margin even in scenarios of partial GNSS degradation. The ability to recognize and isolate a compromised source, before it propagates the error to the network, is a requirement that will become increasingly stringent as the standards evolve.
In laboratory and industrial metrology environments, the same apparatus enables correlation of measurements made on distant benches, disciplines secondary oscillators (even high-quality ones, such as commercial rubidium oscillators) without exposing them to the fluctuations of a single radio, and supports building distributed test systems in which every station shares a common, protected time anchor.
In both domains, the value is not in the absolute precision of the individual instrument, that is ultimately provided by the physics of the constellations, but in the quality of the decision-making process by which the system chooses whom to believe, instant by instant.
In summary
To synchronize, today, means something more than locking onto a satellite: it means building an architecture capable of critically evaluating its own sources, of tolerating their failures, and of carrying on its task even when one of them lies. It is a way of working that closely resembles what national metrology institutes have been doing for decades with their hydrogen maser and cesium oscillators: keeping multiple clocks under observation, and trusting consensus. The difference is that this approach can today be brought outside the laboratory, onto the mountain mast, onto the test bench, into the data center rack, with compact, modular, and replicable instruments.
And in an age in which synchrony has become a critical infrastructure on a par with electrical power, this is a shift in perspective worth adopting before it becomes necessary.
