How a heterogeneous time mesh could resist GNSS jamming

A GNSS jammer can remove the reference from a perfectly healthy clock. Its processor keeps running, its radio still works, and nearby equipment still needs comparable timestamps. A time mesh could make that local loss easier to survive by sharing references that remain available and predicting forward on clocks trained before the interruption.

For PToB, the opportunity is a heterogeneous mesh of sources, receivers and oscillators: inexpensive BLE clocks at the edge, better protected or separated GNSS receivers, an independent reference where available, and selected nodes with stronger holdover. The protocol would need to carry enough information for receivers to judge those alternatives. This is a proposed extension of our present architecture; its resistance to jamming still needs measurement.

Diversity has to reach the reference

Adding three GNSS boards beside the same antenna installation provides limited protection against an interference event that reaches all three. Different manufacturers can diversify implementation faults. Different frequency bands can diversify exposure to a narrowband interferer. Physical separation can diversify exposure to a local jammer. Those are useful, distinct properties.

Multi-constellation reception alone does not establish independence: signals from different constellations can occupy overlapping bands. A receiver capable of using another unaffected band may retain service when one band is lost. Filtering and, for more demanding installations, adaptive antenna systems can add protection at the receiver. Their effectiveness depends on the interference and installation. NovAtel’s interference guide explains these approaches.

A complementary reference should also have a different path back to time. A wired PTP or fiber link could bring a remote clock into a future PToB gateway, but its upstream source matters. A nearby GNSS receiver feeding an Ethernet grandmaster still shares the local GNSS risk. NIST’s Time over Fiber service illustrates a reference delivered without dependence on GNSS.

The same distinction applies to radio transport. Our proposed longer-distance LoRa path could bring time from a receiver outside the affected area into a local BLE mesh. BLE and LoRa provide different delivery paths; neither creates an independent reference. Both paths need their own delay characterization and can suffer interference. Battery backup and separate power paths also matter if several references otherwise share one failure point.

Better holdover at a few nodes can help many receivers

Holdover uses what a clock learned while its reference was healthy. When updates stop, the local oscillator predicts forward. A frequency reference preserves the rate of ticking; a retained, trusted epoch is also needed to predict UTC.

There is a useful hardware ladder. An ordinary MCU clock can learn its rate in software. A temperature-compensated crystal oscillator, or TCXO, adds hardware compensation. An oven-controlled oscillator, or OCXO, controls the crystal’s temperature. Rubidium and chip-scale atomic clocks offer further options for installations with stricter outage requirements. Commercial disciplined oscillator modules already combine such clocks with GNSS or alternative reference inputs. Each candidate needs characterization for its temperature range, aging, power and capture path. A proposed input adapter would capture PPS or divided frequency edges in hardware, associate them with an established epoch, and account for input delay.

A battery-backed RTC has another useful role: preserving approximate time through power loss. It needs measured calibration before it can support precision holdover. For scale, the DS3231’s specified ±2 ppm at 0–40 °C corresponds to 120 µs of accumulated error in a minute at that frequency error. By comparison, 10 ppb of residual frequency error accumulates 600 ns in a minute, before starting phase error and other effects. These are calculations, not measured PToB outage results.

Our ESP32 holdover study provides an inexpensive starting point. A fully replayed population reached 64 seconds below 1 µs at sampled P99; a separate fixed cohort passed 75 seconds, while later rolling windows ended at 24 seconds. These were frozen predictions checked against BLE observations, rather than an independently calibrated GNSS-denial experiment. Temperature remains shadow-only.

A future mesh could concentrate better oscillators at a few reference nodes and distribute their predictions to simpler receivers. Every downstream clock would still inherit the source’s aging error and add its own transfer and prediction uncertainty.

What the protocol would need to add

Today’s GM7 prepares one HOT successor alongside the ACTIVE grandmaster. Its transmission eligibility depends on independent local GNSS/PPS qualification. Receiver holdover does not grant permission to become a new time source. Supporting alternative references and advertised holdover therefore needs explicit protocol work.

Four additions would make the available evidence useful:

• Reference identity and ancestry. Describe the originating reference, its time scale and epoch, and the dependencies shared by derived streams. Three relays repeating one clock remain one reference. Ensemble contribution history must also prevent timing information from circulating and gaining extra weight.
• Reference state and age. Distinguish externally referenced time, holdover, suspect input and unavailable time. Carry the last trusted reference observation and its age through every hop. A newly transmitted packet must never make an old reference look young.
• An aging uncertainty model. Report starting phase uncertainty, residual frequency uncertainty and the conditions under which the prediction was characterized. Account for transport and receiver capture. A sampled percentile needs its own label; an unknown bound must remain unknown.
• Explicit eligibility and recovery rules. Define which source types may serve, their permitted holdover envelope, how fresh grants are established, and how incompatible receivers reject unsupported semantics. Preserve boot, source-epoch, replay and original-expiry checks. A holdover advertisement must not renew an expired GNSS grant.

Before combining observations, receivers would translate them to a common instant and compatible time scale. They could then reduce the influence of aging inputs and isolate disagreements. With two conflicting references, disagreement alone cannot identify the correct one. Several correlated GNSS receivers cannot establish truth by majority vote.

Receiver health reports could contribute evidence such as interference indicators, lost tracking or missing PPS. They should retain an unknown cause when the evidence cannot distinguish jamming from antenna failure or poor reception. Mesh authentication protects report integrity against outsiders; a valid report does not prove that its GNSS input is correct.

How an interruption could unfold

Imagine two separated GNSS inputs, an independent wired reference and an OCXO-equipped node feeding an installation. A local GNSS input loses tracking. Its reference state changes promptly, while the other inputs remain under observation. Receivers use eligible alternatives and bridge gaps with their local predictions.

If all external references disappear, the installation enters holdover. Its clocks may remain closely aligned with one another while their shared uncertainty relative to UTC grows. Applications can have different limits: sensor correlation may tolerate an interval that a UTC logging requirement cannot. The mesh should expose those limits and withdraw a precision claim when its supported envelope ends.

When GNSS returns, a proposed recovery policy would compare it with surviving references and holdover predictions before readmission, retaining discrepancies and applying the appropriate qualification dwell. An unexplained large disagreement should remain visible for diagnosis.

The first validation should use controlled reference interruptions and an independent timing witness, retaining full outage and recovery errors, missing observations and temperature changes. Receiver diversity, geographic separation and simultaneous source loss need separate cases. Conducted or shielded interference testing can then examine receiver behavior without transmitting a jammer into the surrounding environment.

The aim is to make loss of one timing source a manageable change in available evidence. A heterogeneous mesh could preserve useful time for longer by combining references with different weaknesses, sharing better oscillators, and making the limits of every prediction visible.