Common-cause failures in GNSS time synchronization for digital substations: terrestrial and spaceborne threats and temporal resilience measures

Abstract Certain digital-substation applications require precise, traceable and continuously available time, especially synchronized sampled values (SV), synchrophasors, disturbance records, sequence-of-events (SOE) logs and functions that compare measurements from different sources or terminals. This paper treats GNSS dependence as a common-cause failure (CCF): redundant receivers, antennas and networks do not provide functional independence when they share satellite signals, the radio-frequency environment, the ionosphere or external PNT infrastructure. The work is a structured engineering framework supported by a directed technical review, analytical sensitivity modelling and independent analysis of public hardware-laboratory SV/PTP captures under GNSS spoofing (KIT, 2026); the jamming results used here are those stated on the authors’ poster. It (i) gives a semi-quantitative taxonomy that separates existence, probability class, geographic scope, mechanism, consequence and mitigation; (ii) maps time degradation from GNSS through PTP, merging units, SV and IEDs, comparing two master clocks and two merging units from different manufacturers; (iii) extends the holdover model to non-constant drift and temperature, and distinguishes absolute from relative timing error; (iv) extends line-differential sensitivity to unequal magnitudes, independent per-terminal errors, channel asymmetry, CT error, percentage restraint and SmpSynch blocking; and (v) shows that a 10 ms asynchronous spoofing step held the stepping merging-unit pair near $$180^{\circ}$$ for 42 s and kept the slewing unit off its baseline for about 105 s (peak $$180^{\circ}$$ , not held for that whole window), and that a correct best-master-clock failover to a redundant grandmaster 10 ms away produced 12 s near $$180^{\circ}$$ on one pair in each of two windows and 75 s off baseline on the others, then a common 10 ms error for about 14 min during which only the active grandmaster kept healthy PTP attributes and, for the last 11 min, all three merging units published SmpSynch = 2. Temporal-dependence levels DT-0 to DT-4 are given numerical requirements and a validation table. The results support functional diversity, specified holdover and free-running limits, time-quality monitoring, documented degraded modes and targeted commissioning tests.