On Thu, Apr 3, 2014 at 8:46 PM, Rob Seastrom <rs@seastrom.com> wrote:
Chris Adams <cma@cmadams.net> writes:
Once upon a time, Rob Seastrom <rs@seastrom.com> said:
Along the same lines I'm troubled by the lack of divergent sources these days - everything seems slaved to GPS either directly or indirectly (might be nice to have stuff out there that got its time exclusively via Galileo or Glonass).
Since you mentioned GLONASS: it had a 10+ hour outage yesterday, apparently due to a bad ephemeris upload. Did anybody have a GLONASS-using NTP server experience problems?
It would be the height of arrogance to think that this couldn't happen to GPS.
I want redundancy.
Sadly, right now that either means your own real clock, or WWV. The cellphone time is (as far as I know, for the networks I saw data on) all coming off GPS. Fortunately real clocks are coming way down in cost. So the question is, if you want redundancy, what do your failure modes look like. Is some low level drift if GPS goes away and stays away for an extended period OK? In that case, redundancy probably would be a single local high grade clock. Do you want multi-vendor-common-mode-failure-resistant low drift if GPS goes away? In that case, you probably need 3 local clocks. Possibly 4, if you want to be able to down one for maintenance and still have 3 operating when the fit hits the shan, so that if one of the remaining ones drifts you know which of the 3 is out of whack and to exclude from the "live source". Just two operating and you're SOL on figuring out which one is off. This is why spacecraft and aircraft often have 3 or 4 of each critical thing; 3 gets you "only fly with all 3 working" and the ability to detect the bad instrument; 4 lets you fly with one down for maintenance and still have safe redundant operation, increasing dispatch reliability. -- -george william herbert george.herbert@gmail.com