Calnex: the clock nobody checks, and the 5-hour outage that proves it

Calnex published a piece on timing resilience by Stefano Ruffini, rapporteur of ITU-T SG15 Q13 (Calnex blog, 19 August 2026). The thesis is short: networks encrypt traffic, check certificates and back up links, yet they take time itself on trust. Almost nothing in the stack can tell whether the time it receives is right.

Dead clock, wrong clock

A dead clock is the easy case. The source stops answering, failover kicks in, the alarm fires. A wrong clock keeps answering, passes its self-tests and hands out the wrong time. Everything downstream believes it. Certificates, sessions and logs start failing for reasons that look unrelated, so the clock is the last thing anyone checks.

The case from July

In July a national mobile network went down for close to 5 hours. The clocks in its synchronisation nodes jumped about 20 years into the past. Trains stopped, traffic lights and payment terminals failed, emergency calls did not connect. Ruffini ties it to a known failure of GPS receivers, the week-number rollover: the receiver keeps satellite lock, reports itself healthy and outputs a date 2 decades off. The network below did what it was built to do and trusted the source.

What resilience means in practice

• More than 1 time source, GNSS included, plus holdover that lasts and alternative distribution paths.
• Limits on what a source may do: cap the size of a time step and its rate of change, so a lying source becomes visible.
• Verification before deployment: the sync chain, failover between sources and failure scenarios run on a test bed first.
• Continuous measurement in the live network, so drift shows up as data before it becomes an outage.

Standards referenced: ITU-T G.8272.1 (ePRTC), G.8272.2 (coherent PRTC), the ongoing G.8274 work on sync-network resiliency, and the regulatory push for resilient PNT.

Why it matters to our customers

Base stations hold phase within microseconds, power grids locate faults by synchronised measurements, payments and signalling ride on the same clock. The failure above is ordinary: a healthy-looking source that is wrong. A test bed is where you find out how your grandmasters, boundary clocks and holdover behave when a source dies or lies. We write that test plan together with you and agree the instruments before the test. Test. Compare. Decide.

Source: Timing Resilience: The Clock Nobody Was Watching, Calnex Solutions.