Every timing system built on GNSS carries a quiet assumption: that the satellites will be there. Most of the time they are. But a jammer in a passing truck, a spoofer testing a target, a crane parked over the antenna, or a receiver fault can all take the signal away — and when it goes, the clock has to keep time on its own. How well it does that, and for how long, is the difference between a shrug and an incident.
This is the resilience layer that sits underneath every application in this cluster — the ±1.5 µs a 5G network holds across cells, the traceable time a data center has to prove, the ±1 µs a substation runs on. This guide covers what holdover actually buys you, the GNSS-denied threats worth planning for, and why the antenna — not the oscillator — is the first and cheapest line of defense.
What holdover actually buys you
Holdover is what happens after GNSS disappears: the clock’s local oscillator keeps running, coasting on its own stability until the reference comes back. How long it stays inside your timing budget is set almost entirely by the oscillator.
An OCXO — an oven-controlled crystal — holds for hours, which is plenty for the brief, frequent gaps of a masked antenna or a short reacquisition. A rubidium miniature atomic clock holds for about a day, enough to ride through a working shift. A cesium clock, or the enhanced PRTC (ePRTC) defined by ITU-T G.8272.1, holds for 14 days — the standard requires less than 30 ns of error when it enters holdover and under 100 ns of drift across those two weeks, all traceable to UTC.
The catch is that holdover is a countdown, not a cure. Every hour without GNSS is stability you are spending down, and the oscillator that coasts longest is also the one that costs most. Buying resilience purely at the oscillator is the expensive way to do it. The cheaper leverage is to enter holdover less often in the first place — which is a question about the antenna.
The threats: jamming, spoofing, and silent failure
Not all GNSS-denied events are the same, and the differences matter for how you defend against them.
Jamming is brute force: a transmitter floods the band and buries the satellite signals in noise. It is increasingly common — cheap illegal jammers ride in vehicles to defeat trackers — and its effect is at least honest. The receiver knows it has lost lock, raises an alarm, and drops into holdover. You know where you stand.
Spoofing is the dangerous one, because it lies. A spoofer transmits counterfeit signals that a receiver accepts as real, and it can walk the recovered time slowly away from truth. Holdover doesn’t help here — the clock never knows it has lost the reference, so it feeds plausible, wrong time straight into a protection relay, a trade timestamp, or a 5G frame. The failure is silent until something downstream breaks. The distinction, and how to tell the two apart, is worth understanding on its own; it is covered in GPS jamming vs spoofing.
Beyond deliberate attack, ordinary life supplies the rest: obstruction and multipath from new construction, unintentional interference from a nearby transmitter, and space weather degrading the whole constellation at once.
Resilience is layered
No single component makes timing resilient; the defense is layered, and each layer catches what the one before it missed.
The antenna is the outer layer — it decides how many events ever become outages at all. The holdover oscillator is the middle layer, coasting through the outages that do get through. A backup reference — network time carried by PTP or NTP from a distant traceable source, terrestrial eLORAN, or fibre-based time distribution — is the innermost layer, the last resort for a denial that outlasts your holdover.
The important thing about this stack is the economics. Adding holdover means a better oscillator; adding a backup reference means a whole parallel timing path. Both are real money. The outermost layer — the antenna — is the cheapest, and it is the one that reduces the load on everything inside it.
The antenna is the first line of defense
Every outage the antenna prevents is a holdover you never enter and a backup you never fall back to. Three properties do that work, and they are exactly what separates a timing-grade antenna from an ordinary one — the same set the full specifier’s guide to GNSS timing antennas works through in detail:
- Multi-constellation, multi-band. Tracking GPS, Galileo, BeiDou, and GLONASS across L1/L2/L5 means no single system’s outage — or a jammer tuned to one band — takes the clock down. Diversity is resilience.
- Interference and multipath rejection. Strong out-of-band rejection, pre-LNA filtering, and a clean C/N0 floor let the receiver hold lock through low-level interference that would drop a lesser front end. Squeezing that margin out of a hard site is its own discipline, covered in improving GNSS antenna SNR and holdover.
- Anti-jam nulling for high-threat sites. Where jamming is a credible threat, a controlled-reception-pattern antenna (CRPA) uses an array of elements to steer nulls toward interference and keep a clean beam on the satellites — rejecting a jammer spatially, before the receiver ever has to cope with it. The element count sets the ceiling: an N-element array can null up to N−1 independent jammers. Against spoofing, an array’s ability to discriminate signals by direction of arrival is one of the few antenna-side defenses that actually helps.
None of this replaces holdover or a backup clock — it makes them rarely needed, which is the cheapest resilience money can buy.
Choosing for resilience
Match the layers to the threat and the cost of being wrong. A benign, non-critical site is well served by a multi-constellation timing antenna and an OCXO or rubidium holdover. A critical or high-threat site — a substation, a trading floor, a defense installation — earns the full stack: an anti-jam antenna, a longer holdover oscillator, and a backup reference, in that order of cost-effectiveness. Start from the outside, because the outside layer is where a dollar buys the most uptime.
Frequently asked questions
What is GNSS holdover? Holdover is a clock’s ability to keep time after it loses GNSS, coasting on its internal oscillator. How long it stays within budget depends on the oscillator: an OCXO holds for hours, a rubidium clock for about a day, and a cesium or ePRTC clock for around 14 days (ITU-T G.8272.1 requires under 100 ns of drift over that period).
Which oscillator do I need for holdover? It depends on how long an outage you must survive within your timing budget. OCXO covers brief, frequent gaps; rubidium rides through a working day; cesium or an ePRTC covers two weeks. Better holdover costs more, so it is usually cheaper to reduce how often you enter holdover — by improving the antenna — than to over-buy the oscillator.
Why is spoofing more dangerous than jamming? Jamming denies the signal and the receiver knows it, so the clock drops into holdover and raises an alarm. Spoofing replaces the signal with counterfeit time the receiver accepts as real, so it fails silently — feeding plausible but wrong time downstream. Holdover doesn’t protect against spoofing because the clock never realizes it has lost the true reference.
How does the antenna improve timing resilience? By preventing outages in the first place. Multi-constellation tracking survives any single system’s loss, strong interference and multipath rejection holds lock through low-level interference, and an anti-jam CRPA nulls jammers spatially. Every outage the antenna prevents is a holdover event that never happens — the cheapest layer of resilience.
Do I need a backup timing source besides GNSS? Only for outages longer than your holdover can cover, on sites where that risk is unacceptable. Options include network time (PTP/NTP from a distant traceable source), terrestrial eLORAN, or fibre time distribution. For most sites, a resilient antenna plus adequate holdover is enough; add a backup reference when criticality justifies the parallel path.
Written by GNSource Engineering. GNSource manufactures GNSS timing antennas and anti-jamming CRPA arrays for critical infrastructure. Talk to our engineers about a resilient timing front end, or explore the timing & synchronization and anti-jamming CRPA lines.
