Edge gateway clock skew corrupting mine sensor correlation

Time-series correlation between vibration, temperature, and pressure tags is only as good as the timestamps attached to each sample. When those timestamps drift, the correlation silently changes shape. On a tungsten mine, where a SAG mill, conveyor drive, and flotation circuit are monitored by separate edge gateways, this is not a theoretical concern. It is a measurable failure mode that conventional alarms and proof-tests are not built to catch.

The mechanism: how skew enters the data path

An edge gateway stamps each sample using its own clock. That clock is disciplined by NTP or PTP against an upstream server, but discipline is not instantaneous. A gateway that loses its time source freeholds on a local oscillator, typically a temperature-compensated crystal with a stability in the tens of parts per million. At 50 ppm, the clock gains or loses about 4.3 seconds per day. Over a two-week maintenance interval, that is roughly a minute of accumulated offset.

The offset does not announce itself. Individual sensor values remain within tolerance. A gearbox bearing running at 42 °C still reads 42 °C. The vibration RMS on a conveyor drive still sits inside its band. What changes is the relationship between tags. A vibration spike that physically preceded a temperature rise by 400 ms may appear to follow it, or to occur simultaneously, once each stream carries a different clock bias. Cross-correlation windows shift. Phase relationships between a control valve’s position feedback and the downstream pressure response invert.

This matters most where correlation is the diagnostic. Bearing defect frequencies are identified by their ratio to shaft speed, not by absolute amplitude. If the vibration channel and the tachometer channel are timestamped by different gateways with different offsets, the computed order ratio drifts. A developing inner-race defect can be smeared across adjacent order bins until it no longer stands out from the noise floor.

Why conventional alarms and proof-tests miss it

A high-vibration alarm compares one tag against one threshold. A proof-test of a safety instrumented function typically injects a simulated process variable and confirms the final element responds. Both are single-loop checks. Neither interrogates the timestamp field.

IEC 61511 addresses this through diagnostic coverage: the fraction of dangerous failures detected by automatic diagnostics. A proof-test that only verifies a sensor is within tolerance has low diagnostic coverage for failures of the correlation itself. The standard’s requirement for systematic capability and for verification of the safety instrumented function’s specified behaviour implies that the measurement chain, including time alignment, must be validated. A gateway with an undetected clock fault is a diagnostic blind spot.

The failure is also intermittent by nature. A gateway that re-synchronises after a network outage will step its clock, producing a discontinuity. If the step is small, the historian may interpolate across it without flagging. If the step is large, samples may be dropped or reordered. In both cases, the resulting correlation is corrupted but the individual tags look healthy. This is the definition of a covert failure: present, undetected, and capable of defeating the intended function.

Detecting skew through cross-checking and redundancy

The remedy is to make time itself observable. Three practices are defensible under IEC 61511 diagnostic-coverage principles.

First, deploy a dedicated time-reference tag. A gateway can log its own offset from the upstream time server as a first-class process variable. A rising offset trend is a diagnostic that can be alarmed on, trended, and included in proof-test records. This converts an invisible failure into a monitored one.

Second, cross-check redundant sensors on separate gateways. If two vibration sensors on the same gearbox are timestamped by independent gateways, their correlation coefficient is a live diagnostic. A sustained drop in correlation between two channels that should track each other indicates a time-alignment fault, not a process change. This is diagnostic coverage applied to the measurement architecture rather than to a single sensor.

Third, validate correlation during proof-tests. A proof-test that only checks a trip point is incomplete. Where the safety function depends on rate-of-change or on the relationship between two variables, the test should inject a known phase relationship and confirm the system resolves it correctly. This directly exercises the timestamp path and provides evidence for the proof-test interval justification.

For a tungsten mine, the practical targets are the SAG mill trunnion bearing, the conveyor drive gearbox, and the flotation control valves. Each has a correlation-based diagnostic that a clock fault can defeat. Adding a time-offset tag and a redundant cross-check on these assets is a bounded, testable change that raises diagnostic coverage without claiming the sensor is a safety device.

Instrumentation and architecture notes

Clock discipline should be treated as part of the measurement chain. PTP with hardware timestamping gives sub-microsecond alignment where the network supports it. NTP over a congested OT network may give tens of milliseconds of jitter. The choice should be documented, and the achieved offset should be measured, not assumed.

Historians should store the gateway offset alongside the sample, or at minimum log offset changes as events. A historian that silently interpolates across a clock step destroys the evidence needed to diagnose the fault later.

Where a safety instrumented function depends on correlation between tags, the architecture should place those tags on gateways with independent time sources, or on a single gateway with a verified, monitored clock. Mixing disciplined and undisciplined gateways in one correlation is the highest-risk configuration.

Getting started

Begin by auditing which tags feed correlation-based diagnostics on critical assets. For each, record the gateway, its time source, and its measured offset. Add a time-offset tag to the historian and alarm on sustained drift. Then select one asset, such as a SAG mill bearing or conveyor gearbox, and add a redundant sensor on an independent gateway to provide a live correlation cross-check. Finally, extend the proof-test procedure to inject a known phase relationship and confirm the system resolves it. Document the achieved clock accuracy as part of the safety instrumented function’s verification record. This work is incremental, testable, and consistent with IEC 61511 diagnostic-coverage expectations.

Source: live-verified — Australian Mining, “Renascor hits battery-grade purity at Adelaide plant,” 2026-10-09, https://www.australianmining.com.au/renascor-hits-battery-grade-purity-at-adelaide-plant/.

Grounded in a verified live source: Renascor hits battery-grade purity at Adelaide plant (2026-10-09) — source: live-verified.

Talk to S5 System about your site

S5 System designs and manufactures ultra-low-power industrial IoT sensors for mining, agriculture, infrastructure and utilities.

Discuss your IoT monitoring project — book a call.