How Quartz Crystal Oscillators Are Made: Cultured Quartz to TCXO and OCXO

A quartz crystal oscillator is made by growing cultured quartz in a high pressure autoclave, sawing it into thin plates at a precise angle to the crystal axes, lapping and etching the plates to the thickness that sets the frequency, plating electrodes, trimming the frequency by adjusting electrode mass, and sealing the plate in vacuum or inert gas. An amplifier keeps it vibrating, and extra parts turn that plain crystal oscillator (XO) into a temperature compensated (TCXO) or oven controlled (OCXO) one.

This post walks through each step from raw quartz to a tested oscillator, works the numbers for watch crystals, load capacitors and drift, compares XO, TCXO, OCXO, MEMS and atomic references, and ends with how NTP and PTP software corrects a crystal that is never quite right. Makers keep recipes and yields private, so we rely on a US Army tutorial, NIST, USGS, patents and datasheets, and label illustrative numbers.

For network timing, read PTP (IEEE 1588) explained and Network Time Security for NTP. For a device that runs on a 32.768 kHz crystal, read how a smartwatch is made, and for the chips it clocks, how semiconductors are made.

Key takeaways

• Quartz is piezoelectric: strain produces charge, and voltage produces strain. A US Army tutorial by John Vig credits Jacques and Pierre Curie with the discovery in 1880.
• USGS says virtually all quartz used in electronics is cultured, not mined; lascas mining in Arkansas ended in 1997.
• Cultured quartz grows on seed plates at about 350 °C and 800 to 2,000 atmospheres over runs of 30 to 260 days.
• Cut angle sets temperature behaviour: the AT cut sits near 35¼ degrees, and the SC cut, patented in 1978 and 1979, at (yxwl) 21.93°/33.93°.
• Frequency is inversely proportional to plate thickness: an AT cut plate is about 166 µm thick at 10 MHz.
• One monolayer of added mass shifts a 5 MHz resonator by about 1 ppm, which is how trimming works and why contamination causes aging.
• Vig's comparison puts a TCXO near 2 × 10⁻⁶ per year and an OCXO near 1 × 10⁻⁸, at about 15 times the power.
• A 20 ppm crystal can drift about 52 seconds in a 30 day month. NTP assumes 15 ppm, and chrony stores the measured error in a drift file.
• Safeguard does not analyse crystals or firmware; its honest fit is the time sync software and services you build.

Why does almost every electronic device need a quartz crystal?

Digital logic needs a clock that tells registers when to capture data, a UART how long a bit lasts and a radio which channel it is on. An RC oscillator drifts by percent with temperature and voltage; USB, Ethernet, Bluetooth and real time clocks need parts per million.

Quartz gets there because it is a mechanical resonator with very low loss. NIST's "Time and Frequency from A to Z" glossary puts a typical quartz oscillator's quality factor (Q) between 10⁴ and 10⁶. Microchip's AN826 puts standard crystals at 20,000 to 200,000, against about 200 for a good LC circuit. A high Q means a very narrow resonance with little room to wander. NIST calls the quartz oscillator "the most common source of time and frequency signals," made by the billions each year, and notes that one sits inside every atomic oscillator.

What is the piezoelectric effect?

Piezoelectricity couples mechanical strain and electric charge in crystals without a centre of symmetry. NIST's glossary describes it for quartz: apply a voltage and the crystal strains; reverse the voltage and the strain reverses. Vig's milestone list credits Jacques and Pierre Curie with the discovery in 1880, and records the first sonar use in 1917 and the first crystal oscillator in 1918. We did not fetch the Curies' 1880 paper, so that date rests on the tutorial.

Vig explains why quartz won: it is piezoelectric, has cuts with a zero temperature coefficient and a stress compensated cut, has high Q, resists almost every chemical except fluoride and hot alkali etchants, and is easy to grow pure. In 1997, the tutorial notes, about 3,000 tons a year were grown, second among man made single crystals only to silicon.

How does a crystal become an oscillator?

Electrically a crystal is a series RLC branch (the motional arm R1, L1, C1) in parallel with its electrode and package capacitance C0. An oscillator wraps it in an amplifier with feedback, as NIST describes. The Pierce circuit in nearly every microcontroller puts the crystal across an inverting amplifier with a capacitor from each pin to ground. The crystal runs where it looks inductive, so its frequency depends slightly on the capacitance around it: the load capacitance covered below.

A dated timeline of quartz frequency control

Rows through 1982 come from the Vig tutorial's milestone list; later rows from the patents, NIST, USGS, IETF, IEC and IEEE pages in the sources.

From raw quartz to a tested oscillator: the step table

Vig's fabrication flow runs: grow, sweep, cut, lap, round, X-ray orient, angle correct, contour, etch, clean, deposit contacts, mount, bond, inspect, plate, bake, frequency adjust, seal and test. The table expands it and adds oscillator assembly. Order varies; watch tuning forks are made by photolithography in batches, while a precision SC cut blank is handled almost one at a time.

How is cultured quartz grown?

The autoclave

Quartz barely dissolves in water at room temperature, but in hot alkaline water under pressure it dissolves enough to be moved. Vig's tutorial describes the setup:

• The autoclave is filled to a set fraction with water plus a mineralizer, sodium hydroxide or sodium carbonate.
• A baffle separates a hotter dissolving zone at the bottom, holding the nutrient, from a slightly cooler growth zone at the top, holding the seeds.
• Seeds are thin slices of single crystal quartz, usually Z cut. The nutrient is pieces of quartz about 2½ to 4 cm across, called lascas.
• Temperatures are about 350 °C, pressures 800 to 2,000 atmospheres, and the zone difference typically 4 °C to 10 °C. A run takes 30 to 260 days.

The solution convects up, becomes supersaturated in the cooler zone and deposits silica on the seeds. Faster runs yield more quartz per year but trap more impurities, which lower Q and raise aging.

Why natural quartz is no longer used for most crystals

Natural crystals large and clear enough for resonators were rare and selected by hand. Cultured quartz is uniform, grows in a shape convenient for cutting and can be graded. The USGS 2025 Mineral Commodity Summary on quartz says "virtually all quartz crystal used for electronics was cultured," calling it quartz that is "manufactured, not mined." NIST's glossary agrees that "all modern devices use synthetic quartz."

USGS adds that in 2024 two US companies produced cultured quartz (output withheld), likely from imported lascas plus rejected cultured quartz, and that production has moved "increasingly overseas, primarily in Asia." Most lascas comes from Brazil and Madagascar. For 2020 to 2023 imports of unmounted piezoelectric quartz, USGS lists China (including Hong Kong) at 89 percent. Its 2024 price estimates are about 200 dollars per kilogram for as grown cultured quartz and 500 for lumbered quartz (sawn and ground), derived from reported prices and trade data, so treat them as indicators.

Grading the bars

Vig lists the quality indicators for cultured quartz, including infrared absorption, etch channel density, inclusion density and X-ray topography, and notes that EIA Standard 477-1 holds test methods for several. Infrared absorption by hydroxyl in the lattice correlates with achievable Q. The impurities that matter are aluminium, iron, lithium, sodium, potassium and hydrogen.

Sweeping

For radiation tolerant parts, bars are swept. Vig shows a bar at about 500 °C under about 1,000 V/cm along the Z axis, which drives alkali ions out of channels in the lattice. Most consumer crystals skip it.

How are quartz blanks cut, lapped, polished, etched and plated?

Orientation: X-ray diffraction sets the angle

Quartz is anisotropic. Its elastic constants and their temperature coefficients depend on direction, so the angle at which you slice a plate decides how its frequency changes with temperature. The Vig tutorial shows the standard tool: a double crystal X-ray diffraction system with a copper target X-ray source, a monochromator crystal, a goniometer holding the crystal under test, and a detector. Diffraction from known lattice planes tells the operator the true angle of a cut face to within arc minutes, and the saw or lapping fixture is corrected to match.

AT, BT and SC cuts

Quartz is anisotropic, so the slicing angle decides how frequency changes with temperature. Singly rotated cuts are rotated about one axis: Vig's figure shows the AT cut at about 35¼ degrees and the BT cut at about 49 degrees. Both vibrate in thickness shear, the faces sliding past each other. The AT cut has a cubic frequency versus temperature curve, and Vig's figure shows that a few arc minutes of angle error moves it by many ppm over a wide range.

The SC (stress compensated) cut is doubly rotated. Hewlett Packard patents US 4,079,280 (14 March 1978) and US 4,160,183 (3 July 1979), naming John A. Kusters, Jerry G. Leach and Michael C. Fischer, describe a resonator "with an orientation substantially equal to (yxwl) 21.93°/33.93°" vibrating in two thickness modes at once, and their titles say the cut compensates for static and dynamic thermal transients. Vig compares an SC cut third overtone resonator (in an MCXO) with an AT cut fundamental (in a TCXO): low versus significant activity dip incidence, hysteresis of 10⁻⁹ to 10⁻⁸ versus 10⁻⁷ to 10⁻⁶, and aging of 10⁻⁸ to 10⁻⁷ versus 10⁻⁷ to 10⁻⁶ per year. Two angles must be controlled instead of one, so SC cuts go mainly into precision parts such as OCXOs.

Watch crystals are tiny quartz tuning forks that vibrate in flexure. Vig's tutorial mentions photolithographically produced tuning forks and dates quartz watches to 1972.

Thickness sets frequency

For a thickness shear plate, frequency is inversely proportional to thickness:

f = N / t

where N is the frequency constant. Vig gives N as 1,661 MHz·µm for an AT cut and 1,797 MHz·µm for an SC cut's c mode.

Worked example 1: how thick is an AT cut plate?

Using N = 1,661 MHz·µm from the Vig tutorial:

A 10 MHz plate is about as thick as a sheet of thick paper; a 100 MHz fundamental would be thinner than most plastic film and very hard to handle. That is why higher frequency crystals either run on an overtone (third or fifth) of a thicker plate, use inverted mesa blanks that are thinned only in the middle, or are followed by a phase locked loop that multiplies a lower reference.

Lapping, rounding and contouring

Wafers are lapped between flat plates with abrasive slurry to near final thickness. Because thickness sets frequency, progress is tracked by frequency, which Vig says "can be measured much more accurately than thickness." Precision blanks may be contoured slightly convex to trap energy away from the mounts; Vig dates contoured high Q AT cuts to 1949.

Etching

Chemical etching in fluoride solutions removes the lapping damage, relieves stress and fine tunes thickness. Vig measures removal in f² units (frequency change in kHz over frequency in MHz squared), because one unit always means the same thickness: 1.661 µm for an AT cut, about 0.83 µm per side. Quartz etches anisotropically, so dislocations show up as etch channels.

Cleaning and electrode plating

Vig stresses contamination control because contamination worsens aging, hysteresis, noise and yield. Electrodes are then deposited through a mask in vacuum; one of Vig's resonator examples uses evaporated silver. For a 5 MHz resonator the plate is about 10⁶ molecular layers thick, so one quartz equivalent monolayer of added mass shifts frequency by about 1 ppm. That arithmetic drives both trimming and aging.

How is frequency trimmed and the crystal sealed?

Frequency adjust

Blanks come out of etching slightly high in frequency on purpose. After mounting, the unit sits in a fixture that measures its frequency while a little more metal is deposited onto the electrode, which adds mass and lowers the frequency. Some processes instead remove material to raise it. The process stops when the measured frequency hits the target for the specified load capacitance.

Worked example 2: how much mass does trimming add?

Illustrative numbers. Take a 10 MHz AT cut plate (166.1 µm thick, from worked example 1) that measures 200 ppm high after mounting.

Since Δf / f = minus Δt / t, lowering the frequency by 200 ppm needs an effective thickness increase of:

Δt = 200 × 10⁻⁶ × 166.1 µm = 0.0332 µm, or about 33 nm of quartz equivalent mass.

A metal film is much denser than quartz (quartz is about 2.65 g/cm³; gold is about 19.3 g/cm³), so the actual metal layer is a fraction of that thickness. The point is the scale: the factory is adjusting frequency with films a few nanometres thick, and one stray molecular layer of contamination inside the package later shows up as ppm level drift. This is the physical reason sealing and cleanliness matter.

Mounting

Vig shows two point mounts for small blanks and three or four point mounts for larger ones, with clips and bonding adhesive. His X-ray topographs show lattice distortion caused by bonding cements, so the bond is part of the resonator, and its stress relaxes over time.

Sealing: vacuum or inert gas

Crystals are sealed in vacuum or dry inert gas so water and organic vapour cannot adsorb onto the electrodes. Surface mount crystals use small ceramic packages with a sealed lid, as the Epson and Abracon outline drawings show. Vig lists gas inside the enclosure as a factor in Q, and leaks and outgassing among aging causes.

Aging

Vig's aging mechanisms are mass transfer from contamination, stress relief in mounts, bonds and electrodes, outgassing, diffusion, chemical reactions, enclosure pressure changes, oscillator circuit aging and oven control aging. Aging is fastest early, which is why precision parts are burned in. Epson's FC-135 and Abracon's ABS07 32.768 kHz crystals both list plus or minus 3 ppm first year aging; Vig's table puts a TCXO near 5 × 10⁻⁷ per year and an OCXO near 5 × 10⁻⁹.

What are load capacitance and ESR?

Load capacitance (CL) is the capacitance the crystal must see in the circuit to run at its marked frequency. AN826 explains that series and parallel resonant crystals are made exactly alike; a parallel resonant crystal is simply specified at a stated CL. Watch crystals use small values: Epson offers the FC-135 at 7, 9 or 12.5 pF, and the ABS07 defaults to 12.5 pF. In a Pierce oscillator, AN826 gives:

CL = (C2 × C3) / (C2 + C3) + Cs

where C2 and C3 are the capacitors to ground and Cs is stray capacitance, which the note says can be assumed to be 2 to 5 pF.

ESR (equivalent series resistance) is the crystal's resistance at series resonance, given as a maximum. The amplifier must overcome it with margin, or the oscillator may not start, especially cold. Tuning forks are high: Epson lists 70 kΩ typical. Drive level, the power dissipated in the crystal, must stay within the datasheet; the ABS07 lists 0.1 µW typical and 0.5 µW maximum, and Epson warns excessive drive can damage the part.

Worked example 3: picking load capacitors for a watch crystal

Datasheet values from the Epson FC-135; circuit values illustrative.

The crystal wants CL = 12.5 pF. Assume Cs = 3 pF. With C2 = C3 = C: 12.5 = C / 2 + 3, so C = 19 pF. With common 18 pF parts, CL = 9 + 3 = 12 pF, half a picofarad low.

AN826 gives pulling sensitivity as ppm per pF = (C1 × 10⁶) / (2 × (C0 + CL)²), capacitances in pF. Epson lists C1 = 3.4 fF (0.0034 pF) and C0 = 1.0 pF typical. At 12.5 pF: 3,400 / (2 × 13.5²) ≈ 9.3 ppm per pF. Half a picofarad low makes the clock about 4.7 ppm fast, roughly 0.4 seconds a day.

Now suppose a copied schematic leaves CL near 9 pF. AN826's pulling formula Δf / fs = C1 / (2 × (C0 + CL)) gives about 126 ppm above series resonance at 12.5 pF and 170 ppm at 9 pF. The difference, about 44 ppm, is roughly 3.8 seconds a day or 114 seconds a month, from two wrong capacitors.

What are XO, VCXO, TCXO and OCXO?

Vig classifies crystal oscillators by how they handle the crystal's frequency versus temperature curve:

• XO does nothing about it. Vig's illustration shows about plus or minus 10 ppm from minus 45 °C to plus 100 °C.
• VCXO adds a varactor so a control voltage can pull the frequency slightly, for phase locked loops and fine adjustment.
• TCXO reads a temperature sensor such as a thermistor and applies a correction voltage to a varactor. Vig credits analog TCXOs with about a 20 times improvement, illustrated as plus or minus 1 ppm. NIST says it "does not work as well as the oven control used by an OCXO, but is less expensive."
• MCXO uses digital compensation; Vig dates the first to 1982.
• OCXO holds the crystal in an oven at the temperature where its curve has zero slope. Vig credits more than a 1,000 times improvement; NIST says a typical OCXO might be stable to 1 × 10⁻¹² at one second, limited long term by aging, and notes its warm up period.

XO, TCXO, OCXO and atomic references compared

From the Vig tutorial's comparison table (January 2004 revision). Figures represent classes, not products; accuracy includes environmental effects and one year of aging.

Quartz temperature stability is over minus 55 to plus 85 °C; the rubidium and cesium ranges are narrower. Vig's hierarchy table gives a plain XO 10⁻⁵ to 10⁻⁴ (10 to 100 ppm). Prices and sizes have fallen since 2004, but the trade between stability, power and cost holds.

How to choose

Why is a watch crystal 32.768 kHz, and how far does it drift?

Worked example 4: the power of two

Vig puts it plainly: 32,768 = 2¹⁵. Dividing by two fifteen times gives exactly 1 Hz, which drives an analog watch's stepping motor one 6 degree step per second or a real time clock's seconds counter. Each divide by two stage is one flip flop, the cheapest, lowest power counter there is. Vig calls 32,768 Hz a compromise among size, power and stability.

32,768 → 16,384 → 8,192 → 4,096 → 2,048 → 1,024 → 512 → 256 → 128 → 64 → 32 → 16 → 8 → 4 → 2 → 1 Hz

Worked example 5: how many seconds a month does a 20 ppm crystal drift?

Both the Epson FC-135 and the Abracon ABS07 list a frequency tolerance of plus or minus 20 ppm at 25 °C. One ppm of frequency error is one microsecond of time error per second.

Per day: 20 × 10⁻⁶ × 86,400 s = 1.728 s.

Per 30 day month: 20 × 10⁻⁶ × 30 × 86,400 s = 51.84 s.

Per year: 20 × 10⁻⁶ × 365 × 86,400 s = 630.7 s, about 10.5 minutes.

So a clock built on an untrimmed 20 ppm crystal at room temperature can be up to about 52 seconds off after a month, before temperature or aging is counted. Many watches do better because makers trim or select crystals and adjust the divider digitally (by occasionally skipping or adding pulses).

Worked example 6: what temperature does to a tuning fork

A tuning fork has a parabolic curve: Δf / f = B × (T minus T0)². Epson lists a turnover T0 of 25 °C plus or minus 5 °C and B of minus 0.04 ppm per °C² maximum; Abracon lists minus 0.036 to minus 0.040. With B = minus 0.04 and T0 = 25 °C (temperatures illustrative):

The error is always slow because the parabola opens downward. A watch on a wrist stays near its best temperature; an outdoor sensor or a board beside a hot processor loses seconds a day. A 32 kHz TCXO closes that gap: SiTime's SiT1552 datasheet lists plus or minus 5, 10 or 20 ppm over temperature (without initial offset) in a 1.5 × 0.8 mm package at 0.99 µA typical core current.

What do MEMS oscillators change?

A MEMS oscillator replaces quartz with a tiny silicon resonator made in a wafer process, packaged with a temperature sensor and compensation and PLL circuitry. The SiT1552 datasheet calls itself a 32.768 kHz MEMS TCXO, and SiTime's product pages also list MEMS OCXOs. Read any part's claims from its own datasheet; we do not rank products.

• Manufacturing. Lithography and etching on silicon replace growing, sawing and lapping, and frequency is typically set by programming the PLL rather than trimming electrode mass.
• Compensation is built in. Silicon's temperature coefficient is large, so MEMS parts always include temperature correction.
• Phase noise. The output is synthesized, so check jitter against the application.
• Board design. An oscillator module has its own amplifier and needs no external load capacitors, so the mistakes in worked example 3 do not apply.

Either way, the board still has a frequency a few ppm wrong, and software still has to deal with it.

Where do atomic clocks and GNSS disciplined oscillators sit above quartz?

Atomic standards lock a quartz flywheel to a rubidium or cesium transition. Vig's table puts rubidium near 5 × 10⁻¹⁰ per year at about 20 W and cesium near 2 × 10⁻¹¹ at about 30 W. NIST's Time and Frequency Division, which runs cesium fountain clocks and the UTC(NIST) time scale, sits at the top of the US chain.

A GNSS disciplined oscillator (GPSDO) sits between. NIST's glossary describes it as a self calibrating standard that uses GPS signals to steer a local quartz or rubidium oscillator; nearly all use the C/A code on the L1 carrier at 1575.42 MHz, and the satellite signals must be stable to parts in 10¹⁴ over 12 hours for GPS to meet its specifications. The local oscillator matters most when the sky goes away, which is why timing servers use an OCXO. Our post on GPS timing as a hidden dependency covers losing or spoofing that signal.

Worked example 7: holdover when the reference disappears

Illustrative numbers. A PTP grandmaster loses GNSS with a 1 µs time error budget. With a constant fractional frequency error, time to 1 µs = 1 µs / error.

Temperature and aging make real holdover worse, but the ratio between classes holds. NIST Technical Note 1337, Characterization of Clocks and Oscillators (March 1990), collects the methods, including the Allan variance, used to measure stability at different averaging times.

How do operating systems and time sync software correct for an imperfect crystal?

A computer has a real time clock (RTC), usually on a 32.768 kHz crystal and a coin cell, and a system clock driven by a faster oscillator while running. Both inherit their crystal's error.

NTP's assumptions

RFC 5905 (NTPv4) defines a frequency tolerance PHI, "typically 15 ppm," used to grow a clock's estimated error between updates; it notes this is about 1.3 seconds per day. Its reference code defines MAXFREQ, 500 ppm, which caps the correction the clock discipline will apply.

Chrony's drift file

The chrony.conf documentation says the driftfile records "the rate at which the system clock gains or loses time, expressed in parts per million"; 100.0 means 100 µs gained per second. chronyd reloads it at start so it need not relearn. The rtcsync directive copies system time to the RTC; on Linux the kernel does so every 11 minutes.

PTP and hardware timestamps

IEEE 1588-2019 defines the Precision Time Protocol for precise synchronization of networked clocks. PTP timestamps packets in network hardware and steers the interface's own oscillator, often a TCXO on a server NIC and an OCXO in a grandmaster.

Step by step: measure your clock's drift and correct it

These commands read or adjust time settings only and erase nothing, but changing the clock on a production host can upset logs, schedulers and authentication. Try them on a test machine first.

1. See what the system thinks of its own clock

timedatectl status

Check "System clock synchronized" and "NTP service." If the clock is not synchronized, nothing below has been correcting your crystal.

2. Read the measured frequency error from chrony

chronyc tracking
chronyc sourcestats -v

The chronyc documentation's sample shows lines such as Frequency : 3.225 ppm slow and Skew : 0.129 ppm. Frequency is the crystal driven clock's error; skew is the error bound on that estimate. A few ppm is normal; hundreds points to a hardware or virtualization problem.

3. Keep the drift file and step at boot only

A minimal chrony.conf (server names are placeholders):

# /etc/chrony/chrony.conf (path varies by distribution)
server time1.example.net iburst nts
server time2.example.net iburst nts
driftfile /var/lib/chrony/drift
makestep 1.0 3
rtcsync

makestep 1.0 3 allows a step above one second only during the first three updates, fixing a bad RTC at boot without stepping later. The nts option uses Network Time Security.

4. Check the RTC against system time

sudo hwclock --show
date

Note the difference, wait a day with the system synchronized but without rtcsync, and compare. The change over 86,400 seconds is the RTC crystal's error; 1.3 seconds gained in a day (illustrative) is about 15 ppm fast.

5. Check certificate time against device time

openssl x509 -noout -dates -in server.pem
date -u

RFC 5280 defines validity with notBefore and notAfter. A device whose RTC lost power and booted to a default past date rejects every certificate as not yet valid; one running ahead may accept an expired one. Compare before trusting a TLS error.

6. For a board you design: measure the crystal

Route an internal clock to an output pin, measure it with a calibrated counter at room temperature and at your enclosure's extremes, and compare with worked examples 3 and 6. A large room temperature error usually means wrong load capacitors, not a bad crystal.

Common mistakes

• Copying load capacitors from a reference design. Recompute CL = C2C3/(C2 + C3) + Cs for your crystal and board.
• Ignoring ESR and drive level. A marginal oscillator starts on the bench and fails cold; overdrive shifts frequency and can damage a tuning fork.
• Treating tolerance as the whole error. Plus or minus 20 ppm is at 25 °C; temperature, load mismatch and aging add on top.
• Ignoring temperature drift in time sensitive protocols. Test PTP holdover or TDMA slot timing over the real enclosure temperature range.
• Trusting a device clock for certificate validity. Get time from an authenticated source before validating certificates, and log large boot steps.
• Running time sync without a drift file. Every restart relearns the crystal error.
• Stepping the clock on a running host. Prefer slewing; our post on log timestamps and clock sync shows what steps do to incident timelines.
• Judging an OCXO during warm up. NIST notes its performance changes continuously until the oven settles.

Where Safeguard fits, honestly

Safeguard does not design, test or analyse crystals, oscillators, timing hardware or firmware, and its models are single purpose security models, not physics or materials tools.

The fit is the software that keeps time. Chrony, ntpd, linuxptp, SNTP clients in device SDKs and the TLS libraries that check certificate dates are open source components inside the images and services your team builds. Safeguard scans repositories, container images and SBOM files (safeguard scan --dir ., --image <name>, --sbom <file>), matches components against vulnerability databases, ranks findings with reachability analysis, shows which projects contain a given component and version, and evaluates policies and gates. Fixes inside a vendor's firmware still come from that vendor.

A rebuilt time server, a new base image or a device SDK update pulls these components again, so ordinary supply chain hygiene applies to the software side of timing, even though it says nothing about the crystal.

Fix it without waiting for upstream

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation categories include dependencies, licenses, security posture and findings, and each one is set separately. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds.

3. Gold Registry: start from components that are already fixed

Gold Registry provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs and a completed license check, with signed build provenance (signed with Safeguard's key and verifiable with cosign, SLSA Build Level 3 as the design target) and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. Ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

The first demo is a real Safeguard CLI session asked to fix a lodash CVE. It reads the finding and advisory, asks before any command that changes something, edits package.json to lodash 4.17.21, runs npm install and npm test with approval, and pushes nothing. The same flow applies to a time server's management service your team maintains.

Click through it at your own pace, or open it full screen.

The second demo sets up the Safeguard runner on your own machine, approves it with its device code and scans from the terminal. That suits a team building NTP or PTP server images on its own hosts.

Click through it at your own pace, or open it full screen.

The third demo connects Claude to the Safeguard MCP server with OAuth and shows how you choose which tools Claude can use, so an engineer can ask about a timing service's findings while controlling what the assistant may call.

Click through it at your own pace, or open it full screen.

To try it on your own repositories, download Safeguard and follow the CLI documentation.

FAQ

How are quartz crystals made?

Cultured quartz is grown on seeds in autoclaves, sawn into bars, oriented by X-ray and sliced at a set angle. Blanks are lapped, etched, plated, mounted, trimmed, sealed in vacuum or inert gas, aged and tested.

Is the quartz in electronics natural or synthetic?

Synthetic. USGS says virtually all electronic quartz is cultured, and NIST says all modern devices use synthetic quartz. Natural lascas is the feed.

What is the difference between a TCXO and an OCXO?

A TCXO corrects temperature error electrically for about 1 ppm at milliwatts. An OCXO heats the crystal in an oven for far better stability at hundreds of milliwatts, after a warm up.

Why are watch crystals 32.768 kHz?

Because 32,768 is 2¹⁵, so fifteen divide by two stages give one pulse per second.

How accurate is a quartz watch?

An untrimmed 20 ppm crystal can drift about 1.7 seconds a day or 52 seconds a month at room temperature. Trimmed movements on a wrist do much better.

What does load capacitance mean on a crystal datasheet?

The capacitance the crystal must see to run at its marked frequency: in a Pierce circuit, the two capacitors in series plus stray. A mismatch pulls a watch crystal about 9 ppm per picofarad.

Are MEMS oscillators better than quartz?

Neither is better in general. Compare datasheet stability, jitter, power and shock for your design.

How does NTP deal with a drifting crystal?

It measures and corrects the frequency error continuously; RFC 5905 assumes 15 ppm tolerance, and chrony saves the measured error in a drift file.

Can a wrong device clock break HTTPS?

Yes. RFC 5280 certificates have notBefore and notAfter dates, so a clock in the past or future makes valid certificates fail or expired ones pass.

Quick check

Sources

• US Army CERDEC, John R. Vig, Quartz Crystal Resonators and Oscillators for Frequency Control and Timing Applications: A Tutorial, Rev. 8.5.2.0, January 2004 (PDF, hosted copy)
• USGS, Mineral Commodity Summaries 2025: Quartz (High-Purity and Industrial Cultured Crystal) (PDF)
• USGS, Mineral Commodity Summaries 2024: Quartz (PDF)
• NIST, Time and Frequency Division
• NIST, Technical Note 1337, Characterization of Clocks and Oscillators (PDF)
• NIST, Time and Frequency from A to Z: Q to Ra (quartz oscillator)
• NIST, Time and Frequency from A to Z: N to O (OCXO)
• NIST, Time and Frequency from A to Z: T to Te (TCXO)
• NIST, Time and Frequency from A to Z: G (GPS disciplined oscillator)
• IEC, IEC 60122-1:2002+AMD1:2017 CSV, Quartz crystal units of assessed quality, Part 1: Generic specification
• IEEE SA, IEEE 1588-2019, Standard for a Precision Clock Synchronization Protocol
• Google Patents, US 4,079,280, Quartz resonator cut to compensate for static and dynamic thermal transients
• Google Patents, US 4,160,183, Oscillator having a quartz resonator cut to compensate for static and dynamic thermal transients
• Microchip, AN826, Crystal Oscillator Basics and Crystal Selection for rfPIC and PICmicro Devices (PDF)
• Epson, FC-135 32.768 kHz crystal unit datasheet (PDF)
• Abracon, ABS07 32.768 kHz crystal datasheet (PDF)
• SiTime, SiT1552 32.768 kHz MEMS TCXO datasheet (PDF)
• RFC Editor, RFC 5905, Network Time Protocol Version 4
• RFC Editor, RFC 5280, Internet X.509 PKI Certificate and CRL Profile
• chrony, chrony.conf(5) documentation
• chrony, chronyc(1) documentation

Last reviewed: 25 October 2026.