IOP should do more error checking on time.
In the current version, IOP blindly reads the GPS second from the timing card each second, but at LHO there have been possible bad GPS seconds sent by the timing system.
If the IOP already has an established time, it should issue an error if the timing card doesn't agree with the it. Perhaps it should also only synchronize to the timing card after the change persists for some number of cycles.