hardware · 8 min read

Choosing reliable time: redundancy, holdover and traceability

Why choose a premium time server? This guide explains the building blocks of a reliable, traceable time chain: dual time source, failover, holdover and UTC traceability.

Choose your reading level

Reliable time is more than a clock that runs 'about right'. In a data centre, a control room or a high-voltage substation, time that drifts or stops is expensive, sometimes dangerous. You buy a premium time server for the certainty, not for the box.

Three things make time reliable:

Dual source and failover: two independent time sources, so one failure does not take time down.
Holdover: if GPS drops out, the server keeps running accurately on its own oscillator.
Traceability: you can prove your time is correct, back to the world standard UTC. That is what an audit requires.

A cheap clock that drifts or fails after a year ultimately costs you more than a device that simply works for ten years. That is the heart of the choice. Ask for advice.

You buy reliability with three building blocks: a redundant time source, sufficient holdover and a chain traceable to UTC. This guide explains why those three together make the difference between a clock and a time infrastructure you can build on.

1. Redundancy: one failure must not take time down

A critical time chain duplicates its weak links:

Two time sources: for example two independent GNSS antennas, or GNSS combined with an IRIG or PTP reference. If one drops out, the other takes over.
Redundant power: two power supplies, so a failed supply does not stop the server.
Automatic failover: the switchover happens without intervention and without a time jump.

2. Holdover: keep running when the source fails

Even with redundant sources, GNSS can temporarily drop out (interference, jamming, an antenna problem). The internal oscillator bridges that period. An OCXO keeps time within tolerance for days; a Rubidium for months. Holdover is your insurance against a source you do not control.

In depth: Holdover: TCXO, OCXO and Rubidium.

3. Traceability: proving your time is correct

For an audit, 'the clock was right' is not enough. You must be able to trace the time to UTC through a known structure (stratum levels), with a documented source and uncertainty. Regulations such as MiFID II (financial trading) and IEC 61850 (energy) explicitly require that traceability.

In depth: Stratum levels and GNSS disciplining.

Why premium pays off: the total cost

The purchase price is only part of the picture. Consider:

Cost of failure: what does an hour of wrong or stopped time cost in your environment?
Lifespan: a professional device lasts 10+ years; a cheap clock often does not.
Support and warranty: Masterclock devices come with 1 year warranty via Daylight bv and 4 years Masterclock factory warranty, plus local support.

You buy a time server once, for ten years. Choose for certainty. Discuss your requirements with us.

Reliability is a system property, not a product label. It arises from redundancy on every weak link, a holdover that matches the error budget, and a chain traceable to UTC with quantified uncertainty.

Redundancy architecture

Duplicate the single points of failure: two independent GNSS receivers (preferably multi-constellation: GPS, Galileo, GLONASS, BeiDou), separate antenna paths, redundant power and, where the application demands it, two grandmasters with a deterministic selection mechanism (BMCA in PTP). The switchover must not introduce a time jump (phase step).

Holdover in the error budget

The time deviation during holdover is the integral of the frequency error; over a long outage the drift (ageing, temperature) dominates over the initial offset. Size the oscillator on (permissible deviation) divided by (realistic source recovery time), with margin for temperature gradients in the rack.

Traceability and audit

An auditable chain documents source, stratum, disciplining method and measurement uncertainty to UTC. MiFID II (ESMA RTS 25) requires a maximum divergence from UTC per trading activity; IEC 61850-9-3 (Power Profile) defines the requirements for the full PTP chain in a substation, not just for the grandmaster.

The weakest link determines the result

Antenna placement, cable length, switch jitter and ground loops can neutralise an expensive oscillator. A reliable installation designs the full chain, not just the device. See installation.

Sources: IEEE 1588-2019; IEC 61850-9-3; ESMA RTS 25 (MiFID II); NIST Time & Frequency Division.