PTP Holdover Explained: What Happens When Your Grandmaster Loses GPS?
When a PTP grandmaster loses GPS it doesn't stop — it free-runs on its own oscillator, and time error grows from that second. The ppb maths that predicts the drift, why a standard OCXO crosses the 1.5 µs telecom limit in about 4 hours, and how TCXO, OCXO, CSAC and rubidium oscillators compare over 24 hours.
Picture a wristwatch that never has to guess. Every second it checks itself against a perfect atomic reference — the GNSS satellites overhead — and corrects itself before error can build up. That is a grandmaster clock: the one clock a network trusts, kept honest by a signal from space.
Now the signal vanishes. The watch does not stop — it keeps ticking on its own, and it is a very good watch. But with nobody checking it, it slowly drifts. Holdover is the name for that state: the clock coasting on its own oscillator. It fails slowly and predictably — and the only question is how fast the error grows.
Why the satellites disappear
GPS feels like the most reliable signal on Earth — it comes from atomic clocks in orbit. The weakness is down here. By the time it reaches the ground, that signal is extraordinarily faint — far weaker than the buzz of everyday electronics — so it is easily blocked or drowned out.
The usual causes are unglamorous: a failed antenna, a damaged cable on the run to the roof. Then the hostile ones: interference and jamming, or spoofing, where a fake signal lies to the receiver. City sites fight urban canyons and multipath reflections. Sometimes the receiver itself simply faults.
And here is the part that matters: the grandmaster does not stop, and it does not scream. It enters holdover and free-runs on its oscillator. Everything downstream keeps receiving time that looks perfectly normal — it is just quietly getting wronger.
The maths of drifting, in plain English
Time error — how far the clock's time has wandered from true time — grows in two ways, and you need both to predict a holdover.
1. The steady leak: a frequency offset. If the oscillator runs at a slightly wrong rate, error piles up at a steady pace. The rate error is measured in ppb, and one rule of thumb is worth memorizing: 1 ppb of offset adds about 86.4 microseconds of error per day — roughly 3.6 microseconds per hour. Double the offset, double the leak.
2. The bend: ageing. The oscillator's rate itself slowly changes as the device ages, so the leak speeds up and the error curve bends upward instead of rising in a straight line. An oscillator that looks fine in hour one is drifting faster by hour twenty.
Real life is worse than both: temperature swings push the rate around in ways the simple maths does not model, so treat every calculation below as optimistic — the real crossing always comes sooner, never later.
Worked example: a good clock, out of spec in about four hours
Take a standard OCXO running just 0.1 ppb fast — an excellent clock by any normal standard. The arithmetic, step by step:
- The rate: 0.1 ppb of offset — and 1 ppb adds 86.4 µs of error per day.
- Error per day: 0.1 × 86.4 = 8.64 µs gained in 24 hours.
- Error per hour: 8.64 ÷ 24 = 0.36 µs per hour.
- Time to the telecom limit: 1.5 ÷ 0.36 ≈ 4.17 hours. Roughly 4.2 hours after the satellites vanish, a healthy grandmaster is out of spec.
Nothing broke. Nothing alarmed — unless you built the alarm yourself. The clock simply did physics, at the rate its datasheet always promised.
The oscillator ladder: the hardware is the budget
Swap the oscillator and you swap the survival time — by orders of magnitude. These are typical published 24-hour holdover figures; they vary by model and conditions, and temperature makes your unit worse than the headline number, not better.
| Oscillator | What it is | Typical error after 24 h in holdover |
|---|---|---|
| TCXO | A basic temperature-compensated crystal, ~100 ppb class | ≈ 8.64 milliseconds — hopeless for microsecond work within minutes |
| Standard OCXO | A crystal in a tiny oven, held at constant temperature | ≈ 8.64 microseconds |
| High-holdover OCXO module | An OCXO with adaptive, learned compensation for its own drift | ≈ 1.5 microseconds over 24 hours |
| Chip-scale atomic clock (CSAC) | An atomic clock shrunk onto a chip | Typically under 1 microsecond (≈ 0.86 µs in the simple model); worst-case datasheet drift is higher |
| Rubidium oscillator | An atomic oscillator built around rubidium | ≈ 100–500 nanoseconds |
Read that table as a buying decision, because it is one. The oscillator is the holdover budget: no setting and no amount of hope turns a TCXO into a rubidium. A second grandmaster only helps if it brings a better oscillator and its own antenna — hardware choices made long before the outage.
How long can we survive? Name your limit first
Survival is not a property of the clock alone — it is the clock measured against a limit, and different industries draw the line in very different places.
- Mobile networks. LTE TDD and 5G radios must stay within ±1.5 microseconds end to end: the ITU-T G.8271.1 network limit. Against that line, the standard OCXO above buys you about four hours.
- Trading. MiFID II's RTS 25 requires high-frequency trading timestamps accurate to 100 microseconds from UTC, with 1-microsecond granularity. A clock in holdover meets that for days — but firms set far tighter internal targets, because exchanges compare timestamps across venues, and "legally fine" is not the same as "provably first".
- Broadcast and power-grid users have their own limits again.
So "how long can we survive?" has no answer until you name your limit. The same OCXO is a four-hour clock to a 5G engineer and a multi-day clock to a firm watching only the legal line. Do the maths for your limit before an outage does it for you.
What good designs do
- Two grandmasters, truly independent: separate antennas and diverse cable paths, so one roof fault, one cut cable, or one jammer is not a total failure.
- Alarm loudly the moment holdover starts. Silent drift is the killer — everything looks fine while the timestamps rot.
- Know your crossing time in advance, per clock and per limit — treat holdover as a countdown, not a surprise.
- Consider a second, independent time source, so the backup does not share the first source's failure modes.
- Test holdover on purpose: deliberately disconnect the antenna in a maintenance window and watch what happens — before an attacker or a storm does it for you.
Common mistakes
- Trusting the datasheet figure at any temperature. The 24-hour holdover number was measured in friendly lab conditions; your rooftop in August is not one.
- A single grandmaster with a single rooftop antenna — a single point of failure wearing a timing costume.
- No alarm on holdover entry. If entering holdover is silent, you learn about it from the incident report, not from monitoring.
- Confusing frequency stability with time accuracy. A clock can tick at a beautifully steady rate and still be wrong: steady is not the same as true.
- Never testing holdover until the first real outage turns it into a live-fire exercise.
Try it yourself
Three timing questions, three different tools. The budget calculator covers the error while the clock is locked; the simulator covers the network; holdover is the third question — what happens when the reference disappears. Run your locked numbers through the PTP timing budget calculator and the PTP/SyncE timing simulator, then do this article's maths for your own oscillator: its ppb figure × 86.4 is its drift per day, and the size of the countdown you'd be living on.
- Holdover starts the moment GNSS is lost: the grandmaster free-runs on its internal oscillator and time error grows from that second — the only question is how fast.
- 1 ppb of frequency offset adds about 86.4 µs of error per day. A standard OCXO just 0.1 ppb fast gains 8.64 µs in 24 hours and crosses the ±1.5 µs telecom limit in roughly 4.2 hours.
- The oscillator is the holdover budget: TCXO ≈ 8.64 ms per day, standard OCXO ≈ 8.64 µs, high-holdover OCXO ≈ 1.5 µs, chip-scale atomic under 1 µs, rubidium ≈ 100–500 ns (typical published 24-hour figures).
- "How long can we survive?" has no answer until you name your limit — ±1.5 µs for LTE TDD and 5G (ITU-T G.8271.1), 100 µs from UTC for MiFID II HFT timestamps — and good designs alarm the moment holdover begins.