Time Synchronisation with PTP: Getting IEC 61850 Timing Right

A few winters ago, we were called into a UK digital substation where protection engineers were chasing ghost trips. The relay logic was sound, the GOOSE configuration had been validated in the lab, and yet during switching operations the scheme occasionally misbehaved. The culprit turned out to be timing: an ageing satellite clock feeding IRIG-B over copper, drifting just enough during a GNSS outage to push Sampled Values outside their permitted window. That episode convinced us that Precision Time Protocol is no longer an optional extra in IEC 61850 substation automation — it is the backbone that keeps protection, control and smart grid functions honest.

Why IEC 61850 Demands Better Than NTP

Most enterprise networks limp along happily with NTP, syncing servers to within a millisecond or two. That is fine for log correlation and billing. It is nowhere near good enough for a digital substation, where merging units publish Sampled Values sixty or eighty times per second and GOOSE messages must arrive within a few milliseconds to trip a breaker correctly. PTP, defined in IEEE 1588, delivers sub-microsecond accuracy when implemented properly — roughly three orders of magnitude tighter than NTP over a typical WAN.

The limits of NTP and IRIG-B in substation automation

NTP was designed for general-purpose IP networks and tolerates asymmetric routing, jitter and software timestamping. In a substation automation context, those tolerances become liabilities. IRIG-B has served the industry well for decades and remains common across National Grid substations, particularly on legacy transmission sites where hard-wired distribution over coaxial cable is still reliable and well understood. But IRIG-B carries no meaningful security or redundancy model of its own, requires dedicated cabling, and is gradually being phased out in favour of Ethernet-based PTP as new IEC 61850 bays are commissioned.

How GOOSE and Sampled Values expose timing errors

GOOSE and Sampled Values are the two protocols that punish sloppy timing hardest. GOOSE carries protection trip and interlock signals with performance classes that assume publish and receive latencies measured in single-digit milliseconds. Sampled Values carry digitised current and voltage at 4 kHz or 4.8 kHz, and the receiving relay uses the sample counter and timestamp to reconstruct the waveform. A 1 µs timing error on a Sampled Value stream translates to positional error in the reconstructed phasor — often described in metres of equivalent conductor distance — and can push differential protection outside its restraint characteristic. In other words, timing is not a background concern; it is part of the protection algorithm.

IEEE 1588 PTP Profiles for Substation Automation

Generic PTP is a broad standard with many optional features, which is why the industry adopted a specific profile for power utilities. The Power Profile, standardised as IEC 61850-9-3, defines message rates, transport requirements and the role of the grandmaster clock so that equipment from different vendors can interoperate inside a substation. The IEC/IEEE 61850-9-3 edition formalised that work and is what most UK transmission and distribution projects now reference in their specifications.

Default profile vs Power Profile: what changes

The default PTP profile allows a wide range of message rates and transport options. The Power Profile narrows this considerably:

• Sync messages default to once per second, with Announce at the same rate.
• Peer-to-peer delay mechanism is mandated rather than end-to-end, which suits ring topologies common in substations.
• Layer 2 Ethernet transport is used, avoiding the jitter introduced by IP routing.
• Multicast addressing follows a fixed set of MAC addresses defined in the standard.
• Grandmaster clocks must meet strict holdover and accuracy specifications.

The UK’s National Cyber Security Centre has published guidance on securing PTP deployments, warning that unauthenticated PTP traffic can be spoofed to shift the entire substation’s timing reference. We treat that guidance as mandatory reading on every project.

Grandmaster redundancy and BMCA in practice

The Best Master Clock Algorithm decides which clock in a PTP domain becomes the grandmaster. In a well-designed substation we always deploy at least two grandmasters — typically one on GPS/GNSS and one on a caesium or rubidium holdover source — so that BMCA can fail over cleanly if the primary loses satellite lock. Scottish Power and SSE substations that we have reviewed generally run dual grandmaster architectures with GNSS as the preferred reference and a local oscillator for holdover.

IEC 61850-9-3 and the UK’s smart grid context

IEC 61850-9-3 has become the anchor for the UK’s migration toward digital substations. Because it defines both the network behaviour and the clock quality assumptions, it lets a DNO specify a timing architecture that will still work when new bays, new vendors and new protection philosophies are introduced. Without a common profile, every project would reinvent synchronisation from scratch — which is exactly the situation that stalled early digital substation pilots.

Designing a PTP Network for Digital Substations

Getting PTP right on paper is one thing; getting it right on Ethernet is another. The switches in the timing path matter enormously. Hardware timestamping — where the PHY or switch ASIC records the arrival time of a PTP packet rather than the CPU — is essential. Vendors such as Cisco, Siemens Ruggedcom and Belden Hirschmann all offer industrial switches with PTP support, but the feature set varies considerably between models, and we always check the specific firmware revision against the Power Profile requirements.

Transparent vs boundary clock topologies

A transparent clock forwards PTP messages and corrects the residence time inside the switch, keeping the grandmaster’s timing intact. A boundary clock terminates the PTP domain and regenerates it on each port, which is more robust over long chains but adds jitter if poorly implemented. In small substations, transparent clocks in a ring topology usually suffice. In larger sites with dozens of merging units, we lean toward a hierarchy of boundary clocks near the process bus.

VLAN and multicast design for PTP

PTP should sit on its own VLAN, separate from GOOSE, MMS and Sampled Values traffic. This keeps non-timing broadcast storms from interfering with sync messages and lets engineers apply QoS policy cleanly. Multicast filtering should be configured so that PTP messages are not flooded to every port — a common source of subtle jitter in networks we have audited. UK Power Networks has been trialling PTP-aware Ethernet in active distribution networks precisely because this kind of disciplined design lets them extend digital substation techniques further into the network.

Testing and monitoring with tools like Calnex and Meinberg

You cannot verify PTP with a laptop and good intentions. Calnex and Meinberg both produce dedicated PTP analysers that measure time error, message interval and BMCA behaviour under load. We recommend running these tools during FAT, SAT and again during the first energisation, and then leaving permanent monitoring in place so that drift is caught before it becomes a protection incident.

PTP and GOOSE: Timing for Protection and Control

The interaction between PTP and GOOSE is where theory meets consequence. A GOOSE publisher stamps messages with a time-to-live and sequence information, and the receiver relies on its own clock to judge whether the message is fresh. If PTP drifts, the receiving relay can either reject a valid trip or accept a stale one. Both outcomes are unacceptable in a protection scheme.

GOOSE performance classes and PTP holdover

IEC 61850 defines GOOSE performance classes (P1 through P6 for trip, and Type 1A/1B for fast messages), each with a maximum transfer time. Under fault conditions the network load spikes and the grandmaster may briefly lose its GNSS reference. Holdover quality therefore matters as much as steady-state accuracy. A grandmaster with a rubidium oscillator can hold sub-microsecond accuracy for hours; one relying on a cheap TCXO may drift within minutes.

Interoperability between relays from different vendors

Multi-vendor interoperability is where PTP deployments most often stumble. Two relays may both claim compliance with IEC 61850-9-3 but interpret unicast/multicast negotiation, delay request rates or TLVs differently. We test interoperability explicitly at FAT, using GOOSE publishers and subscribers from different manufacturers and confirming that time error stays within budget. Examples from Scottish Power and SSE substations show that this testing pays for itself long before commissioning.

UK Rollout, Standards and Practical Lessons

The UK’s journey toward net-zero has made timing architecture a strategic issue, not just an engineering detail. The Energy Networks Association’s Open Networks project has pushed for greater visibility and control across distribution networks, and accurate time is fundamental to the data those networks will generate. Ofgem’s price controls increasingly reward innovation that depends on reliable time-stamped measurements.

Regulatory drivers: ENA and Ofgem

The Energy Networks Association’s Open Networks project has produced guidance on digital substation architectures that explicitly references IEC 61850-9-3. Ofgem’s RIIO framework funds the kind of network innovation that makes PTP investment justifiable at scale. When we draft specifications for DNO clients, we often cite both as background to justify dual grandmasters, dedicated timing VLANs and monitoring.

GNSS dependency and holdover strategies

Every hour of GNSS outage is a risk. The National Physical Laboratory has done extensive work on time dissemination across the UK, including alternatives to GPS-only grandmasters such as terrestrial time transfer over fibre and eLoran research. For substations, practical strategies include:

1. Dual GNSS receivers with different constellations (GPS plus Galileo).
2. Local rubidium or caesium holdover for at least 24 hours.
3. Terrestrial backup time feeds where fibre is available.
4. Alarm escalation when holdover exceeds a defined threshold.

Commissioning checklists for UK substations

Our standard commissioning checklist for PTP-enabled IEC 61850 bays covers: verifying grandmaster lock and holdover, measuring time error at each boundary clock, confirming BMCA failover, testing under simulated GOOSE and SV loading, and documenting time error budgets for every protection scheme. It is a discipline, not a box-ticking exercise — and it saves weeks of fault-finding later.

FAQ

Is PTP mandatory for all IEC 61850 substations?

No — but it is rapidly becoming expected practice. Stations relying on IRIG-B or NTP can still operate, but they limit the accuracy achievable for Sampled Values and make future digital substation upgrades harder. Most new UK transmission and distribution specifications now require PTP for any bay carrying sampled values or time-critical GOOSE.

What accuracy does IEC 61850-9-3 actually require?

The Power Profile targets sub-microsecond accuracy at the point of use, with typical budgets of 1 µs at the merging unit and tighter values for class 1 applications. In practice we design to 100 ns at the grandmaster output to leave headroom for network jitter.

Can we run PTP over the same switches as GOOSE?

Yes, provided the switches support hardware timestamping and PTP is placed on its own VLAN with appropriate QoS. Mixing PTP and GOOSE on the same physical infrastructure is common, but it demands careful configuration and continuous monitoring — it is not a set-and-forget arrangement.

How do we secure PTP in a substation?

Follow the National Cyber Security Centre’s guidance: isolate PTP on a dedicated VLAN, apply port security, disable unused PTP features, and use PTP authentication where the equipment supports it. Monitor for anomalous Announce messages, since a spoofed grandmaster can shift the whole station’s time reference.

What happens if GNSS is lost?

Well-designed substations have at least one grandmaster with rubidium or caesium holdover, giving hours to days of accurate timing after GNSS loss. Alarms should trigger well before holdover expires, and the protection scheme should be reviewed if outages extend beyond the designed window.

Our experience with UK digital substations is consistent: teams that treat PTP as a first-class design requirement — with dedicated VLANs, dual grandmasters, hardware-timestamped switches and proper testing — rarely have timing-related incidents. Teams that treat it as an afterthought spend their commissioning windows chasing 1 µs ghosts. Test timing under real fault conditions, document the budget, and monitor it in service. That is how IEC 61850 substation automation stays predictable, from National Grid transmission sites down to the active distribution networks UK Power Networks is now trialling.