Keeping clock accuracy on a master clock failure in substation network

Substation automation requires 4 µs accuracy and high availability of the clock synchronization mechanism. The clock synchronization protocol IEEE1588 satisfies the accuracy requirement under normal operation, but a failure on a grandmaster clock causes a large time error on the slave due to transient response by feedback loop. The failure may also trigger another failure on another grandmaster clock since IEEE1588 defines communication among them. We propose a new network architecture that utilizes IEEE802.1Q VLAN so that all grandmaster clocks can be in hot stand-by. The slave can simultaneously synchronize to and can switch between them without time error. Our proposal can also limit the impact of the failure on the other grandmaster clocks. We also describe the internal design of the slave, which consists of software of redundant feedback loops and a single oscillator. The experimental results show that the slave can keep time error under 70ns while a grandmaster clock is disconnected and the slave switches to another grandmaster clock.