Glossary term

Clock Holdover

Engineering definition of clock holdover covering reference loss, fractional frequency error, time error, failover timing and validation evidence.

Branch: Telecommunications Engineering
Glossary type: concept
Content: Glossary term
Updated: Jun 26, 2026
Revision: v1.0.0 · reviewed

Definition

concept

Clock holdover is the ability of a clock or synchronized device to maintain acceptable time or frequency accuracy for a limited period after its external reference is lost or degraded.

Clock holdover is important in packet timing, telecom synchronization, digital receivers, control systems, measurement networks and failover states. During holdover, the local oscillator, servo state and environmental sensitivity determine how quickly time error grows. A device can remain operational while its time accuracy silently moves outside the service requirement.

Clock holdover is the period during which a clock or synchronized device maintains acceptable timing after its external reference is lost, degraded or declared unusable. The device continues from its local oscillator, previous servo state and correction history instead of following a live reference.

Holdover matters in packet timing, telecom synchronization, digital receivers, industrial control, measurement systems and protection switching. A system can keep forwarding packets while its clock slowly drifts outside the time-error requirement.

Basic Frequency Error Model

Let fractional frequency error be:

\displaystyle y=\frac{\Delta f}{f_0}

where f_0 is nominal frequency and Delta f is frequency error. If the error is approximately constant during holdover, accumulated time error is:

TE(t)\approx y t

This simple model is a screen, not a complete oscillator model. Real clocks also have temperature sensitivity, aging, noise, warm-up behavior and servo transients.

Maximum Holdover Time

If the allowed time error is:

TE_{max}

then the maximum holdover interval under constant fractional frequency error is:

\displaystyle t_{hold,max}=\frac{TE_{max}}{|y|}

This expression makes the service requirement visible. A device that is acceptable for a short failover may fail a longer maintenance window.

Worked Example

A timing service allows:

TE_{max}=5\ \mu\text{s}

During reference loss, the local oscillator has estimated fractional frequency error:

y=5.0\times10^{-8}

After:

t=60\ \text{s}

the expected time error is:

TE=5.0\times10^{-8}(60)=3.0\times10^{-6}\ \text{s}

or:

TE=3.0\ \mu\text{s}

The holdover condition passes the 5 microsecond limit for this duration. The maximum screened holdover time is:

\displaystyle t_{hold,max}=\frac{5.0\times10^{-6}}{5.0\times10^{-8}}=100\ \text{s}

If the outage or failover lasts longer than 100 s, this oscillator estimate no longer supports the requirement.

Degraded Oscillator Case

If temperature or aging changes the fractional error to:

y=2.0\times10^{-7}

then the same 60 s interval gives:

TE=2.0\times10^{-7}(60)=12.0\ \mu\text{s}

The timing service fails by:

12.0-5.0=7.0\ \mu\text{s}

This is why holdover specifications should include operating temperature, oscillator grade, calibration state and how long the device has been locked before reference loss.

Holdover State

Clock state should be reported explicitly. A useful timing system distinguishes at least:

locked to a valid reference;
holdover after recent reference loss;
degraded holdover beyond a warning threshold;
free-run without a reliable recent reference;
failed or out of specification.

These states should drive alarms and service decisions. A clock in short holdover may be acceptable during a planned path switch. The same clock in long free-run may be unacceptable for timestamped protection events, sampled measurements, phasor records, industrial control or time-sensitive packet services.

Return To Reference

Recovery after holdover is also part of the engineering behavior. A clock can step suddenly, slew gradually or reject a restored reference if the phase difference is too large. A sudden step may corrupt event ordering or sampled data alignment; a slow slew may leave the system outside tolerance for longer than operators expect.

The release test should therefore measure entry into holdover, time-error growth during holdover, alarms, restoration behavior, and final time error after the reference returns. Passing only the first seconds of reference loss is not enough for a maintenance or failover procedure.

Boundary With Delay Asymmetry

Delay asymmetry biases a clock estimate while synchronization messages are exchanged. Clock holdover describes what happens when the device cannot trust or receive the reference and must coast. Both can appear during failover: a backup route may introduce delay asymmetry, while a reference interruption forces holdover.

The engineering release should state whether the timing service is locked, in holdover, free-running, degraded or failed. Treating all of those states as “synchronized” hides risk.

Validation Evidence

A defensible holdover statement includes reference source, oscillator type, lock duration before holdover, temperature range, voltage condition, aging allowance, phase and frequency error before loss, holdover duration, time-error limit, monitoring alarm, recovery behavior and independent time-reference evidence after restoration.

Common mistakes include quoting oscillator accuracy without converting it to time error, testing holdover only at room temperature, ignoring warm-up and aging, assuming protocol lock means timing accuracy, failing to alarm degraded holdover state, and releasing failover without measuring timing after the reference returns.

REF

Disciplines