Bad Clocks Corrupt Good Data

Every plant eventually learns this lesson the hard way. A unit trips at 03:14. The safety system logs events at 03:14. The historian, however, records the same events at 03:12. Investigators now have two conflicting timelines. First, accept that unsynchronized time destroys the forensic value of your data. Therefore, time synchronization is not an IT nicety. It is an instrumentation requirement, equal in importance to calibration. Moreover, modern requirements make it worse. Safety investigations, alarm rationalization, and machinery diagnostics all assume millisecond-level correlation between systems. I have personally seen a trip investigation stall for two days because a Triconex SIS and the DCS disagreed by 90 seconds.

Know Your Protocols and Their Accuracy Budgets

Second, choose the protocol by the accuracy the application actually needs. NTP synchronizes clients to a master over Ethernet. Typical accuracy reaches around 10 milliseconds on a well-behaved LAN. SNTP is the simplified cousin. It skips network delay calculations, so accuracy degrades to roughly 50 milliseconds. Therefore, use SNTP only for HMIs and non-critical logging. PTP, defined by IEEE 1588, is the precision option. The master pushes timestamps to slaves continuously, and hardware-timestamping switches correct propagation delay. Consequently, PTP achieves sub-millisecond accuracy, often in the sub-microsecond range with PTP-capable switches and NICs. However, PTP costs more, because it demands dedicated hardware throughout the timing path.

• NTP: ~10 ms accuracy, stratum 0 to 3 hierarchy, ideal for PLCs, DCS nodes, and SCADA servers.
• SNTP: ~50 ms accuracy, minimal client load, acceptable for HMIs and simple loggers.
• PTP (IEEE 1588): sub-millisecond accuracy, requires PTP-capable switches, reserved for SOE and machinery protection.
• GPS / IRIG-B: the plant reference source that feeds the master clock with UTC.

Case Study: Triconex SIS and the 90-Second Disagreement

The Triconex Tricon and Trident controllers support time synchronization for sequence-of-events recording using an interface like a Triconex System Interface Module. In our case, a Trident on an offshore platform synchronized from the wrong NTP server. The DCS used the GPS-fed master. However, the SIS pointed at a domain controller that had drifted badly. After a spurious trip, SOE records and DCS alarms disagreed by 90 seconds. Therefore, the sequence could not be reconstructed with confidence. The fix was procedural and quick.

• Step 1 / Inventory every controller, gateway, and server and record its configured time source.
• Step 2 / Point all time clients at the GPS-fed master, either directly or through a documented stratum chain.
• Step 3 / Force a deliberate time offset on the master during a test window and confirm every client follows.
• Step 4 / Add a deviation alarm so any client drifting beyond a threshold, say 5 seconds, pages the control room.

Case Study: Bently Nevada Trends That Skewed

Machinery monitoring punishes bad clocks differently. A Bently Nevada 3500 rack and System 1 database correlate vibration trends with process data from the DCS via instruments such as a Bently Nevada vibration transmitter. At a gas compression station, the 3500 framework had never been given a proper time source. Moreover, the rack clock drifted several minutes per month. Vibration events appeared to precede the process upsets that actually caused them. Therefore, analysts chased phantom mechanical faults for weeks. We configured the monitoring system to take time from the same GPS master as the DCS. Furthermore, we set a quarterly audit to compare rack time against plant reference time. The phantom correlations disappeared. Machine diagnostics only work when the timeline is trustworthy.

Building the Plant Timing Architecture

Finally, follow a simple hierarchy. Put a GPS clock at stratum 0 feeding a redundant master at stratum 1. Let the SCADA servers and DCS nodes sit at stratum 2. PLCs, HMIs, and monitoring racks follow as clients. Moreover, keep automation time traffic off the office IT domain, because domain controllers drift and NTP policies change without warning. Therefore, own your timing infrastructure inside the control network. For safety SOE and turbine protection, upgrade the critical path to PTP with hardware-timestamping switches. Document every client, source, and expected accuracy in the same database as your instrument list. If a device cannot be synchronized, mark it clearly as a known blind spot.