SNTP Holdover Resilience and IEC 62351-6 Security Overhead in IEC 61850 Digital Substations: A Hardware-in-the-Loop Conformance Study

In the IEC 61850 compliant digital substations, event sequencing, fault record correlation and protection coordination are all dependent upon a consistent station-wide time reference, which is one of the basic requirements. Simple Network Time Protocol (SNTP), though first defined in IEC 61850 Edition 1, remains an integral component of Edition 2.1 deployments for station bus timing at Classes T1 and T2, and continues to be widely used across the global installed base of numerical protection relays. While IEEE 1588 Precision Time Protocol (PTP) is the preferred choice for high-precision process bus applications in Edition 2.1, SNTP has not been deprecated and its conformance behavior under stress conditions remains a practical concern for utility engineers commissioning Edition 2.1-certified equipment. The common Ethernet environment in which SNTP operates gives rise to measurable timing vulnerabilities: Variable switch queuing latency, asymmetric packet delay, thermal clock drift and adversarial timing attack vectors defined in the IEC 62351-6 threat model. This paper outlines a detailed, HIL lab test of SNTP holdover resilience and cybersecurity overhead of IEC 61850 compliant numerical relays. We ran test case sTm7 for the characterization of the behavior of the internal oscillator when the master clock is turned off unexpectedly, using UCA approved tool, to collect the state transition data during unannounced disconnection of the master clock for 9 minutes. Measured clock offset was within the T1 class range (< 1 ms) through Loop 22, exceeded the tolerance on Loop 23 and activated the ClockNotSynchronized (CNS) alarm. Asymmetric delays of more than 8ms, which resulted in internal packet loss and premature CNS assertion, were discovered during IEC 62351-6 MAC-authenticated packet processing, and this quantifiable cyber-physical risk window is a concern for utility operators. They directly apply to field commissioning guidelines for SCL verification, holdover threshold configuration and traffic isolation using VLANs.