TL;DR
- ▸Pick by required holdover under your worst realistic GNSS denial scenario, not by hoping GNSS never fails. OCXO holds ±1.5 µs over 24 h; Rubidium Black <500 ns; Rubidium Black+ <120 ns.
- ▸For MiFID II HFT tolerance (100 µs), OCXO has ~66× headroom at 24 h under ideal conditions — which degrades materially with aging and thermal cycling. Rubidium Black+ has ~833× headroom and does not meaningfully degrade.
- ▸Enterprise IT replacing an NTP appliance almost always starts with OCXO at £2,495. Finance venues with DORA Article 11 exposure almost always start with Rubidium Black+ at £7,795 (or 3× at £23,385 on The Shelf).
Why oscillator tier is the load-bearing decision
Every grandmaster clock has a local oscillator that does the actual time-keeping. When GNSS is healthy, the grandmaster disciplines this oscillator to GNSS-derived UTC — a continuous closed-loop correction. When GNSS is unavailable, the oscillator free-runs and holds time on its own. This is holdover, and it is the specification that ends up mattering the most in a real deployment. A grandmaster with an outstanding GNSS receiver but a poor oscillator is useless the moment GNSS denial happens; a grandmaster with a conservative GNSS receiver and an atomic oscillator rides through days of denial without a compliance breach.
Open Time Appliance ships three oscillator tiers: Quartz OCXO (entry, £2,495 per unit), Rubidium Black (mid-tier, £6,500) and Rubidium Black+ (elite, £7,795). The Shelf packages three units per 1RU and can mix tiers across the three positions. The rest of this guide is a decision framework for which tier to deploy in which position.
Drift maths under typical conditions
Published specifications translate to very different real-world drift over the time windows that actually matter to operators.
| Window | OCXO (±0.5 ppb over temp) | Rubidium Black | Rubidium Black+ |
|---|---|---|---|
| 1 second | ≈ 0.5 ns | ≤50 ps | <15 ps |
| 1 minute | ≈ 30 ns | ≈3 ns | ≈1 ns |
| 1 hour | ≈ 60 ns–2 µs | ≈60 ns | ≈10 ns |
| 4 hours (GNSS outage) | ≈ 250 ns–8 µs | ≈130 ns | ≈30 ns |
| 24 hours | ±1.5 µs | <500 ns | <120 ns |
| 1 year (drift) | Requires periodic recalibration | ≈10 µs | <60 µs |
Two things this table does not tell you
First, OCXO drift is not linear — thermal cycling and aging dominate after the first few hours, and a seven-year-old OCXO with no aging compensation routinely exceeds its datasheet spec by 3–5×. Second, Rubidium drift is dominated by ambient temperature and magnetic field changes over short windows — stable environments produce materially better results than the specification implies.
The MiFID II headroom calculation
ESMA MiFID II RTS 25 Article 2 requires HFT business clocks to remain within 100 microseconds of UTC. That is the regulatory tolerance. A grandmaster that holds to its 24-hour spec has the following headroom against that tolerance:
- ●OCXO — ±1.5 µs over 24 h → 66× headroom under ideal conditions. Degrades with aging; an 8-year-old OCXO can halve this.
- ●Rubidium Black — <500 ns over 24 h → 200× headroom. Aging effects are negligible over normal refresh cycles.
- ●Rubidium Black+ — <120 ns over 24 h → 833× headroom. Sub-nanosecond 1-PPS jitter means headroom is consistent second-to-second, not just at the 24-hour mark.
Why the headroom matters
ESMA enforcement actions for clock synchronisation failures have ranged from €25,000 to €500,000 per breach. A grandmaster operating at 66× headroom is fine until GNSS fails for two days and the oscillator was a few years older than anyone had checked; at 833× headroom, the same scenario is uneventful.
Allan deviation — short-term stability matters for HFT card-to-UTC
For venue grandmasters distributing PTP to downstream trading cards, 24-hour drift is not the only metric. Short-term stability — measured as Allan deviation at 1-second and 100-second tau — affects how tightly a downstream card can discipline its own local reference. A grandmaster with noisy 1-second behaviour forces downstream servos to filter more aggressively, which widens the effective accuracy window at the card.
Rubidium Black+ specifies <1.5×10⁻¹¹ Allan deviation at τ=1 s. Rubidium Black is ≤5×10⁻¹¹ at τ=1 s and ≤5×10⁻¹² at τ=100 s — the latter is the metric that governs cycle-to-cycle stability on downstream PTP card servos. The OCXO tier specifies ±0.5 ppb over temperature range, which is an aggregate figure rather than an Allan deviation point; in practice OCXOs produce Allan deviation curves that exceed Rubidium at very short tau (OCXOs beat Rubidium at sub-second timescales) and fall behind at long tau (Rubidium pulls ahead from tens of seconds onwards).
The engineering implication is that OCXO is a fine distribution grandmaster for enterprise IT, where downstream clients are not trying to hold sub-microsecond accuracy on their own. For finance venue grandmasters distributing to Open TimeCards or hardware-timestamped NIC endpoints, Rubidium Black+ is almost always the right choice — the short-term stability flows through to downstream card precision, and the holdover headroom removes compliance exposure at the same time.
Warm-up and recovery time after power events
Oscillators do not hit their full specification instantly from a cold start. How long before a unit is producing specification-grade time after power-on is the warm-up window, and it matters whenever a deployment expects to restart units — planned maintenance, firmware updates, power events in the rack.
Rubidium Black+ specifies under 4 minutes from cold start to full specification. Rubidium Black hits 6 W maximum power draw during startup (settling to a much lower steady-state draw), and typically completes warm-up within a similar window. OCXO specifies 8 minutes to reach ±10 ppb from a cold start — noticeably longer, and a consideration in deployments where quick turnaround on a restart matters.
For The Shelf, warm-up timing per unit is more operationally relevant than for a single-unit deployment — during a controlled restart, units are typically brought up one at a time so at least two remain in service. A staggered restart window of 5 minutes per Rubidium unit or 10 minutes per OCXO unit is the conservative choice.
Power and thermal — where OCXO remains the right answer
Rubidium oscillators are power-hungry compared to OCXO. Rubidium Black+ peaks at 20 W; Rubidium Black at 6 W (max, at startup); OCXO at 1.5–3.5 W (steady-state). In deployments where power envelope and thermal load are constrained — a street cabinet at a telecom site, a passively-cooled edge server, a field-deployable Mini PT variant — OCXO is frequently the only viable choice regardless of what the holdover requirement would suggest.
Thermal stability also matters. Rubidium's stability specifications assume operation within a reasonable ambient range; sustained operation outside the published envelope degrades the lock and, in extreme cases, causes retune events that break the short-term stability guarantee. OCXO's stability curve over temperature is explicit in the datasheet (±0.5 ppb across operating temperature for the OTA's OCXO) and does not require a controlled thermal environment beyond the rack's own airflow.
For enterprise IT deployments in a standard data centre cabinet with reliable airflow, this is not a decision criterion. For the edge of the network — Telebeat's Mini PT and Lite PT variants, street cabinets, outdoor enclosures — OCXO is often the only choice that fits the power and thermal envelope, and the lower holdover specification is an accepted operational tradeoff.
Decision framework — mapping site profile to tier
The cleanest way to decide is to start from the worst realistic GNSS denial scenario at your site and work backwards. Ask: if GNSS is unavailable for N hours, what is the maximum acceptable drift, and what does the regulatory or operational ceiling require? Then match tier.
| Site profile | Worst-case GNSS denial | Max acceptable drift | Recommended tier |
|---|---|---|---|
| Finance venue / exchange GMC — DORA Article 11 scope | 24+ hours (roof antenna fault, jamming incident) | <1 µs for MiFID II HFT headroom | Rubidium Black+ — 833× headroom |
| Finance colo server final-hop | 24+ hours | <100 µs per MiFID II RTS 25 | Rubidium Black+ on Shelf + OTC in server |
| Critical national infrastructure (CNI) / defence GNSS-denied | Extended (48+ hours) | Mission-specific, typically sub-µs | Rubidium Black+ with Clock Ensemble fallback |
| Telecom 5G G.8275.1 fronthaul | 4–8 hours typical | <1.5 µs for G.8275.1 Class 6A | Rubidium Black |
| Broadcast ST 2110 / AES67 facility | Hours (rare outages) | Frame-accurate (sub-µs) | Rubidium Black |
| Distributed database / Kubernetes cluster | Hours (infrastructure outage) | Low ms tolerance | Rubidium Black (multi-site) or OCXO (single-site) |
| Enterprise IT site grandmaster replacing NTP appliance | Hours typical | 10s of ms tolerance | OCXO |
| Campus / dev / staging environment | Short (routine outages) | 100s of ms tolerance | OCXO |
Mixing tiers on a single Shelf
Not every Shelf deployment runs three Rubidium Black+ units. A common finance-venue pattern is two Rubidium Black+ units for elite-tier holdover on positions A and B, plus a Rubidium Black unit at position C — the third unit still provides active redundancy but at a lower unit cost, reflecting that the first two units carry the primary compliance load. Sync Insight and PTP² Mesh treat the mixed Shelf identically; the only difference is the capability each unit advertises into the Mesh hop-cost model.
Enterprise IT deployments sometimes run three OCXO units — a full OCXO Shelf at £7,485 CapEx is a dramatic improvement over a single unmonitored NTP appliance at a fraction of the full Rubidium Black+ Shelf price. For organisations without DORA exposure and with reliable GNSS, this is a legitimate and cost-effective starting position. The oscillator is modular on the OTA: individual units can be upgraded to Rubidium at the next refresh cycle without replacing the chassis, which gives the deployment a clean upgrade path if holdover requirements change.
The modular upgrade
Because the oscillator is field-replaceable on the OTA without a chassis swap, a Shelf deployed with OCXO units today is not locked into OCXO for the life of the platform. If holdover requirements tighten — a new regulatory interpretation, a site relocation into a more GNSS-challenged environment, an incident that changes the risk profile — the oscillator can be upgraded per unit without redeploying the rack space or the downstream PTP configuration.
How to measure your current holdover before buying new hardware
Before buying new hardware, measure the incumbent. Sync Insight deployed alongside your existing grandmaster — PAYG at £1.12 per device per day, no procurement approval needed at that scale — streams Allan deviation, phase offset trend and GNSS quality telemetry live into Grafana. Within a few days you have a documented, evidenced baseline of the incumbent's actual behaviour under your site's actual conditions.
Run a controlled GNSS denial test with Sync Insight recording. Pull the antenna lead for a controlled window — 30 minutes is usually enough — and observe the drift trajectory. The number you get will be much more accurate than the datasheet spec, because it reflects real aging, real thermal history, and your site's actual electromagnetic environment. In a surprising fraction of cases, the test shows the incumbent is doing worse than the datasheet promises; that is the number that funds the hardware refresh.
A 30- to 90-day parallel deployment of an OTA alongside the incumbent, both monitored by Sync Insight, gives you a true performance comparison. You get documented holdover behaviour, a quantified Allan deviation delta, and a GNSS quality comparison across the two platforms. That evidence — on your own data, not vendor claims — is the basis for the tier decision and the procurement case.