Time synchronization has long been used in substations for sequence of events reporting and post event analysis. This has been important for compliance, but protective functions could still operate with a loss of time synchronization. Modern digital substations have introduced protection signals that are distributed over an Ethernet based network, that must be synchronized to a high accuracy within 1 microsecond. A loss of synchronization under these conditions can disable critical protection elements, particularly differential schemes. To mitigate this risk, redundancy is commonly implemented using multiple clocks managed by the Best Master Clock Algorithm (BMCA) in PTP, along with redundant Ethernet connections through Parallel Redundancy Protocol (PRP). This paper serves to analyze the effects on protection of the recovery scenarios that would be encountered from a clock or network failure. Although BMCA enables automatic changeover to a new master, recovery can introduce complications. End devices may experience a time jump if its internal oscillator is inaccurate, or the new master has a significantly offset time reference. Also, the time that is taken for new master selection and synchronization may be longer than the device is capable of providing holdover. By examining these scenarios, the paper highlights the practical considerations needed for designing and implementing protection systems utilizing redundant time synchronization.