What is GOOSE?
GOOSE (Generic Object Oriented Substation Event) is a message type from the IEC 61850 series of standards that lets IEDs in a substation send events such as trips, blocking signals and switchgear positions to each other within a few milliseconds as multicast Ethernet frames, without a server or TCP/IP in between. GOOSE replaces the copper signal wires that used to run between protection relays and circuit breakers. That makes it the real-time backbone of digital substations and industrial medium-voltage installations.
GOOSE is built for speed and reliability, not for security: the basic form has no authentication or encryption.
🧠 How does GOOSE work?
GOOSE follows the publisher-subscriber model. An IED publishes a dataset (for example “trip phase L1”, “breaker open” and a quality bit), and every IED that needs that dataset subscribes to it. There is no connection and no acknowledgement; reliability comes from repetition.
- Directly on Layer 2 - GOOSE uses Ethernet without an IP or TCP layer, with EtherType 0x88B8. This saves protocol processing and makes transit time predictable (deterministic). In the OSI model, the application layer is mapped straight onto the data link layer.
- Multicast - the destination MAC address lies in the range reserved by IEC 61850, 01-0C-CD-01-00-00 to 01-0C-CD-01-01-FF. A switch forwards the frame to every port in the same VLAN unless multicast filtering is configured.
- Event-driven - when a value changes, the publisher immediately sends a new message and increments the state number (stNum).
- Repetition at increasing intervals - right after the change comes a rapid burst of repeats, after which the interval keeps doubling until it reaches the configured idle interval (the heartbeat). Each repeat increments the sequence number (sqNum).
- Supervision with timeAllowedToLive - every message tells the receiver how long it may wait for the next one at most. If nothing arrives in that time, the subscriber marks the value as invalid and can raise an alarm. Since Edition 2, the logical node LGOS reports the status of each GOOSE subscription.
GOOSE gets its priority from an IEEE 802.1Q tag: priority 4 by default, so that QoS in the switches puts trips ahead of other traffic.
🔧 What is inside a GOOSE message?
A GOOSE message always fits in a single Ethernet frame. The key fields:
| Field | Meaning | Why it matters |
|---|---|---|
| APPID | Application ID in the Ethernet header | Publisher and subscriber must use the same value; switches and IEDs filter on it |
| gocbRef | Reference to the GOOSE control block | Identifies which IED and which control block sent the message |
| datSet | Name of the dataset | Defines which data objects the message carries |
| timeAllowedToLive | Maximum wait until the next message | Basis for detecting a lost publisher |
| t | Timestamp of the last change | Needed for fault analysis and the sequence of events |
| stNum / sqNum | State and sequence number | Distinguishes a new event from a repeat |
| simulation (Edition 2) | Test flag | Makes test messages recognisable so a test does not cause a real trip |
| confRev | Configuration revision | A mismatch points to an outdated configuration at publisher or subscriber |
| allData | The values themselves | Booleans, integers, quality and time of each data object |
Which IED publishes which message, and who subscribes to it, is defined in the SCD file: the XML configuration (SCL, IEC 61850-6) of the whole substation.
⚡ How fast is GOOSE?
IEC 61850-5 classifies messages by their permitted transfer time: the time from the application in the sending IED to the application in the receiving IED, including processing on both sides.
| Message type | Example | Maximum transfer time |
|---|---|---|
| Type 1A / class TT6 | Trip, blocking | 3 ms (performance class P2/P3); 10 ms in class P1 |
| Type 1B | Interlocking, switchgear position, other fast signals | 20 ms (P2/P3) to 100 ms (P1) |
| Slower messages | Measurements, reports to SCADA | Hundreds of ms or more (via MMS) |
The performance classes depend on the application: P1 applies to distribution networks, P2 and P3 to transmission networks with stricter requirements. Manufacturers have their IEDs tested against this in the conformance programme of the UCA International Users Group, where accredited labs issue a GOOSE performance certificate. That figure matters more than the often-quoted “sub-millisecond”: network latency in a switched 100 Mbit/s network is small, but processing inside the IEDs counts too. A lost frame must never mean a missed trip, which is why grid operators combine GOOSE with PRP or HSR from IEC 62439-3; both send every frame over two paths with zero recovery time. Time synchronisation uses NTP or, in digital substations, the Precision Time Protocol according to IEC/IEEE 61850-9-3.
🔄 What is the difference between GOOSE, MMS and Sampled Values?
| Protocol | Purpose | Transport | Communication model | Use |
|---|---|---|---|---|
| GOOSE | Events and status messages | Ethernet Layer 2, EtherType 0x88B8 | Publisher-subscriber, multicast | Trips, blocking, interlocks |
| MMS | Data exchange and control | Application protocol over TCP/IP, port 102 | Client-server | Reports, configuration, link to SCADA |
| Sampled Values (SV) | Sampled analogue measurements | Ethernet Layer 2, EtherType 0x88BA | Publisher-subscriber, multicast | Current and voltage from merging units on the process bus |
GOOSE and SV are not routable. For communication between substations there are R-GOOSE and R-SV, which run over UDP/IP multicast; they were described in technical report IEC 61850-90-5 (2012) and were incorporated into the standard with Edition 2.1.
🏭 Where is GOOSE used?
- Protection schemes - transfer trips, breaker failure protection and blocking schemes for busbar protection, where one relay makes another act within milliseconds
- Interlocking - a disconnector may only operate once the circuit breaker is open; that status travels via GOOSE instead of via an auxiliary contact and a wire
- Direct control of circuit breakers without SCADA involvement
- Status transfer of generators, transformers and disconnectors to substation automation
- Industrial power distribution in oil, chemicals, metals and data centres, where medium-voltage switchgear uses IEC 61850 relays
In the Netherlands, transmission system operator TenneT puts the emphasis on IEC 61850 in its qualification system for protection and control equipment, and its Bay Replacement programme for replacing high-voltage bays uses IEC 61850 substation automation. Older substations still talk to the control centre via IEC 60870-5-104 or DNP3; GOOSE always stays inside the substation.
🔐 How do you secure GOOSE?
The basic form of GOOSE is neither encrypted nor authenticated. Anyone with access to the substation network can inject a message with a higher state number, and the subscriber will accept it as the latest state. That is spoofing, often combined with replay or man-in-the-middle techniques, and it can cause unwanted tripping or a blocked protection function. The Industroyer malware used by Sandworm (Ukraine, December 2016) already contained a module for IEC 61850. Security for GOOSE therefore needs several layers.
IEC 62351-6 adds a security extension to the GOOSE frame carrying an HMAC over the content, so the receiver can check that the message is genuine and unaltered. The 2020 edition uses symmetric keys, because digital signatures are too slow for a 3 ms transfer time. Key management is defined in IEC 62351-9, which uses GDOI (RFC 6407) to distribute group keys. Many installed IEDs do not support this yet, so network measures remain the foundation:
- Segment - keep the station bus and process bus in their own VLANs and zones according to IEC 62443; network segmentation with a firewall and ACLs separates them from office and SCADA networks
- Lock down ports - Port Security and disabled unused ports on industrial switches stop a laptop from simply transmitting GOOSE
- Monitor - feed traffic through a TAP or SPAN port to an IDS that understands IEC 61850; an unknown publisher, a jump in stNum or a confRev mismatch is a clear alarm to forward to your SIEM
- Control the configuration - protect SCD files and engineering tools with RBAC and change management, and keep substation cabinets physically secured
- Enable IEC 62351-6 wherever the publisher and all subscribers support it
Grid operators fall under NIS2 and, in the Netherlands, the Cybersecurity Act (Cyberbeveiligingswet), in force since 15 August 2026. GOOSE security is therefore part of the duty of care for the substation network.
❓ Frequently asked questions
What does GOOSE stand for?
GOOSE stands for Generic Object Oriented Substation Event. It is a message type from IEC 61850 that lets IEDs in a substation send events such as trips and switchgear positions to each other as multicast Ethernet frames.
Is GOOSE routable?
Classic GOOSE is not routable, because it runs directly on Ethernet Layer 2 without an IP header. For communication between substations there is R-GOOSE, which runs over UDP/IP multicast and was incorporated into IEC 61850 with Edition 2.1.
How fast must a GOOSE trip arrive?
IEC 61850-5 requires a transfer time of at most 3 ms for trips and blocking signals in the strictest performance classes (class TT6), measured from application to application. Less critical GOOSE messages such as interlocks may take 20 to 100 ms.
Why is a GOOSE message repeated over and over?
GOOSE uses no acknowledgements, so its reliability comes from repetition. After a change there is a rapid burst of repeats at increasing intervals, followed by a fixed idle interval, so the subscriber can also detect a publisher that has gone silent.
Is GOOSE encrypted?
The basic form of GOOSE is neither encrypted nor authenticated. IEC 62351-6 adds an HMAC that lets the receiver verify authenticity and integrity, but many existing IEDs do not support it yet, so segmentation and monitoring are still needed.
What is the difference between stNum and sqNum in GOOSE?
The state number stNum increases with every change in the dataset, while the sequence number sqNum increases with every repeat of the same state and starts again at a new change. An unexpected jump in stNum can indicate an injected GOOSE message.
📌 In summary
GOOSE is the fast multicast message type of IEC 61850 that lets IEDs send each other trips, blocking signals and switchgear positions within 3 ms, directly over Ethernet Layer 2. Repetition, timeAllowedToLive, VLAN priority and redundancy with PRP or HSR make it reliable; segmentation, monitoring and IEC 62351-6 make it secure.