IEC 61850

What is IEC 61850?

IEC 61850 is an international IEC series of standards for communication in power utility automation that defines a vendor-independent data model, communication services (MMS, GOOSE and Sampled Values) and an XML configuration language (SCL) for protection, measurement and control equipment in substations. Where older protocols such as Modbus and DNP3 mainly exchange registers or points, IEC 61850 describes what a device actually is: a circuit breaker, an overcurrent protection function or a measuring function, each with fixed names and meanings. That lets IEDs from different manufacturers work together in one system, from high-voltage substations to industrial medium-voltage installations.

IEC 61850 enables vendor-independent interoperability, fast peer-to-peer communication, scalability and fully digital substations.

🧠 Where does IEC 61850 come from?

The groundwork was laid in the mid-1990s, when American (UCA, Utility Communications Architecture) and European initiatives were merged within IEC Technical Committee 57. The first parts of edition 1 were published in 2003 and 2004 under the title Communication networks and systems in substations. With edition 2 (from 2009–2011) the title and scope were broadened to power utility automation; additional parts and technical reports cover communication between substations, with control centres, hydropower plants and distributed generation. Amendments followed around 2018–2020, collectively known as edition 2.1, which among other things brought the routable GOOSE and Sampled Values from technical report 61850-90-5 (2012) into the core parts.

The UCA International Users Group runs the conformance testing programme: accredited test labs issue certificates for the server, client and GOOSE performance of IEDs.

📚 How is IEC 61850 structured?

IEC 61850 is not a single document but a series of dozens of parts. The most important ones:

The wind turbine standard IEC 61400-25 is also derived from the IEC 61850 data model.

🔧 How does the IEC 61850 data model work?

The model is hierarchical. A physical device (IED) contains one or more logical devices, which in turn contain logical nodes (LN). A logical node is a function with a fixed four-letter name, where the first letter indicates the group:

• P – Protection - for example PTOC (time overcurrent protection) and PDIS (distance protection)
• X – Switchgear - XCBR (circuit breaker) and XSWI (disconnector)
• C – Control - CSWI (switch controller) and CILO (interlocking)
• M – Metering - MMXU (measurements such as current, voltage and power)
• T – Instrument transformers - TCTR and TVTR for current and voltage transformers
• L – System - LLN0 and LPHD with general device information

Each logical node has data objects with attributes. An object reference such as Bay1/XCBR1.Pos.stVal therefore unambiguously gives the position of circuit breaker 1 in bay 1. A SCADA system or gateway can read that meaning without the manufacturer’s register lists.

🔄 Which communication services does IEC 61850 use?

IEC 61850 combines three services, each with its own purpose:

GOOSE and SV are not routable and stay within the local network, separated by VLANs and IEEE 802.1Q priority (default priority 4 for GOOSE). A GOOSE message is sent immediately on a change and then repeated at rapidly increasing intervals, so a lost frame does not result in a missed trip. For real-time communication between stations there are the routable variants R-GOOSE and R-SV, which run over UDP/IP multicast; they were described in 61850-90-5 and incorporated into the standard with edition 2.1.

The network architecture distinguishes the station bus (IEDs, gateway, HMI) and the process bus (merging units and IEDs in the switchgear bay). Because even a network interruption of a few tens of milliseconds is too long for protection, both buses are built redundantly with PRP or HSR (IEC 62439-3), which offer zero recovery time; RSTP is only suitable for less critical parts.

🏭 What does a digital substation look like?

In a conventional substation, hundreds of copper wires run from protection relays to current transformers and circuit breakers. In a digital substation, the process bus replaces that copper:

1. Merging units in the switchgear bay digitise current and voltage and publish them as Sampled Values. The original UCA guideline 9-2LE used 80 samples per cycle (4,000 per second at 50 Hz); its successor IEC 61869-9 defines preferred rates of 4,800 samples per second for protection and measurement and 14,400 for power quality metering, regardless of whether the grid runs at 50 or 60 Hz.
2. Time synchronisation via PTP with the power profile of IEC/IEEE 61850-9-3 keeps all merging units aligned to within about a microsecond, otherwise phase angles no longer add up.
3. Protection IEDs subscribe to the SV streams, calculate a fault and send a GOOSE trip to the circuit breaker.
4. Station level collects data via MMS for the local HMI, the Historian and the gateway or RTU, which often talks to the national or regional control centre via IEC 60870-5-104.

Applications - substations of TSOs and DSOs, industrial power distribution in chemicals, oil and gas, steel and data centres, wind farms, solar parks and battery energy storage. In the Netherlands, TenneT requires IEC 61850 support when prequalifying protection and control IEDs, while many existing stations still run IEC 101/104.

🛠️ How do you approach an IEC 61850 project?

Engineering revolves around SCL files (Substation Configuration Language) as defined in part 6:

1. Specify - the designer captures the single-line diagram and functions in an SSD file (System Specification Description).
2. Select devices - each manufacturer supplies an ICD file (IED Capability Description) describing what the IED can do.
3. Configure the system - a vendor-independent system configurator combines everything into one SCD file containing all IEDs, datasets, GOOSE subscriptions and network addresses.
4. Load the devices - the manufacturer’s IED tool extracts the CID file (Configured IED Description) for each device from the SCD and loads it.
5. Test - FAT and SAT with GOOSE and SV simulators, Wireshark and a test set; also verify all interlocks.
6. Maintain - keep the SCD under version control as the single source of truth; changes always go through the SCD, never directly into an IED.

A common mistake is mixing edition 1 and edition 2 devices without checking which SCL version each tool supports. State in your specification which edition, which conformance certificates and which PIXIT/PICS documents you expect.

🔐 How do you secure IEC 61850?

The base protocols have no encryption or authentication: an attacker with access to the station network can spoof GOOSE messages and make a circuit breaker open. The Industroyer malware that cut power to part of Kyiv in December 2016 had a dedicated IEC 61850 module, alongside modules for IEC 101, IEC 104 and OPC DA.

The security supplement is IEC 62351: parts 3 and 4 add TLS and authentication to MMS, part 6 authenticates GOOSE and SV with an HMAC, part 8 covers role-based access control and part 9 key management. In practice, many IEDs do not yet support these functions, so network security remains the foundation:

• Segment - network segmentation and zones according to IEC 62443, with a firewall and ACLs between the station and the corporate network
• Restrict the process bus - separate VLANs, port security and no connections from outside
• Monitor - mirror GOOSE and MMS traffic via a TAP or SPAN port to an IDS or SIEM; an unexpected GOOSE publisher or a jump in the state number is a clear warning sign
• Harden - Hardening of IEDs and engineering workstations, management of passwords and firmware
• Design for resilience - Redundancy with PRP or HSR, and a strong defence-in-depth strategy because of the lack of native security

In the Netherlands, grid operators and large energy companies fall under the Cybersecurity Act (Cyberbeveiligingswet), in force since 15 August 2026. That makes demonstrable risk management for this critical infrastructure a legal obligation.

🔍 How does IEC 61850 compare with Modbus and DNP3?

❓ Frequently asked questions

Is IEC 61850 a protocol or a standard?

IEC 61850 is a series of standards, not a single protocol. The series defines an abstract data model and services, which are then mapped to concrete protocols: MMS for client-server communication, GOOSE for fast events and Sampled Values for measurements.

What is the difference between GOOSE and MMS in IEC 61850?

GOOSE is a layer 2 multicast message that IEDs use to send each other trips and interlocks within milliseconds. MMS is client-server communication over TCP/IP that SCADA, HMIs and gateways use to retrieve reports and issue commands. In IEC 61850 the two work side by side: GOOSE for speed, MMS for monitoring and control.

What is an SCD file in IEC 61850?

An SCD file (Substation Configuration Description) is the XML file containing the complete configuration of an IEC 61850 substation: all IEDs, their data models, GOOSE subscriptions and network addresses. A system configurator builds it from the manufacturers’ ICD files, and it is the single source of truth for changes.

Is IEC 61850 encrypted?

The base protocols of IEC 61850 are neither encrypted nor authenticated. IEC 62351 adds TLS for MMS and HMAC authentication for GOOSE and Sampled Values, but many installed IEDs do not support it yet. Network segmentation and monitoring therefore remain essential.

Is IEC 61850 used outside substations?

Yes, IEC 61850 is also used in industrial power distribution, wind farms (via the derived IEC 61400-25), hydropower plants, solar parks and battery storage. Part 7-420 defines the data model for distributed energy resources, so inverters and storage systems fit into the same model.

Can you connect IEC 61850 to IT systems?

Yes, through a gateway or OPC UA server that translates MMS data, so historians, asset management systems and analytics platforms can use IEC 61850 data. That connection should pass through a demilitarised zone, so IT systems never talk directly to the station bus or process bus.

📌 In summary

IEC 61850 is the international standard for communication in power utility automation: a self-describing data model with MMS, GOOSE and Sampled Values, configured through SCL files. It enables digital substations and vendor-independent engineering, but the base protocols are unsecured, so segmentation, monitoring and IEC 62351 belong in every design.