IED

What is an IED?

An IED (Intelligent Electronic Device) is a microprocessor-based device that monitors, protects and controls electrical installations by measuring currents and voltages, detecting faults and issuing commands on its own, such as tripping a circuit breaker. IEDs are found mainly in the substations of grid operators and in the medium-voltage installations of industrial sites, data centres and wind farms. They replace the separate electromechanical relays, meters and switches of the past with a single programmable device that also exchanges data with SCADA, a DMS or a station computer.

The best-known IED is the digital protection relay. But tap changer controllers, recloser controls, bay controllers and power quality analysers also fall under the term.

🧠 What does an IED do?

An IED combines functions that used to be spread across several cabinets:

• Measuring - voltage, current, power, frequency and power factor, often including harmonics and power quality
• Protecting - detecting short circuits, overloads, earth faults or abnormal frequency and issuing a trip command within milliseconds
• Controlling - opening and closing switchgear, adjusting transformer tap changers, switching capacitor banks
• Interlocking and logic - interlocks and programmable logic, so that, for example, a disconnector is never operated under load
• Recording - time-stamped events (sequence of events) and disturbance records in COMTRADE format for post-fault analysis
• Communicating - status and measurements to SCADA or DMS via IEC 61850, DNP3, IEC 60870-5-104 or Modbus
• Self-diagnostics - an internal watchdog monitors hardware and firmware and raises an alarm before protection is compromised

An IED’s behaviour is defined by its settings file: thresholds, time delays, logic and communication parameters. That file is therefore just as critical as the hardware.

🔧 What types of IED are there?

Protection functions are identified internationally by the device function numbers from IEEE C37.2, which are also widely used on European drawings:

A modern multifunction relay often contains dozens of these functions, of which only a handful are enabled for a given application.

🏭 Where are IEDs used?

• Transmission and distribution grids - substations of national and regional grid operators, from extra-high voltage down to 10 kV stations
• Industry - medium-voltage switchgear in chemicals, refining, steel and food production, where an unnecessary trip immediately costs production
• Data centres and hospitals - protection and transfer between the grid, standby generators and UPS systems
• Renewable generation and storage - wind farms, solar parks and battery energy storage, where IEDs also implement grid code requirements such as frequency and voltage protection

Well-known manufacturers include Siemens (SIPROTEC), ABB and Hitachi Energy (Relion), SEL, GE Vernova (Multilin) and Schneider Electric (Easergy MiCOM). An IED typically stays in service for fifteen years or more, so a single substation often runs several device generations and firmware versions side by side.

🔄 What is the difference between an IED, an RTU and a PLC?

The boundaries are blurring: many IEDs offer programmable logic, and in a substation an RTU often acts as a gateway that concentrates data from dozens of IEDs towards the control centre. An IED, however, is built and type-tested specifically for the electrical protection task; a PLC is not.

⚡ How does an IED work in an IEC 61850 substation?

In a modern substation, IEDs communicate with each other and with the station computer according to IEC 61850:

1. Station bus - IEDs send events and measurements via MMS to the station HMI and to the gateway towards SCADA.
2. GOOSE - IEDs send each other trips, blocking signals and interlocks as GOOSE messages; for trips, IEC 61850-5 requires a transfer time of 3 ms in the most demanding performance class.
3. Process bus - in a digital substation, merging units deliver measurements as Sampled Values, removing the copper wiring to the relay panels.
4. Time synchronisation - disturbance records from different IEDs can only be compared with a common clock. Traditionally this is done with NTP or IRIG-B; digital substations use PTP according to IEC/IEEE 61850-9-3, with an accuracy better than 1 µs.
5. Redundancy - because a network interruption of a few tens of milliseconds is already too long, the networks are duplicated with PRP or HSR.

Configuration is handled through SCL files: the manufacturer supplies an ICD file for each IED, the system configurator combines them into one substation file (SCD), and a CID file is loaded into each device.

🔐 How do you protect IEDs against cyberattacks?

IEDs are a direct target, because an attacker with access to a relay can physically switch equipment or disable protection. The Industroyer malware, used by Sandworm against the Ukrainian power grid in December 2016, had modules for IEC 60870-5-101, IEC 60870-5-104 and IEC 61850. An additional module abused a vulnerability in Siemens SIPROTEC relays with an EN100 communication module (CVE-2015-5374): specially crafted packets to UDP port 50000 left the relay unresponsive until a manual restart.

The base protocols of IEC 61850 have no authentication or encryption. IEC 62351 adds them, but many installed IEDs do not support it yet. Therefore:

• Segment the substation network into zones according to the zones and conduits model of IEC 62443, with only the necessary connections to the control centre
• Manage settings and firmware centrally from a secured engineering station and keep an up-to-date asset inventory with type, firmware version and settings file for each IED
• Harden the devices: disable unused ports and services, replace default passwords, enable role-based access
• Plan patch management around maintenance windows, because a firmware update on a protection relay requires retesting the protection functions
• Control remote access through a managed jump connection rather than direct modems or VPN connections to the relay
• Monitor traffic with OT network monitoring that understands GOOSE, MMS and IEC 104

Two standards help when procuring IEDs: IEEE 1686-2022 specifies the security functions an IED must provide (access control, audit trail, alarms, firmware management), and IEC 62443-4-2 sets component requirements per security level.

🇳🇱 What does this mean for Dutch and EU organisations?

Grid operators, generators and other energy-sector entities fall under the Dutch Cybersecurity Act (Cyberbeveiligingswet), which implements NIS2 and entered into force on 15 August 2026, as do many industrial sectors such as chemicals and food. They must manage their risks and report significant incidents, and IEDs in substations are among their most critical assets. Industrial companies with their own medium-voltage substation often underestimate this: the substation sits outside process automation, yet a manipulated relay can shut down the entire plant.

A practical approach:

1. Inventory every IED, including older relays with serial or modem connections.
2. Put settings files under version control and periodically compare them with what is actually in the device.
3. Separate the substation network from the office and process networks.
4. Set requirements for suppliers and installers: IEEE 1686, IEC 62443-4-2 and support for IEC 62351.

❓ Frequently asked questions

Is a protection relay the same as an IED?

A digital protection relay is the most common type of IED, but not every IED is a protection relay. Bay controllers, tap changer controllers, recloser controls and power quality analysers are IEDs too. An old electromechanical relay without a microprocessor is not an IED.

Which protocols does an IED use?

An IED in a modern substation usually uses IEC 61850, with MMS for the connection to SCADA and GOOSE for fast messages between IEDs. Many IEDs also support DNP3, IEC 60870-5-103 or -104 and Modbus, especially in existing installations.

How quickly does an IED trip on a short circuit?

An IED typically detects a severe short circuit within a few tens of milliseconds and then sends a trip to the circuit breaker. The total fault clearing time, including the breaker opening, is usually around or below a tenth of a second for fast protection. In selective protection schemes, delays are deliberately set so that only the nearest IED trips.

Why are IEDs attractive to attackers?

An IED directly controls the switchgear of a power network, so whoever takes over an IED can cut power or disable protection. The Industroyer attack in Ukraine in 2016 showed that this happens in practice. Many IEDs also run the same firmware for years without authentication on their protocols.

How long does an IED last?

An IED is typically kept in service for fifteen years or more, because replacement requires a substation outage and retesting of all protection functions. As a result, many substations run older IEDs with outdated firmware alongside new devices, which makes lifecycle management and compensating security controls essential.

Does an industrial company have IEDs too?

Yes, almost every company with its own medium-voltage installation has IEDs in the form of protection relays in each bay. These IEDs are often outside the view of the OT security team, while a failure or manipulation can black out the entire site. Include them in the asset inventory and the network design.

📌 In summary

An IED is the intelligent heart of an electrical substation: it measures, protects and switches autonomously within milliseconds and communicates with SCADA via IEC 61850, DNP3 or IEC 104. Because an IED directly controls the power supply, segmentation, settings management and security requirements according to IEEE 1686 and IEC 62443 belong in every design.