IEC 61850 in Substation Automation

Editor's note: Updated August 2026

IEC 61850 is the international standard that defines how devices in a substation exchange data. It combines a common data model with a common set of communication services, so a protection relay from one vendor can exchange information with a bay controller, a merging unit, or a SCADA system from another. That is what makes vendor-neutral protection, automation, and control possible in practice rather than only on paper.

For a protection engineer the practical change is easier to state than the standard makes it sound. Signals that used to travel over copper between the relay room and the switchyard now travel over Ethernet. Trip and interlocking signals become GOOSE messages. Current and voltage secondaries become sampled values published by a merging unit. What was a wiring diagram becomes a configuration file, and what was a continuity check becomes a subscription check.

The standard first appeared in 2003 and has grown well beyond its original scope. Edition 2 widened the title from substations to power utility automation, and the series now reaches into hydro plants through part 7-410 and distributed energy resources through part 7-420. Wind is covered by the closely related IEC 61400-25 series, which reuses the IEC 61850 modeling approach. For anyone specifying a substation today, IEC 61850 is the baseline that everything else is built on.

Figure 1: IEC 61850 at a glance: the station, bay and process levels, the services that run on each bus, and the parts of the standard behind them.

What IEC 61850 actually standardizes

IEC 61850 is often described as a protocol. That undersells it, and it is also the reason the standard is sometimes compared to IEC 60870-5-104 as though the two were the same kind of thing. The series standardizes four different layers, and the value comes from the combination:

• A common data model. Parts 7-3 and 7-4 define logical nodes and common data classes. A distance protection function is PDIS, a circuit breaker is XCBR, a measurement is MMXU, and the structure is the same regardless of who built the device.
• Communication services mapped to Ethernet. Part 8-1 covers client-server communication and GOOSE, part 9-2 covers sampled values.
• A machine-readable engineering language. Part 6 defines SCL, with file types including ICD, IID, SSD, SCD, and CID. This is what lets signal lists move between tools instead of being retyped, and it is where a modern substation design actually lives.
• Environmental and hardware requirements. Part 3 specifies what equipment installed in a substation has to survive.

Part 10 adds conformance testing, which is why an interoperability claim can be checked before equipment reaches site rather than during commissioning.

The IEC 61850 substation architecture

IEC 61850 organizes a substation into three levels. The terms come from IEC 61850-5, which describes the levels together with logical interfaces numbered IF1 through IF10.

Process level

The process level is the switchyard: circuit breakers, disconnectors, instrument transformers, and the merging units that digitize current and voltage. In a digital substation the copper between the CTs and VTs and the relay room is replaced by a process bus carrying sampled values and GOOSE over fiber.

Bay level

The bay level holds the protection relays and bay controllers. They evaluate data from the process level, make the trip decision, and pass information upward for indication and archiving. This is where the timing requirements are strictest, because the transfer time of a GOOSE trip sits inside the fault clearing time budget.

Station level

The station level hosts the SCADA system, the HMI, the substation gateway, and the engineering workstation. The link to the control center starts at the gateway. The station bus connects station and bay level, typically using MMS for client-server traffic and GOOSE for interlocking across bays.

Figure 2: The three levels of an IEC 61850 substation, with a PRP station bus, a redundant process bus serving the merging units and the breaker IED, and a GNSS-disciplined PTP grandmaster attached to the station bus like any other device.

Why utilities invest in IEC 61850

The business case rarely comes down to the protocol. It comes from what the protocol removes.

Less copper, and fewer things to get wrong

Point-to-point wiring between the switchyard and the relay room is replaced by a fiber network. That reduces cable trenches and trays, cuts commissioning time, and removes an entire category of wiring faults. It also removes the long CT secondary runs, which shortens the circuit where an open secondary is a hazard, though the hazard itself still exists between the CT and the merging unit. Retrofit projects benefit most, because pulling new copper through an existing building is usually the expensive part.

A design that can be tested before it is built

Because SCL describes the complete configuration in a machine-readable file, the substation can be modeled and tested during engineering. Signal lists move between tools instead of being retyped, and much of the factory acceptance test can happen before hardware reaches site.

Vendor independence that survives the next procurement cycle

A common data model plus conformance testing means the relay chosen in 2027 does not lock in the gateway chosen in 2032. Interoperability still takes engineering effort, but the effort is configuration rather than protocol translation.

Higher availability

IEC 61850-3 defines the environmental conditions equipment has to meet, so devices are designed and tested for what a substation actually does to electronics. Combined with PRP or HSR, this reaches an availability level that ordinary IT equipment cannot in this environment.

A path to virtualization

Once functions communicate over Ethernet using a standardized model, they stop being tied to a particular box. That is the precondition for virtual protection automation and control.

Communication services: MMS, GOOSE, and sampled values

Different levels have different needs. A trip cannot wait for a TCP handshake and a retransmission timeout, while a measurement reported to SCADA every few seconds does not need microsecond timing. IEC 61850 therefore defines several services and maps them to different layers of the network stack.

Two points are worth being precise about, because they are frequently mixed up. GOOSE is horizontal communication between peer IEDs and carries events, not measurements. Sampled values run vertically from the process level up to the bay level and carry a continuous stream of measurement samples. Both bypass TCP/IP and run directly on Ethernet, which is how they meet their timing budgets.

Figure 3: The three IEC 61850 communication services: MMS between station and bay level, GOOSE between IEDs, and sampled values from merging units to protection IEDs.

What the transfer time numbers actually mean

IEC 61850-5 defines transfer time as the complete path from the moment the sending application hands the data to the transmission stack, across the network, to the moment the receiving application has extracted it. It is not the wire delay. Vendor figures that quote only network latency are measuring something narrower than the standard does.

The requirement depends on message type and performance class together, which is where most summaries go wrong. A type 1A trip message must arrive within 10 ms under performance class P1, which is half a cycle at 50 Hz, and within 3 ms under P2/P3, which sits inside a quarter cycle. Type 1B messages for other fast signals allow 20 ms under P2/P3 and 100 ms under P1. Distribution substations are typically specified to P1 and transmission substations to P2/P3.

One clarification on sample rates. The commonly quoted figures of 80 and 256 samples per cycle come from the 9-2LE implementation guideline published by the UCA International Users Group rather than from IEC 61850-9-2 itself. Newer projects increasingly reference IEC 61869-9, which defines the digital interface for instrument transformers.

Why a GOOSE subscription supervises itself

A hardwired trip circuit needs trip circuit supervision as a separate function, because an open wire is silent until the day it matters. GOOSE inverts that. Every publisher retransmits continuously, fast after a state change and then backing off to a slower heartbeat, and every message carries a state number that increments on a change of value and a sequence number that increments on retransmission. Each message also declares how long the subscriber should wait before the next one is due.

A subscriber therefore knows within a defined interval that its publisher has stopped talking, without anyone engineering a supervision scheme for it. It also receives a quality attribute with every data object, so it can tell the difference between a signal that is false and a signal that is unreliable. Both behaviors are worth understanding before commissioning, because they change what an alarm means.

What happens when sampled values stop

This is the question protection engineers ask first about process bus, and rightly. A relay taking sampled values has no analog input to fall back on. If the stream stops or the quality attribute goes invalid, the affected protection function blocks and alarms rather than operating on stale data.

There is a second failure mode that is less obvious. Each sampled value stream carries a synchronization indicator that says whether the samples are aligned to a global clock, a local clock, or nothing. Functions that compare measurements from more than one merging unit, such as busbar differential or line differential, depend on that alignment and have to react when it is lost. Functions working from a single merging unit, such as overcurrent, are less exposed. Deciding what each function does when synchronization degrades is a protection design decision and not a network one.

Time synchronization and network redundancy

Sampled values only work if every merging unit stamps its samples against the same clock. IEC/IEEE 61850-9-3, the power utility profile of IEEE 1588 PTP, is the profile used for this, and it targets 1 microsecond accuracy.

The practical shift is that time now travels in band. A GNSS-disciplined grandmaster attaches to the station bus as an ordinary dual-attached device, and the time distributes over the same Ethernet that carries MMS, GOOSE and sampled values. There is no dedicated timing cable to every relay, which is what IRIG-B and 1 PPS required. The cost of that convenience is that timing becomes a network design question: every switch in the path has to handle the profile correctly as a boundary or transparent clock, and a switch that merely forwards PTP packets without correcting for its own delay will quietly destroy the accuracy budget.

Availability is handled by IEC 62439-3, which defines PRP and HSR. Both duplicate every frame over separate paths, so a single fault causes no recovery time at all. This matters because a protection scheme cannot ride through the reconvergence delay of a spanning tree protocol.

In practice the two protocols land in different places. PRP is the usual choice for the station bus, where servers and gateways sit behind substation switches on two independent LANs. HSR rings are more common at bay and process level, where merging units and relays have two Ethernet ports each and are naturally strung together in a loop, typically one ring per bay. A RedBox network card bridges an HSR ring into a PRP network where the two meet. Simpler installations sometimes use RSTP at station level and accept a reconvergence delay that would be unacceptable on a process bus.

Northbound communication to the control center

IEC 61850 governs communication inside the substation. The link to the network control center is a separate question, and in most European utilities it is still IEC 60870-5-104 over TCP/IP. A station level gateway therefore maps the IEC 61850 data model onto 104 data points, which is one of the standard workloads that ends up virtualized at station level.

What connects to a substation has also changed, and that is part of why this topic has become urgent rather than merely current. A hyperscale data center campus now takes a dedicated substation fed from transmission voltage, 230 or 345 kV in North America and 110 kV in Europe, which puts a single customer on the same footing as a mid-sized city. Grid-scale battery storage has become an ordinary connection at distribution and subtransmission, and unlike a passive load it responds to dispatch signals in seconds. Both are reasons the number of automated substations is growing, and both are built new, which means they are specified for IEC 61850 from the start rather than retrofitted into it.

Further down the system the requirements are smaller but the site count is much larger, and this is where the two major grid conventions diverge enough to cause confusion in international projects. The vocabulary does not translate one to one:

One term deserves a warning of its own. "Distribution substation" means different things on the two sides of the Atlantic. In North America it is the station that steps subtransmission down to the primary feeders, typically 69 kV to 12.47 kV. In British usage it is the last step before the customer, 11 kV to 400 V, which is what a continental European engineer calls a secondary substation. The same two words name stations three voltage levels apart, which is worth establishing early in any project that spans both markets.

Two notes on the numbers. In Europe, 400 kV and 380 kV are the same IEC 60038 level under different names, and the 132 kV and 33 kV values are British practice alongside the continental 110 kV and 20 kV. In North America, ANSI C84.1 puts the boundary between high voltage and extra high voltage at 230 kV, so 230 kV can legitimately be described either way; it appears here as regional transmission because that is how a utility running 230 kV as its bulk network speaks.

The last two rows are the ones that catch people. A European utility may operate tens of thousands of secondary substations, each a building or kiosk with room for equipment in it. The equivalent position on a North American grid is usually a pole-mounted transformer with nothing intelligent inside. Both systems automate their medium voltage networks heavily; the difference is where the equipment physically sits, which follows from one network being largely underground and ring-operated and the other largely overhead and radial. Either way the communications pattern is the same: a compact router with a built-in protocol gateway is often the whole solution. The Westermo Merlin 4600 series is built for this position. It is certified to IEC 61850-3 Class 1 for medium voltage substations, and its protocol gateway presents Modbus, DNP3 and IEC 60870-5-101 devices to SCADA through a single IEC 60870-5-104 or MMS interface, so the control center sees one consistent stream instead of a mixture. It also carries its own digital inputs and outputs, which lets it stand in as a small RTU where there is no room for one.

Where IEC 61850 data itself has to cross a WAN, IEC 61850-90-5 defines routable GOOSE and routable sampled values for that purpose.

Figure 4: Voltage levels and the automation layer in the European and North American grids, aligned on shared function bands. The levels differ in number and the substation terminology does not translate directly.

What changes for testing and commissioning

The part of this transition that surprises people is not the protocol. It is that the test switch disappears. In a conventional bay, secondary injection happens at a known physical point, and the isolating links are how a relay is proven without tripping the breaker. On a process bus there is no secondary circuit to inject into at the relay.

IEC 61850 answers this with test and simulation handling built into the messages themselves. Edition 2 defines a simulation flag in the GOOSE and sampled value header, together with a setting in the receiving IED that tells it to accept simulated messages in place of the real ones from that publisher. A test set can then take over a stream while the relay stays in service on everything else. Combined with the mode and behavior attributes that let a function be placed in test or test-blocked, this is a more granular tool than a rack of isolating links, and it is also easier to leave in the wrong state. Verifying that nothing was left simulating is now part of returning a bay to service.

Two habits follow from this. Keep the SCD file under the same change control the wiring diagrams used to have, because it is now the record of what is connected to what. And expect more of the functional check to happen before site, since a subscription error is visible in the configuration in a way a wiring error never was.

IEC 61850-3: what substation hardware has to survive

Part 3 specifies the environmental and EMC conditions for equipment installed in substations, and it is the reason ordinary rackmount servers do not belong in a relay house. In North America the equivalent reference is IEEE 1613, and serious substation hardware is tested against both.

• Electromagnetic immunity. Switching operations and fault currents produce transients that will disturb or destroy unprotected electronics. Testing covers surge, fast transient burst, conducted and radiated fields, and damped oscillatory waves, the same family of tests a numerical relay faces under IEC 60255-26.
• Temperature range. Relay houses and kiosks are often not climate controlled. Fanless designs are commonly specified from -40 °C to +70 °C; actively cooled platforms typically reach +55 °C, which is worth checking against the worst-case cabinet temperature rather than the room temperature.
• Vibration and seismic load. Hardware has to keep operating through transformer vibration and, in some regions, through seismic events.

The levels are logical, not physical

This point decides what is possible next, so it is worth being precise about. IEC 61850-5 defines the levels and the interfaces between them. IF4 is the exchange of instantaneous current and voltage data between process and bay level, which is the sampled values path. IF8 is direct exchange between bays for fast functions such as interlocking, which is the GOOSE path.

What the standard does not do is prescribe how many devices you install or where they sit. IEC 61850-5 works from the principle of free allocation of functions: a function is defined logically, and the designer decides which physical device performs it. The level model describes the structure of the communication, not the layout of the relay panel.

That principle is why virtualized protection does not conflict with IEC 61850. Running a bay level protection function on a server at station level changes the physical allocation while leaving the logical model and the interfaces untouched. The question worth asking of a virtualized design is therefore not whether it is still compliant. It is whether the platform holds the same transfer time and availability the function had when it lived in a dedicated relay.

One terminology trap comes with this. The Bay element in SCL belongs to the primary plant description, in the hierarchy of substation, voltage level, bay, and conducting equipment. That is the single line diagram, not the automation hierarchy. Bay level and Bay in SCL are two different uses of the same word inside the same series.

Substation computing and virtualization

The station level has quietly become a substation computing problem. Four applications turn up in almost every substation: the station SCADA system, the substation gateway that carries the telecontrol link to the control center, the local HMI, and the engineering workstation that holds the configuration tools and the SCD file. Around them sit power quality analysis, disturbance record collection, asset monitoring, and increasingly an intrusion detection sensor. Historically each arrived as its own industrial PC, which is why substations accumulated racks of single-purpose boxes.

Those four go by different names depending on which ecosystem you grew up in, and it is worth naming them plainly, because a discussion about consolidation stalls quickly when two people mean the same box by different words. The substation gateway is what a North American engineer would recognize as the automation controller or RTU handling protocol conversion, and what a European engineer would recognize as the telecontrol gateway on the IEC 60870-5-104 link. The HMI is the station control display, whether it runs on the gateway or on its own machine. The engineering workstation is the machine that runs the relay configuration software and keeps the substation configuration under version control. All four are ordinary x86 workloads, and none of them needs its own chassis.

Consolidating them onto one platform with a hypervisor keeps the isolation while removing the hardware sprawl, provided the platform has the headroom and the right I/O. Two design choices decide whether it works.

The first is the network path. A consolidated station level platform normally attaches to the station bus over PRP, through a dedicated RedBox network card or an upstream switch, so a virtualized gateway is no less available than the physical device it replaced. Where a platform also hosts latency-critical functions, SR-IOV matters: it gives a virtual machine its own hardware path to the network card instead of routing its traffic through a software bridge in the host, which is what keeps jitter out of sampled values and GOOSE. One detail deserves attention at design time. The PTP hardware clock sits in the physical function rather than in the virtual functions, so synchronization runs on the host and the virtual machines take their time through the virtualization layer.

The second is timing. Any workload that touches sampled values needs a real-time capable kernel, hardware timestamping, and cores pinned to it, which is a very different specification from a general IT server. Plan with physical cores rather than threads, since deterministic workloads normally run with hyper-threading disabled.

Figure 5: The SCADA system, substation gateway, HMI and engineering workstation consolidated onto one platform, with seamless redundancy to the station bus.

Welotec covers this with two platforms that target different profile levels in the vPAC Alliance hardware specification. The RSAPC Mk2 targets Profile Level 2: a fanless 2U server with a 6-core or 8-core Intel Xeon W, rated -40 to +70 °C, with eight 2.5 GbE copper ports that all carry IEEE 1588-2008 hardware timestamping, so many station bus designs need no add-in network card at all. The RSAVP targets Profile Level 4: actively cooled, available with 16, 36, or 64 cores and up to 512 GB, with fiber networking and SR-IOV for dense consolidation and for accelerator cards.

Where this is going: vPAC and the software-defined substation

The logical next step after consolidating station level applications is virtualizing protection and control itself. That is the goal of vPAC, virtual protection automation and control, where protection functions run as software on standardized servers instead of on dedicated relays. Open source work such as SEAPATH under LF Energy and the specification work in the vPAC Alliance are both driving toward it, and IEC 61850 with a process bus is the technical precondition.

It is worth being clear that vPAC is one layer of a larger change rather than the whole of it. Virtualizing the application is the visible part. The infrastructure underneath, meaning networking, timing, lifecycle management, and security, has to become software-defined as well before the operating model actually changes. That argument is the subject of its own article, Software-Defined Substation: Why vPAC Is Only the First Layer.