See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/261466832

Communication protocols in substation automation and IEC 61850 based

proposal

Conference Paper · November 2013

DOI: 10.1109/CINTI.2013.6705214

CITATIONS READS
16 3,961

3 authors:

Josef Horalek Jan Matyska

University of Hradec Králové University of Hradec Králové
54 PUBLICATIONS   151 CITATIONS    15 PUBLICATIONS   80 CITATIONS   

SEE PROFILE SEE PROFILE

Vladimir Sobeslav
University of Hradec Králové
72 PUBLICATIONS   230 CITATIONS   

SEE PROFILE

Some of the authors of this publication are also working on these related projects:

TACR "Application for the economic evaluation of the migration of IT infrastructure into the cloud" View project

All content following this page was uploaded by Vladimir Sobeslav on 22 January 2015.

The user has requested enhancement of the downloaded file.

Communication Protocols in Substation Automation and IEC 61850 based proposal

J. Horalek, J. Matyska, V. Sobeslav

Department of Information Technologies
University of Hradec Kralove
Hradec Kralove, Czech Republic
e-mail: [email protected], [email protected], [email protected]

Abstract— The automation of control systems of substations in whole substation automation systems can be connected and
the energy industry uses a variety of specialized standards, create the complex system. Furthermore this paper is mainly
technologies and protocols. Among the most frequently used focused on the modern standrard IEC 61850 and the
belong MODBUS, IEC60870, DNP3 and IEC61850 protocols. implementation in complex SAS project in Czech Republic.
The present paper analyses and compares approaches to data On the other hand the integrated solution brings the potential
communication among the abovementioned protocols with the risk factors, such as security vulnerabilities and threads.
main focus on modern standard IEC61850. The paper was According to EU direction 96/92/EC, only one operator
created on the basis of experience while implementing data is responsible for power distribution. Distribution and power
communications for ČEPS a.s., the national distributor in the
production is separated to ensure the competition on the
Czech Republic.
market. In the Czech Republic ČEPS, a.s. serves distribution
Keywords- IEC standards, power system control, substation services. This company, controlled by the government,
automation, IP networks, ethernet networks, network topology. ensures the allocation of power resources, transformation
capacities, management and security issues. Dispatching
centre grants neighbouring countries interconnection for
I. INTRODUCTION international collaboration in Europe, respecting UCTE [6]
Substation automation in power industry enables the rules for electricity power exchange. Bilateral cooperation is
development of remote monitoring, control and electronic currently in progress with distribution operators in Germany,
devices coordination. Substation automation encounters the Poland, Austria, Slovakia, Hungary and Slovenia.
challenge of power distribution reliability and efficiency.
Potential risk factors such as lighting, accidents, system II. DEVELOPMENT OF SUBSTATION AUTOMATION
faults or financial efficiency leads to development of STANDARDS
standardization process [1], [2]. Standards and appropriate Variety of systems, technologies and protocols has been
technologies help to contribute to the following issues: developed throughout the history. The main problem in this
area is the fact that many of these protocols and developed
 Reduce settings and configuration effort systems are usually vendor depended and cannot be adopted
 Create more capability and flexibility as a complex solution. If we analyse this area from the data
 Stimulate more interoperability networking point of view the most important protocols are
 Lower installation cost Modbus, Modbus Plus, DNP3 and IEC 60870. These
 Reduce manual effort & errors protocols still operates at the electronic utility level. Systems
usually serve the selected services and cannot be adopted
Throughout the history, variety of systems, technologies over the standard and high-speed communication
and protocols has been developed. The main problem in this technologies like the Ethernet [3]. Ethernet is one of the most
area is the fact that many of these protocols and developed important technologies in the networking area. The
systems are usually vendor depended and cannot be adopted utilization and interconnection with the industry
as a complex solution. If we analyse this area from the data communication standards is a topical issue and brings many
networking point of view the most important protocols are assets. Important Ethernet characteristic is that is part of
Modbus, Modbus Plus, DNP3 and IEC 60870. These standardised networking models like ISO/OSI and TCP/IP
protocols still operates at the electronic utility level. Systems protocol stack. The independent parts of the substation or the
usually serve the selected services and cannot be adopted whole substation automation systems can be connected to
over the standard and high-speed communication create the complex system.
technologies like the Ethernet [3]. Ethernet is one of the most
important technologies in the networking area. The III. MODBUS
utilization and interconnection with the industry The MODBUS protocol has gradually become the
communication standards is a topical issue and brings many standard for creation of automation systems in wide are of
assets. Important Ethernet characteristic is that is part of industrial applications. Recently Modbus support various set
standardised networking models like ISO/OSI and TCP/IP of networking technologies including serial communication,
protocol stack. The independent parts of the substation or the
optical or radio networks, RS-232, RS-422 a RS-485 serial
communication or the TCP/IP enhancements.

Figure 1. Communication standards MODBUS Figure 2. Communication standards IEC 60870-5-101

According to the transport technologies, MODBUS IEC 60870-5-10 is a structured substandard which
operates at different layers within the protocol stack model. provides the definition for the interfaces of RTU (Remote
Following picture presents possible solution. At the Terminal Units) and IED (Intelligent Electronic Device). It
operational level, Modbus works in a response/answer consists of the necessary components and profile definitions
manner. Required function is presented by the sequence code for vendor’s development and ensures the compatibility with
listed in protocol documentation. Modbus is suitable mainly other systems. The communication profiles and mechanisms
for serial data communication and it is not optimized for are technologically independent, according to ISO/OSI
communication over the Ethernet. Modbus plus is important relation model. They act mainly on application a data link
enhancement of previous protocol version. Modbus plus can layer.At the physical layer allows the selection of compatible
be seen as a complex solution for remote communication in standards with RS-232 and RS-485, and also support fibre
industry area. Adoption of TCP/IP protocol stack extends the optics interfaces. The frame specification provides the
use of this protocol. For the connection over the internet, required data integrity together with the maximum efficiency
Modbus obtained reserved system port 502. Modbus/TCP for acceptable implementations. FT 1.2 represents
basically encapsulates a Modbus frame into a TCP frame in a asynchronous way of communication and can be
simple manner. Transmission Control Protocol represents the implemented using standard Universal Asynchronous
connection oriented and reliable mechanism instead of other Recover Transmitters ports. This standard also offers fixed
industrial or network technologies. Therefore, Modbus can and variable block length and single transmission character
make use of the advantages of internetworking technologies control procedure. The data link layer specifies if an
and this fit the master and slave nature of Modbus. There are unbalanced or balanced transmission mode is used together
some disadvantages of this protocol. Modbus for example with the link procedures. The selection corresponds with
does not give time stamped events. The sequence of events is function codes. The address schemas for communication
missing the time stamp context and also not provides polled circuit are also provided. The link transmission procedures
report by exception. follow the IEC 870-5-2 standard, like other parts of the
protocol stack, and specify the send commands with
IV. IEC 60870-5-101 confirmation and no replay, request and response message.
This protocol stack can be implemented in multidrop bus and
IEC 870-5-101 is an industrial standard developed by the
point to point networks topology.
IEC TC57 for electric utility communication between master
stations and remote units. The IEC 870-5-101 consist of five V. DNP3
parts, like the DNP3 protocol, which we will discuss in the
next chapter. IEC 60870-5-101 is one of the IEC 60870 set DNP3 - distributed network protocol is a protocol stack
of standards, which is focused on remote control in electrical or a set of communication protocols used for the
engineering and power system automation applications. The interconnection of automation systems. Typically is used
substandard part 5 provides a communication profile for within the SCADA systems and Intelligent Electronic
sending basic remote control messages between two systems Devices (IED in the terminology of IEEE TC97 group) in the
via directly connected permanent circuit. area of power industry. DNP3 is not widely used in other
industries. DNP3 uses the IEC60870-5 defined frame (FT3).
FT3 frame is very similar but not strictly identical. CRC
checking and optimal enhancements are the main
differences. In the networking terminology, according to the
ISO/OSI reference model, DNP3 is mostly the layer 2
protocol, which provides multiplexing, error checksum, link
control, data fragmentation, basic QoS prioritization and
layer2 addressing schemas. From the transport and
application layer perspective, the DNP3 packet loses its own
logical context, the interconnection with data units and
substation transport events. There were some enhancements  Type 1 (Fast messages)
developed, for example the UCA 2.0 (Utility  Type 1A (Shutdown messages)
Communication Architecture developed).  Type 2 (Midfast messages)
 Type 3 (Slow messages)
VI. IEC 61850
 Type 4 (Prime data messages)
IEC 61850 is the response of previous standards limits. It  Type 5 (Data transfer messages)
brings many assets for technology development and  Type 6 (Time synchronization messages)
implementation. The standardization process brings the
convention for object modelling and programming, the use Type 1 and Type 1A are mapped on specific ether-types
of modern networking technologies, commands schemas, for decoding optimization of accepted messages. Type 2, 3
data representation, data transfer, encapsulation and many and 5 are requested by service oriented messages. ISO 9506
more. IEC 61850 is a huge standard and consist of many MMS (Manufacturing Message Specification) provides
substandard. It would be impossible to cover all topics; more methods and services for ACSI information modelling.
information can be found here [3], [4], [5]. ISO/OSI reference model splits up network
IEC 61850 communication and data transfers can be communication into seven sub-layers and helps to scale the
realised via serial and modern computer networks future development of networking model. IEC 61850 enables
technologies using TCP/IP model and Ethernet encapsulation utilization of frequently used IP networks; it helps to lower
techniques. We recognize two categories of communication: financial costs [8], [9]. The picture bellow illustrates the
vertical and horizontal [7]. The collection of IEC 61850 interconnection between ISO/OSI layers, networking
standards covers the methodology for devices integration, technologies and services. There are three main utilized
data encapsulation or network services protocols. services: GOOSE, SVM and ACSI basics.
Relationships between the specific sub-layers of IEC models
are described in the following table. Changes in one part
should not affect other relations or elements.

 IEC 61850-10 - Conformance testing

 IEC 61850-6 Configuration language for
communication in electrical substations related to
IEDs
 IEC 61850-8-x IEC 61850-9-x Specific
communication service mapping (SCSM)
 IEC 61850-7-4 Compatible logical node classes and
data classes
 IEC 61850-7-3 Common Data Classes
 IEC 61850-7-2 Abstract communication service
interface (ACSI)
 IEC 61850-7-1 Principles and models
 IEC 61850-5 Communication requirements for
functions and device models Figure 4. Messaging SVM and GOOSE

A. SMV (Sampled Measured Values)

SMV is a method used for passing measured samples
from sensor units, like CTs, VTs or digital I/O sharing
between IED devices. Lower layers of ISO/OSI model use
Ethernet multicast characteristics and unicast communication
via serial line. OSI reference model (ISO/IEC 7498-1)
describes in detail the conception of each communication
layer and networking profiles, application (A-Profile) and
transport (T-Profile). A Profile is the collection of
specifications and agreements dealing with first three ISO
reference model layers. The rest four layers form T-Profile.
Services are mapped, according to IEC 61850-7-2 standard,
in four different combinations of A-Profile and T-Profile:
Figure 3. Communication standards
 Client/server model
IEC 61850–5 defines the following communication
messages with the consequent interpretation:  GOOSE/GSE control
 GSSE services
  Time synchronization overcome some negative aspects, which are not relevant in
Client/server model is used for relations in conjunction average networking processes. As a critical factor there can
with IEC 61850-8-1 standard and its declaration specified in be mentioned communication delay, destination
IEC 61850-7-2. identification interpretation and packet loss on the second
OSI layer. TCP/IP stack does not include mechanisms for
B. GSE/GOOSE profiles reliable delivery which will grant frames order and quality of
GSE (Generic Substation Events) control model, defined services. This effort historically lays on lower layers or
in IEC 61850, provides a fast and reliable mechanism of data added mechanisms. TCP/IP model is used typically for
transfer [9], [10], [11], [12] over the network. The standard vertical communication. Connectionless and non-reliable
defines more ways for communication in substation. GOOSE communication over UDP protocol is used for NTP time
and GSE events typically use multicasts for data delivery. synchronization. Connection-oriented and reliable
Generic Object Oriented Substation Events (GOOSE) communication over TCP protocol is used for ASCI MMS
mechanism groups data into objects and transmits within message communication described in previous chapter. In
them 4 milliseconds. It helps to assure the reliability and traditional asset the QoS mechanism (Quality of Services) is
transmission speed of communication. (GSSE) mechanism is implemented on logical level and enables services
enhanced by UCA2.0 status messages. In Ethernet networks classification and prioritization. IEC 61850 requests
data are segmented and encapsulated straight into frames and reliability, fast data delivery and redundant topology with
transported as a lower layer multicast over the networks [8]. maximal accepted delivery time of about 10 milliseconds,
This might be a bottle-neck in specific implementations, including network topology convergence. These
because the feature development depends on GOOSE requirements can be overcome only by the enhancement of
interpretation, but broadcast domain limitation is not Ethernet with special technologies and devices. Analysis and
obviously the main problem in implementation. project design has to take these factors into account.
C. Time synchronization VII. SAS PROJECT IN THE CZECH REPUBLIC
Time synchronization is an important part of IEC 61850 The goal of the Substation Automation System project
standard and helps to ensure the system homogeneity and is to create centralized and interconnected solution within
action validity. Communication profile is used for relation in next two years. Finally ČEPS and dedicated suppliers, like
conjunction with IEC 61850 8 1 and specifies objects that ABB or SIEMENS, will be able to connect even with the
contains TIME attribute. Special GPS modules with substation devices via modern IP networks, internet and
horizontal communication capability are used. WAN technologies. This solution opens many questions in
D. Horizontal and vertical comunication security area, data encapsulation techniques, modification of
MPLS WAN network or internal substation topology
The internal topological model separates the proposal. Following chapters describe the limitation and
communication in horizontal and vertical level, as we proposed solution which has recently reached the test phase.
mentioned above. Horizontal communication ensures the
critically important connection between each IEDs A. Internal SAS communication level
(Intelligent Electronic Devices). From a computer Internal substation topology should be designed
networking point of view it is possible to use serial links or according to the IEC 61850 requirements described
direct encapsulation of Generic Object Oriented Substation in chapter 2.1. Proposed topology utilizes Ethernet as a main
Events into Ethernet frames. Serial lines are sometimes transport technology instead of serial lines, because IP
offered as a better solution, because of their advantages in networks allow more possibilities for substation integration.
direct communication, accessing methods, signalling and To overcome the limitation of NBMA network type it is
finally for security reasons. Big advantage of traditional recommended [7], [13], [14] to use IEC 61850 certified
network utilization in industrial communication purposes devices which help to overcome Ethernet limitation with
are: enhanced features.
 Sharing network resources
 Lower the financial costs  Faster spanning tree algorithm calculation
 Faster development of networking technologies  Optical/metallic links support
 Creating complex SAS project over internetworks  802.1q VLAN optical rings support
 Remote access capabilities  GVRP (Generic Attribute Registration Protocol)
 Upper layer segmentation
On the other hand, IP networks, respectively, Ethernet  QoS engine with L2 layer support
technologies utilization comes with many limits for IEC  L2/L3 Security integration
61850 and therefore usually serial links are recommended  IGM snooping and enhanced L2 multicast features
rather than Ethernet. NBMA (Non-Broadcast Multiple
Access) networks were not built for the communication
High availability of the automation system ensures
sensitive on delivery order, reliability, constant throughput or
doubled optical rings connected in high capacity switches
quality of services. In case of data modulation in Ethernet
(Ruggedcom 9100). Data, objects and messages are
frames, it is necessary to grant high quality connection and to
replicated between two heads of the control system. The connecting to the heads of SAS etc. Downrec is a computer
main asset of this approach is a system protected against device, controlled by a vendor, with a special control
Ethernet broadcast storms with fast convergence time (less software on the border between substation and WAN part of
than 6 ms against seconds measured in standard RSTP+ the ČEPS networks. One the most important goals of this
protocol implementations). Token GOOSE messages are gateway are to manage and filter traffic in both directions
controlled by L2 filters and logically interpreted by IED and to apply the security rules. Tunnelling techniques help to
devices. The topology was created with the effort to isolate the traffic between the core of the ČEPS network and
correspond with wide IEEE recommendation for industrial vendor internal networks. Another respected requirement is
automation (IEEE 1613 level 2, IEC 61850-3, IEC 61800- to get the possibility to use the same logical addressing
3, IEC 61000-6-2, NEMA TS-2). scheme in every substation and therefore this device must be
able to perform L3 operation.
B. External connections to SAS
The external connection to substation automation system C. Remote access and substation interconnection
serves the access to merge units, legacy IED devices, Remote access and substation interconnection open many
gathering statistical data or system management. These security threats. A successful project requires a reliable and
connections can be divided into three parts: secure system with the ability to account, authentic, authorise
and monitor the network activity. Every connection to the
 Access to dispatching centres substation passes through the ČEPS WAN network. In this
 Intra-substation communication scenario, vendors, local ČEPS and substation networks are
 Remote connection to WAN or internet connected together. Communication line violation, listening
or DoS attack are pending in transparent networks. Therefore
Dispatching centre accesses via serial line encapsulation it is necessary to isolate this communication in network.
in to IP datagrams over physical or virtual lines defined in Isolation on physical level is rather expensive and in this
IEC 60870-5-101 industrial standard for data exchange. The case an impossible solution, because of the distance between
communication within substation includes the substation substations. Virtual private networks are able to encrypt and
operators and parameterization department access. isolate data.
Demarcation point in these two types of communication lies
on the head of automation system. From the security point of
view, this might be a bottle neck of network.
Future development and integration with IP networks
needs to change this communication means. The first part of
the project includes a brand new connection for the third
communication type. Remote connection to WAN or internet
is used for accounting systems, control and other internal
proposes. External access to the IED devices, sensors or head
of the substation systems needs to be taken under control and
secured. To solve this problem, we offer to use a gateway
located on the substation level with the following features
and configuration.
Figure 6. Remote access topology

Proposed network topology is secured in a multilevel

way. External communication to substation has to pass
CISCO ASA (Advance Security Appliance) connected in
failover cluster for high availability solution. This device
checks the incoming traffic, the filter against access list,
allows to set rules and connects to the AAA system
mentioned above. This rule is applied for each type of
external communication. The access from internet, WAN or
other systems is deeply monitored against viruses, hacking
patterns and mirrored. In the next step, data flow is encrypted
and routed via OSPF protocol, for internet access packets are
translated via NAT mechanism. MPLS networks and
Figure 5. Substation topology control room
firewalls over the rest of the network are allowed to open IPS
tunnels authentication process and data flow only.
There are two types of communication in IEC 61850,
Each substation is connected (also their substation buses)
horizontal and vertical. The first one is encapsulated directly
via gateways with NAT, IPSEC, FIREWALL features. The
into the frames and strongly influenced by the network
gateway creates the border between partial SAS automation
quality. The second one is transported by upper layers of
system and external connection. This place applies further
TCP/IP model and it is used for IED device management,
 security activities like data decryption, rules for vendors, REFERENCES
NAT mappings and many others. Network monitoring and
proactive reaction to security threats became necessary part [1] DAVID, A. K; WEN, F Market Power in Electricity
of the security solution [15]. IDS (Intrusion detection Supply. In Power Engineering Review, IEEE . Volume: 21:
system) monitors network activities for malicious activities Issue:12 , 2001. p. 67 - 68.
or policy violations and process the output to the dispatching <http://ieeexplore.ieee.org/xpl/freeabs_all.jsp?arnumber=431
centre. IPS (Intrusion prevention system) than performs 1230>. ISSN 0272-1724.
reactions to security threats detected by the IDS system. [2] SHIRMOHAMMADI, D, et al Distribution automation
system with real-time analysis tools. In Computer
Security Appliance with IDS/IPS capatibilites will be Applications in Power, IEEE . Volume: 9 : Issue: 2, 1996. p.
located in the ČEPS network core, because this point is the 31 - 35 .
last place before data are encrypted in IPSEC tunnels. This <http://ieeexplore.ieee.org/xpl/freeabs_all.jsp?arnumber=491
device will be responsible for acquiring and recording the 517>. ISSN 0895-0156.
information about network utilization. Traffic can be [3] ZHANG, Jianqing ; GUNTER, Carl A. . IEC 61850 -
forwarded to the free SPAN port of IPSEC-VPN Communication Networks and Systems in Substations:An
Overview of Computer Science. University of Illinois at
concentrator and connected to the monitoring server. High Urbana-Champaign 2007.
availability purpose request more than two ASA device <http://seclab.uiuc.edu/docs/iec61850-intro.pdf>.
connected and configured as a failover cluster. [4] BRUNNER, C IEC 61850 for power system
Remote access from internet allows operators outside the communication. In Transmission and Distribution Conference
company or suppliers networks to connect in the substation. and Exposition. 2008. p. 1 - 6 . ISBN 978-1-4244-1903-6.
SAS project will be examined according to security [5] YONGLI, Zhu, et al Study on interoperable exchange of
standards such as ITSEC or FIPS. Remote networking IEC 61850 data model. In Industrial Electronics and
Applications, 2009. ICIEA 2009. 4th IEEE Conference on.
software and Cisco security appliances are FIPS 140-2 [s.l.] : [s.n.], 2009. s. 2724-2728. ISBN 978-1-4244-2799-4.
certified. The user with remote software connects to [6] Statistical Year Book 2008. 1. Regional Group
IPSEC/VPN concentrator witch filters this traffic and checks Continental Europe ( former UCTE ) : Entsoe, 2008.
the traffic against viruses, malware or potential attacks using <https://www.entsoe.eu/fileadmin/user_upload/_library/publi
signatures, antiviruses and heuristic techniques. All devices cations/ce/Statistical_Yearbook_2008.pdf>.
or security solutions implemented in the SAS project are [7] ZHANG, Jianqing ; GUNTER, Carl A. . IEC 61850 -
certified by security standard FIPS 140 1 or 140-2. Different Communication Networks and Systems in Substations:An
parts of the system require different security levels defined Overview of Computer Science.
by FIPS. [8] IEC 61850-8-1 Ed. 1.0 en:2004, Communication
networks and systems in substations - Part 8-1: Specific
Communication Service Mapping (SCSM) - Mappings to
VIII. CONCLUSIONS 9506-1 and ISO 9506-2) and to ISO/IEC 8802-3, ANSI, 2007
The present paper has analyses and compared approaches [9] IEC 61850-7-2 Ed. 1.0 en:2003, Communication
to data communication among the abovementioned protocols networks and systems in substations - Part 7-2: Basic
with the main focus on modern standard IEC61850. The communication structure for substation and feeder equipment
communication service interface (ACSI), ANSI, 2007
results indicate that remote access to substation automation
[10] IEC 61850-7-1 Ed. 1.0 en:2003, Communication
in power industry can be performed in a different ways. networks and systems in substations - Part 7-1: Basic
Previous standards like Modbus, DNP3 or IEC 608750-5- communication structure for substation and feeder equipment
101 have limited options of use. IEC 61850 area covers a - Principles and models, ANSI, 2007
wide range of problems, solutions and technologies; [11] IEC 61850-7-3 Ed. 1.0 en:2003, Communication
therefore it is complicated to design. Every project may networks and systems in substations - Part 7-3: Basic
significantly differ. The IEC 61850 standardization does not communication structure for substation and feeder equipment
- Common data classes, ANSI, 2007
offer any method or step by step procedure. Standardization
[12] IEC 61850-7-4 Ed. 1.0 en:2003, Communication
is relatively free and open to modifications. IEC61850 networks and systems in substations - Part 7-4: Basic
standardizes object definition, communication technologies communication structure for substation and feeder equipment
and requirements. Many settings, such as GOOSE messages, logical node classes and data classes, ANSI, 2007
TCP ports settings etc. act as recommendations for system [13] Odom W., Hucaby D., Wallece K, CCNP Routing and
designers. Switching Official Certification Library, Cisco Press, 2010,
ISBN: 978-1587202247
ACKNOWLEDGMENT [14] [14] COLE, Robert G. ; RAMASWAMY, Ravi . Wide-
Area Data Network Performance Engineering. 1. Boston :
This work and contribution is supported by the project of Artech House Publishers, 1999. ISBN 978-0890065693.
Specific Science – Analysis of communication protocols and .
resources in system automation, Faculty of informatics and
management.

View publication stats