IEC 61850 Substation Automation: GOOSE, MMS, Sampled Values (2026)

IEC 61850 substation automation is no longer a transitional protocol stack — by 2026 it is the only architecture that utilities, OEMs, and DER aggregators specify for new high-voltage substations. The standard’s three communication services — Manufacturing Message Specification (MMS) for client-server reporting, Generic Object Oriented Substation Event (GOOSE) for sub-4 ms peer-to-peer trips, and Sampled Values (SV) 9-2LE for digitized CT/VT data — replaced 60 years of hard-wired copper and incompatible serial protocols. This deep-dive walks through the architecture every protection engineer and OT-network designer needs to understand: the three-bus reference design, the logical object model (Logical Devices, Logical Nodes, Data Objects), the protocol stack mapping, PRP/HSR vs TSN redundancy, the SCL engineering workflow (ICD/SSD/SCD/CID), IEEE 1588 PTPv2 time sync, IEC 62351 cybersecurity, and what changes when virtual IEDs and TSN converge inside digital substations. Real Logical Node names, real GOOSE/SV frame fields, real timing budgets — no marketing.

Architecture at a glance

Why IEC 61850 displaced legacy substation protocols

IEC 61850 won because it replaced device-specific point lists with a self-describing, object-oriented data model that is the same across every conformant Intelligent Electronic Device (IED). A single configuration file (SCD) describes every signal in the substation; a single IED can publish a GOOSE trip in under 4 ms and stream 4 kHz Sampled Values from a Merging Unit to a protection relay over the same Ethernet.

The standard was developed by IEC TC 57 working groups WG10/11/12, with the original ten-part Edition 1 released in 2003. Edition 2 (2011) added engineering improvements, GOOSE retransmission rules, and the 9-2LE light-edition profile. Edition 2.1 (published 2020 across parts 8-1, 9-2, 6, 7-x) tightened SCL versioning, added IEC 62351-6 security hooks, and clarified subscriber-supervision (LGOS, LSVS logical nodes). The active extensions in the IEC 61850-90-x series now cover DER (90-7), hydropower (90-3), wind (90-25 / IEC 61400-25 bridge), EV charging (90-8), and substation-to-substation tunneling (90-1) — which is why every modern DERMS, microgrid controller, and EV-fleet aggregator is converging on the same logical-node vocabulary.

Before IEC 61850, a typical 230 kV substation used IEC 60870-5-101/103/104, DNP3, Modbus, plus vendor-proprietary trip wiring — a 200-bay station could have 80 km of copper between marshalling kiosks and the control room. Sampled Values plus GOOSE allowed that copper to be replaced with two fibre rings carrying multicast Ethernet frames. The capex savings are real but secondary; the operational win is that the same SCL file documents every signal, eliminating the cost-and-error swamp of vendor-specific point lists.

The three-bus reference architecture

A modern IEC 61850 substation is structured around three Ethernet buses: a Process Bus connecting Merging Units and switchgear sensors to bay-level Protection IEDs, a Station Bus connecting IEDs to the Human-Machine Interface (HMI), substation gateway, and engineering workstations, and an inter-substation bus (IEC 61850-90-1) for tele-protection and wide-area schemes. Each bus has different latency, bandwidth, and redundancy requirements.

The Process Bus carries the heaviest, most timing-sensitive traffic: Sampled Values at 80 samples/cycle (4 kHz at 50 Hz) or 256 samples/cycle (12.8 kHz) for protection and power-quality use cases, plus GOOSE trip and interlock messages. Bandwidth per Merging Unit is roughly 5–6 Mbit/s for one 9-2LE stream and the SV multicast is sent every 250 µs at 4 kHz — meaning any switch in the path must forward those frames deterministically. This is the bus where PRP, HSR, or TSN earns its keep.

The Station Bus carries MMS reports, file transfers (disturbance recordings, IEC 61850-90-3 condition data), SNTP/PTP, and slower GOOSE (interlocking, position indications, alarm pickups). It tolerates jitter measured in tens of milliseconds and typically runs on a redundant Layer-2 ring or a PRP LAN-A/LAN-B pair.

The inter-substation bus uses tunnelled R-GOOSE and R-Sampled-Values (IEC 61850-90-5) over routed IP, often MPLS or carrier-grade IP/MPLS — required for line differential protection, system integrity protection schemes (SIPS), and wide-area damping control where one substation’s bay must publish to relays at sites 50–500 km away.

The logical model: LDs, LNs, DOs, DAs

IEC 61850 models a substation as a hierarchy of self-describing objects. An IED contains one or more Logical Devices (LD); each Logical Device contains Logical Nodes (LN); each LN contains Data Objects (DO); each DO contains Data Attributes (DA). The LN catalogue in IEC 61850-7-4 defines roughly 90 standardized function classes, named with four-letter codes whose first letter signals the function group: P for protection, X for switchgear, M for metering, C for control, G for generic, L for system, R for related-to-protection.

A line-protection IED for a 230 kV transmission line typically contains:

• PTOC — Time-overcurrent protection (51/51N), with DOs Op (operate), Str (start/pickup), and TmACrv (time-current curve parameters).
• PDIS — Distance protection (21), with zone-specific DOs Op.phsA/B/C, Str.dirGeneral.
• PDIF — Differential protection (87L), instantiated separately for line, transformer, or busbar.
• RBRF — Breaker failure (50BF) — publishes a re-trip GOOSE if breaker auxiliary contact does not clear within the breaker-failure timer.
• XCBR — Circuit breaker switch object, DO Pos.stVal (position status) and OpCnt (operations counter).
• CSWI — Switch controller, the command target for Oper.ctlVal (select-before-operate / direct-operate).
• MMXU — Three-phase measurement (V, I, P, Q, frequency).
• LPHD — Physical device, holds DO PhyHealth.
• LLN0 — Logical Node Zero, holds dataset definitions, control blocks (BRCB, URCB, GoCB, MSVCB), and the Mode/Behavior DOs.

A complete object reference looks like IED1Relay/PROT1.PTOC1.Op.general — IED1Relay is the LD, PROT1 the prefix, PTOC1 the LN instance, Op the DO, general the DA. That string is exactly what the MMS client requests, what the SCL file describes, and what the GOOSE dataset carries.

The discipline this imposes is the standard’s quietest superpower. Two IEDs from different vendors can be interchanged because both expose PTOC.Op.general rather than vendor-specific register addresses. The cost is a steeper learning curve — protection engineers must think in objects, not coils.

Communication services: MMS, GOOSE, Sampled Values

IEC 61850 maps its three application-layer services onto different transport stacks chosen for the latency requirement of each service. MMS uses TCP/IP for reliable client-server interaction; GOOSE and SV use raw Layer-2 multicast Ethernet (Ethertypes 0x88B8 and 0x88BA) to bypass the IP stack entirely; routable variants R-GOOSE and R-SV (90-5) use UDP for inter-substation transport.

MMS — the client-server backbone

MMS (Manufacturing Message Specification, ISO/IEC 9506) is the heaviest of the three services. It runs over an ISO upper-stack (ACSE / Presentation / Session) on top of TCP/IP. MMS handles:

• Reading values (GetDataValues, GetDataSetValues).
• Writing setpoints (SetDataValues) — typically wrapped in select-before-operate.
• Reporting — the IED’s URCB (unbuffered) or BRCB (buffered) Report Control Block pushes a dataset on configured trigger options (dchg, qchg, dupd, integrity period).
• File services — fetch COMTRADE disturbance records, transfer SCL/CID files.
• Log services, control services, time sync (when not using PTP).

Typical end-to-end MMS report latency for a Class T1 event is 10–100 ms — adequate for SCADA telemetry but never used for tripping.

GOOSE — sub-4 ms peer-to-peer events

GOOSE is the headline IEC 61850 service. It is a multicast Layer-2 publish-subscribe protocol with retransmission. The publisher allocates a Multicast MAC address (range 01:0C:CD:01:00:00–01:0C:CD:01:01:FF), an APPID (16-bit, 0x0000–0x3FFF), VLAN tag (802.1Q) and priority (802.1p, typically 4), and emits a dataset whenever any member changes value. The standard frame fields include gocbRef, timeAllowedToLive, datSet, goID, t (UTC timestamp), stNum (state number — increments on event), sqNum (sequence — resets to 0 on event, increments on retransmit), test, confRev, ndsCom, and the allData array.

The retransmission discipline is what gives GOOSE its 4 ms target: on a state change the publisher sends the frame, then re-sends at T1 (typically 1 ms), T1*2, T1*4, … up to a steady-state interval T0 (commonly 1 s or 5 s) used for heartbeat. Subscribers detect a stuck publisher when (time - t) > timeAllowedToLive and assert LGOS.St = false to flag a subscription failure.

Performance class P1 (distribution) targets 10 ms total transfer; P2/P3 (transmission and busbar protection) target 3 ms total, of which the published-to-received GOOSE budget is typically 4 ms wall-clock under IEC 61850-5 Section 13 performance classes.

A working example of a GOOSE Control Block in SCL:

<GSEControl name="gcbTrip" datSet="dsTripA" confRev="1"
            type="GOOSE" appID="LineProt1/PROT1/gcbTrip"
            fixedOffs="false">
  <IEDName>BAYCTL_A</IEDName>
  <IEDName>BAYCTL_B</IEDName>
</GSEControl>
<DataSet name="dsTripA">
  <FCDA ldInst="PROT1" prefix="" lnClass="PTOC" lnInst="1" doName="Op"  daName="general" fc="ST"/>
  <FCDA ldInst="PROT1" prefix="" lnClass="PTOC" lnInst="1" doName="Op"  daName="q"       fc="ST"/>
  <FCDA ldInst="PROT1" prefix="" lnClass="PDIS" lnInst="1" doName="Op"  daName="general" fc="ST"/>
  <FCDA ldInst="PROT1" prefix="" lnClass="RBRF" lnInst="1" doName="OpEx" daName="general" fc="ST"/>
</DataSet>

Sampled Values — digitizing CTs and VTs

Sampled Values replaces analog 1 A / 5 A copper from current transformers and 110 V copper from voltage transformers with a digitized multicast Ethernet stream. The dominant profile in service is the UCAIug Implementation Agreement for IEC 61850-9-2 (9-2LE), which constrains sampling to 80 samples/cycle (4 kHz at 50 Hz, 4.8 kHz at 60 Hz) for protection and 256 samples/cycle (12.8 kHz / 15.36 kHz) for power-quality / metering. Each Sampled Value frame is an ASDU containing svID, smpCnt (rolls over at 4000/4800), confRev, smpSynch (0 = no sync, 1 = local, 2 = global PTP), and an INT32U payload of phase + neutral current and voltage samples.

The timing requirement is the hard part. A Merging Unit must publish one ASDU per sample period — 250 µs at 4 kHz. Any switch hop must forward the frame in under 10 µs with zero loss. Protection IEDs need PTPv2 time sync to ±1 µs (IEEE C37.238 Power Utility Profile) to correctly align samples from multiple MUs for differential, distance, and busbar protection.

The GOOSE trip sequence — what actually happens in 4 ms

A trip event in a digital substation is choreographed across four devices: the Merging Unit publishes sampled currents, the protection IED detects the fault and publishes a GOOSE trip, the bay controller receives the trip and commands the breaker via a second GOOSE, and the breaker’s auxiliary contact confirms with a position GOOSE. Each hop is multicast Ethernet at priority 4, VLAN-tagged, and forwarded with strict-priority queuing.

Time budget for a transmission-class P2/P3 trip on a 50 Hz system:

• 0.0 ms — primary fault current rises (CT secondary follows).
• 0.0–0.25 ms — Merging Unit ADC samples and publishes one SV frame.
• 8–20 ms — Protection IED’s PTOC/PDIS algorithm pickups (typically half-cycle to one cycle).
• +0.5–2 ms — IED publishes GOOSE trip; bay controller receives.
• +0.5–1 ms — bay controller emits GOOSE breaker-open command.
• +30–60 ms — circuit breaker mechanically opens (this is the dominant delay and is mechanical, not network).

The IEC 61850 network budget — Merging Unit publish to breaker-control IED receive — is 4 ms. If you blow that budget the failure mode is brutal: missed half-cycle of fault clearance equates to roughly 20 ms more arc energy, often the difference between a clean clear and equipment damage. This is why the Process Bus is engineered for hard real-time, not best-effort.

SCL — the engineering workflow nobody warns you about

Substation Configuration Language (SCL) is the XML-based engineering vocabulary defined in IEC 61850-6 that ties the entire system together. Four file types exist: ICD (IED Capability Description, what the device can do, shipped by vendor), SSD (System Specification Description, the utility’s single-line and function allocation), SCD (Substation Configuration Description, the complete substation), and CID (Configured IED Description, the per-IED filtered config that is loaded onto the device).

The workflow runs left-to-right:

1. Specify — the utility produces an SSD describing the single-line, the LNs required per bay, the protection schemes (distance, differential, busbar, breaker failure), and the inter-bay GOOSE signal list.
2. Procure — each vendor delivers an ICD per IED model, declaring supported LNs, datasets, control blocks, and communication parameters.
3. Engineer — a System Configuration Tool (SCT) — typically vendor-neutral software such as Helinks STS, OMICRON IEDScout, or SISCO AX-S4 — merges the ICDs into the SSD. The engineer allocates LNs to physical IEDs, defines DataSet entries, instantiates GSEControl and SampledValueControl blocks, assigns multicast MACs/APPIDs/VLANs, sets IP addresses, and connects publishers to subscribers via the SCL <Inputs> element. The output is the SCD.
4. Configure — the IED Configurator Tool (often vendor-specific) reads the SCD, extracts the IED’s slice into a CID, and downloads it to the device.
5. Test — IEC 61850-10 conformance test plus utility-specific FAT/SAT, often automated by tools that replay GOOSE/SV streams and assert subscriber behavior.

The trap is that not all “neutral” tools faithfully round-trip foreign vendors’ SCL. Edition 2.1 tightened SCL namespaces, the <Private> element handling, and version negotiation, but you must validate SCL with a separate tool (the IEC 61850 Conformance Testing tool from UCAIug, or open-source SCL validators) before committing.

Network design: PRP, HSR, and the TSN transition

A digital substation cannot tolerate even a single dropped Sampled Values frame on the Process Bus. IEC 62439-3 defines two zero-recovery-time redundancy mechanisms — Parallel Redundancy Protocol (PRP, Clause 4) and High-availability Seamless Redundancy (HSR, Clause 5) — and Time-Sensitive Networking (TSN, IEEE 802.1) is the 2026 replacement that converges PRP, HSR, and bandwidth scheduling into one standardized stack.

PRP — duplicated frames over independent LANs

A PRP node (Doubly Attached Node for PRP, DANP) duplicates every Ethernet frame and sends one copy on LAN A and one on LAN B, which are physically separate switch fabrics. The receiver discards the duplicate using a Redundancy Control Trailer (RCT) appended after the payload. Recovery time on a switch or cable failure is 0 — neither copy was needed simultaneously. PRP is the dominant Process-Bus design today because the two LANs can be built from any standard managed switch.

HSR — ring with self-discard

HSR connects DANH nodes in a ring; each frame is sent in both directions and the originator (or any node receiving its own frame back) discards the duplicate. HSR halves the switch count vs PRP but every node is in the forwarding path, so latency grows linearly with ring length — typical limit is 50 nodes for sub-1 ms ring traversal.

TSN — scheduled Ethernet

IEEE TSN is the long-term replacement. The relevant standards bundle: 802.1AS-Rev for time sync (a PTPv2 profile that survives grandmaster failover), 802.1Qbv for time-aware scheduling (gate-controlled queues so SV and GOOSE get guaranteed transmission windows), 802.1CB for Frame Replication and Elimination for Reliability (the PRP/HSR replacement, now standardized across vendors), and 802.1Qci for ingress policing. TSN-capable switches from Siemens RUGGEDCOM, Cisco IE-4010, Hirschmann Bobcat, and Belden GarrettCom are in production substations as of 2025. The migration story is incremental — you can run PRP and TSN side-by-side, then collapse onto TSN once every IED and MU supports it.

Time synchronization: PTP and the C37.238 profile

Sampled Values protection requires sub-microsecond time alignment across every Merging Unit feeding the same protection function. The standard is IEEE 1588-2008 (PTPv2) with the IEEE C37.238 Power Utility Profile, which fixes domain number, message rates, and announcement intervals so any conformant grandmaster talks to any conformant slave.

A typical deployment uses two redundant grandmasters (GNSS-disciplined oscillators with holdover via Rubidium or OCXO), feeding a Best Master Clock Algorithm (BMCA) election across PTP-aware switches running E2E or P2P transparent-clock mode. Holdover specs are critical: a Stratum-1 rubidium holds 1 µs for >24 hours after losing GNSS, while a TCXO-based grandmaster loses 1 µs in minutes. Many utilities lost SV-based protection during the 2023–2024 GPS-jamming incidents in Northern Europe and the Middle East — the lesson hardened holdover requirements in current IEC 61850-9-3 PTP power-profile updates.

If you cannot guarantee ±1 µs at the protection IED, do not use Sampled Values for that protection function — fall back to conventional CT/VT wiring or accept reduced protection performance. There is no graceful degradation in SV-based differential protection when time-sync fails; samples align wrongly and the algorithm sees spurious differential current.

Cybersecurity: IEC 62351 and R-GOOSE

IEC 61850 was designed in an air-gapped era. Cybersecurity is bolted on through the IEC 62351 series, which adds authentication and encryption to each IEC 61850 service. The relevant parts:

• IEC 62351-3 — TLS for MMS over TCP. Mandates TLS 1.2+ with mutual certificate authentication.
• IEC 62351-4 — Application-layer security for MMS (ACSE authentication).
• IEC 62351-6 — GOOSE and SV authentication via HMAC-SHA256 in the reserved-fields, optional AES-GCM encryption (Edition 2). The challenge is performance: signing every GOOSE frame within the 4 ms budget needs hardware acceleration; signing every SV ASDU at 4 kHz needs even more. Most utilities defer SV signing and rely on physical Process-Bus isolation.
• IEC 62351-8 — Role-Based Access Control (RBAC) profile, ties LDAP/Active Directory groups to IEC 61850 control rights.
• IEC 62351-9 — Key management.

R-GOOSE (routable GOOSE, defined in IEC 61850-90-5) wraps GOOSE in UDP/IP with IPsec or DTLS, used for inter-substation tele-protection where you cannot guarantee a Layer-2 path. The trade-off is added IP-stack jitter — typical R-GOOSE one-way budgets are 8–10 ms versus 4 ms for Layer-2 GOOSE.

Regulatory drivers in 2026 force the issue: NERC CIP-005-7 and CIP-007-6 in North America, NIS2 Directive in the EU, and BSI/ANSSI guidance in Germany/France now treat substation Ethernet as in-scope. New-build substations specify IEC 62351-6 GOOSE authentication and IEC 62351-3 MMS TLS by default.

For a deeper view of how cybersecurity and authentication are evolving across industrial protocols, the OPC UA FX field-level communications analysis covers parallel patterns for the factory floor.

Interoperability: the UCAIug conformance regime

Interoperability is not automatic. An IED that passes IEC 61850-10 conformance testing at one of the eight UCAIug-accredited test labs (KEMA, DNV, KERI, Xtra-Connect, ENTELEC, CESI, NIST/EPRI, SGEPRI) gets a “Level A” certificate identifying the supported edition, services, conformance blocks, and the engineering tool used. Practical multi-vendor system integration still requires interoperability testing — putting the actual IED models you bought into one lab and running the real SCD against them. Two Level-A devices can still fail to interoperate over a vendor-specific GOOSE dataset element ordering, an SCL <Private> extension, or a buggy MMS report format.

The UCAIug also publishes Implementation Agreements that fill standard gaps — 9-2LE is the most famous, but agreements exist for MMS reporting behavior, GOOSE timing, and SCL handling. Treat them as de-facto mandatory.

Trade-offs and failure modes — when not to use what

IEC 61850 is not a free lunch. The standard makes several uncomfortable trade-offs, and several deployment patterns regularly bite operators.

Engineering complexity. SCL workflows are not Modbus point lists. A 200-bay substation SCD can run 80–200 MB of XML; a single bad <Inputs> reference breaks one subscriber silently. Budget 30–40% more engineering hours than a legacy SAS for the first project, then 10–15% less from the third.

Process Bus operational risk. A single bad switch QoS configuration drops Sampled Values and disables protection. Many utilities still hard-wire critical trips in parallel as a fall-back during initial Process Bus deployments — accepting double the wiring for two to three years until operational confidence builds.

Time-sync brittleness. As covered above, lose PTP and lose SV-based protection. GNSS jamming, faulty grandmaster, mis-configured BMCA — all are recurring real incidents in 2024–2026. Two independent grandmasters with rubidium holdover are not optional.

GOOSE flooding. GOOSE frames are Layer-2 multicast and (without IGMP-snooping-equivalent on Layer-2 multicast or carefully tuned VLAN/MAC filtering) flood the entire broadcast domain. A handful of chatty IEDs can saturate a station bus. Use VLAN segregation and switch-level multicast filtering aggressively.

Cybersecurity gaps in legacy IEDs. IEC 62351-6 GOOSE authentication requires firmware support that pre-2018 IEDs do not have. Retrofitting a fleet to authenticated GOOSE often means replacing devices — a five-to-ten year capital programme.

Vendor lock-in via SCT. Despite the SCL standard, vendor-specific SCT tools subtly extend SCL with proprietary <Private> elements. The “vendor-neutral” engineering promise still requires discipline.

Wrong protocol for the job. GOOSE is not for SCADA-level state telemetry — use MMS reports. Sampled Values is not for slow metering — use MMS MMXU polling. R-GOOSE is not for sub-4 ms wide-area trips — the IP stack adds too much jitter. Wide-area sub-cycle requirements need PMU streaming under IEEE C37.118 instead.

Practical recommendations — a one-page checklist

For a 2026 IEC 61850 substation new-build or upgrade, the engineering and OT-network team should commit to the following non-negotiables:

• Specify Edition 2.1 as the procurement baseline; reject Edition 1-only IEDs.
• Adopt PRP on the Station Bus and either PRP or TSN (802.1CB + 802.1Qbv) on the Process Bus — never run unprotected Ethernet on the Process Bus.
• Standardise on PTPv2 IEEE C37.238 Power Utility Profile with two GNSS-disciplined grandmasters with rubidium holdover.
• Enforce 9-2LE SV streams at 80 samples/cycle for protection; 256 samples/cycle only where power-quality is required.
• Mandate IEC 62351-3 TLS for MMS and IEC 62351-6 HMAC for GOOSE on day one; defer SV signing only with documented risk acceptance.
• Choose a vendor-neutral System Configuration Tool and a separate SCL validator — never trust a single vendor’s round-trip.
• Require UCAIug Level-A conformance certificates for every IED model, plus a documented multi-vendor interoperability test on the actual procured fleet.
• Architect the Process Bus with VLAN segregation per bay, switch-level multicast filtering, and strict priority queuing for SV and GOOSE.
• Provision R-GOOSE with IPsec for any inter-substation scheme; document the latency budget against the protection requirement.
• Keep a dual-trip parallel hard-wired path for the first 1–2 years of Process Bus operation if this is the utility’s first digital substation.

For deterministic networking design choices that apply equally to substations and factory floors, the TSN vs 5G URLLC deterministic networking comparison is the natural follow-up.

FAQ

What is the difference between GOOSE, MMS, and Sampled Values?

GOOSE is a sub-4 ms Layer-2 multicast publish-subscribe protocol for fast peer-to-peer events such as protection trips and interlocks. MMS (Manufacturing Message Specification) is a slower client-server protocol over TCP/IP for SCADA-style reading, writing, and reporting. Sampled Values (SV / 9-2LE) digitizes CT and VT analog signals into multicast Ethernet frames at 4 kHz or 12.8 kHz, replacing copper wiring between switchyard sensors and protection relays.

How does IEC 61850 SCL engineering work?

SCL is an XML language with four file types. Vendors ship an ICD (IED Capability Description) per device; the utility writes an SSD (System Specification Description); a System Configuration Tool merges these into an SCD (Substation Configuration Description) that defines every IED, dataset, GOOSE/SV control block, and signal subscription; finally a per-IED CID (Configured IED Description) is extracted from the SCD and loaded onto each device. Edition 2.1 (2020) tightened namespaces and round-trip rules.

Is TSN replacing PRP and HSR in IEC 61850 substations?

Time-Sensitive Networking (IEEE 802.1) is the long-term Process Bus standard because it bundles deterministic scheduling (802.1Qbv), seamless redundancy (802.1CB Frame Replication and Elimination), and PTP time sync (802.1AS-Rev) into one standardized switch architecture. As of 2026, PRP remains the dominant deployed pattern, but new digital substations from Siemens, ABB, Hitachi Energy, and GE are specifying TSN-capable Process Bus switches with PRP as a transition fallback.

What time-sync accuracy does Sampled Values need?

Sampled Values protection requires ±1 microsecond time alignment across every Merging Unit feeding the same protection algorithm. This is delivered by IEEE 1588-2008 (PTPv2) with the IEEE C37.238 Power Utility Profile. Two redundant grandmasters, GNSS-disciplined with rubidium or OCXO holdover, plus PTP-aware transparent-clock switches, are the standard pattern. Losing PTP disables SV-based differential, distance, and busbar protection — there is no graceful degradation.

Does IEC 61850 work for DERs, EVs, and microgrids?

Yes — the IEC 61850-90-x extensions cover distributed energy resources (90-7), wind power (90-25 bridging IEC 61400-25), EV charging (90-8), and substation-to-substation tunnels (90-1). The same Logical Node vocabulary (DXCBR, ZBAT, ZGEN, MMXU) now appears in DER controllers, EV chargers, and microgrid controllers — which is why DERMS platforms increasingly speak IEC 61850 directly rather than translating from Modbus or DNP3.

Is IEC 61850 secure against the threats in 2026’s NIS2 and NERC CIP regimes?

The base standard is not — it was designed for air-gapped substations. IEC 62351 adds the security layer: TLS for MMS, HMAC-SHA256 for GOOSE, RBAC for control authorisation, key management. New-build substations under NERC CIP-005-7 / CIP-007-6 (North America) and NIS2 (EU) are specifying IEC 62351-3 and 62351-6 by default. Retrofitting older fleets to authenticated GOOSE typically requires IED replacement and is a multi-year capital programme.

Further reading

• Internal — pillar deep-dive on OPC UA FX field-level communications analysis for the parallel factory-automation thread.
• Internal — TSN vs 5G URLLC deterministic networking comparison for the network determinism trade-offs.
• Internal — Sparkplug B vs OPC UA PubSub comparison for adjacent publish-subscribe industrial protocols.
• External — IEC TC 57 (Power systems management and associated information exchange) — the standards body.
• External — UCAIug Implementation Agreement for 9-2LE (PDF) — the de-facto Sampled Values profile.
• External — IEC webstore for IEC 61850 series and IEC 62351 cybersecurity series.
• External — IEEE 1588-2019 PTPv2 and IEEE TSN Task Group.
• External — NERC CIP standards and EU NIS2 Directive.