Protective relays separate what each user can do into levels or roles: reading metering and events, operating the breaker or resetting targets, and changing settings or the configuration. Each level has its own password or account. Default passwords are public in the manuals and must be changed when the relay is placed in service. IEEE 1686 and IEC 62351-8 describe what that access control should look like.
What access levels are for
From its display, its front port or the network, a protective relay lets you do things with very different consequences: read a measurement, open a breaker or change a protection setting. Access levels exist so that each action is done only by whoever should do it, whether at the relay front panel or when connecting with the software:
| Typical level | What it allows | Who uses it |
|---|---|---|
| Read | Metering, status, events, oscillography, settings in read-only mode | Operations, maintenance, analysis |
| Operate | Open and close, reset targets and lockout, change the settings group on some devices | Authorized operations staff |
| Settings and configuration | Change protection settings, logic, communications and ports | Protection engineering |
| Administration | Accounts, passwords, firmware and security | Whoever is responsible for system security |
Each manufacturer names and groups them in its own way:
- SEL uses numbered access levels, each with its own password: the read level, the settings level and, depending on the model, intermediate levels for operation or for particular kinds of settings.
- Schneider MiCOM Px4x uses levels 0, 1 and 2. Level 0 is read only; level 1 gives some write permissions and level 2 all of them. Schneider documents that password control ships at level 2 for all users and recommends changing it to 0, so that writing requires a password.
- Siemens SIPROTEC 5, Hitachi Energy Relion and GE Vernova Multilin work, in their recent generations, with user accounts and roles, plus centralized authentication as an option depending on the model.
These levels apply per port: the front display, the engineering port and the network can have different permissions. A relay with a well-protected network and an open front port is still exposed to anyone who reaches the panel.
Why change default passwords
Default passwords are in the manuals, which are public. A relay that keeps its default password, or that ships without asking for one, has no access control in practice. The risks are not only cyberattacks:
- Unauthorized settings changes by well-meaning staff who do not know the study.
- Switching from the relay by someone without operating permission.
- No traceability: if everyone uses the same password, the relay log does not show who made the change.
Changing them is part of commissioning. When the relay is handed over, the new passwords go into the owner’s password manager, never into the printed test report or onto a label on the panel. In North America, NERC CIP-007 also requires known default passwords to be changed on the cyber assets it covers.
What IEEE 1686 and IEC 62351-8 say
- IEEE 1686-2022 defines the cybersecurity functions an intelligent electronic device must provide: access control, operation, configuration, firmware revision and data retrieval, with an audit trail and alarms. It is used to specify and compare devices. We explain it in IEEE 1686: IED cybersecurity requirements.
- IEC 62351-8 defines role-based access control (RBAC) for power systems: permissions are assigned to roles and roles to people, instead of sharing one password per level. See IEC 62351: cybersecurity for IEC 61850, 104 and DNP3.
- IEC 62443-4-2 sets the technical security requirements for automation components, including user identification and authentication; we cover it in IEC 62443 in substations.
Good management practice
In general terms, a relay access policy covers:
- A different password per level, and, if the relay allows it, one account per person.
- Passwords in a manager controlled by the owner, with logged access.
- Unused ports disabled, and unnecessary network services turned off.
- An alarm to SCADA for failed attempts or settings changes, when the relay offers one.
- Resetting after a trip with the level that belongs to operations, without sharing the settings level; see resetting a relay after a trip.
- Periodic review: passwords of staff who no longer work at the site, temporary contractor accounts.
- Remote access only through the site’s secure architecture; see secure remote access to relays and substations.
What is verified at commissioning
During relay commissioning, access security is tested like any other function. In general terms, the checks are that each level asks for its password on each port, that the default passwords no longer work, that unused ports and services are disabled, that the relay log records access and changes, and that the security alarms reach SCADA. The result goes into the test report, without writing down the passwords.
If a password is lost
- Is it in the commissioning files or in the owner's password manager?
- YesUse it, change it if it was shared and record it again
- NoIs the missing level only settings or administration?
- YesThe relay keeps protecting; plan the reset with the manufacturer's procedure
- No, there is no read access eitherPlan the reset anyway; meanwhile, events can be retrieved through SCADA or the fault recorder if they exist
The reset is defined by each manufacturer. On many devices it requires physical presence at the relay, sometimes taking it out of service, and on others the manufacturer’s support with the serial number. There are no safe shortcuts: any method that bypasses the password without the manufacturer’s procedure puts the settings and the warranty at risk. Treat it as an intervention in the bay, with the backup protection verified and the bay isolated for testing if needed.
After the reset, read the settings and compare them with the last approved file before returning to service: some procedures return the relay to factory values.
How we can help with access to your relays
At Tiza Group we configure relays of the main brands remotely, including accounts, access levels, ports and security alarms, within your company’s policy. See remote relay configuration. If your site needs to review the security of the whole protection and control network, our communications engineering covers it.
Related guides
- IEEE 1686: IED cybersecurity requirements
- IEC 62351: cybersecurity for IEC 61850, 104 and DNP3
- Secure remote access to relays and substations
- Is remote relay configuration secure?
- Protective relays: types, functions and maintenance
- Relay configuration software by brand
References
- IEEE 1686-2022, Standard for Intelligent Electronic Devices Cyber Security Capabilities. https://standards.ieee.org/ieee/1686/5321/
- IEC 62351-8, Role-based access control for power system management.
- IEC 62443-4-2:2019, Technical security requirements for IACS components.
- NERC CIP-007, Cyber Security – System Security Management.
- Schneider Electric, FAQ FA180139, password levels of MiCOM Px4x relays. https://www.se.com/us/en/faqs/FA180139/
- SEL, Siemens, Hitachi Energy and GE Vernova instruction manuals, security and access sections.
Frequently asked questions
Where do I find my relay's default password?
It is in the manufacturer's instruction manual, in the security or access section. We do not publish it here because it is precisely the one that should no longer work in an in-service relay. If your relay still accepts it, change it and record the new one in your company's password manager.
What do I do if nobody knows the relay password?
First look in the commissioning files and in the owner's password manager. If it is not there, follow the manufacturer's procedure to restore access; on many devices it requires physical presence, taking the relay out of service or support from the manufacturer. Plan it as an intervention in the bay, with backup protection in place.
Is one password per level enough to meet IEEE 1686?
IEEE 1686 describes the security capabilities the device must offer, such as accounts, access control, an audit trail and alarms. Compliance depends on what the relay offers and how it is used: passwords shared by all staff or never changed give no traceability even if the relay has levels.