So that the substation does not go blind after a failure, the link to the control center is duplicated at three levels: two gateways (hot standby or standby), two channels over different physical routes and, often, two control centers, main and backup. IEC 60870-5-104 organizes redundant connections in groups with a single active connection. The delicate part is the switchover: if it is not designed well, events are lost or duplicated.
Why duplicate the link
A substation that loses its link with the control center keeps operating: protection trips and local control works. But the system operator can no longer see it or control it. In transmission substations, the operator’s supervision requirements usually call for high link availability, and that is not achieved with a single device and a single channel.
Redundancy is built at three levels: the device that translates the data (the gateway or RTU), the communication channel and the control center.
Redundant gateways
There are two usual ways of duplicating the gateway:
- Hot standby. Both gateways are powered, connected to the IEDs and with an up-to-date database. One is active toward the control center and the other is ready to take over. The switchover is fast because the backup already has the substation state.
- Warm or cold standby. The backup is powered but not acquiring data, or it is off. On switchover it has to start, connect to the IEDs and rebuild the state, which takes longer.
In both cases a mechanism is needed to decide which one is active: a heartbeat between the two devices over a dedicated link, mutual supervision over the network or logic in the control center itself. The most serious design error is a configuration in which, when communication between the two gateways fails, both declare themselves active or neither does.
IEC 60870-5-104 redundancy groups
IEC 60870-5-104, in its edition 2 of 2006, has a chapter on redundant connections. It organizes them in redundancy groups: several TCP connections between one client (the control center) and its server (the gateway), of which only one is active and transfers data.
- The active connection is started with the STARTDT frame.
- The others stay established and stopped, and are supervised with TESTFR.
- If the active one fails, the client sends STARTDT over another connection of the group.
This mechanism covers redundancy of the channel and the network interface. If the server is also duplicated, each gateway can serve its own connection within the scheme, and coordination between them depends on the manufacturer.
With DNP3 (IEEE 1815), link redundancy is solved in practice by master and gateway logic, for example with alternate channels to the same outstation; how it switches over depends on each manufacturer and is verified during testing.
Two control centers
Many operators have a main control center and a backup one, in another city or another building. The substation must be able to report to both. There are two schemes:
- Both receive data all the time. Each center has its own connection or its own redundancy group. Commands are accepted only from the center that holds authority at that moment.
- Only the active one receives data. When operation moves to the backup, it activates its connection and interrogates the substation.
Command authority is handled carefully: two centers able to issue commands to the same device at the same time are an operational risk.
- 01Main and backup gatewayHot standby or standby, with mutual supervision
- 02Two channels over different routesOwn fiber, carrier network, radio or cellular, with no common sections
- 03IEC 104 redundancy groupOne active connection per control center, the others supervised
- 04Main and backup centerOnly one with command authority at a time
Channels over different routes
Two channels that share a section are not redundant. Typical common-mode failures:
- Both channels run in the same OPGW cable or the same duct into the substation.
- Both use the same multiplexer, the same router or the same power supply.
- The backup radio or cellular channel depends on the same tower or provider as the main one.
The design reviews the full path of each channel, from the gateway port to the control center, and looks for any shared element. The wide area network engineering guideline IEC TR 61850-90-12 treats redundancy between substation and control center as one of its topics.
What happens during the switchover
The switchover is the delicate moment. What can go wrong:
- Lost events. The outgoing gateway had events in its buffer that it did not manage to send, and the incoming one does not know them.
- Duplicated events. The new gateway resends events that the control center had already confirmed to the previous one.
- Stale states. If the backup gateway was in cold standby, it presents old values until it reads the IEDs.
- Commands in progress. A select-before-operate started with one gateway does not complete with the other.
That is why the control center usually runs a general interrogation after each switchover, and the redundancy test includes counting events on both sides. If the link drops repeatedly without switching over properly, the diagnosis is in DNP3 or IEC 104 link that keeps dropping.
How it is tested
In general, the redundancy test checks every failure combination: turning off the active gateway, cutting each channel, causing loss of communication between the gateways and moving operation to the backup center. In each case the switchover time, event integrity, alarm status and acceptance of commands only from the center with authority are checked.
We help with your link
Tiza Group does the communications engineering of high and extra-high voltage substations and industrial plants: redundant architecture, channel routes, IEC 104 redundancy groups and the test plan with the control center. Gateway configuration can be done or reviewed through remote relay configuration, and tests with the control center are done in Colombia, or elsewhere on request. Contact us.
Related guides
- Substation RTU and gateway
- IEC 60870-5-104: what it is, how it works and how it is tested
- DNP3 (IEEE 1815)
- Substation SCADA and HMI system
- Command rejected from SCADA
- SEL RTAC
- IEC 61850 to the control center: TR 61850-90-2
- Mapping IEC 61850 to IEC 104 and DNP3 in the gateway
- WAN for substations: IEC TR 61850-90-12
- Substation communications by voltage level
- Substation network redundancy: RSTP, PRP, HSR or MRP
References
- IEC 60870-5-104:2006 + Amd 1:2016, Network access for IEC 60870-5-101 using standard transport profiles, chapter on redundant connections.
- IEEE 1815, Standard for Electric Power Systems Communications – Distributed Network Protocol (DNP3).
- IEC TR 61850-90-12:2020, Wide area network engineering guidelines.
Frequently asked questions
What is a redundancy group in IEC 60870-5-104?
It is the set of TCP connections that one client keeps with its server for the same purpose. All of them stay established and supervised, but only one is active and transfers data, started with STARTDT. If the active one fails, the client activates another with STARTDT.
Why do repeated or missing events appear after a gateway switchover?
Because the gateway that takes over does not know exactly which events the control center managed to confirm with the previous one. Depending on how the buffers are synchronized between the two devices, it resends some or stops sending others. That is why the control center usually runs a general interrogation after each switchover.
Are two links over the same fiber cable redundant?
Not in practice. If both channels share a cable, duct, tower or transmission equipment, a single failure cuts both. Real redundancy requires different physical routes and, if possible, different providers or media.