Substation Communication Matrix: Flows, Ports, VLANs

Short answer

A substation communication matrix is the table that says who talks to whom, over which protocol and port, on which VLAN, how often and with what protection. Unlike the signal list, which describes the data, the matrix describes the flows. It yields the firewall rules, the VLAN plan, the bandwidth calculation, the network tests and the evidence for an audit.

What the communication matrix is

A modern substation runs dozens of simultaneous conversations: IEDs talk to each other, report to the local SCADA, a gateway reports to the control center, meters answer the energy management system, clocks distribute time and, now and then, someone logs in to engineering from outside. If those conversations are not written down in one place, each one lives in the head of whoever configured it.

The communication matrix is that place. It is a table in which each row is a data flow and each column answers a question about it: who originates it, who receives it, which protocol and port it uses, which VLAN it runs on, how often it is sent and how it is protected. It does not describe the data point by point; that is the job of the substation signal list. It describes the path the data takes and who is allowed to use it.

Which flows it covers

Substation flows are grouped by function. Each group usually has a different transport and therefore different rules:

Flow	Protocol and transport	Particularity
Trip and interlocking between IEDs	GOOSE over Ethernet, EtherType 0x88B8	Layer 2 multicast: it does not cross routers and cannot be filtered by IP address
Sampled values from field units to protection relays	Sampled Values, EtherType 0x88BA	Layer 2 multicast, constant and high throughput
Reports and controls between IEDs and local SCADA	MMS over TCP, port 102	Client-server association that stays open
Gateway to the control center	IEC 60870-5-104 over TCP, port 2404, or DNP3, port 20000	Crosses the substation boundary: the most closely watched flow
Meters, station service and inverters	Modbus TCP, port 502	Cyclic polling, no built-in security in its basic version
Time synchronization	NTP, UDP port 123, or PTP per IEEE 1588	A failure here degrades the time stamping of everything else
Network management and monitoring	SNMP, syslog, HTTPS, SSH	Administration traffic, with restricted access
Engineering and remote access	VPN and jump server	Temporary connection that must be logged

Each protocol is covered in the guides on GOOSE, MMS, Modbus and IEC 104 port 2404. What matters here is something simpler: every flow exists as a row.

Which columns it needs

There is no mandatory format, but a useful matrix answers at least these questions:

Flow ID. A code that can be cited in tests, in the firewall and in the acceptance report.
Source and destination. Device, network zone and, where applicable, IP or multicast address.
Service or function. What the flow does: trip, report, control, time, management.
Protocol and port, or EtherType. What actually shows up in a traffic capture.
Who initiates the connection. This sets the direction of the rule in a firewall.
VLAN and priority. Per the IP addressing and VLAN plan and IEEE 802.1Q tagging.
Periodicity and volume. Cyclic, event-driven or on demand, with the estimated throughput.
Criticality and redundancy. What happens if the flow is interrupted and which alternate path restores it.
Security. Whether the flow is in clear text, authenticated or encrypted, and which access control applies.
Remarks and owner. Who is responsible for that flow when it fails.

An empty column is a question someone will have to answer during commissioning, with the substation already wired.

Where the data comes from

The matrix is not invented: it is built from documents that already exist and reconciled between them.

The SCD configuration file, in an IEC 61850 substation, provides the GOOSE, sampled values and reports: who publishes, who subscribes, with which address and which VLAN. This is covered in the guide on SCL files.
The signal list provides the flows to the control center and the protocol of each one.
The addressing plan provides the addresses, subnets and VLANs.
The specifications of auxiliary equipment provide the meters, chargers, inverters and other devices integrated over Modbus or another protocol.
The remote access policy provides the engineering and vendor support flows.

If two documents contradict each other, the matrix exposes it: an address that appears in the SCD and not in the plan, a gateway that expects a port the firewall does not open. Finding that in the office is cheap; finding it with the panel energized is not.

What it is used for

Firewall rules. Every row that crosses a zone becomes an explicit rule. Anything not in the matrix is denied by default. This is the principle behind segmentation into zones and conduits in the IEC 62443 series, and a well-configured industrial firewall is, in practice, the matrix translated into rules.

VLAN and priority plan. Trip and sampled value flows must not share a queue with management traffic. The matrix shows what goes with what.

Bandwidth. Adding up the throughput of each flow per link confirms that no port or trunk is close to its limit. The guide on Sampled Values and GOOSE bandwidth gives the criteria.

Testing. Each row has its own check: does the flow exist? Does it reach the intended destination? Does it drop and recover over the alternate path? This is the thread running through communication network testing.

Audit and operation. A current matrix makes it possible to show which communications were authorized and to detect those that were not. For operators it is also the first sheet to open when a link keeps dropping.

How a new flow is classified in the matrix

Is the flow time-critical (trip, interlocking or sampled values)?
- Yes: Layer 2, dedicated VLAN with high priority, not routed or firewalled
- No: Does the flow cross a security zone boundary?
  - Yes: Explicit firewall rule with source, destination and port, plus event logging
  - No: Is it management or engineering traffic?
    - Yes: Management VLAN, access limited to authorized stations
    - No: VLAN of the corresponding function, with the appropriate priority

Common mistakes

A matrix built once and left without an owner. It is handed over at commissioning and nobody updates it: two years later it describes a substation that no longer exists.
Documenting only the IP traffic. GOOSE and sampled values have no IP address, yet they are the most sensitive flows. If they are not listed, they cannot be protected or tested.
Firewall rules wider than the matrix. Port ranges are opened “just in case” and the firewall stops being a barrier.
Unrecorded vendor flows. Remote monitoring or firmware update services that reach out to the internet and that nobody drew. In an OT gap assessment they are often the main finding.

How to check it against reality

A matrix is a hypothesis until it is compared with what actually flows. A Wireshark traffic capture on mirror ports, or continuous monitoring with SNMP and syslog, shows which conversations exist. Every observed flow that is not in the matrix is a finding: either a row is missing or a device is misconfigured.

The matrix with Tiza Group

At Tiza Group we prepare the communication matrix as part of the communications engineering for substations and plants. We reconcile it with the SCD, the signal list and the addressing plan, and we use it as the script for acceptance tests and for SCADA and gateway integration. If you already have an installation in service and do not know what runs on its network, we can quote a network survey. The auxiliary-service signals a discrete I/O RTU collects, and how they are wired and time-stamped, are described in Station Service RTU.

References

IEC 61850-8-1: mapping to MMS and to ISO/IEC 8802-3 (GOOSE).
IEC 61850-9-2: sampled values over ISO/IEC 8802-3.
IEC TR 61850-90-4: network engineering guidelines for power utility automation.
IEC 60870-5-104: network access for IEC 60870-5-101 using standard transport profiles.
IEC 62443-3-2: security risk assessment and system design, with zones and conduits.
IEEE 1588: precision clock synchronization protocol for networked measurement and control systems.

Frequently asked questions

What is the difference between the signal list and the communication matrix?

The signal list describes each data point: its name, type, protocol address and quality. The matrix describes each flow: who originates it, who receives it, over which protocol and port, on which VLAN and how often. A single flow, such as the IEC 104 session to the control center, carries hundreds of signals. One documents the content and the other documents the path.

Who should prepare and maintain the matrix?

It is prepared by whoever designs the network, with input from the protection and control integrator, the SCADA vendor and the control center operator. It needs a single owner and change control, because every change to an IED, a gateway or a remote access path changes a flow and, with it, a firewall rule.

Is the matrix useful in a conventional substation without IEC 61850?

Yes. Even without GOOSE or sampled values, there are still SCADA flows, Modbus meter flows, time synchronization, device management and remote access. The matrix is shorter but does the same job: it defines what must be allowed and exposes everything that is not on it.