Substation Ethernet Switch: IEC 61850-3, VLAN, Redundancy

Short answer

The substation Ethernet switch is the managed device that connects relays, bay controllers, merging units, the HMI and the gateway. It must withstand the electrical environment of the substation (IEC 61850-3, IEEE 1613), separate and prioritize traffic with VLANs and IEEE 802.1Q tags, deliver GOOSE and sampled values only to those who need them, and provide the redundancy the application calls for: RSTP or MRP with reconfiguration, or PRP and HSR with zero recovery time.

What it is and where it sits

The substation Ethernet switch is the node of the substation communications network. Relays, bay controllers, merging units, the HMI, the clock and the RTU or gateway all connect to it. It goes in the panels of the control building, in yard kiosks or inside the switchgear, and is usually mounted in a 19-inch rack or on a DIN rail.

It is not an office device in a different case. In an IEC 61850 digital substation it carries trips and current samples, so its behavior during an electrical fault is part of the protection’s performance.

Main parts

Copper ports (RJ45) for equipment in the same panel.
Fiber-optic ports, fixed or in pluggable modules: multimode for short distances and single-mode for long links or links between buildings.
Power supply, often dual, fed from the substation battery bank.
Alarm contact wired to report loss of a supply or an internal failure.
Managed firmware, with a web or command-line interface, SNMP, event log and configuration backup.
In some models, PRP or HSR ports, RedBox function and hardware PTP clock.

How it works

Layer 2 switching. The switch learns which port each MAC address is on and sends each frame only to its destination. Broadcast and multicast frames, by contrast, are forwarded to all ports unless filters are configured.

VLANs and priority (IEEE 802.1Q). The 802.1Q tag carries a VLAN identifier and a three-bit priority field, that is, eight levels. GOOSE and sampled values (SV) are published with configurable VLAN and priority. The switch uses the VLAN to decide which ports a frame may go to and the priority to place it in an output queue faster than the one for MMS, engineering or video traffic.

Multicast filtering. GOOSE and SV are layer 2 multicast, not IP traffic, so IGMP snooping does not control them. They are filtered with VLANs, static multicast address tables or a layer 2 registration protocol such as GMRP, if the devices support it. Without filtering, SV streams can saturate relay ports that do not use them.

Redundancy. RSTP (defined in IEEE 802.1D-2004) and MRP (IEC 62439-2) block one link to avoid loops and enable it if another fails; frames are lost while the network reconfigures. PRP and HSR (IEC 62439-3) send each frame over two paths and the receiver discards the duplicate copy, with zero recovery time. They should not be mixed carelessly on one interface.

Port security. Substation switches offer IEEE 802.1X port authentication, MAC address locking, shutdown of unused ports, accounts with access levels, and RADIUS or TACACS+ authentication for management.

Variants and selection criteria

Unmanaged: only for very small networks without GOOSE; it allows no VLANs, filtering or supervision.
Managed layer 2: the general case on the station bus and process bus.
With layer 3: routes between VLANs or subnets; useful at the edge toward the control center, together with an industrial router and firewall.
With PRP, HSR and RedBox: for protection networks with zero recovery time, common in high and extra high voltage.
With PTP: needed when merging units synchronize over the network (see time synchronization).

Fiber or copper. Fiber does not conduct current: it eliminates ground loops and interference between buildings, yard and control building. Copper is kept for short connections inside the same panel. To link old serial devices, use media converters and serial device servers.

Key specification data

Compliance with IEC 61850-3 (construction, environmental and electromagnetic compatibility requirements for communication equipment in substations) and IEEE 1613, stating the class. In IEEE 1613, class 1 allows data errors, losses or delays during the interference tests and class 2 requires error-free operation; neither allows permanent damage.
Operating temperature range, fanless if the site requires it.
Number and type of ports, wavelength and fiber reach.
Power supplies: nominal battery voltage and redundancy.
Supported redundancy protocols (RSTP, MRP, PRP, HSR) and number of PRP or HSR ports.
VLANs, priorities, static multicast filtering, per-port traffic limiting.
PTP: transparent or boundary clock according to IEC/IEEE 61850-9-3.
Security: 802.1X, RADIUS or TACACS+, syslog logging, signed firmware.

Integration with protection and control

The switch has no protection functions, but it must be supervised. Its alarm contact is wired to an input of the bay controller and its status is read over SNMP or, in some models, with the bridge object model described in IEC TR 61850-90-4. In the IEDs, the logical node LGOS supervises each GOOSE subscription and LCCH each physical channel; their alarms reveal network problems even when the switch does not report them.

Commissioning tests and maintenance

Configuration against design: VLAN per port, priorities, multicast filters and RSTP root node, compared with the network design and the SCD.
GOOSE and SV delivery: with a subscribed test set, check that each IED receives only what it should.
Redundancy: disconnect links and power supplies, one at a time, and verify that no protection messages are lost or that reconfiguration stays within what is accepted.
Security: unused ports closed, passwords changed, individual accounts, logging active.
Backup: save the final configuration and firmware version. These tests are complemented by end-to-end tests.

Common failures and what to check first

A GOOSE stops arriving after a switch is replaced: VLAN not allowed on the port or multicast filter missing.
Port saturation from unfiltered SV streams.
Loop created by a test cable on a port without RSTP.
Ports A and B crossed in a PRP network.
Intermittent errors from dirty or high-attenuation fiber: check the port error counters.
Loss of a supply without an alarm: alarm contact not wired.

Network configuration with Tiza Group

Are you losing GOOSE messages after a network change, or do you need your switch configuration reviewed? At Tiza Group we review it through our remote relay configuration service and, on site, through our IEC 61850 engineering, in medium, high and extra high voltage, in substations and industry, in Colombia or elsewhere on request. The variants of the Hitachi Energy AFS and GE MultiLink switches are described in Hitachi Energy AFS660, AFS670 and GE MultiLink ML3000.

References

IEC 61850-3: general requirements for communication equipment in substations.
IEEE 1613: environmental and testing requirements for communications networking devices in substations.
IEEE 802.1Q: bridges and bridged networks with VLANs.
IEEE 802.1D-2004: MAC bridges, including RSTP.
IEEE 802.1X: port-based network access control.
IEC 62439-2 (MRP) and IEC 62439-3 (PRP and HSR).
IEC/IEEE 61850-9-3: PTP profile for power utility automation.
IEC TR 61850-90-4: network engineering guidelines for power utility automation.

Frequently asked questions

Can an office switch be used in a substation?

No. A substation switch is tested for the electromagnetic and climatic environment of the site according to IEC 61850-3 or IEEE 1613. Under IEEE 1613, a class 2 device must not lose, delay or corrupt data during the interference tests, a requirement meant for protection traffic.

Why do GOOSE messages reach ports that do not need them?

Because GOOSE and sampled values are layer 2 multicast. If the switch does not filter by VLAN or by multicast address, it forwards them to all ports. IGMP snooping does not filter them, because they are not IP traffic; you have to use VLANs, static multicast tables or a layer 2 registration protocol.

Is RSTP enough for a protection network?

It depends on what travels over it. RSTP reconfigures the network after a failure, and frames are lost during that time. For critical GOOSE trips or sampled values, PRP or HSR (IEC 62439-3) is preferred, as they have zero recovery time.