A substation communication network carries trips, interlocks and controls, so its condition is monitored like that of any protection device. Alarms for link down, loss of PRP or HSR redundancy, power supply failure and configuration changes are collected with SNMP, preferably version 3, and with syslog, and the essential ones reach SCADA. IEC 62351-7 defines monitoring objects specific to the power sector, with their mapping to SNMP.
Why monitor the network
In a substation with IEC 61850, the Ethernet network carries GOOSE trips, interlocks between bays, sampled values on the process bus and the controls from the control center. A network failure is, in practice, a failure of the protection and control system. Even so, many networks are handed over without monitoring: the switches work, nobody looks at their condition, and the first sign of a problem is an interlock that does not release or a trip that does not arrive.
Redundancy makes the risk worse, silently. With PRP or HSR, losing one LAN or one ring segment interrupts nothing; traffic keeps flowing over the other path. If nobody notices, the substation runs without redundancy until the second path fails. Monitoring exists so that the first failure is seen and corrected.
Which alarms to bring to SCADA
Not everything a switch reports matters to the operator. A practical split separates what goes to SCADA from what goes to a network management system:
| Event | To SCADA | To network management |
|---|---|---|
| Failure of the switch or one of its power supplies | Yes | Yes |
| Link down on a port with protection traffic or on a trunk link | Yes | Yes |
| Loss of one PRP LAN or one direction of the HSR ring | Yes | Yes |
| RSTP ring topology change | Yes, as an alarm | With the port details |
| Frame errors on a port | No | Yes |
| High internal temperature | Depending on the design | Yes |
| Configuration change or administrative login | Depending on the security policy | Yes, with user and time |
The switch alarm contact, wired to an input of the bay controller, covers a serious device failure. The rest arrives through management protocols.
SNMP: versions and use
SNMP (Simple Network Management Protocol) is the standard management protocol for network devices. The manager polls the device’s values periodically, and the device sends notifications (traps or informs) when an event occurs. The values are organized in management information bases (MIBs): standard ones, common to all manufacturers, and private ones, with data specific to each model.
The version matters for security:
- SNMPv1 and v2c identify the manager with a community string sent in clear text. Whoever captures the traffic obtains it and, if the write community is enabled, can change the switch configuration.
- SNMPv3 adds a user-based security model, with authentication and, if enabled, message encryption.
In a substation the practice is to use SNMPv3, keep access read-only unless there is a reason not to, and restrict which addresses may poll the device.
Syslog and centralized logging
Syslog is the standard format for a device to send its log messages to a central server. Switches, routers, firewalls and many IEDs support it. Where SNMP answers “what condition is the device in”, syslog answers “what happened and when”: restarts, port changes, configuration changes, successful and failed logins.
To be useful, logging must be centralized and time-synchronized. An event with the wrong time cannot be correlated with the SCADA sequence of events or with an oscillography record. That is why network monitoring also depends on time synchronization.
What IEC 61850 and IEC 62351-7 add
The IEDs also monitor the network from their side. In IEC 61850, the LGOS logical node supervises each GOOSE subscription and LCCH supervises the IED’s physical communication channels. Their alarms reveal problems the switch does not report, such as a GOOSE that stopped arriving because of a configuration error. The guide on the substation Ethernet switch also mentions the bridge object model of IEC TR 61850-90-4, which lets the switch status be read with the same model as the IEDs.
IEC 62351-7 defines network and system management (NSM) objects specific to the power sector, to watch the health of the network, IEDs and RTUs and to support intrusion detection, with their mapping to SNMP MIBs. Its second edition, from 2025, replaced the 2017 one. The guide on IEC 62351 places this part within the series.
- 01Event in the switchA link goes down or a PRP LAN loses redundancy
- 02NotificationThe switch sends an SNMPv3 trap and a syslog message
- 03Network managerLogs the event with its time and classifies the alarm
- 04Gateway or SCADAReceives the essential alarms as substation points
- 05OperatorSees the alarm and opens a work order before the second path fails
Link to cybersecurity
Network monitoring is also a security control. IEC 62443-3-3, in its foundational requirement on timely response to events, calls for audit logs to be accessible and for the system to be monitored continuously. A switch that reports every administrative login and every configuration change makes misuse detectable; one that reports nothing hides it.
At the same time, the management protocol is a way in. That is why the same rules apply as in the rest of the network: management on its own VLAN, SNMPv3, individual accounts and access only from authorized machines. Monitoring traffic to detect anomalous behavior is a further step, the job of intrusion detection systems.
Common mistakes
- Default SNMP communities (the factory ones) enabled for read and write.
- Monitoring only the alarm contact and not the loss of redundancy, which does not operate that contact on many models.
- Syslog sent to a server nobody reviews, or one without storage space.
- Network alarms without a clear text in SCADA, such as “SW3 P12”, which the operator cannot interpret.
- Clocks out of sync between switches, IEDs and the log server.
How we solve it
Network monitoring is defined in the engineering: which alarms are generated, by which protocol, how they are named and how they reach the gateway and SCADA. We configure IEDs, switches and gateways remotely through our remote relay and communications configuration service, with a backup before and after every change. At Tiza Group we handle control, protection and communications configuration, including the integration of network alarms into SCADA, and the remote design of the network in our communications engineering service, for medium, high and extra-high voltage substations and for industry. Tell us which equipment you have and what you need to monitor.
Related guides
- Substation Ethernet switch
- Substation communication network
- PRP and HSR: redundancy without frame loss
- RSTP and Ethernet redundancy
- Industrial router and firewall
- Substation SCADA and HMI system
- Configuration management: settings and SCD versions
- Substation communications by voltage level
References
- IEC TR 61850-90-4:2020, Network engineering guidelines.
- IEC 61850-7-4, Compatible logical node classes and data object classes (LGOS, LCCH).
- IEC 62351-7:2025, Network and System Management (NSM) data object models.
- IEC 62443-3-3, System security requirements and security levels.
- IEC 62439-3, Parallel Redundancy Protocol (PRP) and High-availability Seamless Redundancy (HSR).
- IETF RFC 3414, User-based Security Model (USM) for SNMPv3.
- IETF RFC 5424, The Syslog Protocol.
Frequently asked questions
Which switch alarms should reach the substation SCADA?
At a minimum, failure of the device or of one of its power supplies, loss of the links that carry protection traffic, loss of network redundancy (one PRP LAN or one direction of the HSR ring) and ring topology changes. Other events, such as port errors or logins, can go to a network management system.
Why is SNMPv3 recommended over SNMPv1 or v2c?
Because SNMPv1 and v2c identify the manager with a community string sent in clear text and encrypt nothing. SNMPv3 adds user authentication and, if enabled, message encryption, which prevents anyone on the network from reading or changing the switch configuration.
Is the switch alarm contact wired to a bay controller input enough?
It covers a serious device failure, but it does not say which port went down or whether the network lost redundancy while it keeps running. That is why it is combined with SNMP or syslog and with the monitoring the IEDs themselves do of their GOOSE subscriptions and ports.