Substation network redundancy: RSTP, PRP, HSR or MRP

The two families of redundancy

A substation network must keep working when a link or a switch fails. There are two ways to achieve this, and the difference between them is what happens during the failure:

• Redundancy by reconfiguration. The network has spare paths, but in normal service it keeps one blocked so that frames do not loop forever. When a link fails, the protocol enables the blocked path. While it does so, frames are lost. This is the case of RSTP and MRP.
• Redundancy by duplication. Each frame is sent over two paths at once and the receiver keeps the first copy. If one path fails, the other copy is already on its way: there is no recovery time. This is the case of PRP and HSR, from IEC 62439-3.

The choice is a design decision and depends on how well each function tolerates message loss.

RSTP

RSTP (IEEE 802.1D, now included in IEEE 802.1Q) works in rings and meshes. The switches elect a root bridge, block the ports that would close a loop and enable them if a link is lost. Almost every managed switch supports it.

Its reconvergence time depends on the topology, the number of switches and the vendor’s implementation: it can range from milliseconds to much longer. The details are in RSTP and MRP.

MRP

MRP (IEC 62439-2) is designed for rings only. A manager switch blocks one of its ports and sends test frames; if they stop coming back, it opens the port. The standard defines recovery time classes of 500, 200, 30 and 10 ms, and the fastest ones require hardware that supports them. Its advantage over RSTP is that the time is predictable.

PRP

PRP uses two independent networks, LAN A and LAN B. Each doubly attached node (DAN) transmits every frame on both and the receiver discards the duplicate. The two LANs can have different topologies, for example two stars. The failure of any element in one LAN loses no frame.

HSR

HSR forms a ring in which each node sends the frame in both directions. The destination takes the first copy, and multicast frames are removed by the node that sent them. There is no recovery time, but ring traffic is doubled, which limits the number of nodes and the volume of sampled values. Both protocols are explained in PRP and HSR.

SAN, DAN and RedBox nodes

• SAN (single attached node): a single-port device. In PRP it can go to one LAN only, without redundancy.
• DAN (doubly attached node): a device with two ports that implements PRP (DANP) or HSR (DANH). Most recent relays offer it as an option.
• RedBox: a device that connects one or more SANs to both PRP LANs or to the HSR ring. It also joins an HSR ring to a PRP network. See PRP and HSR RedBox.

Comparison

What each function requires

• MMS, SCADA, engineering access and video. They tolerate a brief loss: the client retries and reports are recovered. RSTP or MRP is usually enough.
• Interlocking GOOSE. It tolerates a brief loss if the interlock was designed to fail to the safe position. RSTP, MRP or PRP depending on the philosophy.
• Trip and breaker failure GOOSE. IEC 61850-5 assigns them the most demanding transfer time class, 3 ms. A reconfiguration at the moment of the fault can delay the trip. PRP or HSR is preferred. See GOOSE.
• Sampled values. A continuous stream of samples; a sustained loss blocks the protection that uses them. They require PRP or HSR.
• PTP synchronization. It works over PRP and HSR, with clocks that recognize both paths.

You can estimate the load on each link and the effect of PRP or HSR on traffic with our free process bus network tool.

Common combinations

• PRP on the station bus and HSR on the process bus, joined by RedBoxes.
• An RSTP ring inside each PRP LAN, as long as the two LANs remain independent.
• PRP for the protection IEDs and RSTP for everything else (cameras, access control, services), separated by VLANs or by separate switches.

In any combination, the design documents which port uses which protocol and disables, on the PRP and HSR ports, the features intended for STP.

Common mistakes

• Both PRP LANs on the same power supply or along the same fiber route.
• LAN A and B crossed, which the network does not reveal at a glance but the counters do.
• An HSR ring with too many nodes, with sampled values saturating the doubled bandwidth.
• Assuming RSTP is deterministic: its timing changes with the topology and the vendor.

Design and testing with Tiza Group

Redundancy is decided from the list of functions carried by the network and verified at commissioning by disconnecting each link with real traffic. We configure IEDs, switches and gateways remotely through our remote relay and communications configuration service, with a backup before and after every change. Our team designs the network remotely as part of our communications engineering service and, on site in Colombia or elsewhere on request, configures and tests PRP, HSR, RSTP and MRP through our IEC 61850 engineering service, at medium, high and extra-high voltage, for utilities and industry. Write to us and we will propose the architecture.

Related guides

• Substation communications by voltage level: MV, HV, EHV
• Substation network topologies: star, ring, ladder
• Redundant teleprotection channels: routes and diversity
• Redundant gateway and dual links to the control center

References

• IEC 62439-2:2021: Media Redundancy Protocol (MRP).
• IEC 62439-3:2021: PRP and HSR.
• IEEE 802.1Q: bridges and bridged networks with VLANs, including RSTP.
• IEC TR 61850-90-4:2020, Network engineering guidelines.
• IEC 61850-5: communication requirements and transfer time classes.

Frequently asked questions