Update on Traffic Engineering with IEC 61850

The other day I have discussed Traffic Engineering with IEC 61850. In a second post today I showed how SCL can be used to validate incoming messages.

Now I will show you in the analogy of traffic control how limits on the street are signaled. Fotos by Karlheinz Schwarz. 

First example Maximum Load Limit on a bridge: 

Second example with three limits: one vehicle at a time, max gross weight, and max speed:

Third example: max Tunnel hight 4,00 Meter

I guess you understand that IEC 61850 SCL can be used to configure signals for limits ... 

Enjoy. 

Cyberattacks Targeting OT Systems and IEC 61850

According to Security Week, "Hackers targeted operational technology (OT) systems at two private water utilities in Colorado in late August, apparently attempting to cause disruptions.

Few technical details are available, but it seems the attackers targeted industrial control systems (ICS) at the water utilities, which serve fewer than 200 people. 

A spokesperson for Colorado Governor Jared Polis told The Denver Post [paywalled] that the attackers changed equipment settings, disabled remote access and alarms, and altered pumping cycles. However, the disruptions were brief and did not affect water services or public safety."

I highly recommend small and all electric power utilities to pay attention to this situation and improve the cyber-security of the power system devices like SCADA, control, protection, RTUs, ... changing equipment settings could cause dangerous situations like blackouts, ... 

IEC 61850 information models can play an important role when somebody wants to change settings of a process control signal. The other day I used the IEDScout from Omicron to limit the setting value of a CDC=APC (Analogue Setting) structured setting. I set the maxVal to 1,000 (in the server) and tried with a second instance of IEDScout as a client to set the process value to Oper.ctlVal > maxVal ... the server responds with an MMS Write-Error and a Report "Inconsistent-parameters". The server did not accept a value outside of the maxVal and minVal. The process value did not change at all!

This possibility is a standardized (kind of "security") function incorporated into the CDC=APC !!!

Sure, the maxVal and minVal should be blocked for online changes! That could be configured in the CSL file as well.

So, IEC 61850 and especially SCL provide more than just a communication configuration ... many function related definitions are defined for the various common data classes!!

Let me know in case you want to further discuss this.

P.S.: After I published the above post I came across the following LinkedIn post   

CVE-2025-6625 — Improper Input Validation
> Crafted FTP command can take the controller offline
> CVSS 7.5 — network reachable, no auth, availability hit
> Energy, water, manufacturing fleets still run these PACs

Input VALIDATION is a crucial issue ... YES!

P.S2.: I just read another post on LinkedIn regarding DNP3 message validation. Interesting.

P.S3: Update

Could IEC 61850 be used for I/O applications as AS-i bus or Profibus DP?

Definitely one of the crucial objectives of IEC 61850 is to model, collect, and exchange Input and Output data! Many of the I/O technologies listed below (in a job description I just found today) are simply providing the exchange of bits and bytes over a communication link:

A well known company is looking (maybe) for you if you have – among other qualifications – “Experience with I/O technologies including FF, HART, WirelessHART, Profinet / Profibus DP, Ethernet IP / DeviceNet, Modbus / Modbus TCP, AS-i bus, IEC 61850, Wireless, Remote I/O technologies.”

IEC 61850 is much more than a I/O technology: BUT it is also a (very smat) I/O technology!! Sure it is! Why not?

So, is IEC 61850 competing with AS-i? No! I have written the first draft of the AS-i standard (IEC 62026-2) … some 20 years ago. It could provide the data we model and communicate to a higher level in an automation system. Data about a simple switch status or whatever. In the same way a Modbus device could provide I/O-data to an IEC 61850 server that provides input to a higher layer IEC 61850 or …

Yes, many signals are simply I/O data. IEC 61850 can handle them all …

What is the main difference between IEC 61850 and many of the field busses? Simply this: IEC 61850 applies an event-driven approach with DataSets and Controlblocks while most field busses run cyclic polling by a master device. The master polls for values … one field device after the other … again and again … IEC 61850 works like this:

IEC 61850 is usually (if used that way!) communicating useful information rather than bunches of Data – that just may tell the receiver: nothing has changed, nothing has changed, nothing has changed, … stop here and make it smarter. This could easily applied when Ethernet infrastructure is in place anyway.

This is one of the major paradigm shifts in process information exchange … that will take decades to understand by …