Summary
- The network does not alter the SCADA protocol; 104 and 61850 stay identical end to end — transparent transport.
- Security is chosen to fit the site: IEC 62351-3 (TLS) where the endpoints support it, otherwise IPsec without touching the endpoints.
- Protocol inspection is a hygiene layer — not an IDS; its role shrinks once end-to-end TLS is in place.
- What the digital substation really needs is precise time — high-accuracy time as required by the chosen profile (e.g. microsecond class for Sampled Values), with drift bounded by holdover; inside the substation, not in a WAN capacity project.
- The real value lies in the integrated system: the Simgenet SMGOS router, SMG104 switch and GNSS time source in one solution — shared identity, security, time and management.
Introduction
As the old 64 kbps telecontrol circuits give way to fibre and IP/MPLS backbones measured in megabits, IEC 60870-5-104 and IEC 61850 now travel over the same line. The question we hear most often in the field is: “What does a device that supports these protocols actually give me — doesn't a plain router carry this traffic anyway?”
As an engineering company, our honest answer is: the network's job is not to change the protocol, but to carry it correctly, securely and on time. In the second half of this article we show how these principles are realised in the integrated architecture built from the SMGOS router, the SMG104 switch and the GNSS time source.
01Two standards, two different places
IEC 60870-5-104 is the telecontrol link between the RTU and the master SCADA at the centre — over the wide area network (WAN). IEC 61850, on the other hand, is substation automation inside the substation: MMS, GOOSE and Sampled Values between IEDs. This distinction directly determines how the solution is built: inside the substation it is a switch's job; the line to the centre is a router's job.
02The router does not alter the protocol — transparent transport
The most common misunderstanding: “Does the device reformat the 104 data before sending it?” No. A properly designed router carries the 104 packet generated by the RTU without touching a single byte of its payload. The RTU and the master SCADA speak the same 104 end to end; there is no protocol conversion and the endpoint settings do not change. The router sits in between transparently.
This is a principle of trust: the network does not corrupt the integrity of the SCADA data it carries. SCADA data has, after all, been carried over standard routers for years. So the real added value lies not in transport itself, but in the security, continuity and time discipline delivered while transporting.
03Security: IEC 62351 (TLS) or IPsec?
On its own, IEC 104 contains no security at all — it is plaintext TCP. Security is added in two separate layers, and the two are frequently confused:
| IEC 62351-3 (TLS) | IPsec (network layer) | |
|---|---|---|
| Who does the encryption | RTU ↔ SCADA (endpoints) | Router ↔ router |
| Changes at the endpoints | Required (TLS + certificate) | Not required (endpoints unaware) |
| Place in the standards | The official security profile for 104 | Complementary, protocol-independent |
Field reality
Modern RTU families support TLS; however, a large part of the installed base still speaks plain 104. For that reason, in most projects IPsec, which protects the line without touching the endpoints, is the more practical choice. The right decision is not “which one is better” but choosing the one that matches the capability of the endpoints in the field.
04Protocol awareness and its honest limit
Our IP/MPLS network operating system SMGOS — “In-house developed IP/MPLS Network Operating System” — can recognise protocols such as 104 and 61850: it checks passing traffic against the protocol rules (e.g. header integrity for 104) and can flag or filter non-conforming packets. Being honest here is a requirement of our engineering discipline:
- This inspection is not a signature-based antivirus/IDS. IEC standards are fixed; it needs no continuously updated threat database — an operational advantage.
- For exactly that reason we do not position it as a “threat hunting” product. It is a hygiene layer: it keeps the line within the rules.
- Once the endpoints move to end-to-end TLS, the network in between can no longer see the content, and the field role of protocol inspection naturally diminishes. We say this up front.
In short, SMGOS is an OT-aware (OT-hardened) secure network operating system — not an IDS/IPS. Our goal is not to scan traffic but to protect the line and the device: encrypted links, certificate-based identity (PKI/mTLS), role-based access with audit logging, control-plane protection and management isolation.
05The real decider: time
In a digital substation where IEC 61850 extends to the process bus (Sampled Values), time is a requirement as decisive as security. Sample-based protection and Sampled Values require, depending on the application, that devices lock to a common time with high accuracy (typically microsecond class according to the relevant IEC/IEEE profiles — IEC 61850-9-3 / IEEE C37.238 PTP profile, IEEE 1588 v2). GOOSE has application-dependent time requirements; it is event-driven and latency-sensitive, and its need for absolute timestamps is usually looser — yet the same time chain feeds all of them. If synchronisation degrades, samples no longer align and the reliability of sample-based/differential protection drops. In short, time is part of the correctness of protection — and this need is independent of encryption.
The right layer
This time requirement is inside the substation. In a project that merely increases the capacity of the RTU↔SCADA WAN link (e.g. upgrading a 104 link from 64 kbps to 5 Mbps), microsecond timing does not come into play; what matters there is bandwidth, a secure link and availability. Sound engineering does not confuse which need belongs to which layer.
06What happens on failure? Redundancy and priority
In critical infrastructure the value of a link is usually understood the moment it breaks. SCADA data and protection communication must be immune to interruption; two engineering decisions deliver this:
Redundancy — an uninterrupted path
Inside the substation, HSR and PRP (IEC 62439-3) carry every frame over two separate paths; even if one path fails, the receiver keeps getting data without interruption — the protection network keeps running “without a break”. On the line to the centre, IP/MPLS fast reroute (switch-over to the redundant path) takes over. The aim is that no single failure stops SCADA visibility or protection communication.
Priority — not every packet is equal
Telecontrol (104), management traffic and time synchronisation all flow over the same line. QoS prioritises these classes: time and protection communication do not queue behind file/management traffic. Correct classification ensures that critical data still arrives on time even when the line is saturated.
07The three-part architecture: which product, in which scenario
The principles described so far come to life when three roles are placed correctly in the field. Simgenet product family — the SMGOS router, the SMG104 switch and the GNSS time source — take on different weights in the same project:
In this article we look at example architectures across two application groups: transmission (TEİAŞ), power generation plants and railways are typically backbone / hub-and-spoke (high reliability, time); water and distribution are frequently mixed: fibre ring + radio (remote sites over RF/LTE), volume-oriented. The sector name alone does not determine the topology or the timing requirement.
The point to watch: the value of time/GNSS is inside the substation, not in a WAN capacity project; 61850 is the job of the substation switch, not the router. Placing products in the right layer is a matter of engineering honesty and correct cost.
08A system, not parts
In critical infrastructure the real value is not in a single “best box” but in an integrated system whose parts recognise each other. Concretely, this means the devices recognise each other through a common certificate infrastructure (PKI/mTLS), share their authentication and diagnostics layers, and run under a single management and a single time chain. A stack assembled from different vendors usually lacks this cohesion: three separate managements, three separate certificates, three separate support lines.
Simgenet's difference comes from the principle of full control: because we develop the operating system (SMGOS) ourselves, we can adapt site-specific needs end to end, and we can commit to long-term sustainability and supply continuity at the company level.
09Conclusion
- The network does not alter the SCADA protocol; transports transparently, securely and on time — 104 and 61850 stay identical end to end.
- The security layer is chosen to fit the site: IEC 62351-3 (TLS) where the endpoints support it, otherwise IPsec without touching the endpoints.
- Protocol inspection is a hygiene layer, not an IDS; its limits are stated openly.
- What the digital substation really needs is time; for SV, synchronisation at the accuracy the application/profile requires (e.g. microsecond class) and holdover (bounded drift) determine the correctness of protection; GOOSE needs low latency.
- The real value is in the integrated system: shared identity, security, time and management — Simgenet SMGOS, SMG104 and GNSS in one solution.
Our approach is to bring the standards together not as a slogan but in a measurable and understandable way. Rather than selling a box, we build an engineering solution that fits the real needs of the site.
Key Concepts
Technical References
- IEC 60870-5-104 — Telecontrol (APCI/ASDU), TCP/2404.
- IEC 61850-8-1 — Station bus: MMS and GOOSE.
- IEC 61850-9-2 / 9-3 — Sampled Values and the PTP profile for power utility automation.
- IEEE C37.238 — IEEE 1588 (PTP) profile for power systems.
- IEC 62351-3 / 62351-5 — TLS profile for TCP; IEC 60870-5 application-layer security.
- IEC 62439-3 — PRP and HSR redundancy methods.
- IEEE 1588-2019 — Precision Time Protocol (PTP) v2.
The references point to the relevant standards and technical descriptions; field implementation is assessed on the specific conditions of each project.
