What this page solves

This page focuses on the hardware and power architecture of substation IEDs for IEC 61850 grids. It helps substation and IED design teams understand how to size the SoC or CPU, select Ethernet and TSN devices, plan secure elements, and build redundant power trees and watchdog chains that support revenue-critical protection and automation functions.

Many IEC 61850 projects struggle during certification because the IED platform cannot sustain full MMS, GOOSE and Sampled Values traffic under worst-case load, or because time synchronisation and redundancy do not behave deterministically. Others fail EMC and surge testing when the power tree, supervisors and reset strategy do not keep the device stable through dips, transients and brown-outs.

Security and lifecycle requirements are also increasing. Substation operators now expect secure boot, protected key storage, signed firmware updates and robust logging that can pass cybersecurity audits for ten years or more. This page highlights the IED-level building blocks for hardware security modules, secure elements, watchdogs and power supervision, while leaving detailed protection algorithms, station-wide SCADA functions, TSN network design and grid-level cybersecurity to dedicated pages in the same Smart Grid & Power Distribution cluster.

System roles & IEC 61850 services

A modern substation IED is not a single-purpose box. The same device often acts as an IEC 61850 server that exposes a logical model, a client that subscribes to other IEDs, and a publisher or subscriber for high-speed GOOSE and Sampled Values traffic. Understanding these roles is the first step in deciding how much CPU, memory and Ethernet capability an IED platform really needs.

As a server, the IED presents Logical Devices, Logical Nodes and Data Objects over MMS so that other equipment can read measurements, statuses and protection states. As a client, it maintains sessions to peer IEDs or station controllers to retrieve data, write settings and request operations. As a publisher and subscriber, it sends and receives GOOSE events and Sampled Values streams that must be delivered with tight latency and time alignment on the process and station buses.

Feeder, busbar and transformer IEDs share a similar hardware pattern but operate at different scales. Feeder IEDs may terminate more GOOSE signals related to interlocking and trip commands. Busbar and transformer IEDs may carry heavier Sampled Values traffic and stricter time-sync requirements. Station controllers and bay controllers tend to manage larger MMS models and more client sessions. These differences drive the performance tier of the SoC or CPU, the size of RAM and non-volatile storage, and the number of Ethernet ports that must be populated on the board.

Each IEC 61850 service maps directly to concrete hardware needs. MMS server and client functions require enough processing headroom and memory to hold the data model, handle simultaneous client connections and buffer logs. GOOSE requires deterministic Ethernet paths and traffic prioritisation so that protection messages are not delayed by background traffic. Sampled Values depend on hardware time stamping, stable reference clocks and sufficient MAC and PHY bandwidth to sustain continuous high-rate streams without gaps.

Redundancy and determinism add further constraints. Implementing HSR or PRP means planning for at least two, and often three, GbE interfaces plus appropriate switch and buffer resources. Time-sensitive networking features, such as time-aware scheduling and frame pre-emption, influence the choice of TSN-capable switch and PHY components. Detailed network topology and TSN profile planning is covered in the Industrial Ethernet and TSN page; the focus here is to highlight which capabilities the IED hardware must expose so that those designs remain possible.

Substation IED hardware architecture

A substation IED for IEC 61850 grids can be viewed as a single board with a small number of well defined hardware zones. At the centre sits the main SoC or CPU, optionally combined with an FPGA, running the IEC 61850 stack and coordinating protection logic, measurements, logging and security. Around this core, process interfaces, redundant Ethernet ports, secure elements, isolation and power-management ICs create a platform that can pass grid-level robustness and certification.

On the process side, the IED terminates bay-level signals through optically or capacitively isolated digital inputs and outputs, as well as serial interfaces towards legacy relays and RTUs. Time synchronisation inputs such as IRIG-B or pulse-per-second may also enter on this side before crossing into the processing domain. On the network side, two or three GbE ports and an optional industrial switch provide station-bus connectivity, uplinks to gateways and engineering tools, and the physical hooks needed for HSR, PRP or future TSN-based schemes.

Beneath the processing core, redundant DC inputs, surge and inrush protection, PMICs, DC/DC converters, supervisors and watchdogs form the power and supervision tree. An RTC with backup supply maintains time across outages, while secure elements, secure storage devices, tamper inputs and digital isolators sit around the edges of the design. High-voltage CT and VT circuits, trip-coil drivers and detailed primary or secondary wiring are handled by protection relay hardware and are therefore kept out of this IED-level architecture view.

Ethernet, TSN & redundancy design

Ethernet hardware on a substation IED is more than a pair of RJ-45 connectors. The device must host enough GbE interfaces, support redundancy schemes such as HSR or PRP, and expose PTP-capable MAC or PHY devices so that MMS, GOOSE and Sampled Values traffic remains deterministic under fault and overload conditions. The number of ports populated on the PCB directly limits which redundancy and maintenance strategies can be offered over the product lifetime.

Two GbE ports are typically the minimum for new designs, enabling PRP or ring-based redundancy and allowing the station bus to remain available if a single path fails. High-end IEDs often add a third port for engineering tools or local HMIs so that maintenance traffic does not compete with protection messages. Whether redundancy is implemented through external switches, dedicated redundancy logic or SoC-integrated MACs, each solution consumes PHY channels, traces and power budget that must be planned early in the board layout.

Time synchronisation pushes additional requirements onto Ethernet ICs. Hardware support for IEEE 1588 PTP time stamping at the MAC or PHY level is essential for utility-grade GOOSE and Sampled Values performance. Stable reference clocks, low-jitter oscillators and well-behaved timestamp paths help align events across redundant ports and across the wider substation network. Without hardware time stamping and careful clock design, Substation IEDs struggle to pass advanced IEC 61850 and power-quality tests even if basic communication appears functional during early trials.

Time-sensitive networking extends these capabilities. TSN features such as time-aware shaping, scheduled traffic windows and frame pre-emption can reserve bandwidth for GOOSE and Sampled Values while carrying engineering and SCADA flows on the same links. Even when TSN is not used immediately, choosing TSN-capable switches and PHYs during initial IED design gives substation operators a path to future interoperability. Detailed network-topology and TSN-profile planning belongs in a broader Industrial Ethernet and TSN discussion; at the IED level, the priority is to ensure that port count, redundancy support, PTP capability and TSN feature coverage are sufficient for the intended grid segment.

Processing, memory & security subsystem

The processing and memory subsystem determines whether a substation IED can sustain IEC 61850 workloads, security functions and long-term logging without unexpected behaviour. The main architectural choice is usually between an ARM MPU running a feature-rich operating system, a microcontroller combined with an FPGA or CPLD, or a fully integrated FPGA SoC that merges hard cores and programmable logic. Each option targets a specific mix of IEC 61850 services, local HMI requirements and redundancy expectations.

ARM MPU-based platforms suit IEDs that host large IEC 61850 data models, multiple MMS client and server roles, Secured profiles and web or graphical HMIs. MCU plus FPGA architectures separate protocol and configuration logic from hard real-time processing, and are common in protection- oriented devices with demanding sampling or custom legacy interfaces. FPGA SoCs combine these patterns on a single die and are often used in high-end bay controllers or merging units that terminate dense Sampled Values streams while still running complex applications and multiple Ethernet ports on top.

Memory and storage sizing must reflect the IEC 61850 model, connection count and logging policy. RAM and DDR capacity is driven by the number of logical nodes and data objects, simultaneous MMS sessions and buffers for GOOSE and Sampled Values processing. ECC on external memory reduces the risk of silent bit errors over long service lifetimes. Non-volatile storage is typically split between a secure boot region for ROM-validated bootloaders and firmware images, and larger devices such as eMMC or NAND for event logs, disturbance records and multiple firmware packages with rollback capability and wear-leveling support.

Security hardware wraps around the processing core. A secure boot chain anchors in immutable ROM, validates the bootloader and then authenticates signed firmware images before execution. A hardware security module or secure element protects long-term keys and certificates, provides a robust random number source and can accelerate TLS or DTLS handshakes as well as GOOSE or Sampled Values authentication functions. The IED exposes these capabilities through well-defined interfaces so that the wider cybersecurity architecture can manage credentials, certificates and secure update workflows without full access to the root keys.

Watchdog and fault-management circuits complete the subsystem. Internal watchdog timers supervise the main firmware, while external supervisors monitor voltage rails, clock health and a hardware heartbeat. Window watchdogs detect both stalled and runaway software. Reset causes are logged in non-volatile storage so that cold starts, controlled warm restarts, brown-outs and watchdog events can be distinguished. Clear fail-safe modes ensure that, when unrecoverable faults occur, the IED moves to a defined safe state while leaving protection and interlocking responsibilities in a predictable condition for the wider grid.

Power tree, redundancy & ruggedness

The power tree of a substation IED must support redundant supply options, predictable start-up and restart behaviour and stable operation through surge, dip and electromagnetic disturbances. Typical topologies combine two independent DC feeds, a DC feed and a battery backup rail or combinations of local DC and PoE. Input protection, Or-ing control and surge limiting devices prevent faults on one source from propagating into the rest of the IED or into the other source.

Redundant DC inputs usually pass through separate fuses or eFuses, current-limited stages and surge protectors before meeting at an ideal-diode or active Or-ing controller. This protected bus then feeds one or more DC/DC stages and PMICs that generate core, DDR, I/O and PHY or switch rails. In some layouts, a battery or supercapacitor-backed rail supplies selected domains during short interruptions, giving the IED enough time to save logs and perform a controlled shutdown instead of dropping power abruptly under stress.

The PMIC and downstream regulators implement the rail structure, sequencing and supervision needed for modern SoCs. Core rails, DDR rails, I/O rails, Ethernet-device rails and auxiliary rails are often separated so that faults can be contained and sensitive domains are not over-stressed. Power-up sequencing ensures that voltage levels rise and fall in a safe order, while brown-out detection and voltage supervisors provide early warning of sagging supplies and assert reset before digital logic enters undefined regions. These supervision signals connect directly to the watchdog and reset-management logic described in the processing subsystem.

Ruggedness is validated against standards such as IEC 61000-4-x. The power tree must ride through electrostatic discharge, conducted and radiated disturbances, surges and voltage dips without uncontrolled resets or latch-up. Device selection and layout should support industrial temperature ranges, conformal coating where required and long-life capacitors that can survive elevated ambient temperatures over the expected service period. Detailed surge-arrestor combinations, SPD stages and TVS or GDT selection are covered in the EMI and surge protection topic; here the focus is on ensuring that the IED power architecture exposes the right hooks to remain stable and predictable in harsh grid environments.

I/O, time sync & process interfaces

The way a substation IED connects to process signals and time sources determines how well it can align events, coordinate with protection devices and integrate legacy equipment. Time synchronisation is usually anchored by PTP over Ethernet, which relies on hardware timestamp support in the MAC or PHY and on stable reference clocks. Additional options such as GNSS, IRIG-B and pulse-per-second inputs and outputs extend the time architecture and should be considered when defining board-level connectors, isolation and routing.

Board-level time interfaces typically include one or more Ethernet ports that participate in PTP time synchronisation, plus optional headers or connectors for GNSS receivers and IRIG-B channels. GNSS modules or external receivers contribute serial NMEA data and a 1PPS signal that must reach timer-capable pins with controlled jitter. IRIG-B inputs and outputs pass through filtering and galvanic isolation before entering FPGA or SoC timer blocks, and dedicated PPS distribution outputs can fan out an internal time base to other bay-level devices without exposing the IED core directly to external noise and surge events.

On the process side, the IED terminates digital inputs and outputs, breaker control signals on the low-voltage side and legacy serial or fieldbus interfaces. Discrete inputs from auxiliary contacts or position switches arrive through digital isolators or optocouplers that provide creepage, surge robustness and common-mode transient immunity. Digital outputs and low-voltage breaker drive signals use high-side or low-side switch ICs, often with built-in diagnostics, while high-energy trip coils and high-voltage paths remain the responsibility of protection relay hardware and are not part of the IED board-level design discussed here.

Legacy relays and RTUs are commonly attached through RS-485 or RS-232 links. Industrial-grade transceivers, sometimes combined with digital isolators or integrated isolated drivers, provide the physical layer for these channels and must meet ESD, surge and temperature requirements. From an IC perspective, the I/O and time-sync domain is built around families of digital isolators or optocouplers, serial transceivers, low-voltage drivers and optional GNSS or time-sync companion devices that feed precise time and process information into the main IED logic domain.

Design traps & checklists

A substation IED that looks correct at block-diagram level can still fail type tests or field trials because of subtle performance, hardware or maintenance pitfalls. This section collects common traps encountered during IEC 61850 performance testing, network integration and long-term operation, and turns them into concrete checklist items that can be used before freezing hardware and before sending devices to certification laboratories.

Performance and protocol traps include overload scenarios where GOOSE and Sampled Values traffic pushes CPU usage, buffers and latency beyond acceptable limits, as well as conformance failures caused by time-synchronisation drift or abnormal restart behaviour. Hardware traps are often linked to Ethernet layout, redundant power switching and watchdog configuration. Maintenance and lifecycle traps show up later, when firmware upgrade chains, logging strategies and timestamp handling are exercised over many years of service.

IC mapping & vendor-neutral roles

The hardware blocks of a substation IED can be described as a set of vendor-neutral IC roles. This makes it easier to compare different suppliers, prepare bill-of-material variants and keep the IEC 61850 station-bus, security and power architectures stable across product generations. The table below groups these roles by function, lists the IC families typically used and highlights the key parameters that drive selection.

Each function block can be implemented by multiple vendors. The example part numbers under “Example IC families” are indicative only and are intended to show the typical device classes used in this role. Detailed comparisons and brand-specific shortlists can then be developed on separate pages without changing the high-level mapping shown here.

Cross-links in the “Notes / cross-links” column point to sibling topics that cover network topologies, cybersecurity architectures, high-voltage isolation and surge protection, so that this page can stay focused on device roles rather than complete schematic details.

FAQs about substation IED hardware and IEC 61850 design

These twelve questions capture the main hardware and system decisions you face when planning a substation IED with IEC 61850. Each answer focuses on practical selection criteria and cross-links to the relevant sections of this page and related topics when deeper detail is needed.