IEC 61850-90-5: Routable GOOSE and SV

Back to Blog

Making Layer 2 Services Routable

Standard GOOSE and Sampled Values are published as raw Ethernet multicast on Layer 2. That is deliberate - it keeps them fast - but it also means they cannot cross a router, so they are confined to a single substation LAN segment. As utilities needed to share fast measurement and signaling data between substations and to control centers, that boundary became a limitation. IEC 61850-90-5 is the technical report that removes it by defining routable profiles.

R-GOOSE and R-SV carry the same application payloads as their Layer 2 counterparts but wrap them for transport over IP, typically as UDP multicast that a network can route between sites. Because the traffic now crosses shared networks, 90-5 also builds in security - authentication and integrity for the routed messages - so the data cannot be spoofed or altered in transit, aligning with the broader IEC 62351 approach.

Where Routable Profiles Are Used

The driving application was wide-area monitoring: synchrophasor data from phasor measurement units, which needs to travel between substations and to regional control centers in something close to real time. R-SV gives a routable path for streaming that measurement data across the grid, and R-GOOSE gives a routable path for fast signaling and protection coordination that spans more than one station - wide-area protection schemes that no single-station Layer 2 GOOSE could reach.

R-GOOSE and R-SV are an extension of the same model, not a replacement, so the datasets, control blocks, and data references you already know still apply - only the transport is routable. The choice between local Layer 2 services and their routable forms comes down to whether the data has to leave the substation, which slots neatly into the wider IEC 61850 picture and the station-versus-wider-network thinking behind station and process buses.

What the Routable Wrapper Adds

R-GOOSE and R-SV keep the application payload of their Layer 2 originals and change everything underneath it. The frames are wrapped in a session protocol and carried over UDP/IP - typically as IP multicast - so ordinary routers can forward them between sites. Because the traffic now crosses networks a substation does not own end to end, the 90-5 profile builds in message security: authentication and integrity protection in the spirit of IEC 62351, with keys distributed through a key-management function rather than configured by hand on every device.

For the engineer, the familiar model survives intact: publishers, subscribers, datasets, and control blocks configure the same way, and the data references mean the same things. What changes is the engineering around the traffic - suddenly the questions are about multicast routing, WAN quality of service, and key management, which are network-team questions as much as protection-team questions. Successful 90-5 deployments tend to be joint projects for exactly that reason.

Network Engineering for Wide-Area Streams

Routable multicast does not happen by itself. Edge networks need IGMP so hosts can join groups, and the WAN core needs multicast routing configured and tested - or, where the network cannot support it, unicast delivery of the wrapped traffic as a fallback. R-SV in particular is a continuous stream, so the WAN must carry sustained bandwidth with consistent QoS marking end to end; how much bandwidth depends on the configured streams and is site-specific. Latency and jitter budgets are set by the application: synchrophasor visualization tolerates far more than a wide-area protection scheme, and what a given scheme can tolerate is for its protection engineers to specify.

Time synchronization quietly becomes a multi-site problem. Data that will be compared across substations - which is the entire point of synchrophasors - needs every site disciplined to a common reference, in practice GPS or PTP (IEEE 1588) time synchronization at each participating station, with holdover behavior understood for the day a receiver fails.

Routable Profiles vs the Alternatives

R-GOOSE and R-SV are not the only way to move fast substation data between sites, and the alternatives fit different problems.

Approach	What it is	Where it wins
R-GOOSE / R-SV	Native routable profiles over UDP/IP multicast	Wide-area protection and synchrophasor exchange designed to the standard
Layer 2 tunneling	Carrying standard GOOSE or SV across a pseudowire between sites	Interim links between two stations when devices lack 90-5 support
Gateway conversion	Terminating fast services locally and forwarding results over a SCADA protocol	Supervisory monitoring where protection-grade timing is not required

The deciding question is what the remote end does with the data. If a device at another station must act on the message with protection-grade timing, the native routable profiles - or, less happily, a tunnel - preserve semantics that a conversion discards. If the remote consumer is a control room, a historian, or an engineer's dashboard, terminating the fast services at the station and forwarding results over MMS reporting or another supervisory protocol is simpler, and it keeps multicast off the WAN entirely. Tunneling occupies an awkward middle: transparent to the devices, but it asks a wide-area link to behave like a LAN.

Running It Day to Day

A 90-5 link is not a commission-and-forget asset. Key management becomes an operational duty: keys expire and rotate through the key-distribution function, and a lapsed key shows up as subscribers silently rejecting traffic that the network is still delivering perfectly - a failure mode worth rehearsing before it happens at an inconvenient hour. Monitoring should watch both layers separately: the network path (multicast group state, WAN latency and loss) and the application (subscriber status, sequence gaps in the received streams), because each can fail while the other looks healthy.

Testing follows the same split. Network changes - a router upgrade, a new QoS policy, a rerouted circuit - deserve a regression check of the streams before they are trusted again, and any change on a link that carries wide-area protection signaling belongs inside the site's management-of-change process with the protection engineers in the loop. The habit to build is treating the WAN as part of the protection system, with the same discipline about who may change it and how changes are proven, rather than as ordinary IT plumbing that happens to carry substation traffic.

Frequently Asked Questions