Design and check the communication network of an IEC 61850 substation in one place: IP plan, VLANs and multicast addressing for GOOSE and sampled values, bandwidth, GOOSE transfer time, PRP/HSR redundancy, PTP time synchronisation, firewall zones and a capture analyser to verify the result on site. A sample 132/33 kV substation is loaded so you can try every tool straight away.
Open full screen ↗Private: your project and files stay in your browser and are never uploaded.
The nine tools in SCL NetStudio
Project & devices.List the IEDs, merging units, gateways, clocks and switches, with the networks each one is on (station bus, process bus, management, SCADA DMZ, engineering) — or import them from an SCD. Every other tool works from this inventory.
IP plan.Subnet calculator and VLSM planner: split one address block between the station networks with growth allowance, then assign every device its address in a fixed order. Exported to Excel and written back into the SCD Communication section.
VLAN & multicast.Allocate a unique MAC address, APPID, VLAN and priority to every GOOSE and sampled-value stream from one set of rules, check them against the IEC 61850-8-1 / 9-2 ranges, and derive the VLAN membership of every switch port, with a vendor-neutral switch configuration template.
Bandwidth.Load of every device port and uplink from GOOSE, sampled values and MMS, in steady state and during a GOOSE avalanche, with or without multicast filtering.
Latency.Transfer time t = ta + tb + tc of a GOOSE message through the switches, including frame transmission, switch latency, worst-case queuing behind a full-size frame and cable propagation, compared with the IEC 61850-5 transfer time class (TT6 = 3 ms for trips).
Redundancy.RSTP, MRP, PRP and HSR compared; HSR ring load, worst path and maximum ring size for a latency budget; PRP bill of quantities (duplicated switches, cables, RedBoxes).
Time synchronisation.PTP (IEC 61850-9-3), SNTP, IRIG-B or 1PPS error budget against the time performance class each function needs (T0–T5), and how long devices stay accurate if GPS is lost.
Firewall planner.Security zones and conduits in the style of IEC 62443, the services allowed on each conduit, warnings for unencrypted protocols (IEC 62351) and rules that break the zone model, and a rule table for the firewall team.
Capture analyser.Open a Wireshark capture taken on site and compare it with the plan: GOOSE stNum/sqNum and time allowed to live, sampled-value continuity and synchronisation, addressing and VLANs, unknown publishers and TCP retransmissions.
SCL NetStudio designs the network around the IEDs. To view, validate and edit the SCL files themselves, use SCL Studio; for a detailed conformance check of GOOSE and sampled values in a capture, with clause references, use the GOOSE & SV Capture Analyzer.
Bandwidth, latency and time-error results are engineering estimates from the stated assumptions (frame sizes, switch latency, worst-case queuing, clock error per device). Confirm them with the switch and IED manufacturers' data and test them on site. The firewall planner proposes rules for review by the security team; it is not a security assessment.
How to use SCL NetStudio
1
Start from the sample substation
The tool opens with S13, a 132/33 kV substation: a gateway, HMI, GPS clock, three protection IEDs, a bay controller and two merging units on three switches (two station bus, one process bus), with four GOOSE and two sampled-value streams. The Project page shows a nine-step checklist with the status of every tool — work down it, or jump to any tool from the left rail.
2
Enter or import the devices
On Project, list each device with its bay, role and the networks it is connected to (station bus, process bus, management, SCADA DMZ, engineering) and its switch. Or use Import SCD to fill devices and streams from your SCD. Load sample project brings S13 back; New empty project starts from scratch.
3
Plan the IP addresses
IP plan has a subnet calculator and a VLSM planner: give the address block (10.13.0.0/22 in the sample) and the host count and growth for each segment; the largest segments are placed first so each starts on its natural boundary. Assign addresses to all devices then numbers them in a fixed order (gateway, HMI, time server, protection, control, merging units).
4
Allocate GOOSE and SV addressing
VLAN & multicast gives each stream a MAC address, APPID, VLAN and priority from your rules (in the sample GOOSE VLAN 10, SV VLAN 11, trip GOOSE priority 6), checks them against the IEC 61850 ranges and for duplicates, works out which VLANs each switch port must carry, and writes a vendor-neutral switch configuration template.
5
Check bandwidth, latency, redundancy and time
Bandwidth shows the load of every port and uplink, steady and during a GOOSE avalanche. Latency adds sender, network and receiver times for a GOOSE and compares the total with the transfer time class (TT6 = 3 ms for trips). Redundancy sizes an HSR ring or a PRP network. Time sync adds up the PTP error budget and compares it with the accuracy class the function needs.
6
Plan the firewall
Firewall planner: define zones with a target security level, list the services each conduit needs, and read the warnings — unencrypted MMS, a corporate network reaching the station LAN directly, GOOSE that needs layer 2 rather than a routed rule. Copy the generated rule table for the firewall team.
7
Verify on site with a capture
Capture analyser opens a Wireshark capture and compares it with the plan: GOOSE stNum/sqNum and time allowed to live, sampled-value continuity and synchronisation, addresses and VLANs, streams missing from the capture and publishers the project does not know. Load sample capture shows a 10-second capture generated from the project with typical site faults.
8
Export
Every tool exports to Excel (IP plan, streams, bandwidth, firewall rules, capture findings), and Export SCD writes the addresses back into the SCD Communication section. The project is kept in your browser; nothing is uploaded.
Worked examples
Step-by-step examples you can follow in the application, with every result checked against it.
An IEC 61850 substation carries three kinds of traffic with very different needs. MMS (client/server) carries reports, controls and file transfer between the IEDs and the gateway or HMI over TCP/IP; it is tolerant of delay. GOOSE carries trips, interlocks and status between IEDs as layer-2 multicast; a trip must reach the subscriber within 3 ms (transfer time class TT6 in IEC 61850-5). Sampled values carry currents and voltages from merging units at 4,000 frames per second per stream at 50 Hz (9-2LE), about 5 Mb/s each, and must not be lost.
The network design therefore has to answer a few questions before anything is bought. Which IP subnets and VLANs keep the traffic apart, and which switch ports must carry which multicast streams? Is every link comfortably below its capacity even when every GOOSE changes at once during a busbar fault? Does a trip GOOSE reach its subscriber in time through the chosen number of switches? Which redundancy scheme (RSTP, MRP, PRP or HSR) gives the recovery time the protection needs? Is the time synchronisation accurate enough for sampled values (±4 µs for protection, class T4)? And which services may cross between the station LAN, the SCADA DMZ, engineering access and the corporate network?
SCL NetStudio answers each question with its own tool, all working from one inventory of devices and streams that can be imported from, and written back to, the SCD file. A capture analyser then checks the commissioned network against the plan.
Engineering practice values are rules of thumb; follow the project specification where it differs.
Frequently asked questions
What is the difference between SCL Studio and SCL NetStudio?
SCL Studio opens, validates and edits the SCL files themselves (data model, data sets, GOOSE/SV/report control blocks, references). SCL NetStudio designs the network around the IEDs: IP plan, VLANs and multicast, bandwidth, latency, redundancy, time synchronisation, firewall zones and on-site verification. Both read and write the SCD.
Does the bandwidth calculation include the GOOSE burst after a fault?
Yes. The burst figure assumes every GOOSE changes state at the same moment (avalanche) and is retransmitted at the MinTime / MaxTime scheme — about 9 frames in the first second per stream with MinTime 4 ms.
Can it configure my switches?
It writes a vendor-neutral configuration template (VLANs, port membership, priority trust, multicast filtering) to translate into your switch's CLI or web interface. It does not connect to the switches.
Is the project uploaded anywhere?
No. The project is stored in your browser and capture files are analysed locally. Export to Excel or SCD to keep a copy.
For preliminary engineering use. Results must be checked by a qualified engineer against the project's standards. How results are checked · Terms & disclaimer · Build 93206b8 · 2026-11-11