IEC 61850 IED Discovery With OTserver
Overview
IEC 61850 models substation equipment as intelligent electronic devices (IEDs), logical devices, logical nodes, and data objects. OTserver Otter browses the MMS model and reads a fixed set of advertised identity and status attributes, preserving the evidence against a MAC-identified asset.
How OTserver discovers IEC 61850 devices
Otter connects to MMS on TCP port 102, retrieves the server’s logical-device directory, and browses the logical nodes and their advertised variables. It reads only matching attributes from its fixed allowlist: identity under functional constraint DC and status under ST.
The scanner uses two-second connection and request timeouts, one outstanding MMS request, and directory limits of 64 logical devices, 256 logical nodes per device, and 4,096 advertised variables per node. Missing attributes are skipped. Individual read failures or unexpected value types produce warnings while other collected evidence is retained.
Evidence extracted
| OTserver evidence | IEC 61850 source |
|---|---|
| Vendor, model, serial number | LPHD1.PhyNam.vendor, .model, .serNum, with LLN0.NamPlt alternatives |
| Hardware version | LPHD1.PhyNam.hwRev |
| Firmware and location | LPHD1.PhyNam.swRev and .location, with LLN0.NamPlt alternatives |
| Health | Advertised Health.stVal, decoded as ok, warning, or alarm |
| Physical health | Advertised PhyHealth.stVal when returned as a boolean |
| Blocking status | Advertised boolean BlkOpn.stVal and BlkCls.stVal |
| Position | Advertised Pos.stVal, decoded as intermediate, off, on, or bad-state |
| Operation count | Advertised integer OpCnt.actVal or OpCnt.stVal |
| Additional raw evidence | Logical-device and logical-node directories, advertised variables, and values keyed by object reference and functional constraint |
The first successfully decoded value for each normalized field is retained, while per-object readings remain in raw evidence. Identity reads use the exact LPHD1 and LLN0 node names; a device with a different identity layout may expose less metadata. The display name falls back to the model, then the vendor.
Security and read-only safety
Otter browses directories and reads the listed attributes. It does not access control, report, setting-group, file, or write services and does not issue breaker commands. This is MMS discovery, not GOOSE or Sampled Values capture, subscription, or transmission.
IEC 61850 is enabled by default. Disable it with --no-iec61850, set "noIec61850": true in otter.json, or turn off IEC 61850 in the GUI. Every scan requires --ack-authorized.
Frequently asked questions
How is this different from S7 discovery on port 102?
Both protocols use ISO-on-TCP, but they have different application exchanges. S7 discovery reads Siemens system-status lists; IEC 61850 discovery establishes an MMS association and browses the IED model. An open TCP port alone does not identify either protocol.
Does a position reading mean Otter can operate the breaker?
No. Otter reads the advertised status value only. Control services and state-changing commands are outside this discovery implementation.
Compare all supported discovery protocols or configure the scanner.