Substation-to-Control-Centre WAN

The substation-to-control-centre WAN is the wide-area network that connects every transmission substation back to the control-centre data hall where the EMS, ADMS, and SCADA systems run. It is not a single-purpose link — multiple traffic types share the same physical transport:

• SCADA telemetry — RTU polls and event-driven reports flowing northbound to the SCADA front-end via DNP3 or IEC 60870-5-104.
• Protection inter-tripping — fast signalling between substations at either end of a transmission line, so that a fault detected at one end triggers breaker opening at the other within milliseconds.
• Synchrophasor data — PMU streams at 50 frames per second to the control-centre Phasor Data Concentrator for wide-area monitoring.
• Engineering access — remote connection to substation IEDs, merging units, and network switches for configuration, firmware updates, and fault investigation.
• Operational voice — the dedicated voice circuits that control-room operators use during switching and emergency procedures.

The physical transport underneath is typically the operational telecoms network — utility-owned fibre (OPGW strung along transmission pylons) or leased MPLS circuits, or a combination of both.

Transports

The WAN rides on the operational telecoms backbone. Common transport options:

• Utility-owned OPGW fibre — optical fibres inside the earth wire on transmission pylons, giving the operator a private fibre route between every substation on a pylon circuit. The preferred option where available; RIIO-T3 is funding continued expansion.
• Service-provider MPLS — leased circuits, typically committed at three-or-four-nines availability, used where the operator does not own fibre or as a secondary path alongside OPGW.
• Cellular or satellite backhaul — for remote sites where wired transport isn’t economic, often as a failover behind one of the above.
• Hybrid layered designs — primary OPGW, MPLS failover, cellular last-resort at the substation edge, dual-path routing into the control room.

Protocols

The northbound application protocols are typically DNP3 (UK distribution, North America) or IEC 60870-5-104 (European transmission), running at poll cycles of seconds to tens of seconds.

Both were originally specified without authentication or encryption. End-to-end protection is provided by IEC 62351 (DNP3 Secure Authentication, TLS for TCP-based protocols) or by network-layer mechanisms (IPsec, MACsec) where the application-layer crypto isn’t available in the installed base.

What does not traverse the WAN

The tight-deadline substation traffic — Sampled Values, trip GOOSE — does not leave the substation. It lives on the substation LAN with its own PRP or HSR redundancy. The WAN carries telecontrol, telemetry, engineering access, and voice — but not the sub-millisecond process-bus traffic that stays within the substation fence. (Protection inter-tripping between substations does traverse the WAN, but on dedicated channels with strict latency budgets, distinct from the SCADA poll traffic.)

Availability framing

WAN availability targets vary by role. Backbone segments between control centres are typically engineered to four or five nines. Per-site access circuits into individual substations are often committed to lower contractual floors with the tolerance budget absorbed by:

• RTU autonomy — the RTU continues logging and executing pre-configured control logic during uplink outages, syncing back when connectivity returns.
• Redundancy above the WAN — dual-path routing, failover transports, SCADA front-end redundancy.

The WAN is one of the conduits that an IEC 62443 zone-and-conduit design has to enumerate explicitly — it’s a semi-trusted boundary between the substation zone and the control-centre zones.