IEC 61850 SCL Substation Configuration File
IEC 61850 System Configuration Language (SCL) files for a configured substation or IED: SCD, ICD, CID, SSD and IID exports from substation configurator tools. Detects the SCL XML namespace and the populated Communication section (ConnectedAP with IP addressing, GOOSE and Sampled Values multicast MAC addresses in the 01-0C-CD range, APPIDs) plus IED, logical device and control-block structure. A populated SCD/CID gives the station bus network plan, IED names and GOOSE trip-signal addressing for a live substation.
- Type
- regex
- Engine
- boost_regex
- Confidence
- high
- Confidence justification
- High: the SCL namespace URI and the P type="IP" / P type="MAC-Address" / P type="APPID" address elements are machine-format structures that essentially only occur in IEC 61850 SCL files. Residual false positives are developer fixtures and schema documentation, which are excluded. 85/75 are heuristic evidence tiers, not measured accuracy; test values are synthetic SCL fragments shaped like the libiec61850 and OpenSCD sample files.
- Jurisdictions
- global
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth), Directive (EU) 2022/2555 (NIS2)
- Frameworks
- IEC 62443, IEC 61850, NIST CSF, AESCSF
- Data categories
- infrastructure, technology
- Scope
- narrow
- Risk rating
- 9
- Platform compatibility
- Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Unsupported
Pattern
xmlns(?::[A-Za-z]{1,10})?="http://www\.iec\.ch/61850/2003/SCL"Corroborative evidence keywords
GSEControl, ReportControl, SampledValueControl, ConnectedAP, SubNetwork, GOOSE, APPID, LDevice
Proximity: 1000 characters
Should match
<?xml version="1.0" encoding="UTF-8"?> <SCL xmlns="http://www.iec.ch/61850/2003/SCL" version="2007" revision="B" release="4"> <Header id="WATTLEBIRD_ZS_132kV" nameStructure="IEDName" version="3" revision="12"/> <Communication> <SubNetwork name="STATION_BUS_A" type="8-MMS"> <ConnectedAP iedName="WBZ_F07_PROT" apName="S1"> <Address> <P type="IP">172.20.14.21</P> <P type="IP-SUBNET">255.255.255.0</P> <P type="IP-GATEWAY">172.20.14.1</P> </Address> <GSE ldInst="PROT" cbName="gcbTrip"> <Address> <P type="VLAN-ID">00A</P> <P type="VLAN-PRIORITY">4</P> <P type="MAC-Address">01-0C-CD-01-00-1A</P> <P type="APPID">3A01</P> </Address> </GSE> </ConnectedAP> </SubNetwork> </Communication>— 85 - CID with populated IP, GOOSE MAC, APPID and a GSE control-block address<SCL xmlns:sxy="http://www.iec.ch/61850/2003/SCLcoordinates" xmlns="http://www.iec.ch/61850/2003/SCL"> <Substation name="KOORALBYN_66" desc="Zone substation"> <VoltageLevel name="E1" nomFreq="50.0" numPhases="3"> <Bay name="FDR_03"><ConductingEquipment type="CBR" name="QA1"/></Bay> </VoltageLevel> </Substation> <Communication> <SubNetwork name="PROCESS_BUS" type="8-MMS"> <ConnectedAP iedName="KRB_MU_03" apName="P1"> <Address><P type="IP">10.66.3.40</P></Address> <SMV ldInst="MU01" cbName="MSVCB01"> <Address><P type="MAC-Address">01-0C-CD-04-00-03</P><P type="APPID">4003</P></Address> </SMV> </ConnectedAP> </SubNetwork> </Communication>— 85 - SCD with Substation section, IP, Sampled Values MAC, APPID and SMV control block<SCL xmlns="http://www.iec.ch/61850/2003/SCL"> <Header id="REL_670_ICD" nameStructure="IEDName"/> <IED name="RC670_BAY_IED" manufacturer="Relayco" type="RC670" configVersion="2.1"> <AccessPoint name="S1"><Server><LDevice inst="CTRL"> <LN0 lnClass="LLN0" lnType="LLN0_1" inst=""/> </LDevice></Server></AccessPoint> </IED>— 75 - vendor ICD with namespace and IED / LDevice structure but no addressing<ConnectedAP iedName="MRV_BCU_12" apName="S1"> <Address> <P type="IP">192.168.40.112</P> <P type="IP-SUBNET">255.255.255.0</P> </Address> </ConnectedAP>— 75 - ConnectedAP fragment with a populated station-bus IP (namespace outside the window)
Should not match
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns="http://www.iec.ch/61850/2003/SCL" targetNamespace="http://www.iec.ch/61850/2003/SCL"> <xs:element name="SCL"><xs:complexType><xs:sequence> <xs:element name="Header" type="tHeader"/> <xs:element name="IED" type="tIED" minOccurs="0" maxOccurs="unbounded"/> </xs:sequence></xs:complexType></xs:element>— SCL.xsd schema documentation (published specification text)<SCL xmlns="http://www.iec.ch/61850/2003/SCL"> <Header id="" nameStructure="IEDName"></Header> <Communication><SubNetwork name="subnetwork1" type="8-MMS"> <ConnectedAP iedName="simpleIO" apName="accessPoint1"><Address> <P type="IP">10.0.0.2</P> <P type="IP-SUBNET">255.255.255.0</P> </Address> <GSE ldInst="GenericIO" cbName="gcbEvents"><Address> <P type="MAC-Address">01-0c-cd-01-00-01</P><P type="APPID">1000</P> </Address></GSE></ConnectedAP></SubNetwork></Communication> <IED name="simpleIO">— libiec61850 example CID (sample address 10.0.0.2)<SCL xmlns="http://www.iec.ch/61850/2003/SCL" version="2007" revision="B" release="4"> <Header id="TrainingIEC61850" nameStructure="IEDName"/> <DataTypeTemplates> <LNodeType lnClass="LLN0" id="LLN0_Template"><DO name="Mod" type="ENC_Mod"/></LNodeType> </DataTypeTemplates>— Blank DataTypeTemplates file from a training fixture (no IED, no addressing)IEC 61850 training course, module 4: editing the SCD file. The trainer shows a ConnectedAP with <P type="IP">192.168.1.10</P> and a GOOSE MAC-Address 01-0C-CD-01-00-01 so students can see where addressing lives.— Training slide text quoting SCL snippetsRelayco launches a cloud IEC 61850 SCL editor that imports .scd and .icd files and validates GOOSE subscriptions in seconds, the company said on Tuesday.— News / marketing text
Known false positives
- IEC 61850 schema (SCL.xsd) and standard text quote element names and the namespace. Mitigation: Enforce tiers need populated element markup (IED name=, ConnectedAP iedName=, P type="IP" values) and exclude xs:element / xs:complexType / xs:schema.
- Open-source library fixtures (libiec61850 examples, OpenSCD test files) are real SCL but describe no live site. Mitigation: The libiec61850 sample address 10.0.0.2, "libiec61850", "server_example" and the OpenSCD "TrainingIEC61850" header are excluded; in a large SCD the Header can sit outside the window, so an OpenSCD fixture may still reach 75 through its ConnectedAP section.
- Vendor ICD templates carry IED and LDevice structure with no station addressing. Mitigation: They reach 75 only; 85 needs a populated IP, a 01-0C-CD MAC or APPID, and a control block.
- Training decks and forum posts that paste SCL snippets. Mitigation: Template/noise exclusion plus "IEC 61850 training"; prose mentions of the standard stay at 65.