An MMS client gets a connection somebody can refuse. It opens ISO-on-TCP to port 102 on the IED [6], and once that is up the useful questions are all session-shaped: whether the server will accept an anonymous session, what objects it will disclose, and which operations require authorization, including whether control operations are protected [21][10]. Every one of those answers lives in server state, and server state can be configured to say no.
A Sampled Values subscriber gets a frame. Tesla's process-bus list is that gap written out five ways: who is allowed to publish, how publisher state is represented, how sequence numbers are interpreted, what happens when frames originate from an unexpected source, and whether a subscriber can distinguish legitimate traffic from manipulated traffic [11]. Those are posed as research questions, not as findings, and the published section stops before answering them.
Count the two lists. Five questions on the station bus side, five on the process bus side, one of the station-bus five turning on establishing a session, and none of the process-bus five referring to a session or a connection at all [19]. The delta comes down to one fact: on the process bus there is no connection event to attach an identity to. Provenance has to be inferred from frame contents instead.
The phase ordering here is the part I would copy. Configuration came first, before any attack on the network protocols [22], because SCL describes IED capabilities, logical nodes, communication parameters, datasets and the relationships between devices [12]. That makes the configuration the reference model, and observed wire behaviour only means something when read against a known data model [14].
The historical detour earns its place. Parker McCauley pointed Tesla at Bruce Muschlitz, a former UCA conformance-testing participant, with the instruction to ask about the UCA decision dart board [16]. What came back was an older 9-2LE Sampled Value capture, a legacy Excel visualisation tool, and observations on how conformance testing used to be performed [17]. The state of the art for reading a process-bus capture, in that lineage, was a spreadsheet.
Whether any of this transfers to a live substation depends on where the observations came from. The observations came from packet captures, custom Python tooling, native library examples, malformed-input testing and direct observation of simulated IEDs [8]. Simulated publishers and subscribers accept and reject frames according to one library's implementation choices. Timing, state and sequencing are exactly where implementations diverge [4], and they are also what the process-bus questions turn on. So a result from this bench is evidence about libIEC61850 first and about a merging unit second, and the sequence-number cases would need re-running against the real relay before anyone writes an acceptance criterion from them.
