IEC 61850 digital substations depend on communication services whose compromise can affect protection, supervision, and control. Existing work has advanced substation threat modeling, cyber-physical testbeds, and intrusion detection, but the relation between structured threat priority and operational observability remains under-characterized. This article examines that relation in a smart grid simulator (SGSim)-based IEC 61850 digital-substation environment. DFD-guided STRIDE analysis, CVSS v3.1 scoring, likelihood–impact prioritization, and ATT the SYN flood weakens control recoverability while remaining weakly visible at the operator plane; and the GOOSE FDI case preserves communication continuity while falsifying the represented operational state. These findings indicate that visible disruption alone is insufficient for interpreting cyber-physical severity in the studied SGSim-based digital substation.
Alolabi et al. (Sat,) studied this question.