Join the Conversation on Variable Frequency Drives and Cybersecurity

Cybersecurity was a huge topic at the ARC’s Industry Forum in Orlando last month.  Among the many workshops and presentations in the cybersecurity session, one of the more interesting presentations was by an MIT professor, Stuart Madnick.   Dr. Madnick provided an academic perspective of cyber-attacks and related hazards of industrial control systems in the energy sector.  Furthermore, he pointed out that attackers could overwrite firmware, such as firmware in variable frequency drives, which could have disastrous consequences. 

Dr. Madnick discussed an interesting analysis that his team had conducted at MIT on the potential impact that even small firmware changes could have on a low-power variable frequency drive (VFD).   Changes to six lines of code could release the energy stored in capacitors and cause a variable frequency drive to blow up.  Based on its calculations, the MIT team estimated that the blow out of the energy stored in capacitors in the VFD driving a 400 HP motor at MIT would have resulted in serious damage to the surroundings!   Furthermore, recovery could take months due to the long lead times required to replace equipment.

Virtually every industrial operation uses variable frequency drives, so there is a high potential risk of a cyber-attack.   Additionally, since safety and failsafe mechanisms in many VFDs are also implemented in software, a dedicated attacker could remove all safety limits for an application.  With this background, it appears that industrial facilities should have significant concerns due to the possibility of either a blow out or operating under unsafe conditions. 

While Dr. Madnick’s analysis was hypothetical; it implies potentially serious consequences.  ARC would like to hear your opinion on these threats for real-world variable frequency drives systems installations.  For example:

1. Should there be concern about the above scenarios for real world variable frequency drive applications, particularly in critical industries like energy production, oil & gas, and chemicals?
2. How cyber-safe are the variable frequency drives system installations you are involved in?
3. Are cyber-attack concerns serious enough for variable frequency drives system installations to invest in necessary precautions against such cyber-attacks? If so, what precautions would you recommend?
4. Should all or certain variable frequency drives systems used in certain critical applications be burdened by the cost to minimize cyber risk such as above?

Cyber security in the industrial arena is on everyone’s mind these days.  I would love to hear your comments on cybersecurity as they relate specifically to variable frequency drive systems.  Please email these to me at [email protected].