HART Protocol Security
HART (Highway Addressable Remote Transducer) was developed in 1986 and is the most widely deployed digital field instrument protocol globally — with an estimated 40 million HART-enabled devices in service. It overlays FSK (Frequency Shift Keying) digital signals at 1200 baud on the existing 4-20mA analog current loop, allowing simultaneous analog process measurement and digital communication without disrupting the control signal.
The digital channel carries device diagnostics, configuration parameters, engineering units, and secondary variables that the analog signal cannot convey. HART-IP (2012) extends HART protocol over TCP/UDP networks, enabling integration with higher-level systems without dedicated hardware.
4-20mA + HART Architecture
The 4-20mA loop carries the primary process variable: 4mA represents 0% of range; 20mA represents 100%. The HART digital signal rides on top without interfering with the analog current. A HART master (handheld communicator or multiplexer) communicates with up to 15 devices per loop in multi-drop mode.
Security Vulnerabilities
- No authentication by default — HART write commands (SetPoint, Mode change, Tag write) require no credentials in the base protocol
- Physical bus access = full control — any device connected to the 4-20mA loop can issue HART commands to field instruments
- Sensor spoofing — trim commands can shift a sensor's calibration, causing process controllers to act on false measurements
- Mode manipulation — HART command 12 (Lock Device) or mode switch to Fixed Current output can disable normal device operation
- HART-IP exposure — HART multiplexers with HART-IP enabled on TCP port 5094 may expose all HART devices on connected loops to the network
HART Security Layer
HART 7 introduced an optional challenge-response authentication mechanism for write commands. When enabled, the device issues a challenge nonce; the master must respond with an HMAC computed from the nonce and a pre-shared device key. Without this layer, all HART write commands are unauthenticated. Field adoption is very limited.
Defences
| Control | SR | Effect |
|---|---|---|
| Enable HART challenge-response | SR 1.2 | Authenticates write commands to field instruments |
| Restrict HART-IP port 5094 | SR 5.2 | Allow only asset management server IPs |
| Physical loop security | SR 5.1 | Restrict access to field junction boxes and marshalling panels |
| Calibration audit trail | SR 2.8 | Log all trim/calibration changes for anomaly detection |
Examine HART command structure, sensor spoofing via trim manipulation, and HART-IP network exposure in the interactive protocol lab.
Open HART Protocol Lab →