Industry consortium
FOUNDATION Fieldbus
An all-digital fieldbus that can execute control function blocks in field devices themselves, common in large continuous process installations.
N/A / Ethernet for HSEH1 (31.25 kbit/s) and HSE over EthernetEncryption: No
How it works
A link active scheduler coordinates deterministic publishing of function-block data between devices on an H1 segment.
Communication patternScheduled publisher/subscriber exchange on each segment.
Fact sheet
TransportH1 (31.25 kbit/s) and HSE over Ethernet
PortsN/A / Ethernet for HSE
AuthenticationNone
PurdueLevel 1 – Level 0
EnvironmentsContinuous process plants
DevicesTransmitter, Valve, Linking device, DCS controller
IndustriesOil & Gas, Chemical, Pharmaceutical
Why should I care?
Understanding FOUNDATION Fieldbus is what lets you tell a routine poll from a process-affecting command. Detection here depends on knowing which peers, function codes and timings are normal for your plant.
Key functions and operations
- Function block execution
- Scheduled data publishing
- Device configuration
Security concerns
- Control logic distributed into field devices widens the change-management surface
- No authentication; physical and host-side controls dominate
What normal looks like
- Stable segment live list and schedule
What deserves attention
- Function block configuration changes outside change control
Hunting ideas
- controller-logic-changes
Defensive controls
- Treat configuration workstations as engineering assets
- Capture device configuration baselines
Related ATT&CK for ICS techniques
T0836
Sources & further reading