Industry consortium
HART
Digital communication superimposed on the classic 4–20 mA analog loop, used for device configuration, diagnostics and calibration data.
N/A — field wiringAnalog 4–20 mA with FSK digital overlayEncryption: No
How it works
A master (handheld or host) modulates an FSK signal on the current loop and receives digital device responses without disturbing the analog value.
Communication patternHandheld / asset management system → field device configuration and diagnostics.
Fact sheet
TransportAnalog 4–20 mA with FSK digital overlay
PortsN/A — field wiring
AuthenticationNone
PurdueLevel 0
EnvironmentsProcess instrumentation
DevicesTransmitter, Valve positioner, Field device
IndustriesOil & Gas, Chemical, Pharmaceutical
Why should I care?
Understanding HART is what lets you tell a routine poll from a process-affecting command. Detection here depends on knowing which peers, function codes and timings are normal for your plant.
Key functions and operations
- Read device variables
- Device configuration
- Calibration
- Diagnostics
Security concerns
- Configuration changes at the loop require only physical access
- Asset-management servers reach many devices at once
- Range or damping changes can distort the process view
What normal looks like
- Configuration activity only during calibration work orders
What deserves attention
- Device configuration changes with no work order
- Asset management server accessed by unusual accounts
Hunting ideas
- unauthorized-firmware-change
- abnormal-authentication
Defensive controls
- Protect asset management servers as engineering systems
- Reconcile device configuration changes against work orders
Related ATT&CK for ICS techniques
T0857
Sources & further reading