The PLC says the valve is open, the HMI agrees — but the valve is physically closed. Who is lying? OT-security specialist Joe Weiss’s answer in Control Global is worth pinning above every control-room desk: a command is not proof of an action, and an indication is not proof of a physical condition. A PLC output only proves a command was issued; position feedback only proves the actuator reached some position; neither proves the intended process result happened — and real events through 2026 (a nuclear unit trip, a city water outage) show display-versus-physics divergence is not a theoretical risk.
The operator issues an open command, the PLC output turns on, the HMI shows open — yet the field valve has not moved. Candidates: failed solenoid, loss of instrument air, faulty actuator, incorrect limit-switch feedback, wiring fault, configuration error — or something more nefarious. The key point: a command is not proof of an action; feedback may confirm the actuator or valve reached a particular position, but neither establishes that the intended process condition occurred — and the two can be reporting different states.
Fisher FIELDVUE DVC6200 digital valve controller (source: Control Global)
Digital valve controllers like the Fisher FIELDVUE DVC6200 are everywhere — refining, power, nuclear, LNG, water. Far more capable than a plain positioner: digital communications, position feedback, diagnostics. The same capability introduces cybersecurity considerations: the HART pathway can be used for unauthorized configuration changes, altered calibration parameters, misleading diagnostics, changed valve response. Whether malicious, accidental or equipment-related, the impact is similar. Crucially, digital communications do not mean every HART implementation is remotely accessible — exposure depends on configuration, access arrangements and architecture; security assessments must treat digital communications and the physical process together.
On April 7, 2026, CISA identified Iranian-affiliated cyber actors manipulating HMI/SCADA displays in US critical infrastructure — showing operators process conditions that did not exist. Operators depend entirely on displays to understand the physical process; wrong displays mean decisions based on premises that do not exist, in automatic and manual operation alike. Stuxnet (2010) was the same idea: man-in-the-middle replay made displays look normal while centrifuges were being destroyed — the attack targeted the integrity of the information operators relied on.
| Event | What happened | Lesson |
|---|---|---|
| BP Texas City refinery explosion (Mar 2005) | 15 dead, ~170 injured; CSB cited level indicator, level alarm and control-valve position deficiencies | Without reliable process information the consequences can be catastrophic |
| Stuxnet (2010) | Replayed data deceived operators while centrifuges were damaged | The target was display-physics integrity itself |
| Hatch Unit 1 automatic trip (Apr 2026) | Turbine control valves inserted while a broadcast storm froze displays and suppressed alarms | Display failure amplifies whatever is already going wrong |
| Municipal water plant SCADA failure (Sep 2026) | Frozen screens kept showing a full tank while level fell; wells never started; plant shutdown and boil-water notice | A network that "looks normal" provides no assurance |
The API Cybersecurity Conference (Nov 10–11, 2026) agenda lists neither process-sensor integrity nor control-valve digital communications; yet per API, 31% of 2023 refinery process-safety incidents traced to undiagnosed control-valve degradation — over half despite "no anomalies" in routine maintenance logs. One DVC6200 case: a US monoclonal-antibody plant lost sterile isolation pressure on a buffer skid, found only after three consecutive batch rejections — while positioner diagnostics logged "minor signal lag, within vendor tolerance" for four weeks. The myth worth pinning on the wall: "digital positioners eliminate mechanical failure risk" is false — they add firmware bugs, EMI and power-supply instability; in that dataset 22% of "smart valve" failures involved corrupted positioner memory or uncommanded zero-shift, none of which a hydrotest would reveal.
Weiss’s recommendation is one independent principle: monitor the physics to answer whether displays agree with reality — independently collect pressure, flow, temperature, level, voltage and current data without relying on the PLC/HMI/historian paths operators normally use; when independent monitoring disagrees with the displays, investigate regardless of cause. Monitoring communications and monitoring physics are both important, and neither substitutes for the other. For instrument technicians: (1) verify limit-switch feedback against the actual valve; (2) spot-check smart-positioner diagnostics — that 22% memory-failure class does not alarm by itself; (3) for critical interlocks, add a process-side cross-check (downstream pressure/flow) to the position feedback.
Local/remote wiring-fault case · Feedback control basics · Fisher DVC2000 hands-on · Bernard optical absolute encoder · Pneumatic actuator verification & maintenance in petrochemical plants
For actuator sizing, alternatives and repair submit an RFQ.
Source: Control Global, Unfettered Blog, Joe Weiss, "The PLC says the valve is open. The HMI agrees. But what if neither is telling the truth?" (Nov 4, 2026); compiled by actuators.cn.
An industry resource for electric & pneumatic actuators, dampers and heaters: brand manuals, sizing guides and maintenance know-how. Global brands in, China manufacturing out.
