ISIS Iran Report

Stuxnet Worm Targets Automated Systems for Frequency Converters: Are Iranian Centrifuges the Target?

Stuxnet Worm Targets Automated Systems for Frequency Converters: Are Iranian Centrifuges the Target? photo

November 17, 2010

On Friday, November 12, 2010, the Symantec Corporation posted an update of its analysis of the Stuxnet worm and narrowed the target to automated systems that control frequency converters manufactured by two firms: Fararo Paya in Tehran, Iran, and Vacon in Finland.  It concludes that frequency converters in Iran’s gas centrifuge plants could be the target of Stuxnet. 

The information, on its own, is not yet sufficient to determine if Stuxnet is indeed aimed at Iranian centrifuge plants.  Frequency converters of the type identified as Stuxnet’s target have many other uses than centrifuge plants.  For example, they are used to drive turbomolecular vacuum pumps, which are not typically used in centrifuges plants but have wide application in high-technology industries. 

Moreover, it is unknown if Fararo Paya provides frequency converters to the Iranian enrichment program.  In any case, it is unlikely that Fararo Paya makes frequency converters from scratch for Iran’s enrichment plants.  It likely either makes them from major subcomponents acquired abroad or purchases them intact from overseas suppliers.  The latter is difficult to accomplish successfully since frequency converters with a range of 600-2,000 Hz are considered nuclear-related dual-use goods controlled for export by Nuclear Suppliers Group (NSG) guidelines.  But Iran could pursue a strategy of seeking major subcomponents abroad, which are less controlled. 

Despite the need for more confirmation of Stuxnet’s target, Symantec makes a legitimate case that Stuxnet could indeed disrupt or destroy Iranian P1-type centrifuge plants.  The “P” stands for Pakistan, which was the supplier of the centrifuge designs and initial P1 centrifuges used at the Natanz enrichment plants.  Iran in parallel created a manufacturing complex to make P1 centrifuges, which it calls IR-1 centrifuges, using a wide variety of goods acquired illegally from abroad by its smuggling networks. 

In the Symantec post, Eric Chien writes:

Once operation at those frequencies occurs for a period of time [Stuxnet requires the frequency converter drives to be operating at between 807 Hz and 1210 Hz], Stuxnet then hijacks the PLC code and begins modifying the behavior of the frequency converter drives.  In addition to other parameters, over a period of months, Stuxnet changes the output frequency for short periods of time to 1410Hz and then to 2Hz and then to 1064Hz.  Modification of the output frequency essentially sabotages the automation system from operating properly.  Other parameter changes may also cause unexpected effects.

For the P1 centrifuge found at the Natanz enrichment plants, a frequency of 1410 Hz would translate into a tangential rotor wall speed of 443 meters per second, faster than what the aluminum P1 rotor could withstand.  As a result, if the frequency of the rotor increased to 1410 Hz, the rotor would fly apart when the tangential speed of the rotor exceeded about 400 meters per second.  If the rotor did not reach that speed—perhaps the computer control system responds by slowing down or shutting down the centrifuge—Stuxnet would send its next command to lower the frequency to 2 Hz.  If the rotor assembly slowed down too quickly it might not survive its passage through critical frequencies.  Centrifuge plants are designed to empty centrifuges quickly of uranium hexafluoride in the event of a malfunction.  The reason is that if a centrifuge rotor assembly runs down with the uranium hexafluoride inside, the rotor will likely become unbalanced and “crash,” or break.  The article by Chien does not state whether the worm can block the plant’s control system from dumping uranium hexafluoride. 

The final Stuxnet command is a speed-up to 1064 Hz.  Again, the rotor may not survive the critical frequencies as it approaches the frequency of 1064 Hz, which corresponds to a tangential rotor wall speed of about 334 meters per second.  This speed is a more typical operational speed of Iran’s P1 centrifuge.  The sequence instituted by Stuxnet could apply to the Iranian P1 centrifuge, where from a normal operational speed, the worm commands a speed-up, followed by a slow-down, and than a return to near the original speed. 

For a P2-type centrifuge of the type Iran is developing, 443 meters per second is the nominal speed for a maraging steel rotor and well within the operational limits of a carbon fiber rotor.  The effect of Stuxnet for a P2-type rotor would be to possibly cause multiple runs through critical frequencies in a centrifuge not designed to pass through critical frequencies quickly.  Stuxnet’s effect would likely be less destructive in the case of the P2-type centrifuge plant.

The plant’s control system would be expected to respond to each step ordered by Stuxnet in order to protect the centrifuges and the plant.  It is unknown how effective that defense would be, since little is known publicly about the Iranian control system at its enrichment plants.  Chien may be correct that the effect of Stuxnet may be to prevent an Iranian enrichment plant’s automation system from operating properly, thus diminishing centrifuge performance or causing centrifuge breakdowns.  Whether Stuxnet could cause widespread centrifuge crashes, in essence destroying the whole or substantial parts of the plant, is unclear.

email us twitter Share on Facebook