On Oct. 29, 2026, the following blog was published by Michael Akparibo Alung: “Controversial Question: The Programmable Logic Controller (PLC) Says the Valve Is Open. But the Valve Is Physically Closed. Who Is Lying?”

Consider the scenario. You are in a control room monitoring an industrial process. The operator issues an open command to a valve. The PLC output turns on, and the HMI indicates that the valve is open. However, when someone inspects the valve in the field, it is still closed. What went wrong?

Possibilities include a failed solenoid valve, loss of instrument air, a faulty actuator, incorrect limit-switch feedback, a wiring fault, a programming issue or something more nefarious. Here is the important point: A command is not proof of an action. A PLC output confirms that a command has been issued. Feedback may confirm that the actuator or valve has reached a particular position, depending on the instrumentation provided.

However, neither necessarily establishes that the intended process condition has actually occurred and each can be reporting different conditions. This distinction is fundamental to understanding control system cybersecurity, process safety and operational reliability.

The Fisher FIELDVUE DVC6200 digital valve controller is used across numerous industries, including oil and gas, petroleum refining, chemical and petrochemical processing, electric power generation, nuclear power, water and wastewater, LNG, mining and metals, pulp and paper, food and beverage, pharmaceuticals, and marine and offshore operations. The DVC6200 is considerably more sophisticated than an ordinary valve positioner. Its capabilities provide significant operational and maintenance benefits, including digital communications, valve-position feedback, and diagnostic information. However, these same digital capabilities introduce cybersecurity considerations.

Potential cybersecurity considerations and gaps

The DVC6200 uses HART digital communications. This creates an additional pathway through which configuration and diagnostic information can be accessed. Depending on the implementation, a compromise of the digital communications pathway or device configuration could affect the integrity of valve operation or the information available to operators and maintenance personnel. Potential concerns include:

• Unauthorized or unintended configuration changes.
• Altered calibration parameters.
• Misleading diagnostic information.
• Changes affecting valve response or operating characteristics.

The impact can be similar whether the underlying cause is malicious, accidental or the result of equipment or configuration problems. Importantly, the existence of digital communications does not mean that every HART implementation is remotely accessible or that every configuration change can be made through the same pathway. Actual exposure depends on the device configuration, access arrangements, and system architecture. The broader concern is that cybersecurity assessments must consider the integrity of digital communications and the physical process, not simply the security of the network carrying the information.

CISA identifies Iranian manipulation of operator displays

On Apr. 7, 2026, CISA identified Iranian-affiliated cyber actors manipulating operator displays in U.S. critical infrastructure. The joint advisory, “Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure,” specifically identified the manipulation of HMI and SCADA displays. The advisory described how Iranian-affiliated actors manipulated information presented to operators, potentially causing them to see incorrect process conditions.

This is particularly significant because operators depend on these displays to understand what is happening in the physical process. If the information displayed is incorrect, operators may make decisions based on conditions that do not actually exist. This applies to both automatic and manual operations. The problem is not limited to whether a PLC received the correct command or whether a network communication was successful. The fundamental question is whether the information presented to the operator accurately represents the physical process.

Differences between operator displays and the physical process can have serious consequences

Returning to the Fisher valve scenario, several conditions could create discrepancies between the displayed valve position and actual operation:

• Incorrect configuration: A configuration error can produce unintended valve behavior and hazardous process conditions.
• Incorrect calibration: The actual valve position may differ from the expected position.
• Misleading position feedback: Reported valve position does not necessarily establish that the intended process result has been achieved.
• Compromised diagnostics: Diagnostic information may be incomplete or misleading if the underlying configuration, instrumentation, or communications are compromised.

The larger issue is that even accurate valve-position feedback does not necessarily establish that the process is operating as intended. For example, a valve may indicate that it is open, but there may be no flow because of a blocked pipe, a failed pump, or another process condition. Knowing what the controller commanded, what the valve reports and what is actually happening in the process are three different things.

Examples of the consequences of incorrect displays and sensor information

Several important incidents demonstrate the consequences of discrepancies between displayed information and actual physical conditions.

The March 2005 BP Texas City refinery explosion killed 15 people and injured approximately 170 others. The U.S. Chemical Safety and Hazard Investigation Board identified multiple deficiencies involving instrumentation, including problems associated with the level indicator, level alarm and control valve position. The incident demonstrated the potentially catastrophic consequences when operators do not have reliable information about actual process conditions.

The 2010 Stuxnet attack demonstrated that cyberattacks could manipulate industrial control systems while deceiving operators about what was happening physically. Stuxnet used man-in-the-middle techniques, including replaying previously recorded information, to make operator displays appear normal while centrifuge equipment was being subjected to damaging operating conditions. Operators were effectively being shown a version of the process that did not reflect reality. This was not simply an IT network compromise. It was an attack on the integrity of the physical process and the information operators depended upon.

Get your subscription to Control's tri-weekly newsletter.

In April 2026, Hatch Unit 1 experienced an automatic forced shutdown when turbine control valves were being inserted for an undetermined reason. At approximately the same time, a broadcast storm froze operator displays and suppressed alarms. The frozen displays prevented operators from receiving timely and reliable information about plant conditions. This illustrates how a failure of the communications supporting operator displays can compound an existing operational problem by depriving operators of the information needed to respond.

In September 2026, a city-owned water plant experienced a SCADA system failure in which the displays froze while continuing to indicate that a storage tank was full. In reality, the tank level continued falling. Because the control system did not recognize the actual tank level, it did not initiate the wells needed to replenish the tank. Eventually, the tank reached a level that caused the plant to shut down. The result was a loss of water pressure and a precautionary boil-water notice.

Regardless of the initiating event, these incidents illustrate a critical vulnerability: Operators can lose situational awareness when the information systems providing process information become unavailable or unreliable. Incorrect process information can have serious public consequences whether the cause is unintentional or malicious. Network monitoring cannot necessarily identify these conditions and may even provide a false sense of security when the network appears to be operating normally.

A gap in the oil and gas industry's safety and cybersecurity programs

The American Petroleum Institute (API) Cybersecurity Conference is scheduled for Nov. 10–11, 2026. According to the conference agenda, neither process sensor integrity nor digital control valve communications appear to receive attention. This is concerning given the significance of the 2005 BP Texas City explosion, one of the most consequential process safety incidents in the oil and gas industry.  The issues illustrated by the 2026 valve controller scenario involve the same fundamental problem: The information available to operators may not accurately represent what is happening in the physical process.

This gap in the API agenda becomes even more important by reading the May 26, 2026 article in Flow Machinery: “Why Control Valve Failure Case Studies are your Most Underrated Reliability Asset”. According to the article, engineers are hunting for forensic-grade evidence to prevent their next unplanned shutdown. In 2023 alone, API reported that 31% of process safety incidents in refineries traced back to undiagnosed control valve degradation—and over half occurred despite ‘routine’ maintenance logs showing ‘no anomalies.’ These aren’t theoretical risks; they’re repeatable, preventable failures hiding in plain sight.

Case Study #1 was “The Silent Leak That Shut Down a Biopharma Batch Line”. This was a U.S. monoclonal antibody facility using the Fisher Fieldvue DVC6200 digital positioner (this was the positioner in the figure from an oil/gas facility used in a biopharma facility). There was a gradual loss of sterile isolation pressure in buffer preparation skid detected only after three consecutive batch rejections. From week 1–4, the positioner diagnostics showed ‘minor signal lag’ logged as ‘within tolerance’ per vendor specification.

Myth #2 in the report is “Digital positioners eliminate mechanical failure risk.” The report response to the myth was “They add layers of complexity: firmware bugs, electromagnetic interference and power supply instability. In our dataset, 22% of ‘smart valve’ failures involved corrupted positioner memory or uncommanded zero-shift—none of which a hydrotest would reveal.” Network monitoring would not be able to detect these issues either. This would require monitoring the physics of the process sensors to immutably identify the change in process conditions.

The oil and gas industry (as well as others) needs to recognize that process sensor integrity and control system communications are not simply maintenance issues. They are also cybersecurity, process safety, and operational resilience issues. This is a significant blind spot in industry’s safety and cybersecurity programs. It is also a gap in the recently issued CISA 2030 operational technology (OT) national plan, which emphasizes OT security and resilience but does not adequately address the integrity of process measurements and field-device communications. Network monitoring alone cannot identify every condition in which the information presented to operators differs from the actual physical process.

Recommendation: Independently monitor the physical process

The fundamental lesson is straightforward: A command is not proof of an action. An indication is not proof of a physical condition. This is a general issue throughout industrial, manufacturing and transportation sectors. A PLC output confirms that a command has been issued. Feedback may confirm that an actuator or valve has reached a particular position. Neither necessarily establishes that the intended process result has occurred.

Operators need an independent means of determining whether the physical process is actually operating as represented on their displays. Physics-based process monitoring, such as that provided by Immutable Situational Awareness, offers an additional layer of assurance. Its technology has monitored process sensors at one of the most critical U.S. defense facilities for more than eight years. Unlike conventional OT cybersecurity monitoring, which examines network traffic, communications and connected devices, this approach independently evaluates the physical process. It does not depend on the same PLCs, HMIs, historians or control-system communications pathways that operators normally rely upon.

By independently monitoring the process sensors that measure pressure, flow, temperature, level, voltage and current, the technology provides an independent assessment of whether the actual physical process agrees with what the control system reports. If the independent monitoring disagrees with the operator displays, the discrepancy warrants investigation, regardless of whether the cause is mechanical failure, instrumentation problems, configuration errors, communications failures or malicious cyber activity.

In the opening Fisher valve scenario, independent process monitoring could have provided the critical information needed to determine whether the valve was actually producing the intended process result, rather than relying solely on what the PLC or valve position feedback reported. This is the fundamental difference between monitoring the communications and monitoring the physics. Both are important, but one cannot substitute for the other.

Summary

If you cannot trust what you measure, you cannot trust your situational awareness. And without trustworthy situational awareness, you cannot assure the safety, reliability, resilience or cybersecurity of your operation. This is a blind spot in industrial safety and OT cybersecurity programs that cannot be filled simply by monitoring OT networks or even performing equipment testing. Process sensor monitoring at the physics level can help establish which information is inconsistent with reality. That is how we know who’s lying.