Overview

As technology becomes increasingly connected to the internet, security measures must be implemented. In 2007 Idaho National Laboratory (INL) conducted the Aurora Generator Test to demonstrate how a cyberattack could cause devastating damage to the electric grid. In the test, they compromised a network-connected circuit breaker, giving them the ability to open and close the circuit breaker out of sync from the grid. This placed an enormous amount of excess torque on the physical generator components. At first, rubber pieces of the rotating coupling were ejected, but soon the stresses caused the alternator to overheat, and caused the diesel engine itself to be ripped apart. This test highlighted the dangers of a cyberattack on the national grid.

Applying the 2023 Code

The 2023 NEC has added subsection 240.6(D) to require specific methods of connection for remotely accessible adjustable-trip circuit breakers. The options include connection through a local non-networked interface, or through a networked interface that utilize software evaluated for cybersecurity, or through a network that has underwent a cybersecurity assessment with provided documentation of the assessment. This addition to the Code will help ensure that remotely accessible adjustable-trip circuit breakers are protected against cyberattacks, which, as demonstrated in the Aroura Generator Test, can cause devastating damage to connected equipment. Moving forward with this code change will require the authority having jurisdiction (AHJ) to request the required documentation from the installer. The installer will need to be prepared to provide this documentation as needed.

What’s New for the 2023 NEC?

2020 NEC

In the 2020 NEC Section 240.6(D) did not exist.

2023 NEC

In the 2023 NEC Section 240.6(D) now reads as follows (not including 3 informational notes):

(D) Remotely Accessible Adjustable-Trip Circuit Breakers.
A circuit breaker(s) that can be adjusted remotely to modify the adjusting means shall be permitted to have an ampere rating(s) that is equal to the adjusted current setting (long-time pickup setting). Remote access shall be achieved by one of the following methods:
(1) Connected directly through a local nonnetworked interface.
(2) Connected through a networked interface complying with one of the following methods:
a.The circuit breaker and associated software for adjusting the settings are identified as being evaluated for cybersecurity.
b.A cybersecurity assessment of the network is completed. Documentation of the assessment and certification shall be made available to those authorized to inspect, operate, and maintain the system.