Institute for Science and International Security
ISIS REPORT
February 15, 2011

Stuxnet Malware and Natanz:
Update of ISIS December 22, 2010 Report1
By David Albright, Paul Brannan, and Christina Walrond

Overview
In the December 22, 2010 ISIS report on Stuxnet, ISIS found that this malware contained important evidence
indicating that its target was the IR-1 centrifuges at the Fuel Enrichment Plant (FEP) at Natanz. ISIS focused on
the attack sequences generated by a Siemens S7-315 programmable logic controller (PLC) connected tofrequency converters of a particular type. The ISIS analysis centered on the rotational frequencies listed inthese detailed attack sequences. These frequencies matched, in two cases identically, key frequencies
characteristic of the IR-1 centrifuge at the FEP.
A further analysis of another attack sequence has revealed that this code contains a description of what
appears to be an exact copy of the IR-1 cascade at the FEP. The attack is titled “Sequence C” by Symantec, thecomputer security company that has conducted the most thorough and reliable open analysis of the malware’scode, or “417 code” after the advanced Siemens S7-417 programmable logic controller that Stuxnet targets.2
However, the 417 code is not activated and thus unable to launch an attack.3 Moreover, key data is missing
from the code available to Symantec that would define exactly what is affected or sabotaged.4 Symantec has
assessed that the 417 code is likely unfinished, perhaps a work in progress.
Additional analysis also lends more support to the conclusion that the Stuxnet malware is aimed principally at
destroying centrifuges, not manipulating parameters of the centrifuge cascades so as to lower the productionof low enriched uranium (LEU) on a sustained basis. To date, Stuxnet is known to have had at least one
successful attack. It is increasingly accepted that, in late 2009 or early 2010, Stuxnet destroyed about 1,000 IR1 centrifuges out of about 9,000 deployed at the site. The effect of this attack was significant. It rattled the
Iranians, who were unlikely to know what caused the breakage, delayed the expected expansion of the plant,
and further consumed a limited supply of centrifuges to replace those destroyed. Nonetheless, Iran took steps
in the aftermath of the attack that likely reduced further damage by Stuxnet, principally shutting down many
centrifuge cascades for months. The shutdown lasted long enough for the malware to be discovered publicly,
by which time Iran could have found Stuxnet on the Natanz control systems.
1

David Albright, Paul Brannan, and Christina Walrond, Did Stuxnet Take Out 1,000 Centrifuges at the Natanz Enrichment
Plant? Preliminary Assessment, ISIS Report, December 22, 20102

Nicolas Falliere, Liam O. Murchu, and Eric Chien, W32.Stuxnet Dossier version 1.4, Symantec, February 2011.
W32.Stuxnet Dossier, op. cit.
4
Researchers are limited to studying the Stuxnet code that has emerged on the internet. It is possible that an older
version of the code exists that is more complete than the available samples of Stuxnet. However, this older version would
also likely be much less able to spread outside a targeted facility. In addition, the latest sample of the code is dated April
2010, so a later version could exist, although this too should have propagated widely.
3

236 Massachusetts Avenue, NE, Suite 305 Washington, DC 20002
TEL 202.547.3633 • FAX 202.547.3634
E-MAIL isis@isis-online.org • www.isis-online.org

Symantec has established that Stuxnet first infected four Iranian organizations in June and July 2009.5 Afterthe 2009/2010 attack, and before Stuxnet’s public discovery, the malware’s operators tried to attack again.
Symantec found that in March, April, and May 2010, two of the original organizations were again infected. In
May, a new Iranian organization was also infected. Were the Stuxnet operators dissatisfied with destroying
only 1,000 centrifuges, or were they encouraged by their success? In any case, they were improving the code’s
ability to spread by the spring of 2010, according to Symantec. These improvements undoubtedly sought toenable the program to again breech Iran’s security on its gas centrifuge program and destroy more centrifuges.
Symantec has decided not to release the names of these organizations because of the company’s privacy
policies. But it characterized these companies as involved in industrial systems and work on “normal”
industrial projects. A fraction of them deal with programmable logic controllers. Some are on lists ofsuspected violators of non-proliferation conditions and, by implication, involved in procuring for Iran’s
sanctioned programs. Natanz is not one of the first infected entities, given the number of initial infections.
Kalaye Electric Company is also unlikely to be one of these companies. According to Symantec, none of thecompanies are publicly associated with Natanz and all the companies lack any publicly traceable history of
being associated with Natanz. Therefore, the infection would have spread from these organizations to Natanz.
To increase the chance of success, Stuxnet’s creators appear to have targeted the domestic portion of Iran’s
supply chain for industrial control systems. Finding a way to infect systems in an Iranian supplier would beeasier than doing so directly at the Natanz enrichment plant.
Because of sanctions and trade controls, Iran operates international smuggling rings to obtain industrial
control equipment, including the Siemens 315 and 417 PLCs. Although foreign intelligence agencies could
infect or sabotage these PLCs abroad, they would have far greater chance of ultimately infecting Natanz byinserting Stuxnet in the core of Iran’s supply chain for the centrifuge program’s control systems.
Contrary to several recent media reports, Stuxnet does not appear to be designed to attack the Bushehr
nuclear power reactor. Stuxnet has spread easily on Windows-based computers, so it is not surprising thatcomputers at other Iranian facilities, namely the Bushehr nuclear power reactor, would contain this malware.
But the code’s attack sequences do not appear targeted at a nuclear power reactor or its associated systems.
A cyberattack like Stuxnet is an uncharted method to damage and delay Iran’s nuclear efforts. Without adiplomatic settlement with Iran, such attacks are likely to continue against Iran’s centrifuge program. They
provide an alternative to military strikes against Iran’s known nuclear sites, a tactic that most see as likely to beineffectual or counterproductive.
"War is ugly, awfully ugly," Israeli Deputy Prime Minister Dan Meridor recently told diplomats and journalists
at the think tank Jerusalem Center for Public Affairs.6 He added that “the cyberworld...becomes more
important in the conflict between nations. It is a new battleground, if you like, not with guns but withsomething else," he said. It is strategy, he implied, that would be waged in secret by intelligence agencies.
Thus, more attacks can be expected in the future. Governments are likely to increase their offensive anddefensive cyberwar capabilities.
But nations need to pause before diving into cyberwar against nuclear facilities. Stuxnet is now a model code
for all to copy and modify to attack other industrial targets. Its discovery likely increased the risk of similar
cyber attacks against the United States and its allies. While it has delayed the Iranian centrifuge program at
the Natanz plant in 2010 and contributed to slowing its expansion, it did not stop it or even delay thecontinued buildup of LEU. A much broader debate, involving the public, needs to weigh the pros and cons ofdeveloping this new type of warfare.
5
6

W32.Stuxnet Dossier, op. cit.
Dan Williams, “Israeli official sees cyber alternative to ‘ugly war,’” Reuters. February 3, 2011.
ISIS REPORT

2|P ageNew Findings and Updates to December ISIS Report
New Information on 2009/2010 Attack on Natanz
ISIS published in its December 22, 2010 report7 that Stuxnet may have destroyed about 1,000 centrifuges at
the Natanz Fuel Enrichment Plant in late 2009 or early 2010. Since this report, more information has emergedthat increases the likelihood that the part of Stuxnet centered on Siemens S7-315 programmable logic
controllers caused this damage. However, the relatively limited damage implies that destroying centrifuges
through a cyberattack may be more difficult to do than commonly perceived.
The Washington Post has learned new important information supporting Stuxnet as the cause of the damaged
IR-1 centrifuges, which Iran removed over the course of a few weeks. Moreover, the numbers removed wereover and above the normal failure rate, which occurs at a rate of 10 percent per year.
The International Atomic Energy Agency (IAEA) cannot determine conclusively the origin of a decommissioned
centrifuge at the FEP, although it is better able to establish the number removed from the cascade areas. In
August 2009, the IAEA stepped up its surveillance at the FEP to better ensure that Iran could not remove
equipment in or out of the cascades without IAEA verification, perhaps undermining the inspections.8 As aresult, Iran agreed to allow the IAEA to enhance its camera surveillance of the cascade areas and retain all
items taken from the cascades at a central location until IAEA inspectors could view them. In practice, about
every few weeks, IAEA inspectors verify and count the items that left the cascade area. Thus, the IAEA has arelatively accurate count of the number of centrifuges removed from the cascade areas of the FEP. However,the IAEA does not receive information about the original locations of the removed centrifuges. The IAEA
cannot therefore determine from which cascade, or module, the decommissioned centrifuges originated. In
addition, IAEA surveillance cameras control only the perimeter of the cascade areas, so inspectors do not see
the replacement of the centrifuges.
According to The Washington Post, Iran tried to downplay the significance of the removal of so many
centrifuges. It told inspectors that the removed centrifuges were undergoing maintenance and originated inmodule A28, which contained centrifuges not yet under vacuum or spinning (see table 1). IAEA inspectors did
not believe the Iranians, independently assessing that the centrifuges were likely already spinning anddamaged beyond repair, according to officials close to the IAEA. Adding to suspicions about Iran’s story, theinspectors witnessed Iran moving quickly to replace all these broken centrifuges, something Iran is less prone
to do for non-spinning centrifuges in module A28.
The data in the IAEA safeguards reports suggests that the broken centrifuges actually came from cascades inmodule A26 that were spinning but not enriching.9 During this period, Iran took eleven non-enriching A26
cascades off-line and kept them off-line for several months (see table 1). As of August 2010, six of thesecascades were still off-line.
However, decommissioned centrifuges could have also originated in the enriching cascades in module A26, if
they were quickly replaced. Because the production of LEU increased during the late fall 2009 and early 2010,
it is doubtful that 1,000 out of almost 4,000 enriching centrifuges at the FEP were out of service for long.
Stuxnet does not appear to have attacked module A24, which is responsible for the vast bulk of LEU produced
at Natanz.
7

David Albright, Paul Brannan, and Christina Walrond, Did Stuxnet Take Out 1,000 Centrifuges at the Natanz Enrichment
Plant? Preliminary Assessment, ISIS Report, December 22, 20108
The strengthened safeguards followed an episode in the spring of 2009, when the IAEA noticed substantial removal ofequipment from the cascade area.
9
See ISIS December 22 report.
ISIS REPORT

3|P ageMedia reports have stated that Stuxnet destroyed all the centrifuges in six cascades, or 984 centrifuges.
However, Iran has not provided such a number, and the IAEA does not appear to be able to make such a
precise estimate. Some centrifuges have entered and left the cascade area without the inspectors’ knowledge,
according to senior officials close to the IAEA, complicating any IAEA effort to determine a precise number.
Nonetheless, this value is plausible since it is close to the actual number destroyed. Yet, the number ofcascades controlled by a S7-315 PLC remains unclear.10 The 417 code is more explicit in establishing that eachS7-417 PLC may control six cascades, for a total of 984 centrifuges. However, this code in not active and thus
would not be expected to have caused the damage at Natanz.
Because the launch of the Stuxnet attack in Iran started in June and July 2009, an attack at Natanz prior to late2009 cannot be excluded, but it appears unlikely. If an earlier attack on the FEP succeeded in destroying alarge number of centrifuges, Iran would have needed to remove the centrifuges without the knowledge of the
IAEA. This is unlikely, because the IAEA’s bolstered inspection capabilities instituted in early August 2009 were
aimed specifically at more accurately determining the number and type of items leaving the cascade area.
Impact of Stuxnet. At the time of the attack, the Natanz FEP contained a total of almost 9,000 IR-1
centrifuges. The destruction of 1,000 out of 9,000 centrifuges may not appear significant, particularly since
Iran took steps to maintain and increase its LEU production rates during this same period. However, the IAEA
safeguards data (see table 1) support that the attack delayed Iran from expanding the number of enriching
centrifuges, in essence keeping large sections of the plant idle for many months.
Iran is also facing shortages of raw materials to build IR-1 centrifuges. It may have the materials to build only
12,000 to 15,000 IR-1 centrifuges. With 9,000 centrifuges already deployed at Natanz, and an estimated 1,000
centrifuges broken during routine operation, adding in the 1,000 centrifuges destroyed by Stuxnet brings thetotal to 11,000 centrifuges deployed over the lifetime of the FEP.11 Iran may be approaching a limit on thenumber of IR-1 centrifuges it can build, making those destroyed by Stuxnet more significant than the number
would imply.
There are also other, less tangible deleterious effects. To the extent it did not know what caused thedestruction, Iran would have faced multiple questions about its centrifuge operations. In particular, a failureof this magnitude would have been a direct challenge to the program’s quality assurance program, which isfundamental to successfully operating these high-precision machines. Iran has spent considerable effort increating a reliable quality assurance program, where specialists carefully test each centrifuge component
looking for out-of-spec parts. Without knowing the cause was malware, Iran would have struggled tounderstand this failure and likely would have lost valuable time worrying about more failures.

10

A S7-315 PLC controls six communication modules, each of which in turn controls up to 31 peripherals, for a total of
186 items, according to Symantec. Thus, each communication module may in theory control one cascade, and therefore
a single S7-315 PLC could control six cascades. There is unlikely to be many frequency converters per cascade. Eachcascade needs only a handful of frequency converters that can raise and lower the frequency of rotation of thecentrifuges. However, it is also possible that one S7-315 controls only one cascade and the six communication modules
are needed to control a variety of frequency converters and associated equipment that controls each of the 164
centrifuges. For example, the communication modules may also control additional frequency converter drives or related
equipment that take over for the main frequency converters once at the desired operating frequency and provide
sufficient power to the centrifuges to keep them running. In addition, in case of a centrifuge breaking, there should be a
way to turn off the power to that individual centrifuge. This may require additional peripherals that lead to one S7-315
for each cascade.
11
This value is derived from the failure rate of the IR-1 centrifuges, which is reportedly 10 percent per year. The failuresoccur mainly because of the difficulty of operating aluminum-based P1 centrifuges, the design which Iran obtained fromthe Khan network.
ISIS REPORT

4|P ageOnce Iran learned of the reason for the failure of so many centrifuges, it must have felt a heightened sense ofvulnerability to outside attack. The immense detail in Stuxnet about the Natanz enrichment plant must havealso unsettled the Iranians, as it demonstrated that foreign intelligence agencies had learned a considerable
amount of information about their secret operations, far beyond what the IAEA knew. Only an insider could
have obtained so much detail. One official at a Western intelligence agency said that since outsiders knew somuch about Natanz, Iran would tend to hesitate about building a secret centrifuge plant out of fear of gettingcaught. That fear was already magnified after Western intelligence agencies exposed the secret gas centrifuge
plant near the holy city of Qom in October 2009.
Iran must also feel less secure about the goods its smuggling networks acquire abroad for its nuclear programs.
It may need to resort to relying more heavily on reverse engineering and domestic production of a greater
variety of advanced industrial goods for its centrifuge program. However, Iran has limited advanced industrial
capabilities and has encountered difficulties in successfully reverse engineering equipment and technology.
Thus, such a strategy would cause delays in its centrifuge program and require Iran to use goods of far lessquality that are more prone to failure.

ISIS REPORT

5|P ageNew Finding: Evidence of Targeting Natanz in Sequence C or 417 CodeSoon after the publication of the ISIS December 22 report, Ralph Langner, a German security expert, contacted
ISIS after noticing that each of the Natanz centrifuge cascades contained 164 centrifuges. He said that the 417
code, or sequence C, is grouped in six arrays of 164 units each, perhaps representing six cascades, each with164 centrifuges.
Based on Symantec’s analysis of this array, ISIS discovered that this array is identical to an IR-1 centrifuge
cascade at the FEP. This evidence is perhaps the strongest evidence that Stuxnet is aimed at Natanz.
This attack sequence targets a Siemens S7-417 programmable logic controller, which acts independently of theattack sequences targeting a Siemens S7-315 PLC, the focus of ISIS’s December 22, 2010 report.12 However,
Symantec has determined that the 417 code is disabled and not able to infect S7-417 PLCs.13
Sequence C is also missing key code, including a block of data that would change the behavior of thecentrifuges.14 As a result, the code does not reveal what is sabotaged and how the attack progresses.
The attack would last about seven minutes and repeat about every 35 days.15 Unlike the 315 code, the 417
code orders few checks of specific operational constants before launching an attack. But like the 315 code, the417 code would also send false data to the operator’s consoles during the attack, masking its sabotage.
The code describes six arrays of 164 objects organized into 15 clusters. Table 2, derived by Symantec from the417 code, summarizes this information. The 15 clusters are numbered from 0 to 14, and the table lists thenumber of objects in each cluster.
This array corresponds exactly to the design of the IR-1 centrifuge cascades at the Natanz plant, according tosenior officials close to the IAEA (see table 3). The only difference is that authors of the code started their
numbering of the stages at the product end of the cascade, which has no special significance since an arraydoes not have an implicit direction. The product stage is cluster 0, the feed stage is cluster 9, and the waste
stage is cluster 14.
A reasonable interpretation is that each S7-417 PLC would control six cascades, each with 164 centrifuges. So,
a module of 18 cascades would require three such controllers. In an attack, Stuxnet should be able to attack
all the cascades operated by these controllers.
Table 2 also shows the number of objects in each cluster that would be affected, if the code were active. The
attack appears to start at the product end of the cascade and work its way down the stages of the cascade,skipping the centrifuges in the feed stage. In total, 110 out of 164 centrifuges would be affected.
But with key data missing, one can only speculate about what the 417 code aims to sabotage. According to
Symantec, the data sent to the cascades appear more aimed at flipping a series of on/off values rather thansending a packet of commands like the 315 code sends to frequency converters.

12

W32.Stuxnet Dossier, op. cit.
W32.Stuxnet Dossier, op. cit and Symantec private communication. Stuxnet is a Windows binary that self-propagateson Windows and then adds to or modifies the computer programs on programmable logic controllers. The PLC code does
have not the capability to self-replicate or spread the computer code. What makes 417 code inactive is that the Windows
code does not inject it properly, e.g. no modification of OB1 and the missing DB8061.
13

14
15

This data would be in DB8061, which Stuxnet does not create, private communication from Symantec.
Symantec, private communication.

ISIS REPORT

6|P ageBecause the code has correctly characterized the cascade by stage (cluster number) and the number ofcentrifuges per stage, the target is likely the centrifuges and not the cascade itself. In that case, one obvious
target is the valves of the centrifuges. Other possibilities exist, such as changing the temperature of acentrifuge or affecting the pressure sensors in a cascade. But such attacks would be unlikely to have asignificant impact on the centrifuges, particularly since after the attack is over, the operator would resumecontrol of the cascades.
The valves play an essential role in the safety system of a cascade, stopping gas flow to a malfunctioning
centrifuge and isolating it before their damage can spread to neighbors.16 They are also a key part of thesystem to evacuate uranium hexafluoride from the cascade in an emergency. But by closing these valves
unexpectedly, the 417 code could damage the centrifuges.
Closing all the Fast-Acting Valves. Each centrifuge has three fast acting valves, one each on the feed, product,
and waste tubes attached to the top of the centrifuge. If all three fast-acting valves were the target, closing all
the valves on 110 centrifuges would cause the feed gas to bypass each of these centrifuges.
If the feed gas is blocked from going into the affected centrifuges, it will redistribute itself into othercentrifuges. The rate of feed in the other centrifuges in the cascade would increase, building up the gaspressure at the wall of the rotor. Above a certain pressure, the feed gas would solidify, which could imbalance
the rotor, causing it to fail. This could result in destruction of up to 54 out of 164 centrifuges in each affectedcascade.
In this scenario, the attacker would want to delay any safety systems that could automatically cut off the flowof the feed gas into the cascades. That could explain why the centrifuges in the feed stage are not affected. In
addition, the feed stage may have additional sensors not connected to the S7-417 PLC, which could, in theevent of a malfunction, quickly stop the feed flowing to the cascade, undermining the attack.
The 417 code sends false data to the operator during the attack that would effectively blind them to changes
mandated by Stuxnet’s attack sequences. Plant personnel in the cascade area may hear centrifuges breaking,but the attack is so short that the operator is unlikely to have time to enact countermeasures.
During this attack, the enrichment product would be affected but only briefly. There would be reduced
production of LEU since two-thirds of the centrifuges would be isolated from the cascade. The enrichmentlevel of the LEU would be significantly reduced. The centrifuges in the upper two stages raise the enrichmentlevel significantly but they would all be isolated. However, this effect would be temporary and minimal, since
the attack lasts only seven minutes. The primary effect would be damaged centrifuges. Afterwards, theoperators would resume control of the centrifuge cascades and learn of the closed valves.17

16

Valves are also used to assist in a sudden loss of the power to a centrifuge motor. In this case, the centrifuge starts torun down, and the pressure in the center of the rotor will increase, causing instabilities that can crash the centrifuge. The
safety system will shut off the feed to the cascade and quickly empty the cascade in order to reduce the pressure inside
the rotor.
17

One anomaly in the FEP’s operation is that the feed rate often suddenly decreases temporarily from an average ofabout 60-80 grams per hour of uranium hexafluoride per cascade. Iran has refused to discuss these effects. Perhaps, thiseffect is related to the frequent dumping of the uranium hexafluoride in the cascades and subsequent isolation of thecascade by cutting off the uranium hexafluoride feed, which in turn could reflect the routine breakage of centrifuges at alevel of 10 percent a year. However, even if code 417 were active, it would be unlikely to have caused this phenomenon.
It would more likely result from the myriad other problems affecting the IR-1 centrifuge cascades.
ISIS REPORT

7|P ageClosing a Subset of Valves. Another destructive procedure would be if code 417 shut off the valves to the
product and waste tubes in centrifuges, but left open the feed valve, rapidly increasing the amount of gas
inside the centrifuge. This would undoubtedly be catastrophic for the rotor. This attack could destroy as manyas 104 centrifuges (no gas can pass to the top and bottom stages (see table 2)). Since a certain number of
product and waste valves must remain unaffected to allow the gas to pass to the next stage, this approach
could not destroy all the centrifuges in a cascade. However, it could destroy about double the number
affected in the attack shutting all the fast-acting valves.
There are undoubtedly other options for the attack. Some have speculated that code 417 does not seek todestroy centrifuges but instead lowers and disrupts the output of enriched uranium on a sustained basis. It is
unknown how this would be done. In any case, after the short attack sequence, the operator would regain
control of the cascades and would detect any changes in the enrichment output at the product end of thecascade, leading to a search for the cause and remediation. It is far more likely that Stuxnet seeks to destroy
centrifuges and disrupt operations in that matter.
Update on Nature of the 315 Code Attacks
The ISIS December 22 report left open the question of whether Stuxnet would successfully destroy most of theaffected centrifuges in attack sequences A and B, which Symantec has identified as two distinct, but similar
attack sequences that target Siemens S7-315 PLCs. They work by changing the speed of two types offrequency converters.18 These frequency converters in turn drive the motors of IR-1 centrifuges, which control
the speed of the centrifuge rotor. Once in control, Stuxnet alternatively increases and decreases the speed of
the centrifuge rotor. The attacks are short-lived, either 15 or 50 minutes, and recur about every month.
With additional analysis, ISIS has assessed that the first attack subsequence is sufficient to destroy most of theaffected centrifuges simply by increasing rotor speed toward the burst frequency. Safety systems independentof Stuxnet are unlikely to be effective in preventing damage to the centrifuges. Thus, the limiting factor
appears to be whether the control systems meet all the criteria to initiate an attack, including encountering
the specific type of 315 PLC, the right communication module, and the requisite number of frequency
converters of the correct manufacture.
The initial ISIS report focused on sequence A, which is an attack involving a preponderance of Finnish
frequency converters and is far better understood than sequence B involving Iranian assembled frequency
converters. In sequence A, there are two specific attacks that are separated by about a month. The first, called
sequence one, would raise the speed of the centrifuge as high as a frequency of 1,410 hertz (Hz) during a 15
minute attack, before the malware returns the control system to normal operation. After waiting about 27
days, Stuxnet would launch attack sequence two. This attack would lower the frequency only a few hundredhertz during a 50-minute attack. Then it would raise the frequency back to the nominal IR-1 centrifuge
frequency of 1,064 Hz. After another 27 days, the first attack sequence would start again; followed by thesecond sequence 27 days after that, and so on.
The code of attack sequence one, which raises the speed, does not give the starting frequency, but areasonable assumption is that it is between 1,007 Hz and 1,064 Hz.19 After 15 minutes, the frequency would
reach nearly 1,325-1,380 Hz, respectively. These frequencies imply a fast rotor speed, but they are below the
maximum frequency of 1,410 Hz, which corresponds to the burst frequency for this aluminum rotor where thealuminum simply fails from rotational acceleration. Will the rotors nonetheless break? The answer is likely
yes.

18
19

W32.Stuxnet Dossier, op. cit.
ISIS December 22 report.

ISIS REPORT

8|P ageThe ISIS December 22 report conjectured that each of four high-strength rotor tubes in a rotor assembly would
experience a flexural critical resonance before reaching the burst frequency of about 1,410 Hz. (A rotor
assembly comprises four short aluminum tubes connected by three maraging steel bellows and a top andbottom aluminum end cap.) In practice, the rotor tubes would start to break well before reaching this criticalfrequency.20 However, subsequent calculations show that the first flexural solid body resonance for each tube
exceeds the burst frequency and is in fact greater than 2,000 Hz.21 As a result, resonances will not break thecentrifuges in their run up to 1,410 Hz.
However, when rotor speeds approach the maximum frequency, the rotor assembly will experience forces thatwill likely cause most of them to fail in any case. For example, at those high speeds, the mid-point of the top
and bottom rotor tubes in an assembly expand outward. However, one end of each of these two rotor tubes
has an end cap welded to it. The end caps, which are aluminum discs, resist expansion more than the tube
itself, causing the rotor tube to form into a bottle shape, something that would likely break many of the tubes.
The bearings will also be subjected to enormous stresses that could cause the rotor to break.
An attack by Stuxnet turns off the converters’ warnings and alarms, and sends false data to the operators’
computer terminals. As a result, the operators are unlikely to discover what is happening until it is too late.
They may receive reports of centrifuges breaking in the cascade areas, but during the attack itself, theoperators have no obvious way to wrest control of the frequency converters from Stuxnet.22 It is doubtful thatany of the plant’s safety systems can intervene in time to stop the destruction wrought by this particular attack
sequence.23 Thus, Stuxnet should destroy most of the affected rotors.
But that being said, what is the purpose of the second attack? It lowers the frequency only a few hundredhertz at best. Few centrifuges would break as a result, and enrichment levels would be affected only during
the attack, which lasts just 50 minutes. Was this attack merely to sow confusion?
About a month later, the first attack sequence would repeat itself. Perhaps, multiple attacks are needed
because the first attack to raise the frequency may abort, requiring another attempt. Or, the next attack may
seek to damage any centrifuges that survived the first attack and any centrifuges installed to replace thebroken ones.
Despite Stuxnet’s sophistication, Iran appears to have taken a simple step that may have reduced the impact ofa subsequent attack, assuming Iran had not yet discovered the malware on its controllers. It stopped thecentrifuges in eleven cascades in module A26, the module that was likely most affected by Stuxnet. It kept
them disconnected until late May 2010, when it started up six of those cascades (see table 1). Given that
Stuxnet was publicly discovered in June 2010, Iran should have discovered the infection then, perhaps even
earlier. Because a cascade needs to operate for at least two weeks before an attack starts against S7-315 PLCs,

20

Typically, designers would want to keep the frequency at no more than 80 percent of this flexural frequency, or below
about 1,130 Hz to avoid breakage.
21
Calculations were performed based on information in J.P. Den Hartog, Mechanical Vibrations (New York: Dover
Publications, 1984); and S. Timoshenko, Vibration Problems in Engineering (New York: D. Van Nostrand Company, 1937).
22
Private communication from Symantec.
23
The Stuxnet code does not appear to stop other safety systems from operating. For example, each IR-1 centrifuge has avibration sensor that alarms when the vibration levels exceed some pre-determined level. A speed up would likely set
these sensors off before the rotors break. Within milliseconds after an alarm, the control system would order the
dumping of the uranium hexafluoride in an affected cascade. In expected emergencies, this action can resolve theexcessive vibration problem. This dumping is accomplished by the closing of the three fast-acting valves on eachcentrifuge, the maintenance of the feed pressure, and the opening of a valve to allow the gas to leave the cascade andenter the dump tank. However, in a Stuxnet attack, the speed up would likely continue until the attack sequence ends.
The dumping may still produce a benefit. With the uranium hexafluoride dumped from the cascades, some centrifuges
may survive the speed up.
ISIS REPORT

9|P ageStuxnet may not have had enough time to attack again after the restart of several cascades in module A26 inlate May.
Six cascades in A26 that were enriching uranium remained operational in 2010 (see table 1). Perhaps thesecentrifuges either continued to be damaged or A24’s control system was unaffected by Stuxnet.
Another Set of Attacks in Spring 2010
Symantec dates the initial infections of four Iranian organizations to June and July 2009. Symantec has
identified fresh infections in March, April, and May 2010 on Iranian organizations, including two organizations
attacked earlier and a new one.
Stuxnet’s operators had modified the malware’s code by the spring of 2010, apparently trying to attack Iran’s
gas centrifuge program again. According to Symantec, as of March 2010, Stuxnet operators had updated thecode, making it spread more aggressively.24 Once modified, the code would rapidly update older versions via
network connections and Stuxnet’s two dedicated command and control web sites in Denmark and Malaysia.
The collateral infections can be traced to the infection of these five organizations. Most of these infections,
12,000 of which Symantec tracked, resulted from the updated Stuxnet versions. It was likely the spread of
Stuxnet from the spring 2010 infections that inevitably led to its public discovery.

Conclusion
Assuming Iran exercises caution, Stuxnet is unlikely to destroy more centrifuges at the Natanz plant. Iran likely
cleaned the malware from its control systems. To prevent re-infection, Iran will have to exercise special
caution since so many computers in Iran contain Stuxnet.
Although Stuxnet appears to be designed to destroy centrifuges at the Natanz facility, destruction was by nomeans total. Moreover, Stuxnet did not lower the production of LEU during 2010. LEU quantities could havecertainly been greater, and Stuxnet could be an important part of the reason why they did not increasesignificantly. Nonetheless, there remain important questions about why Stuxnet destroyed only 1,000
centrifuges. One observation is that it may be harder to destroy centrifuges by use of cyber attacks than often
believed.
The authors of Stuxnet remain unknown. This is one of the attractions of cyber attacks. The perpetuator caneasily hide. Rumors and common sense point to a country or team of countries, but proving that theyengineered Stuxnet remains almost impossible.
Stuxnet’s elaborate nature and its updating show a firm determination to sabotage Iran’s nuclear program. It
is certain that foreign intelligence agencies will continue in their efforts to sabotage Iran’s centrifuge program.

24

W32.Stuxnet Dossier, op. cit., pp. 47-49.

ISIS REPORT

10 | P a g e

Table 1: Number of Centrifuge Cascades enriching, under vacuum, installed, or withcentrifuges disconnected, January 31, 2010
Fed with
UF6

Under
VacuumInstalled, not With Centrifuges
Under vacuum Disconnected

Total

Module A24
Aug. 12, 2009
Nov. 2, 2009
Jan. 31, 2010
May 24, 2010
Aug. 28, 2010

18
18
17
18
17

0
0
1
0
0

0
0
0
0
1?

0
0
0
0
0

18
18
18
18
18

Module A26
Aug. 12, 2009
Nov. 2, 2009
Jan. 31, 2010
May 24, 2010
Aug. 28, 2010

10
6
6
6
6

8
12
1
7
6

0
0
0
0
6

0
0
11
5
?

18
18
18
18
18

Module A28
Aug. 12, 2009
Nov. 2, 2009
Jan. 31, 2010
May 24, 2010
Aug. 28, 2010

0
0
0
0
0

0
0
0
0
0

14-15
17 (1 being installed)
16
16
18

0
0
2*
2?
0

14-15
18
18
18
18

* In these two cascades in module A28, Iran had removed all the centrifuges in one cascade and was removing
the ones in the other one.
Source: David Albright, Paul Brannan, and Christina Walrond, Did Stuxnet Take Out 1,000 Centrifuges at the
Natanz Enrichment Plant? Preliminary Assessment, ISIS Report, December 22, 2010.

ISIS REPORT

11 | P a g e

Table 2: Code 417 Data for an Array of 164 Objects
ClusterNumberObjects in
the Cluster

0

1

2

3

4

5

6

7

8

9

10

11

12

13

14

2

2

4

6

8

10

12

16

20

24

20

16

12

8

4

ObjectNumber

01
2

23
2

47
2

813
4

1421
6

2231
8

3243
10

4459
13

6079
14

80103
0

1041231412413913140151101521598160163
4

Objects
affected

Source: Nicolas Falliere, Liam O. Murchu, and Eric Chien, W32.Stuxnet Dossier version 1.4,
Symantec, February 2011.

Table 3: Sequence C Array and FEP IR-1 Centrifuge Cascade
ClusterStage
No. ofCentrifuges

010E
2 (1+1)
Product
Stage

1
9E
2

2
8E
4

3
7E
6

4
6E
8

5
5E
10

6
4E
12

7
3E
16

8
2E
20

9
1E
24

10
5S
20

11
4S
16

12
3S
12

13
2S
8

Feed
Stage

14
1S
4
Tails
Stage

Notes and Comments:
1) Stage 10E, which is where the highest enrichment level is achieved, involves two centrifuges but this stage
acts to all intents as ‘one plus a spare.”2) The cascade shape is far from ideal because of the limited number of centrifuges in this cascade.
3) The number of stages is set by the required enrichment and depletion factors. They would be similar for
any centrifuge that has an enrichment factor equal to the depletion factor. Thus, this cascade design is notunique to an IR-1 design but it is the basis for what Iran showed the IAEA in the Pilot Plant at Natanz in August
2003 and what Iran has installed underground in the FEP.

ISIS REPORT

12 | P a g e