Dave Whitehead On SBOMs, Manufacturing in the US, and more

### Overview In this episode of the Unsolicited Response Show hosted by Dale Peterson, guest Dave Whitehead, CEO of Schweitzer Engineering Laboratories (SEL), discusses SEL's approach to domestic manufacturing, supply chain resilience, and the industry debate surrounding Software Bills of Materials (SBOMs). Whitehead details the launch of SEL's printed circuit board (PCB) factory in Moscow, Idaho, SEL's perspective on product security lifecycles and customer vulnerability notifications, and the role of virtualization through SEL's Blueframe platform.

### Key Topics - **In-House PCB Manufacturing and Supply Chain Control**: SEL invested roughly $100 million in a PCB manufacturing plant in Moscow, Idaho, which is operational and producing about a quarter of SEL's daily board consumption (projected to cover all internal demand within a year). Whitehead explains that manufacturing domestically reduces supply chain delays, mitigates intellectual property risk associated with sending Gerber layout files to third-party board houses, and offers a strong return on investment within roughly three years. - **Tight Hardware and Firmware Coupling**: Whitehead notes that SEL's hardware, firmware, and RTL/FPGA designs are tightly coupled due to stringent real-time control constraints, such as traveling wave protection relays that sample at one million times per second and make trip decisions every 100 microseconds. Respinning boards to replace unavailable parts during supply crunches is feasible at their SMT assembly plants (in Pullman, Washington, and Lewiston, Idaho), but re-qualification and certification remain the primary cost. - **The SBOM Debate**: Addressing industry buzz and government pushes regarding SBOMs, Whitehead questions the practical utility of raw SBOM files for asset owners. While SEL maintains comprehensive internal bills of materials for hardware and software to track defects down to specific lot codes and firmware versions, Whitehead argues that providing raw SBOMs creates management overhead for utilities. Instead, SEL supports sharing SBOMs or VEX documents (using formats like CycloneDX) on a case-by-case basis under NDA, while relying on direct service bulletins and customer portals for defect reporting. - **Focus on Process Assurance Over Raw Data**: Whitehead compares SBOM mandates to quality frameworks like ISO 9001 and SEL's certification under IEC 62443-4-1 (secure product development lifecycle). He suggests that external audits demonstrating a mature development process are more effective than delivering raw inventory files to end users. - **Organizational Culture and Edge Virtualization**: Whitehead highlights SEL's 100% employee-owned structure and weekly all-hands Friday lunches as mechanisms to maintain customer focus. Additionally, he reviews the adoption of Blueframe, SEL's application platform running on edge hardware or servers, noting it suits PLC and monitoring tasks, while ultra-fast microsecond protection functions remain on dedicated hardware.

### Technical Details - **Manufacturing & Facilities**: $100M total investment in Moscow, ID board factory; 250,000 sq ft SMT manufacturing in Pullman, WA; microelectronics assembly in Lewiston, ID. SEL fabricates power supplies, transformers, ferrite chokes, plastics, and sheet metal internally, outsourcing mainly LCDs. - **Software & Firmware Security**: SEL writes its own relay firmware and rejects compiled third-party binaries, ingesting only third-party source code to trim unused code and perform internal security scans. SEL conducts periodic (at least monthly) dependency reviews of third-party libraries. - **Standards & Platforms**: Adherence to IEC 62443-4-1; CycloneDX and VEX document generation for requesting customers; Blueframe application framework running on SEL-3350, SEL-3355, and SEL-3360 platforms.

### Takeaways Whitehead stresses that vertical integration provides superior quality control and long-term reliability for critical infrastructure equipment. Regarding cybersecurity and supply chain visibility, while manufacturers must maintain rigorous internal tracking and adhere to accredited development standards, asset owners benefit most when vendors proactively manage dependencies and provide contextualized service bulletins rather than raw SBOM data dumps.