Chapter 30 — Laboratory II

Chapter 30 — Laboratory II

Lesson map

Lesson 30 published. Map, example, EX059.

flowchart TD
  N0["Learning outcomes and connection"]
  N1["30.1 Scenario synthetic"]
  N2["30.2 Part A — tabletop 90 minutes"]
  N3["30.3 Part B — evidence analysis offline"]
  N4["30.5 After-action report"]
  N5["30.6 Assessment rubric"]
  N6["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX059"]

Logical drawing

flowchart LR
  N0["Learning outcomes and connection"]
  N1["30.1 Scenario synthetic"]
  N2["30.2 Part A — tabletop 90 minutes"]
  N3["30.3 Part B — evidence analysis offline"]
  N4["30.5 After-action report"]
  N5["30.6 Assessment rubric"]
  N6["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX059"]

[Learning outcomes and connection]
    |
    v
[30.1 Scenario synthetic]
    |
    v
[30.2 Part A — tabletop 90 minutes]
    |
    v
[30.3 Part B — evidence analysis offline]
    |
    v
[30.5 After-action report]
    |
    v
[30.6 Assessment rubric]
    |
    v
[Chapter synthesis]
    |
    v
[Worked example] --> [Exercise EX059]

Learning outcomes and connection

After this laboratory you can (1) run a contained, two-part exercise — a facilitated tabletop and an offline evidence analysis — for a cross-sector scenario; (2) reconstruct a timeline from synthetic logs and verify log integrity; (3) evaluate decisions against plans and measures; and (4) write an after-action report with an improvement plan. It integrates Chapters 17, 21, 22, 26, 27 and 29 and is the second project checkpoint.

30.1 Scenario (synthetic)

This scenario is synthetic. At 02:10 on a winter night, Calder Water's control room reports that pump station PS2's level setpoint changed from 4.1 m to 2.0 m at 01:52. Nobody admits to the change. At 02:30, CPN reports a fault on Substation North that will take 6 hours to repair. The CEDC duty manager asks whether hospital water supply is at risk. Teams of four play CW operations, CW security, CPN control and CVH estates; a facilitator delivers injects.

Calder Water could investigate the PS2 setpoint change, and CPN could repair Substation North in 6 hours; together they raise the question neither can answer alone: whether hospital water holds while both are unresolved.

30.2 Part A — tabletop (90 minutes)

Objectives: (1) decide within 20 minutes whether to move PS2 to local control; (2) produce a consolidated cross-operator status for CEDC by 03:00; (3) decide what evidence to preserve. Injects: 02:40 — CW security finds a vendor remote session was active 01:45–01:58; 02:55 — CVH estates reports 72 h generator fuel but asks about water; 03:20 — a local journalist calls CW. Observers record decision times, who decided and on what evidence.

Observers should note the minute each decision was made, by whom and on what evidence, so the after-action report can compare times with the objectives. The 20-minute objective for PS2 starts at 02:10.

30.3 Part B — evidence analysis (offline)

Using Lab 8's hash-chain function, teams receive three files: the operator log, the anchored head from the separate anchor server, and the vendor-session record. They recompute the chain, find which entry (if any) was altered, and align it with the session times. Using Lab 9's autonomy model (Chapter 22) with the 6-hour outage, they state which services are lost and when, and whether hospital water depends on PS2. Every result must be reproducible: script hash, Python version, output.

With 10 hours of treated storage against a 6-hour outage, hospital water should hold on Lab 9's figures; the open question for teams is whether that storage figure still applies with PS2's setpoint at 2.0 m rather than the normal 4.1 m.

30.4 Worked example: the timeline and its limits (synthetic)

Interpretation: the setpoint change coincides with the vendor session, and the log entry recording it was altered — consistent with a malicious or careless change hidden afterwards, but not proof of who did it. Cross-sector: with a 6-hour grid outage CW's pumps stop at once and treated storage (10 h) carries supply (Lab 9); a lowered setpoint means less stored water than planned, shortening that autonomy — the dangerous interaction is between two individually manageable events. Decisions: move PS2 to local control and restore the setpoint (operations), suspend vendor remote access (security, with CW director), preserve the vendor session record, the log server image and the anchor (security), inform CEDC and CVH with an estimated water autonomy range (operations, by 03:00), and refer media to the agreed spokesperson.

30.5 After-action report

Structure: objectives and whether met (with times); what went well; what did not; root causes (systemic, blameless — Chapter 28); improvement actions with owners and dates; evidence appendix. Distinguish exercise artefacts (things that happened only because it was an exercise) from real findings.

In this scenario, the journalist call at 03:20 tests a real procedure; a facilitator's late inject is an exercise artefact. Improvement actions follow from root causes, such as unmanaged vendor remote access, not from individual errors.

For the vendor-access action, verification would be a check that the vendor account is disabled outside approved tickets and that the session record for 01:52 can be retrieved.

30.6 Assessment rubric

A team that restores the setpoint quickly but cannot say who decided scores 2 for decisions. A timeline whose 01:52 row is marked high confidence despite the altered log entry scores 1. Cross-sector reasoning earns 3 only if the shortened water autonomy is estimated, not just mentioned.

Exercises — chapter 30

EX059 — Confidence grading. Objective: justify evidence weights. Inputs: the worked timeline in this laboratory. Steps: explain the confidence of each row and what additional evidence would raise the 01:52 row to high. Expected evidence: explanations. Rubric: 3 = system records high; altered log entry medium because the time and value of the original entry are unknown; raising it needs PLC/controller event logs, historian trend of the setpoint, vendor-side session recording; 2 = partial; 1 = assertions; 0 = none.

EX060 — Improvement plan. Objective: turn findings into actions. Inputs: the scenario. Steps: write five improvement actions with owner, date and how completion will be verified. Expected evidence: table. Rubric: 3 = e.g. per-session vendor approval and recording, setpoint change alarms with limits, anchor on separate team's system, cross-operator status template, joint exercise with CPN; each verifiable; 2 = actions without verification; 1 = vague; 0 = none.

Chapter synthesis

Laboratory II combines people and evidence: decide under time pressure, reconstruct timelines from sources of graded confidence, verify integrity and reason across sectors. The most dangerous situations often arise from the interaction of two individually manageable events.

Continue studying — chapter 30 of 40

← Chapter 29 · Course chapter index · Chapter 31 →

Continue to the next authored lesson.