Chapter 2 — Computing systems | Bachelor's OT, IoT and cyber-physical security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Computing systems

Lesson map

Lesson 02 published. Map, example, EX004.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 The scan cycle"]
  N2["2.2 PLC versus server"]
  N3["2.3 What lives in firmware"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX004"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 The scan cycle"]
  N2["2.2 PLC versus server"]
  N3["2.3 What lives in firmware"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX004"]

[Learning outcomes]
    |
    v
[2.1 The scan cycle]
    |
    v
[2.2 PLC versus server]
    |
    v
[2.3 What lives in firmware]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX004]

Learning outcomes

You will (1) describe the layers of a programmable logic controller from I/O card to scan cycle; (2) contrast a PLC with a general-purpose server; (3) explain why deterministic timing is a security property in OT; and (4) list what a firmware image contains.

2.1 The scan cycle

A PLC repeatedly reads inputs, executes logic, writes outputs and services communications. At LDHP the boiler PLC-H completes this loop every 20 ms. If communication handling grows — for example because a misconfigured historian polls 400 registers every 50 ms — the scan time stretches and the watchdog may trip the controller into a safe stop. A denial of service in OT can therefore arrive as ordinary traffic that is simply too much.

Maya met this in her second week: a dashboard project asked for "all tags, every scan". Converted into scan time, that request would have loaded PLC-H's communication handling on every 20 ms cycle, so she recommended reading the historian instead.

2.2 PLC versus server

A server is designed to run many programs, accept updates and recover by reboot. A PLC is designed to run one program for years, often with no user accounts, limited logging and firmware that the vendor signs (or, in older models, does not sign). Rebooting a server is routine; restarting a controller in a running boiler house requires a work permit, operator presence and a plan to hold the process safe.

For PLC-H this means a firmware fix cannot simply be applied on a Tuesday afternoon: it needs the monthly four-hour window, a work permit and the shift lead present.

2.3 What lives in firmware

Firmware bundles a real-time operating system, protocol stacks, the runtime that executes ladder or structured text, and a bootloader. Security consequences follow: a protocol stack bug can affect every program on the device, and an unsigned update path lets anyone who reaches the engineering port replace the runtime. NIST SP 800-82r3 treats firmware integrity and controlled program download as core OT practices.

For PLC-H, the practical question is who can reach the engineering port: if EWS-1 is the only host that can, protecting EWS-1 protects the runtime; if the office VLAN can reach port 502 as well, the firmware's signing behaviour becomes the last barrier.

Worked example (synthetic LDHP)

PLC-H has a 20 ms target scan and a 100 ms watchdog. Logic takes 9 ms, I/O 4 ms, and each Modbus request costs 0.6 ms to service. With 10 requests per scan the cycle is 9 + 4 + 6 = 19 ms. If a new dashboard adds 30 requests per scan, the cycle becomes 37 ms: still under the watchdog, but the 20 ms timing that tuned loops expect is lost and control quality degrades before any alarm fires.

Synthetic case — Lakeside District Heating Plant. Maya finds a dashboard project asking for "all tags, every scan". She converts the request into scan milliseconds and recommends polling the historian, not the controller.

Errors and limits

Vendor scan models differ; some service communications in a separate task. Never measure scan impact by loading a production controller — use a bench unit or the vendor's figures.

Exercises

EX004 — Communications load and scan time. With 9 ms logic, 4 ms I/O and 0.6 ms per request, how many requests per scan keep PLC-H at or under 20 ms? Rubric: 3 = 11 requests, shown; 2 = right number, no working; 1 = ignores I/O; 0 = none.
EX005 — Server habits that hurt controllers. Name two server administration habits that are unsafe on a running PLC and give the OT alternative for each. Rubric: 3 = two habits with alternatives; 2 = one pair; 1 = habits without alternatives; 0 = none.
EX006 — Firmware layers and blast radius. Explain why a vulnerability in a controller's protocol stack is wider in impact than a bug in one ladder rung. Rubric: 3 = shared stack serves every program and is reachable before logic runs; 2 = partial; 1 = vague; 0 = none.

Synthesis

A controller is a timed machine first and a computer second; its security starts with respecting the scan cycle and controlling what may be loaded onto it.

Continue studying — chapter 02 of 40

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →