Chapter 28 — OT, IoT and cyber-physical security: failure analysis
Lesson map
Lesson 28 published. Map, example, EX082.
flowchart TD
N0["Learning outcomes"]
N1["28.1 Fault trees"]
N2["28.2 Adding cyber events"]
N3["28.3 FMEA for the gateway"]
N4["28.4 Bow-tie view"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX082"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["28.1 Fault trees"]
N2["28.2 Adding cyber events"]
N3["28.3 FMEA for the gateway"]
N4["28.4 Bow-tie view"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX082"]
[Learning outcomes]
|
v
[28.1 Fault trees]
|
v
[28.2 Adding cyber events]
|
v
[28.3 FMEA for the gateway]
|
v
[28.4 Bow-tie view]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX082]
Learning outcomes
You will (1) build a fault tree for loss of district heat; (2) combine AND and OR gates with simple probabilities; (3) add cyber-induced events to a safety-style analysis; and (4) use failure modes and effects analysis (FMEA) for an IoT gateway.
28.1 Fault trees
A fault tree starts with an undesired top event and decomposes it into causes joined by gates. An OR gate means any child causes the parent; an AND gate needs all children. For independent events, P(OR) ≈ sum of probabilities when they are small, and P(AND) = product.
For LDHP's top event, the four-hour heat-loss tree in this chapter, the OR gate at the top means any one branch is enough; the AND gate under branch (c) means the attack succeeds only if all three of its conditions hold. If each of those three had a probability of 0.1 and they were truly independent, branch (c) would be 0.001; the next paragraphs explain why a cyber cause breaks that assumption.
28.2 Adding cyber events
Top event: loss of heat to the district for more than four hours. OR children: (a) both boilers trip and cannot restart; (b) circulation pumps stop; (c) supply setpoint manipulated and not detected for four hours. Event (c) is itself an AND: unauthorised setpoint write and operators fail to notice and the detector fails. Cyber events break the independence assumption: one intruder can cause several "independent" failures at once, so treat common-cause carefully.
At LDHP, one intruder with access to HMI-1 could write the setpoint and also silence the alarm display operators rely on to notice it.
28.3 FMEA for the gateway
FMEA lists each component, its failure modes, effects, detection and severity. Gateway failure modes include power loss (readings missing — detected by heartbeat), corrupted firmware (malformed data — detected by validation), configuration tampering (plausible false readings — hard to detect), and certificate expiry (uplink refused — detected by monitoring).
For LDHP, configuration tampering is the row to dwell on: a gateway configured to scale every reading by 0.9 produces plausible numbers that pass validation and heartbeat checks, and would show up only in a comparison of gateway totals with the heat leaving the plant. Maya's STRIDE ranking puts gateway takeover first for this reason. Certificate expiry, by contrast, is easy to detect and easy to prevent with a renewal alert, so it ranks low despite stopping all readings.
Worked example (synthetic LDHP)
Annual probabilities (illustrative): unauthorised write 0.05; operators miss it for four hours 0.2; detector misses 0.1. P(c) = 0.05 × 0.2 × 0.1 = 0.001. Boilers both fail to restart 0.002; pumps 0.003. P(top) ≈ 0.002 + 0.003 + 0.001 = 0.006 per year. But if the intruder can also suppress HMI alarms, "operators miss" is no longer 0.2 and the AND gate's independence collapses — P(c) may approach 0.05 × 1 × 0.1 = 0.005.
Synthetic case — Lakeside District Heating Plant. All probabilities are invented for illustration and should not be reused.
28.4 Bow-tie view
A bow-tie diagram places the top event in the centre, threats and preventive barriers on the left, and consequences with mitigating barriers on the right. It helps operators see that SIS-H is a mitigating barrier for over-temperature but offers nothing for under-temperature caused by a lowered setpoint.
Maya's HAZOP contribution in Chapter 32 makes the same point from the other side: SIS-H's high-temperature trip is the safeguard for a manipulated setpoint that over-fires the boiler, but a setpoint written down to 30 °C, as in Chapter 29's tabletop, causes loss of heat without ever approaching a trip point. For that consequence the barriers are on the left of the bow-tie: the firewall allow-list, named accounts, PLC-H's 70–110 °C setpoint limits and the monitor's alert.
Errors and limits
Probabilities for adversarial events are judgements; present them as ranges. Fault trees miss interactions not drawn.
Exercises
- EX082 — Computing a cyber AND gate. With write 0.1, operators miss 0.3, detector misses 0.2, compute P(c). Rubric: 3 = 0.006; 2 = method right; 1 = sums instead; 0 = none.
- EX083 — Common cause. Explain how one intrusion can break the AND gate's independence. Rubric: 3 = same actor suppresses alarms/blinds detector, so events correlated; 2 = partial; 1 = vague; 0 = none.
- EX084 — An FMEA line. Write the FMEA row for gateway certificate expiry. Rubric: 3 = mode, effect, detection, severity, action; 2 = four; 1 = mode only; 0 = none.
Synthesis
Fault trees and FMEA bring cyber events into reliability engineering — provided you challenge the independence that adversaries are paid to break.
Continue studying — chapter 28 of 40
← Chapter 27 (draft) · Course chapter index · Chapter 29 (draft) →