Chapter 10 — Engineering ethics and safety
Lesson map
Lesson 10 published. Map, example, EX028.
flowchart TD
N0["Learning outcomes"]
N1["10.1 Authorization is not enthusiasm"]
N2["10.2 Dual use"]
N3["10.3 Stop conditions that protect the process"]
N4["Practice note"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX028"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["10.1 Authorization is not enthusiasm"]
N2["10.2 Dual use"]
N3["10.3 Stop conditions that protect the process"]
N4["Practice note"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX028"]
[Learning outcomes]
|
v
[10.1 Authorization is not enthusiasm]
|
v
[10.2 Dual use]
|
v
[10.3 Stop conditions that protect the process]
|
v
[Practice note]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX028]
Learning outcomes
You will (1) refuse unauthorized plant access and dual-use requests; (2) apply stop conditions that protect process safety; (3) document consent so a review can reconstruct it.
10.1 Authorization is not enthusiasm
A plant manager saying "go ahead" in a corridor is not written authorization. OT work needs a signed scope naming units, methods, windows, stop conditions and a process-safety contact who can halt the plant. Without that document, the engineer stops. NIST SP 800-82 and ISA/IEC 62443 assume authorized, planned activity — not clever improvisation.
Lena keeps a copy of the signed scope with every work package and checks it before each session. If the scope does not cover a planned step, she stops and asks for an amendment rather than interpreting it generously. The process-safety contact's phone number is on the permit itself.
10.2 Dual use
This programme teaches zoning, monitoring, measurement and reporting. It does not teach exploit development against PLCs, weaponised protocol stacks or bypasses of safety systems. When a peer asks for "just the PoC against brand X", the answer is the finding description and the vendor's disclosure channel, not a working attack.
Lena's refusals are polite and specific, pointing to what she can offer instead: a finding with bounded consequences, a reference to the vendor's disclosure process and a design change that removes the exposure. The record of each request and refusal is kept with the project notes.
10.3 Stop conditions that protect the process
Stop if: an unexpected process alarm fires; latency or cycle time exceeds the budget; a safety system indicates a fault; the process-safety contact says stop. Software hard-denies help, but humans always win. Never disable a safety function to "make the test work".
Synthetic case — Ashford Batch Plant. During a bench test of the serial monitor, cycle time rose above 50 ms. Lena stopped, removed the device, and re-tested on a spare trunk before any plant window was booked.
These conditions are printed on the permit.
10.4 Errors and limits
Ethics is a constraint on every later chapter. Legal text here is orientation, not advice. Live plants are never course lab targets.
Every later chapter assumes this boundary. Lena's work at ABP happens under a signed scope with named stop conditions and a process-safety contact; nothing in the course is ever aimed at a running plant. Where a question touches law, such as data protection or contracts with vendors, she asks the site's legal adviser rather than relying on course notes, and records the advice she received.
Practice note
Print the stop conditions on the work permit hung at the panel. Under noise and time pressure, people remember what they can see. A stop condition buried in page 12 of a PDF is a stop condition that will be missed.
10.5 Worked example — a permit that says no (synthetic ABP)
A contractor asks to run an active Modbus scan of PLC-A during a batch "to finish the inventory faster". Lena's permit review applies three tests: is the owner's written authorization specific to this host and technique (it is not); does a stop condition exist that an operator can trigger (none was written); and is there a passive alternative (a mirror-port capture plus the engineering project export gives the same inventory). She declines the active scan, records the reason, and issues a permit for passive capture only, with the shift lead named as the person who can stop the work. NIST SP 800-82r3 warns that active scanning can disrupt OT devices, which is the engineering reason behind the ethical one.
Exercises
- EX028 — Refuse. Two-sentence refusal to a request for a working PLC exploit for a graded assignment. Rubric: 3 = refuses, offers allowed alternative, cites safety; 2 = refuses only; 1 = vague; 0 = provides exploit.
- EX029 — Stop. List four stop conditions for an ABP window. Rubric: 3 = four process-relevant; 2 = three; 1 = one; 0 = none.
- EX030 — Fields. Six fields a signed OT work permit must contain. Rubric: 3 = units, methods, window, rate/impact limits, contacts, stop/resume; 2 = four; 1 = two; 0 = none.
Synthesis
Written permission, process-first stop conditions and a refusal habit are safety engineering.
Continue studying — chapter 10 of 50
← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →