Chapter 16 — Systems engineering
Lesson map
Lesson 16 published. Map, example, EX046.
flowchart TD
N0["Learning outcomes"]
N1["16.1 Testable requirements"]
N2["16.2 Traceability"]
N3["16.3 Interfaces"]
N4["Practice note"]
N5["16.1b Glossary and retirement"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX046"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["16.1 Testable requirements"]
N2["16.2 Traceability"]
N3["16.3 Interfaces"]
N4["Practice note"]
N5["16.1b Glossary and retirement"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX046"]
[Learning outcomes]
|
v
[16.1 Testable requirements]
|
v
[16.2 Traceability]
|
v
[16.3 Interfaces]
|
v
[Practice note]
|
v
[16.1b Glossary and retirement]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX046]
Learning outcomes
You will (1) write testable OT security requirements; (2) trace a requirement to a conduit rule and a lab; (3) manage interfaces between PLC, SIS, historian and security monitors.
16.1 Testable requirements
"The plant should be secure" is not a requirement. "No host outside L1/L2 shall initiate writes to PLC-A holding registers; verified by reachability analysis and allow-list tests on synthetic fixtures" is. Each requirement needs an id, a shall-statement, a verification method and an owner.
Lena assigns each CNHP requirement an id such as R-12 and an owner before any design work starts. A requirement without a verification method is returned to its author. Lena also checks that each one can be tested on synthetic fixtures, because a requirement that can only be verified by writing to a live controller cannot be accepted.
16.2 Traceability
Matrix: requirement to design element to test case to plant evidence. When a finding shows a conduit into SIS, you know which requirement and test failed. Without the matrix, post-mortems become blame.
Lena keeps the matrix as a file in the CNHP repository, updated in the same pull request as the policy it describes. Each row links a requirement such as R-12 to the zoned edge list, the reachability test and the latest firewall-export hash. When a test fails, the matrix shows which requirement is at risk and who owns it.
16.3 Interfaces
PLC-A publishes process values; SIS-B consumes dedicated sensors; the historian consumes PLC tags; the serial monitor consumes a listen-only tap. Agree tag lists and update rates. An interface change is a change request, not a quiet edit during a batch.
Synthetic case — Ashford Batch Plant. Requirement R-12 "SIS not reachable from L4" traces to the zoned edge list, lab_reach.py, and the quarterly firewall-export hash in the dossier.
Lena keeps the tag list for each interface in the repository, with its owner and update rate.
16.4 Errors and limits
Traceability matrices rot if not updated in the same PR as the policy. Keep them next to the code.
Lena's continuous integration fails a pull request that changes a policy file without touching the matrix, which keeps the two in step. Each row also carries the date it was last verified. Rows that have not been checked for a quarter are flagged in the review meeting, because an old link is often a broken one. Owners confirm each row yearly.
Practice note
Put requirement ids in firewall-object names and in detector config comments (req=R-12). Searchability during an incident beats a slide that once mapped requirements to modules.
16.1b Glossary and retirement
Maintain a one-page glossary: work permit, ConduitSet, allow-list, planned technique, sealed evidence. Stakeholders misuse coverage and risk constantly; the glossary is a requirements artefact. Traceability also covers retirement: when a requirement is withdrawn, mark it superseded with a pointer rather than deleting the row. Historical findings still cite old ids.
Internal SLAs between services matter: the monitor may need the finding store to accept an event within N seconds during a stop condition. Write that as a requirement with a synthetic load test. Without it, stop-condition pages arrive after the human already called process safety.
Exercises
- EX046 — Shall. Rewrite "stop office from touching SCADA" as two shall-requirements. Rubric: 3 = two testable shalls with verify method; 2 = one good; 1 = still vague; 0 = none.
- EX047 — Trace. For R-12, name the artefact and the failing test signal. Rubric: 3 = zoned edges + L1-SIS in reach(L4); 2 = one; 1 = vague; 0 = none.
- EX048 — Interface. List three fields in a tag-list interface contract. Rubric: 3 = tag name, type/engineering units, update rate (or equiv.); 2 = two; 1 = one; 0 = none.
Synthesis
Requirements you can test, links you can follow, interfaces you version.
Continue studying — chapter 16 of 50
← Chapter 15 (draft) · Course chapter index · Chapter 17 (draft) →