Chapter 3 — Physics for computing | Engineering OT, IoT and cyber-physical security

Lesson map

Lesson 03 published. Map, example, EX007.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 Bits on a wire"]
  N2["3.2 Process time constants"]
  N3["3.3 Physical-layer manipulation"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX007"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 Bits on a wire"]
  N2["3.2 Process time constants"]
  N3["3.3 Physical-layer manipulation"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX007"]

[Learning outcomes]
    |
    v
[3.1 Bits on a wire]
    |
    v
[3.2 Process time constants]
    |
    v
[3.3 Physical-layer manipulation]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX007]

Learning outcomes

You will (1) compute serial-link timing for fieldbus polling; (2) relate physical process speed to required control cycle times; (3) recognise that physical signals can be manipulated outside the network.

3.1 Bits on a wire

Much plant communication still runs over RS-485 serial at rates such as 115,200 bit/s. With one start bit, eight data bits and one stop bit, each byte costs ten bit-times. A 40-byte Modbus RTU response therefore takes 40 × 10 / 115,200 ≈ 3.5 ms on the wire, before device processing. Summing every poll in a cycle tells you whether the schedule fits the controller's cycle budget.

"""Lab: does a polling schedule fit the PLC scan/communication budget? (synthetic)"""
link_bps = 115200; bits_per_byte = 10           # RS-485 serial, 8N1 + start bit
polls = [("T-1 level", 8), ("T-2 level", 8), ("R-101 block", 40), ("pump status", 8), ("historian sweep", 120)]
overhead = 12                                    # bytes of request+framing per poll (assumed)
total = sum(n + overhead for _, n in polls)
t = total * bits_per_byte / link_bps
print(f"bytes per cycle={total} time per cycle={t*1000:.1f} ms")
for target in (100, 50):
    print(f"cycle budget {target} ms -> {'fits' if t*1000 <= target else 'OVERRUN'}")

Expected output:

bytes per cycle=244 time per cycle=21.2 ms
cycle budget 100 ms -> fits
cycle budget 50 ms -> fits

Lena does this sum for the trunk to PLC-A before approving any monitoring device on it, and the result is the 21 ms figure she later uses throughout the programme.

3.2 Process time constants

A level loop on a 12 m³ tank changes over minutes; a pressure loop on a compressor changes in tens of milliseconds. The required control and detection speed follows the physics. Security monitoring that adds 200 ms of latency is harmless on the tank and dangerous on the compressor. Always ask what the process time constant is before inserting inspection devices inline.

For ABP, the feed tanks and reactor level are slow loops, while a compressor skid nearby is fast. Lena lists the loops on each trunk with their time constants before choosing where a monitor may sit.

3.3 Physical-layer manipulation

Sensors measure physics: a 4–20 mA loop, a thermocouple voltage, a pulse from a flow meter. An adversary or a fault can alter those signals without touching any network packet — by injecting current, heating a probe or vibrating a meter. Network monitoring cannot see this; physical plausibility checks (Chapter 29) and tamper-evident enclosures can.

Synthetic case — Ashford Batch Plant. Lena's polling budget for the RS-485 trunk to PLC-A came to 21 ms per cycle, comfortably inside the 100 ms cycle. That left room for an inline serial monitor, which she approved only after measuring its added latency on a bench copy.

3.4 Errors and limits

Timing calculations ignore device turnaround and retries; measure on a bench before committing. Do not test signal injection on live loops.

Lena's bench copy of the RS-485 trunk to PLC-A is where the polling budget and the serial monitor's added latency were measured, and it is the only place course work touches serial timing. Any signal-injection experiment, even a small bias on a 4–20 mA loop, belongs on a bench with a spare transmitter, never on T-1's live loop. Record bench results with the equipment used, because a different transmitter or cable can change the numbers.

3.5 Worked example — signal levels and the time budget (synthetic ABP)

T-1's level transmitter sends a 4–20 mA signal over 180 m of twisted pair to PLC-A. A 0.2 mA bias injected at a marshalling cabinet shifts the reading by 0.2/16 = 1.25 % of span, which for the transmitter's 9 m³ calibrated span is about 0.11 m³ — small enough to hide inside normal noise. The tank's time constant (span over typical inflow, 9/1.25 ≈ 7.2 h) tells Lena how long such a bias can act before the hold-up calculation from Chapter 1 is wrong by a whole safety margin. She therefore specifies a second, independent level switch on T-1 wired to SIS-B and a periodic comparison of transmitter and switch, because a physical-layer attack on one loop cannot then silently defeat both.

Exercises

EX007 — Wire time. How long does a 120-byte frame take at 19,200 bit/s with 10 bits per byte? Rubric: 3 = 62.5 ms with working; 2 = slip; 1 = method; 0 = none.
EX008 — Budget. Using the lab's 244 bytes per cycle, what is the slowest baud rate that still fits a 50 ms budget? Rubric: 3 = 48,800 bit/s (so 57,600 standard) with working; 2 = number without standard rate; 1 = method; 0 = none.
EX009 — Physical. Give two physical-layer manipulations a network IDS cannot detect and one compensating control each. Rubric: 3 = two manipulations plus controls; 2 = two without controls; 1 = one; 0 = none.

Synthesis

Physics sets the timing budget for control and for any security device you put in the loop.

Continue studying — chapter 03 of 50

← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →