Chapter 36 — OT, IoT and cyber-physical security: performance and scale
Lesson map
Lesson 36 published. Map, example, EX106.
flowchart TD
N0["Learning outcomes"]
N1["36.1 Cycle time is first-class"]
N2["36.2 Assessment traffic"]
N3["36.3 Canaries"]
N4["Practice note"]
N5["36.1b Fairness and warm-up"]
N6["Field note — warm-up schedule"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX106"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["36.1 Cycle time is first-class"]
N2["36.2 Assessment traffic"]
N3["36.3 Canaries"]
N4["Practice note"]
N5["36.1b Fairness and warm-up"]
N6["Field note — warm-up schedule"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX106"]
[Learning outcomes]
|
v
[36.1 Cycle time is first-class]
|
v
[36.2 Assessment traffic]
|
v
[36.3 Canaries]
|
v
[Practice note]
|
v
[36.1b Fairness and warm-up]
|
v
[Field note — warm-up schedule]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX106]
Learning outcomes
You will (1) size monitors under cycle-time budgets; (2) apply token-bucket thinking to assessment traffic; (3) measure plant impact with a canary.
36.1 Cycle time is first-class
Throughput goals that ignore the PLC cycle budget are bugs. Size decode pipelines so the wire-plus-decode time stays inside the budget measured in Chapter 3.
"""Lab: does a polling schedule fit the PLC scan/communication budget? (synthetic)"""
link_bps = 115200; bits_per_byte = 10 # RS-485 serial, 8N1 + start bit
polls = [("T-1 level", 8), ("T-2 level", 8), ("R-101 block", 40), ("pump status", 8), ("historian sweep", 120)]
overhead = 12 # bytes of request+framing per poll (assumed)
total = sum(n + overhead for _, n in polls)
t = total * bits_per_byte / link_bps
print(f"bytes per cycle={total} time per cycle={t*1000:.1f} ms")
for target in (100, 50):
print(f"cycle budget {target} ms -> {'fits' if t*1000 <= target else 'OVERRUN'}")
Expected output:
bytes per cycle=244 time per cycle=21.2 ms
cycle budget 100 ms -> fits
cycle budget 50 ms -> fits
At ABP the RS-485 trunk to PLC-A runs a 21 ms polling cycle inside a 100 ms control cycle, and the stop condition fires if cycle time reaches 50 ms. Lena sizes the monitor so that tapping, decoding and logging add nothing to the wire time, because the tap is passive and the decoder runs on its own host. Load tests on the bench replay a full day of captured traffic at double speed to confirm the decoder never falls behind the trunk.
36.2 Assessment traffic
When active methods are authorized, rate-limit them so they cannot starve control traffic. Prefer listen-only methods; when you must poll, share a global budget across scanners.
During CNHP assessment windows at ABP, only one active tool may poll the trunk at a time, and its request rate is written in the permit before it starts. Passive discovery from the tap covers most of the inventory, so active polling is limited to the few devices that do not speak on their own. Each tool reports its rate to the shared budget, and the window lead can pause all active methods with one switch if cycle time rises.
36.3 Canaries
A synthetic canary request or cycle-time probe every minute tracks health; stop conditions fire on threshold (Chapter 33).
Synthetic case — Ashford Batch Plant. With 21 ms cycles on the RS-485 trunk, Lena left headroom under 50 ms so a decode spike would not trip the stop.
The canary at ABP reads one harmless status register on PLC-A every minute and records the response time beside the trunk cycle time. If either moves toward its threshold, the window lead is paged before the stop condition is reached, which gives time to pause active work calmly instead of reacting to an automatic stop.
36.4 Errors and limits
Distributed scanners need a coordinated global budget or they N× the limit.
At ABP two scanners once ran from different hosts, each within its own rate, and together exceeded the trunk budget. Lena moved the budget to a single coordinator that grants tokens to every scanner, so the total stays within the permit no matter how many tools are running. A scanner that cannot reach the coordinator is not allowed to send anything, which keeps the failure safe rather than letting each tool fall back to its own limit.
Practice note
Publish a rate-limit economics note: cost of waiting versus cost of a batch interruption. Most arguments for raising limits dissolve when interruption cost is written down.
36.1b Fairness and warm-up
When several methods share one budget, a noisy enumerator can starve a quiet config review. Weight or separate budgets by method class. Ramp traffic at window start and drain before hard stop. Draining means no new requests in the last ten minutes, so in-flight replies arrive before the stop.
Document who may raise a rate limit and which AUTH ticket type is required. A raised limit expires at the end of the window unless renewed under a new ticket.
Lena enforces both budgets in the coordinator.
Field note — warm-up schedule
The scheduler now ramps assessment polls over five minutes at window start. Instant full-rate starts had tripped unrelated vibration alarms on a neighbouring skid. Warm-up is courtesy to the process and to the people who own it.
36.5 Worked example — measuring monitoring load on PLC-A (synthetic ABP)
A proposed asset-health poller would read 120 holding registers from PLC-A every second. On the bench controller, Lena measures scan time with and without the poller: 18 ms baseline, 23 ms with polling, against a 50 ms watchdog. The increase is acceptable on the bench, but she still caps the poller at 120 registers every 5 seconds in production, adds a canary on one line before plant-wide rollout, and alarms if scan time exceeds 30 ms. Assessment traffic gets the same treatment: any test tool must declare its request rate, and the permit sets a maximum.
Exercises
- EX106 — Lab. Bytes and time per cycle at 115200 — report both. Rubric: 3 = 244 bytes, 21.2 ms; 2 = one; 1 = wrong; 0 = none.
- EX107 — Headroom. If budget is 50 ms and cycle is 21 ms, what headroom remains and why keep it? Rubric: 3 = ~29 ms for spikes/retries; 2 = number only; 1 = use it all; 0 = none.
- EX108 — Global. Why do three uncoordinated pollers break a 2 req/s permit? Rubric: 3 = 3× rate; 2 = vague; 1 = deny; 0 = none.
Synthesis
Budget first, scale second, canary always.
Continue studying — chapter 36 of 50
← Chapter 35 (draft) · Course chapter index · Chapter 37 (draft) →