Chapter 41 — OT, IoT and cyber-physical security: system optimization
Lesson map
Lesson 41 published. Map, example, EX121.
flowchart TD
N0["Learning outcomes"]
N1["41.1 Profile first"]
N2["41.2 Constraint-preserving"]
N3["41.3 Safety veto"]
N4["Practice note"]
N5["41.1b Load shedding and N+1"]
N6["Field note — safety paragraph"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX121"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["41.1 Profile first"]
N2["41.2 Constraint-preserving"]
N3["41.3 Safety veto"]
N4["Practice note"]
N5["41.1b Load shedding and N+1"]
N6["Field note — safety paragraph"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX121"]
[Learning outcomes]
|
v
[41.1 Profile first]
|
v
[41.2 Constraint-preserving]
|
v
[41.3 Safety veto]
|
v
[Practice note]
|
v
[41.1b Load shedding and N+1]
|
v
[Field note — safety paragraph]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX121]
Learning outcomes
You will (1) profile OT security pipelines ethically; (2) optimize under cycle-time and ROE constraints; (3) reject optimizations that weaken safety.
41.1 Profile first
Measure where time goes: decode, permit eval, event write. Optimize the dominant term. Synthetic load only.
At ABP, Lena profiled the monitor on the bench before any optimisation was approved. Replaying a recorded day of trunk traffic, she measured how long decoding, permit evaluation and event writing each took, and found event writing dominated. Batching writes cut overall latency without changing a single permit rule. She uses synthetic or replayed load only, because profiling against live equipment would add exactly the risk the monitor exists to reduce, and the bench copy of PLC-A behaves closely enough for timing work.
41.2 Constraint-preserving
Caching AllowListVersion is fine if invalidation on publish is correct. Caching allow decisions across stations is not — stations differ.
In CNHP the allow-list is cached in memory with its version number, and every publish clears the cache before the new version is used, so stale rules cannot linger. Caching individual decisions was rejected, because HMI-1 and the engineering workstation are allowed different registers, and a decision cached for one would be wrong for the other. Lena's tests include a publish during heavy load to confirm that the first decision after publishing always uses the new version.
41.3 Safety veto
Any monitor optimization that skips allow-list checks, shortens audit fields or fails open is rejected, whatever cycle time it saves.
"""Lab: does a polling schedule fit the PLC scan/communication budget? (synthetic)"""
link_bps = 115200; bits_per_byte = 10 # RS-485 serial, 8N1 + start bit
polls = [("T-1 level", 8), ("T-2 level", 8), ("R-101 block", 40), ("pump status", 8), ("historian sweep", 120)]
overhead = 12 # bytes of request+framing per poll (assumed)
total = sum(n + overhead for _, n in polls)
t = total * bits_per_byte / link_bps
print(f"bytes per cycle={total} time per cycle={t*1000:.1f} ms")
for target in (100, 50):
print(f"cycle budget {target} ms -> {'fits' if t*1000 <= target else 'OVERRUN'}")
Expected output:
bytes per cycle=244 time per cycle=21.2 ms
cycle budget 100 ms -> fits
cycle budget 50 ms -> fits
Synthetic case — Ashford Batch Plant. Caching signed allow-lists in memory cut latency; invalidation on publish kept safety. A proposal to skip register checks for known good HMIs was vetoed.
Lena records each vetoed proposal at ABP with its expected speedup and the reason it was rejected. The decision log means the same idea is not reopened every quarter without new safety arguments.
41.4 Errors and limits
Benchmarks on laptops do not predict plant trunks.
At ABP, a decoder that ran easily on a developer laptop fell behind when Lena tested it on the bench copy of the RS-485 trunk with real timing and frame sizes. Laptops have faster processors and none of the serial timing limits that matter on the plant. Lena now accepts performance figures only from the bench, and each benchmark report states the trunk's 21 ms polling cycle and the 50 ms stop next to the measured result, so readers can judge the margin.
Practice note
Optimization proposals require a safety paragraph. Proposals without it are returned unread.
41.1b Load shedding and N+1
Under overload, shed discovery work before shedding deny evaluation. Chatty ticket updates during bulk import crush the finding store — batch writes and measure. Keep headroom under the cycle-time budget so a retry storm does not breach it.
The load-shedding order is written in the runbook, so the window lead knows which work pauses first.
Lena's reviews apply each rule. At ABP, Lena tested overload by replaying traffic at triple speed: discovery paused first while deny decisions continued at full rate and stayed well under the cycle budget.
Field note — safety paragraph
An optimization PR that removed reason codes from hot-path logs to save microseconds was returned unread for lack of a safety paragraph. The revised PR kept the codes and found its speedup elsewhere. Safety paragraphs are not bureaucracy; they are the veto mechanism.
The overload replay is repeated after every release that touches the decoder.
41.5 Worked example — optimisation with a safety veto (synthetic ABP)
Production asks to shorten the R-101 batch by raising the feed rate, and asks CNHP to relax the permit function's rate limit on setpoint writes from one per 10 s to one per second to suit the faster recipe. Lena profiles first: only the charge phase needs faster writes. She proposes a phase-specific limit, applied only while the batch state is "charge", and submits it to the process safety engineer, who confirms SIS-B's high-temperature and high-level trips are unaffected. The safety engineer holds a veto over any optimisation touching a safety-relevant loop; this one passed, with a load test on the bench.
Exercises
- EX121 — Veto. An optimization that must be rejected. Rubric: 3 = safety-weakening example; 2 = vague; 1 = okays it; 0 = none.
- EX122 — Cache. When is decision caching safe? Rubric: 3 = same version+station+fc+reg, short TTL, invalidate on publish; 2 = partial; 1 = always; 0 = none.
- EX123 — Shed. What do you shed first under overload? Rubric: 3 = discovery/assessment before deny evaluation; 2 = partial; 1 = drop denies; 0 = none.
Synthesis
Speed under constraints; safety has veto power.
Continue studying — chapter 41 of 50
← Chapter 40 (draft) · Course chapter index · Chapter 42 (draft) →