Chapter 8 — Computer architecture
Lesson map
Lesson 08 published. Map, example, EX022.
flowchart TD
N0["Learning outcomes"]
N1["8.1 Privilege in the plant"]
N2["8.2 Independence is physical"]
N3["8.3 Evidence without writing to the PLC"]
N4["Practice note"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX022"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["8.1 Privilege in the plant"]
N2["8.2 Independence is physical"]
N3["8.3 Evidence without writing to the PLC"]
N4["Practice note"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX022"]
[Learning outcomes]
|
v
[8.1 Privilege in the plant]
|
v
[8.2 Independence is physical]
|
v
[8.3 Evidence without writing to the PLC]
|
v
[Practice note]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX022]
Learning outcomes
You will (1) place PLC, SIS and SCADA on a privilege and dependency map; (2) explain why safety systems need independent hardware; (3) design evidence collection that does not require writing to the PLC.
8.1 Privilege in the plant
A PLC executes the basic regulatory loop. An SIS implements the safety instrumented functions and must be able to act when the PLC is wrong or compromised. SCADA and HMIs are supervisory: they set setpoints and display state. Architecture that lets SCADA write into SIS logic collapses that independence — which is exactly what the reachability lab warned about.
At ABP, PLC-A runs the regulatory loops on T-1, T-2 and R-101, and SIS-B holds the trips. Lena marks these roles on her privilege map.
8.2 Independence is physical
Independence is not a VLAN tag. It means separate controllers, sensors where required by the safety requirement specification, and conduits that do not allow the regulatory network to alter safety logic. NIST SP 800-82 and ISA/IEC 62443 both treat safety systems as needing careful zoning; process-safety standards (IEC 61511) go further on independence. Security architecture must not undo what safety architecture paid for.
Lena checks independence by tracing wires and conduits, not by reading labels in the network drawing. SIS-B's own level sensors on T-1 are the clearest example of that independence.
8.3 Evidence without writing to the PLC
Authorized assessment of OT prefers read-only methods: configuration exports, mirrored historian data, span ports, serial monitors in listen mode. Writing a test setpoint to a live PLC is a process change and needs the same authorization as an engineering change. Course labs never write to real devices.
Synthetic case — Ashford Batch Plant. SIS-B is a separate controller with its own sensors for high-high level on T-1. CNHP's rule set forbids any conduit from L2/L3 into SIS engineering ports except through a locked physical keyswitch during scheduled tests.
8.4 Errors and limits
"Air gap" claims often hide USB, vendor laptops and cellular modems. Inventory those out-of-band paths as carefully as IP routes.
Lena's inventory for ABP lists every USB port on HMIs and engineering workstations, every vendor laptop that connects for support and every cellular modem fitted for remote diagnostics. Each gets an owner and a control, such as port blocking or a logged sign-out. A plant described as isolated is checked against this list before anyone repeats the claim in a report, because one forgotten modem can create a path the zone graph never shows.
Practice note
Draw the privilege map on one page: who can change setpoints, who can change logic, who can change safety setpoints, and through which physical ports. Hang it in the engineering room. Arguments about "just a temporary rule" die faster when the map is visible.
Exercises
- EX022 — Map. Name three actions that require SIS engineering privilege and three that a normal HMI may do. Rubric: 3 = six correctly split; 2 = four; 1 = vague; 0 = none.
- EX023 — Independence. Why is VLAN separation alone insufficient for SIS independence? Rubric: 3 = shared controller/sensors/management path can still couple; 2 = one reason; 1 = vague; 0 = claims VLAN enough.
- EX024 — Evidence. Propose a read-only evidence path for "HMI can write register 40050". Rubric: 3 = config export or monitored span showing the write capability / attempt, no live write; 2 = partial; 1 = live write; 0 = none.
Synthesis
Keep safety logic independent in hardware and conduits; collect evidence without becoming an actuator.
Continue studying — chapter 08 of 50
← Chapter 07 (draft) · Course chapter index · Chapter 09 (draft) →