Chapter 1 — Building systems as cyber-physical systems
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 What runs a hospital building"]
N2["1.2 Why they are cyber-physical"]
N3["1.3 Consequence for patients"]
N4["1.4 Who owns them"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 What runs a hospital building"]
N2["1.2 Why they are cyber-physical"]
N3["1.3 Consequence for patients"]
N4["1.4 Who owns them"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 What runs a hospital building]
|
v
[1.2 Why they are cyber-physical]
|
v
[1.3 Consequence for patients]
|
v
[1.4 Who owns them]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) list the building systems a hospital depends on; (2) explain how each becomes a cyber-physical system once networked; and (3) describe the patient consequences of their failure.
1.1 What runs a hospital building
Behind the wards sit air-handling units that keep operating theatres at controlled temperature, humidity and pressure; chillers and boilers; medical gas alarm panels that warn when oxygen pressure drops; elevators that move patients between floors; and access control on doors to pharmacies and maternity units. A building management system (BMS) ties many of these together on a network with a central workstation.
Most of these systems are invisible to patients and to many staff until they fail. At Millbrook they include the two theatre air-handling units, a chiller, a medical gas alarm panel, the lift controller and the access control server, all reached from one BMS workstation. Knowing the list is the first step towards asking who protects each item.
1.2 Why they are cyber-physical
Each system reads sensors and drives equipment in the physical world through controllers. Once those controllers are networked, a change made on a screen anywhere on the network can move a damper, stop a pump or unlock a door. NIST SP 800-82r3 covers building automation explicitly within operational technology for exactly this reason.
At Millbrook a setpoint typed on BMS-WS can change the air in an operating theatre, and a schedule on DOOR-SRV decides which doors open. Neither change needs anyone to stand in a plant room. That is what makes these systems a security concern: whoever can reach the screen can reach the equipment behind it.
1.3 Consequence for patients
Office IT failures delay work. Building-system failures can harm patients: a theatre that loses positive pressure risks surgical infection; a silenced gas alarm hides a real drop; a stuck elevator delays an emergency transfer. Security planning in a hospital begins by asking which failure would hurt someone, and how quickly.
Write the answer for each system in a sentence a clinician would recognise, and note how long the hospital can cope before harm becomes likely. A theatre may cope for minutes before a list is cancelled; a ward may manage a door failure for hours with keys. Those timescales later decide which risks come first in planning and in an incident.
1.4 Who owns them
Building systems are often owned by estates or facilities teams, maintained by contractors, and invisible to the hospital's IT security staff. Closing that gap — agreeing who is responsible for the security of each system — is often the first practical win.
At Millbrook, Aisha's first meeting is with the estates manager rather than with the IT team, because estates runs the BMS and holds the contractor relationships. The outcome she wants is a short list with one named owner per system, agreed by both sides. Without it, every later finding risks being passed between teams with nobody acting on it.
Worked example (synthetic Millbrook)
Aisha Bello, newly hired as a junior security analyst at Millbrook Hospital, meets the estates manager and lists the systems on a whiteboard with one consequence each. "AHU-OT1: theatre 1 loses pressure — surgery postponed or infection risk." "MGAS-PANEL: oxygen pressure alarm silent — ward staff unaware of supply fault."
Synthetic case — Millbrook Hospital Building Systems. The hospital, Aisha Bello and every figure in this book are invented for teaching.
Errors and limits
Consequences must be confirmed with clinical and estates staff; an analyst's guess is a starting point only.
Exercises
- EX001 — Five systems. List five hospital building systems and what each controls. Rubric: 3 = five systems each with a correct function; 2 = four; 1 = two; 0 = none.
- EX002 — Becoming cyber-physical. Explain in two sentences how networking turns an air-handling unit into a cyber-physical security concern. Rubric: 3 = networked controller lets remote screen change physical equipment; consequence named; 2 = one point; 1 = vague; 0 = none.
- EX003 — Theatre pressure. Why does loss of positive pressure in an operating theatre matter? Rubric: 3 = unfiltered air enters, surgical infection risk, surgery postponed; 2 = one; 1 = comfort; 0 = none.
- EX004 — Silent gas alarm. Describe the harm if MGAS-PANEL alarms are disabled during a real pressure drop. Rubric: 3 = staff unaware, patients on oxygen at risk, delayed response; 2 = partial; 1 = "noise stops"; 0 = none.
- EX005 — Ownership gap. Why is agreeing who owns building-system security an early win? Rubric: 3 = estates/contractors/IT gap leaves nobody patching or monitoring; clear owner enables every next step; 2 = partial; 1 = paperwork; 0 = none.
Synthesis
Hospital building systems move air, gas, people and doors; their failure can hurt patients, so their security needs an owner.