## Chapter 1 — What operational technology is on a packaging line ### Learning outcomes You will (1) name the main OT components on a food packaging line; (2) explain why OT priorities differ from office IT; and (3) describe what can physically go wrong when a control system misbehaves. ### 1.1 The line as a system A packaging line turns film, trays and product into sealed, labelled packs. Programmable logic controllers (PLCs) read sensors and drive motors, heaters and valves many times a second. Operator panels, called human-machine interfaces (HMIs), show the state of the line and let operators start, stop and adjust it. A vision camera rejects badly sealed packs. An engineering laptop holds the programs and is used to change them. NIST SP 800-82r3 calls this whole family operational technology: systems that monitor or control physical processes. ### 1.2 Why priorities differ In an office, losing confidentiality of a spreadsheet is the classic harm. On a line, the first questions are: can someone get hurt, will food be unsafe, will the line stop? A sealing heater that runs too hot can burn a worker or leave packs unsealed and contaminated. That is why availability and safe behaviour come before confidentiality here, and why you never "just reboot" a controller to see what happens. At HPFL this order shapes small decisions. Tomás does not unplug HMI-1 because it looks odd; he first asks the supervisor whether the line is safe to stop. A fix that protects data but leaves the sealing heater uncontrolled would be the wrong fix, however sensible it looks in an office. ### 1.3 What an attacker or a mistake can change The same changes come from malice or error: a setpoint altered, a program replaced, an HMI locked, a network flooded. MITRE ATT&CK for ICS lists, for example, T0836 Modify Parameter. Your job as a technician is to notice such changes, report them and help restore safely — not to investigate devices by yourself. Because the same change can come from either source, Tomás records what changed, when and on which device, without deciding why. On HPFL a changed wrapper speed could be an operator clearing a backlog or someone misusing a password; Chapter 9 shows a case where it was the first. The report is equally useful in both cases. ### Worked example (synthetic HPFL) On his first shift, Tomás Reyes walks the line with the supervisor and draws it: filler PLC-FILL, wrapper PLC-WRAP, panel HMI-1, vision camera VIS-CAM, engineering laptop ENG-LT. Beside each box he writes one sentence on what happens physically if it fails. The wrapper sentence reads: "film stops, packs pile up, jam risk at the infeed." > **Synthetic case — Harbor Point Food Packaging Line (HPFL).** The plant, Tomás Reyes and every number in this book are invented for teaching. ### Errors and limits A drawing from one walk is incomplete; spare panels and wireless devices are easy to miss. Consequences are judged with operations staff, not alone. ### Exercises - **EX001 — Naming the parts.** List four OT components of the HPFL line and the job of each. *Rubric:* 3 = four components each with a correct job; 2 = three; 1 = names only; 0 = none. - **EX002 — Office versus line.** Explain in two sentences why "reboot it and see" is acceptable for an office PC but not for PLC-WRAP. *Rubric:* 3 = physical consequence plus safe-state/production argument; 2 = one reason; 1 = vague; 0 = none. - **EX003 — Heater consequence.** Describe two harms if the sealing heater setpoint is raised far above normal. *Rubric:* 3 = burn/fire risk and unsafe or rejected packs; 2 = one; 1 = "it breaks"; 0 = none. - **EX004 — One ATT&CK technique.** Which ATT&CK for ICS technique describes a changed setpoint, and could the same change be accidental? *Rubric:* 3 = T0836 Modify Parameter and yes, by error; 2 = technique only; 1 = wrong ID; 0 = none. ### Synthesis OT security on a line starts from physical consequence: people, food and production come first. ### Continue studying — chapter 01 of 18 [← Course home](../../README.md) · [Course chapter index](../SUBJECTS.md) · [Chapter 02 (draft) →](#ch-02) ## Worked answers **EX001.** PLC-FILL controls the filler; PLC-WRAP drives the wrapper motors and heaters; HMI-1 shows status and takes operator commands; VIS-CAM inspects seals and rejects bad packs; ENG-LT stores and changes PLC programs. **EX002.** An office PC restart loses at most unsaved work, while restarting PLC-WRAP stops motors and heaters mid-cycle, can jam film or leave product unsafe, and must follow the line's stop procedure with operations agreeing. **EX003.** A much higher sealing temperature can scorch film, start a fire or burn a worker clearing a jam, and it can produce damaged or poorly sealed packs that must be rejected as food-safety risks. **EX004.** T0836 Modify Parameter; yes — an operator mistyping a value causes the same physical effect, which is why changes are logged and checked whatever their cause.