Chapter 15 — OT, IoT and cyber-physical security: guided lab
Lesson map
Lesson 15 published. Map, example, EX043.
flowchart TD
N0["Learning outcomes"]
N1["15.1 The lab question"]
N2["15.2 Interpreting"]
N3["15.3 What an attacker would change"]
N4["15.4 Recording the result"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX043"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["15.1 The lab question"]
N2["15.2 Interpreting"]
N3["15.3 What an attacker would change"]
N4["15.4 Recording the result"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX043"]
[Learning outcomes]
|
v
[15.1 The lab question]
|
v
[15.2 Interpreting]
|
v
[15.3 What an attacker would change]
|
v
[15.4 Recording the result]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX043]
Learning outcomes
You will (1) analyse synthetic logger data for temperature excursions; (2) relate alarm delay to food-safety consequence; (3) recognise how falsified data would change the result; and (4) document a lab result with inputs and output.
15.1 The lab question
Did Freezer-2's chilled anteroom stay at or below 5 °C, and if not, for how long and did the alarm fire? The lab uses ten synthetic readings five minutes apart and an alarm that fires only when an excursion lasts at least 10 minutes — a delay that avoids nuisance alarms from door openings.
"""Lab 15: find cold-room temperature excursions in synthetic logger data (minutes, degC)."""
readings = [(0, 2.1), (5, 2.4), (10, 3.0), (15, 5.6), (20, 7.2), (25, 8.4), (30, 6.9), (35, 4.8), (40, 3.9), (45, 2.6)]
LIMIT, ALARM_DELAY = 5.0, 10
start = None
for t, v in readings:
if v > LIMIT and start is None: start = t
if v <= LIMIT and start is not None:
dur = t - start
print(f"excursion {start}-{t} min, duration {dur} min, peak {max(x for s, x in readings if start <= s < t)} C, alarm {'raised' if dur >= ALARM_DELAY else 'not raised'} (delay {ALARM_DELAY} min)")
start = None
Run with python3 lab_excursion.py. Verified output:
excursion 15-35 min, duration 20 min, peak 8.4 C, alarm raised (delay 10 min)
The anteroom data are synthetic set A, which Priya used for her write-up below.
Set A has 5-minute sampling, a 5 °C limit and a 10-minute alarm delay, the values her record repeats.
15.2 Interpreting
The excursion started at 15 minutes and ended at 35, lasting 20 minutes with a peak of 8.4 °C. The alarm fired because 20 ≥ 10. The output also tells us the resolution limit: with five-minute samples, the true start could be anywhere between minutes 10 and 15.
That five-minute uncertainty matters for a food-safety record: a customer contract that allows excursions up to 20 minutes would be met or breached depending on where in that window the excursion really began. Priya's write-up states the duration as 20 minutes, with the start uncertain by up to five, and leaves the contractual judgement to the quality manager.
15.3 What an attacker would change
If readings for minutes 15–30 were replaced with values around 4 °C, the script would report no excursion at all — the record would show compliance while the goods warmed. This is why Chapter 13's scenario compares cloud logger data with the PLC's own probe in the historian: two independent records are much harder to falsify consistently.
Priya's write-up lists the missing cross-check as a limitation: synthetic set A has no HIST probe to compare.
In real NCS data, HIST's probe in the anteroom would be the cross-check: a logger reading that disagrees with it is a question before it is an excursion.
15.4 Recording the result
Record the input file (or its hash), the script version, the limit and delay parameters, and the output. Another technologist must be able to reproduce it exactly.
Priya's record, quoted in the worked example below, names the excursion, how uncertain its start time is because of the sampling interval, and the integrity check that could not be done. With the input file's hash and the limit of 5 °C and delay of 10 minutes recorded, another technologist can rerun it and get the same line.
Worked example (synthetic NCS)
Priya writes: "Lab 15 on anteroom readings (synthetic set A): one excursion 15–35 min, 20 min, peak 8.4 °C, alarm raised under 10-min delay. Resolution: 5-min sampling, so start uncertain by up to 5 min. Integrity check: compared with HIST probe TT-A1 — not available in synthetic set; listed as limitation."
Synthetic case — Northgate Cold Storage. All readings are invented.
Errors and limits
The script assumes readings are ordered and evenly spaced. An excursion still running at the last sample is not reported — a bug worth fixing.
Exercises
- EX043 — Changing the alarm delay. If
ALARM_DELAY = 25, what does the lab print? Rubric: 3 = same excursion, "alarm not raised (delay 25 min)"; 2 = alarm state only; 1 = no excursion; 0 = none. - EX044 — The unfinished excursion bug. Append
(50, 6.0)to the readings. What happens and how would you fix it? Rubric: 3 = second excursion not printed; add a final check after the loop; 2 = one; 1 = says it prints; 0 = none. - EX045 — Falsification check. Describe a check that would reveal replaced readings. Rubric: 3 = compare with independent PLC/historian probe or second logger, flag disagreement; 2 = partial; 1 = vague; 0 = none.
Synthesis
A guided lab turns raw readings into a reproducible, bounded statement — and shows exactly where falsified data would hide.
Continue studying — chapter 15 of 30
← Chapter 14 (draft) · Course chapter index · Chapter 16 (draft) →