The Systems That Run the Physical World

The Invisible Computers

Right now, as you read this sentence, computers are deciding how much chlorine goes into your drinking water. Other computers are controlling how much power reaches your home, and still others are deciding whether valves on gas pipelines open or close. You have almost certainly never seen any of them. The controllers that talk directly to pipes, valves, and motors do not run Windows. They have no keyboard, no mouse, and usually no screen of their own. Many of them sit in steel cabinets bolted to a wall in a pump house or a factory, doing the same job thousands of times a day, often for decades. Nobody logs into them to check email or browse the web, because that is not what they are for. They exist to make the physical world behave: to keep a tank from overflowing, a turbine spinning at the right speed, a chemical dose within safe limits. Because they work quietly and almost never fail in ways the public notices, it is easy to forget they exist at all. Yet the water, electricity, fuel, food, and medicine that modern life takes for granted all pass through them. This chapter is about what these systems are, why they are built so differently from the computers you use every day, and how widely they reach. By the end of it, those invisible computers should not be invisible to you any more.

What an Industrial Control System Actually Is

An industrial control system (ICS) is any computer system designed to monitor and control a physical process. The definition is short, and every part of it matters. Monitoring means measuring what is happening: a temperature, a pressure, a flow rate, the level of liquid in a tank. Controlling means acting on that measurement: opening a valve, starting a motor, switching on a pump. And the process being monitored and controlled is physical, made of water, steam, electricity, chemicals, or moving parts, rather than made of data. That is the clearest way to separate an ICS from the systems most people think of as computers. An ICS is not there to store records or send email. Its job is to make things happen in the physical world. Consider a tank whose contents must stay below a certain temperature. A sensor in the tank reports that the temperature is climbing. The control system compares that reading with the limit it has been programmed to respect, decides that the tank is getting too hot, and responds on its own, perhaps by adjusting a flow rate or triggering a cooling cycle. It does not wait for a person to notice and make a decision. The action is carried out by an actuator, a device that acts on the physical world, such as a valve that opens or a motor that starts. Measuring, deciding, and acting, over and over, without pause, is what an industrial control system does all day.

A helpful way to picture the whole arrangement is to think of a nervous system. Sensors are the nerves that feel the environment. The controllers that react automatically are like the spinal cord, handling reflexes without waiting for conscious thought. The operator screens and supervisory systems are like conscious awareness, letting people see what is happening and steer it. And the actuators, the valves, motors, and pumps, are the muscles that physically do the work. Without that nervous system, a plant is just passive machinery. With it, the machinery senses, responds, and keeps itself running. "ICS" is an umbrella term for the whole arrangement, and it covers several distinct kinds of system that you will meet one by one in Part 2: the programmable logic controller, the operator's screen known as the human-machine interface, supervisory control and data acquisition (SCADA), and the distributed control system. For now, the umbrella is enough. You will also hear the term operational technology (OT). OT is the broader name for hardware and software that monitors and controls physical equipment and processes, as opposed to information technology (IT), which handles data. Industrial control systems are the core of OT, and in everyday conversation the two terms are often used almost interchangeably, as in "OT security" or "the OT network."

Consequences You Can Touch

The single idea that sets industrial control systems apart, and that the rest of this book keeps returning to, is physical consequence. When an office computer misbehaves, the damage is measured in lost files, lost time, or lost money. Those losses are real, but they stay inside the world of information. When an industrial control system misbehaves, the result shows up in the physical world: a tank overflows, a pump runs dry, a chemical dose is wrong, a line of equipment stops halfway through a job. The control system is the link between a digital decision and a physical event, so a wrong decision becomes a wrong event. That is why the people who design and run these systems think about them differently from the way IT teams think about servers and laptops. Their first question about any change is not whether it might expose data, but what it might do to the process and to the people near it. Keep that question in mind as you read. It explains choices that otherwise look strange from the outside, such as running the same hardware for decades, applying updates only rarely, and treating an unplanned stop as a serious event rather than an inconvenience.

Not a Niche Technology

It is tempting to think of industrial control systems as a specialist corner of engineering, something found only in a handful of large plants. The opposite is true. Every power plant, water treatment facility, oil refinery, chemical plant, food factory, and pharmaceutical manufacturer runs on industrial control systems. The vast majority of the world's energy infrastructure is controlled by them. And their reach does not stop at heavy industry. Flip a light switch, turn on a tap, or fill a fuel tank, and an industrial control system was part of that process somewhere upstream of you. The electricity was generated and routed by one. The water was treated and pumped by one. The fuel was refined and moved through a pipeline under the control of one. The same is true of the packaged food in your kitchen and the medicine in your cabinet. What makes this easy to miss is that a well-run ICS is designed to disappear. It is not a product anyone buys at a store or interacts with directly, and when it is working, which is nearly all the time, its only visible output is that the lights stay on and the water keeps running. The scale becomes obvious only when you start looking for it, which is what the rest of this chapter does.

Why ICS Is a Completely Different World

When a desktop computer crashes, you restart it. You might lose an unsaved document and a few minutes of your day, but the fix is simple and the consequences are small. Now imagine the industrial control system running a city's water treatment plant. That system cannot crash in the same casual way, because if it stops, the city has no clean water. The difference is not a matter of degree. It changes the whole design philosophy. The design priority of an office computer is flexibility: install new software, update often, replace it every few years. The design priority of an industrial control system is continuity. The process it controls has to keep running, correctly, every minute of every day, and every engineering decision inside the system follows from that single requirement. One example shows how far that reaches. On an ordinary computer, applying an update is routine. On an industrial control system, applying an update can mean stopping the system, and stopping the system means stopping the process, which is exactly what continuity forbids. So updates are rare and carefully planned, a pattern that surprises almost everyone who comes to industrial systems from IT. Chapter 2 looks closely at that priority, how it reverses the order IT security is built on, and why rebooting is so rarely an option.

A Tour of the Industries

Energy is the clearest place to start. Every power plant uses industrial control systems to control its turbines, generators, boilers, cooling systems, and grid switching. Coal, gas, nuclear, wind, and solar plants all do this, because the fuel source changes but the need for control does not. Beyond the plant, the electricity has to be moved and transformed. Substations step voltage up for long-distance transmission and down again for local distribution, and they are typically monitored and controlled remotely by SCADA systems, which collect data from distant equipment and send commands back to it (Chapter 6 explains SCADA in full). The electricity you are using right now passed through industrial control systems at every stage before it reached you.

Water and wastewater follow a similar pattern. A municipal water treatment plant uses an ICS to control chemical dosing, filtration, pumping, and pressure. Water quality sensors are monitored continuously, and the system adjusts treatment automatically as conditions change. On the other side of the cycle, wastewater treatment plants use an ICS to control aeration tanks, chemical treatment, and discharge. From the moment water enters a treatment plant to the moment it comes out of your tap, every stage is managed by an industrial control system. Oil and gas are just as dependent. Refineries use industrial control systems to run distillation columns, heaters, compressors, and product blending. These are continuous processes running at high temperature and pressure, with no acceptable downtime. Pipelines add distance to the picture. Pipeline operators use SCADA to monitor and control valves, flow rates, and compressor stations, and a single control room can oversee hundreds of miles of pipe. An operator sitting in one city can see every pressure reading along the line and operate any valve on the network.

Manufacturing is where the variety is greatest. Automotive assembly lines use industrial control systems to coordinate robots, conveyors, welding stations, and quality checks, so that each station does its job at exactly the right moment. Pharmaceutical plants use them to control batch reactors, where temperature and timing directly affect whether the product is safe. Food and beverage production, chemical manufacturing, and paper mills run on them too. Some of these are discrete manufacturing, which makes individual items such as car doors, and some are continuous process industries, where a chemical reaction or a production stream runs without stopping. The money at stake helps explain the attitude. One hour of unplanned downtime on an automotive line can cost more than two million dollars. That figure is a large part of why availability, the system being up and running, is treated in industrial environments as something close to a safety value rather than a business preference. And when an industrial process loses control, the consequences are not only financial.

Beyond Heavy Industry

The morning in that example reaches well past power stations and refineries, and that is the point. Rail signaling systems control track switches and signal lights to prevent trains from colliding, which makes them safety-critical in a way a web server never is. Airport baggage systems route luggage through automated sorters. Traffic management centers coordinate signal timing across entire cities. Building management systems apply the same principles to heating, ventilation, and air conditioning (HVAC), elevators, fire suppression, and access control in large facilities. They are often overlooked as industrial control systems because they live in offices and hospitals rather than plants, but architecturally they are the same kind of system. Mining relies on industrial control for underground ventilation, conveyors, and hoisting, and without it underground operations cannot run safely at all. A simple test captures the pattern behind all of these examples: if a system moves something, heats something, or controls something physical at scale, it is almost certainly running on an industrial control system. The table below gathers the industries in one place, together with what the control system actually controls in each.

Name an Industry That Does Not Use ICS

Try it: name an industry that does not use industrial control systems. It is harder than it sounds, and after the tour above the honest answer is that there are almost none. Energy, water, oil and gas, manufacturing, pharmaceuticals, transportation, building management, and mining all rely on them, and so does nearly anything else that depends on physical processes running reliably. Industrial control is not a niche specialty sitting off to the side of modern life. It is the infrastructure layer that keeps physical processes running, underneath everything else. That is also why these systems matter so much beyond engineering. The industries you have just named are the ones a modern society cannot do without for long, and that is exactly why the security of the control systems inside them matters. Why these systems are hard to secure, and where to learn more, is the subject of Chapter 13. Before you get there, you need to understand the systems themselves: how they think, how they are built, and how they talk to each other. Most people who work near these systems every day could not explain how they are organized. By the end of this book, you will be able to.

What's Next

You now know what an industrial control system is and how much depends on it. The next step is to understand why it behaves so differently from the IT systems around it. Chapter 2 takes the familiar security priority order that IT is built on, confidentiality first, and shows why industrial systems turn it almost completely around, what failure really looks like when a physical process is involved, and why "turn it off and on again" can be a dangerous suggestion in a control room.

Reflect

• Trace one thing you used today, such as water, power, or fuel, back through the industrial control systems it passed through. How many can you identify?
• Where in your current workplace or a facility you know is there an industrial control system that most people walk past without noticing, such as a building management system?
• What would change about the way you approach a computer system if every wrong decision it made showed up as a physical event rather than a lost file?
• Which of the industries in this chapter is closest to your own work, and what do you think its control systems would be most important to keep running?