A Setpoint Write Is Not Actuation: Finality for ICS, Grid, and Robot Command

Introduction The command path in a plant, grid, water system, warehouse robot cell, or rail interlocking is now: write {device, tag, value} -> OPC UA / DNP3 / IEC 61850 / MQTT / ROS -> PLC / RTU / drive / robot controller -> physical change ]]> This document controls the last arrow. The computer may compute a setpoint. The fieldbus may authenticate the client. Neither fact is authority for this value to leave the logic solver toward this actuator in this mode and epoch. The profile uses the chain in and the tool objects in . It specifies only physical-actuation predicates: tag and value binding, zone and device binding, operating-mode binding, interlock and permit-to-work inputs, and coexistence with existing ICS protocols that remain the transport.

How OT Command Abuse Changed

Past: Steal the Engineering Station Historical OT incidents stole the thing that already issued commands: an engineering workstation, a vendor laptop, a PLC project file, a default password on an HMI. Defense was island-centric. Air-gap the cell. Lock the cabinet. Patch when the outage window allows. The valuable object was the workstation that engineers already trusted to write.

Present: Steal the Jump Path that Can Write Present incidents often leave the PLC password in place. The attacker takes a jump host, a VPN into the DMZ, an MES API that forwards setpoints, or an agent seat allowed to "help operations." IEC 62443 zones are drawn. The write is still just a write. Business-email compromise had a plant cousin: a lawful operator session, a new target tag, a valid protocol signature.

Future: Compute the Setpoint, Then Actuate The coming incident does not require the attacker to speak DNP3. The model speaks the gateway's JSON and the gateway speaks DNP3. "Open this valve, the work order says so" is a Candidate Act that looks like ordinary assistance. If the I/O server accepts any authenticated write from that worker, language becomes motion. Safety PLCs still trip. This profile does not replace SIS. It exists so a protocol-valid write that is safety-irrelevant or that sits below the SIS threshold still cannot complete without current actuation authority.

Requirements Language The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here. Failure to establish current actuation authority MUST NOT be converted into permission to energize, stroke, step, or otherwise change a physical output.

Problem Space An OT write is a Candidate Act whose consequence class is PHYSICAL or NETWORK_CONTROL. After the coil changes, rollback is a process, not a protocol. First-class failures:

Value substitution (80.0 authorized, 800.0 sent).
Tag substitution (authorized PCV-12, live PCV-21).
Device or zone substitution (cell A authority used on cell B).
Mode violation (remote write while the device is Local or Locked-out).
Replay of a consumed jog or close pulse.
Permit-to-work expired while the command sat in a queue.
Agent or wrapper substitution (approved historian bot, executing write bot).
Safety-bypass or interlock-ignore flags set after approval.

Existing Solutions and What They Do Not Bind

IEC 62443, Zones, and Conduits Zoning answers which hosts may talk. It does not consume single-use authority for this tag and this value at the I/O server.

OPC UA, DNP3, IEC 61850, Modbus, MQTT These authenticate and structure writes. A valid signed call can still be the wrong act. Modbus in particular is often a raw register write with no act object at all.

Safety PLC and SIS SIS is the last physical backstop. It is not an authorization system for every non-trip command. Most harmful writes never reach a trip setpoint.

Jump Hosts, Privileged Access, and MFA They authenticate the operator session. Possession of the session is bearer-like for every tag that session can see.

Change Tickets and Permit-to-Work A ticket is class approval. It MAY be a PED input. It MUST NOT by itself be actuation authority for a particular write.

Robot and ROS Command Buses A trajectory topic is a write. Auth on the bus does not bind a pose digest at the motion controller.

What This Profile Adds

the write remains an Actuation Candidate Act;
device, tag, value, mode, and zone are in the digest;
authority is non-bearer, sink-bound, epoch-bound, and consumed;
legacy fieldbus remains the transport;
hot-path envelopes exist so a 20 ms loop is not forced through a remote ledger.

Industrial Applicability

Transmission and Distribution Sink is the RTU or gateway that would emit the 61850/DNP3 operate. Authority for breaker A MUST fail on breaker B. Overflight-like jurisdiction epochs from the NTN profile are not required; yard and voltage-level epochs are.

Process, Refining, and Batch Sink is the DCS write service or PLC put. Batch recipe download is a Candidate Act whose digest includes recipe id and unit.

Water, Waste, and Pipelines Remote pump and valve writes are the classic low-staffing surface. Envelope ceilings on flow and pressure are load-bearing.

Discrete Manufacturing and Robots MES "start job" and robot "execute trajectory" are separate acts. A job start MUST NOT authorize an arbitrary pose.

Rail, Tunnel, and Building Life-Safety Interlocking commands and fire-system overrides are cold-path default. Timeout MUST NOT actuate.

OT Copilots and MCP on the Plant LAN A historian explain tool is INFORMATIONAL. A write tool is this profile plus . Discovery of an MCP server in the DMZ is not permit-to-work.

How an Operator Would Pilot Pick one outbound write API used by a new assistant or by a single OEM gateway. Deploy consume next to the existing command log. Leave the dedicated HMI on existing dual control. Measure unauthorized-would-have-written denies and added latency on the supervised path. Expand zone by zone. No PLC firmware rewrite is required for v1 if the gateway is in-line.

Terminology

Actuation Candidate Act: A generated or selected write that would change a physical or safety-adjacent output, but has not been permitted to do so.
Actuation Sink: The last software component that can still refuse before I/O changes. If that component can be skipped, it is not the sink.
Write digest: Hash over canonical device, tag, value, units, mode, zone, and interlock flags.

Architecture

Actuation-time finality drive I/O once, consume | `-- FAIL -> no physical change ]]>

End-to-End Workflow

Write constructed. Status NON_EFFECTIVE.
Canonicalize device, tag, value, units, mode. Compute write digest.
Build ActuationCandidateAct.
PED validates envelope, mode, interlock, PTW, epochs.
Fail: deny, do not write.
Pass: commit evidence.
Issue scoped Actuation Finality Authority.
Carry the write on the legacy protocol together with authority reference.
Sink verifies live fields immediately before I/O.
Atomic consume + actuate, or deny with no I/O.

Value canonicalization MUST include scale and units. 1.5 bar and 150 kPa are the same act only if policy says so before hashing. expires_at is authority TTL, not process dead-time. A queued write MUST re-validate mode and interlocks at the sink, not only at queue entry.

Actuation Pseudocode drive_io() is unreachable when any check fails. A protocol ACK after a failed check is non-conforming.

JSON Interoperability Profile

ActuationCandidateAct Schema

Evidence, Authority, Allow, Deny

Complete Allow Transaction

Load-Bearing Bindings Authority for PIC-12 / SP / 8.0 bar / REMOTE / digest D1 MUST NOT authorize 18.0 bar, PIC-13, LOCAL mode, or digest D2. ENABLE_OUTPUT authority MUST NOT authorize INHIBIT_OVERRIDE. Cell-A sink authority MUST fail at cell-B.

Worked Denials

Dual Control, LOTO, and Permit-to-Work Maker-checker on a write that can kill or spill is industrial instinct. PED MUST treat missing checker shares as validation failure. An agent MAY be the maker. An agent SHOULD NOT be the sole checker for PHYSICAL class above the hot envelope. LOTO and permit-to-work are mode and evidence inputs, not a reason to skip consume. A PTW that names unit U MUST fail on unit V even if both are in the same zone drawing.

Informative Protocol Mappings

OPC UA Write / Call device_id and tag map to NodeId. value maps to the written DataValue. mode maps to a companion property or to gateway state. authority_id MAY travel as an additional argument on a Method call or as a header on the gateway that fronts UA. UA signature of the session is channel auth, not act authority.

DNP3 Select/Operate Select/Operate is already two-step. This profile still applies: Operate MUST present current authority for the selected point and value. A Select that is then Operated with a swapped value is WRITE_SUBSTITUTION. Replay of Operate after consume is EF-005.

IEC 61850 Operate ctlVal and orCat are load-bearing and MUST enter the digest. Test bits that would become live operate MUST be mode=TEST and MUST not inherit REMOTE-live authority.

ROS / Robot Trajectory A FollowJointTrajectory goal is a TRAJECTORY_EXECUTE act. Digest the goal points or a hash the controller already computes. Start-job from MES is a different act_type.

Practical Feasibility: Latency and Legacy

Scan-Time Budget Closed loops run in milliseconds to tens of milliseconds. This profile is for *supervised writes and agent writes*, not for replacing the inner PID. Hot-path enforce at a gateway is canonicalize, hash, MAC verify, compare-and-swap — typically well under 1-5 ms on the same host as the existing command server. Inner loop setpoint tracking stays in the PLC. Do not put a network round trip inside the 10 ms task.

Hot-Path Envelope A cold evaluation MAY allow a bounded envelope: zone Z, device set D, tag family T, value band [lo, hi], mode REMOTE, sink S, epochs (P,R), until time U. Writes inside the envelope MAY use local validation. Change of device, band, mode, or epoch MUST escalate. Hot does not mean skip consume or skip digest compare.

Coexistence with OPC UA and DNP3 Place the sink immediately before the component that performs the Operate / Write. Carry authority_id in a companion attribute or gateway header. Field devices that cannot parse JSON still only see writes the sink admitted.

Coexistence with Modbus Modbus has no act object. The gateway that turns JSON into function-code 6 or 16 IS the sink. Raw 502 exposure of the same registers is an alternate path and MUST be closed or listed.

Coexistence with SIS Do not move trip logic into PED. If SIS would refuse the physical state, this profile is irrelevant. If SIS would allow it, this profile still applies to the supervisory write.

Coexistence with HMIs A dedicated hardwired HMI can stay on existing dual control during a pilot. Alternate-path closure says that if the HMI can emit the same coil change as the agent path, it eventually needs the same consume semantics or it remains a listed exception.

What This Profile Does Not Require It does not require replacing IEC 61850, DNP3, or the PLC vendor. It does not require a blockchain on the scan cycle. It does not require the model to detect process hazards. It requires that the component which can change I/O refuse to do so without current, consumed, digest-bound authority.

Combined Agent Tool Call and Actuation When the write is born as a model tool call, build AgentCandidateAct for dispatch and ActuationCandidateAct for I/O. Dispatch allow MUST NOT drive I/O if the actuation sink denies.

OT Threat Catalog

T1 Stolen jump host or VPN
T2 Stolen agent seat with write tools
T3 Injected work-order text
T4 Value substitution after HMI approval
T5 Tag / device swap
T6 Mode ignore (write while Local)
T7 Replay of a pulse / jog
T8 Raw Modbus beside the gated API
T9 PTW expiry on a queued write
T10 Safety-config epoch rollback
T11 Recipe download to the wrong unit
T12 Robot trajectory swap

Failure Codes EF-002 NO_FINALITY_AUTHORITY, EF-005 AUTHORITY_ALREADY_USED, EF-006 REPLAY, EF-023 WRITE_SUBSTITUTION, EF-030 MODE_FORBIDDEN, EF-031 INTERLOCK, EF-032 PTW_MISS, EF-033 VALUE_ENVELOPE, EF-040 SINK_MISMATCH, EF-070 ESCALATE, EF-080 FAIL_CLOSED. Timeout MUST NOT actuate.

Implementation Checklist

Every supervised or agent write has a consumed authority_id.
Digest covers device, tag, value, units, mode.
Mismatch is deny, not a log line.
Raw protocol paths to the same coil are inventoried.
Timeout does not write.
Inner PID is not routed through this profile.
Added gateway latency is measured.

Security Considerations If the actuation sink holds unrestricted write rights and skips verification, the profile collapses for that path. Keys that sign authority SHOULD live off the agent host. Override bits are cold-path default.

Privacy Considerations Tag names and values can reveal process secrets. Logs SHOULD store digests and tag identifiers, not continuous process traces, unless the plant already archives those traces under existing OT policy.

IANA Considerations This document requests no IANA actions.

Intellectual Property Note Related concepts appear in the DAS Protocols family, including PCT/IB2026/055615. Disclosure should follow BCP 79 .

Conclusion Fieldbuses move coils. Agents and MES APIs now write the setpoint. A signed OPC call, a jump-host session, or a work order is not authority for this value to become motion on this device now. Bind the digest. Consume at the I/O sink. A setpoint write is not actuation.