A Setpoint Write Is Not Actuation: Finality for ICS, Grid, and Robot Command

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶

This Internet-Draft will expire on 28 February 2027.¶

Copyright Notice

Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶

Table of Contents

1. Introduction

The command path in a plant, grid, water system, warehouse robot cell, or rail interlocking is now:¶

HMI / MES / agent / work-order bot
        -> write {device, tag, value}
        -> OPC UA / DNP3 / IEC 61850 / MQTT / ROS
        -> PLC / RTU / drive / robot controller
        -> physical change

This document controls the last arrow. The computer may compute a setpoint. The fieldbus may authenticate the client. Neither fact is authority for this value to leave the logic solver toward this actuator in this mode and epoch.¶

The profile uses the chain in [I-D.das-6g-finality] and the tool objects in [I-D.das-agentic]. It specifies only physical-actuation predicates: tag and value binding, zone and device binding, operating-mode binding, interlock and permit-to-work inputs, and coexistence with existing ICS protocols that remain the transport.¶

2. How OT Command Abuse Changed

3. Requirements Language

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶

Failure to establish current actuation authority MUST NOT be converted into permission to energize, stroke, step, or otherwise change a physical output.¶

4. Problem Space

An OT write is a Candidate Act whose consequence class is PHYSICAL or NETWORK_CONTROL. After the coil changes, rollback is a process, not a protocol. First-class failures:¶

• Value substitution (80.0 authorized, 800.0 sent).¶
• Tag substitution (authorized PCV-12, live PCV-21).¶
• Device or zone substitution (cell A authority used on cell B).¶
• Mode violation (remote write while the device is Local or Locked-out).¶
• Replay of a consumed jog or close pulse.¶
• Permit-to-work expired while the command sat in a queue.¶
• Agent or wrapper substitution (approved historian bot, executing write bot).¶
• Safety-bypass or interlock-ignore flags set after approval.¶

5. Existing Solutions and What They Do Not Bind

6. Industrial Applicability

7. Terminology

Actuation Candidate Act

A generated or selected write that would change a physical or safety-adjacent output, but has not been permitted to do so.¶

Actuation Sink

The last software component that can still refuse before I/O changes. If that component can be skipped, it is not the sink.¶

Write digest

Hash over canonical device, tag, value, units, mode, zone, and interlock flags.¶

8. Architecture

HMI / MES / agent emits write
              |
              v
    ACTUATION CANDIDATE ACT
              |
              v
        Non-Effective State
              |
              v
   Protected Enforcement Domain
      principal, zone, device, tag
      value envelope, units, mode
      interlock / LOTO / PTW inputs
      policy and revocation epochs
      intended actuation sink
              |
              v
   evidence + scoped authority
              |
              v
        ACTUATION SINK
              |
      +-- PASS -> drive I/O once, consume
      |
      `-- FAIL -> no physical change

9. End-to-End Workflow

1. Write constructed. Status NON_EFFECTIVE.¶
2. Canonicalize device, tag, value, units, mode. Compute write digest.¶
3. Build ActuationCandidateAct.¶
4. PED validates envelope, mode, interlock, PTW, epochs.¶
5. Fail: deny, do not write.¶
6. Pass: commit evidence.¶
7. Issue scoped Actuation Finality Authority.¶
8. Carry the write on the legacy protocol together with authority reference.¶
9. Sink verifies live fields immediately before I/O.¶
10. Atomic consume + actuate, or deny with no I/O.¶

Value canonicalization MUST include scale and units. 1.5 bar and 150 kPa are the same act only if policy says so before hashing. expires_at is authority TTL, not process dead-time. A queued write MUST re-validate mode and interlocks at the sink, not only at queue entry.¶

10. Actuation Pseudocode

function ON_WRITE(w, ctx):
    act = ActuationCandidateAct{
        candidate_act_id: fresh_id(),
        act_type: map_write(w),
        zone: w.zone,
        device_id: w.device_id,
        tag: w.tag,
        value: canonical_value(w),
        units: w.units,
        mode: w.mode,
        write_digest: HASH(canonicalize(w)),
        policy_state: current_epochs(),
        freshness: {nonce: fresh_nonce()},
        finality_sink: ctx.actuation_sink,
        expires_at: now() + short_ttl
    }
    HOLD_NON_EFFECTIVE(act)
    return PED_VALIDATE(act, w)

function PED_VALIDATE(act, w):
    if malformed(act):
        return DENY(MALFORMED_ACT)
    if not fresh(act.freshness.nonce):
        return DENY(REPLAY_OR_STALE)
    if act.policy_state != current_epochs():
        return DENY(EPOCH_MISMATCH)
    if w.mode in {LOCAL, LOTO, OUT_OF_SERVICE}:
        return DENY(MODE_FORBIDDEN)
    if interlock_open(w) and not override_authorized(act):
        return DENY(INTERLOCK)
    if not ptw_covers(act):
        return DENY(PTW_MISS)
    if not value_in_envelope(act):
        return ESCALATE_OR_DENY(VALUE_ENVELOPE)
    evidence = COMMIT_PROTECTED_EVIDENCE(act)
    authority = ISSUE_SCOPED_AUTHORITY(act, evidence)
    return ALLOW(authority)

function ACTUATION_SINK_WRITE(act, authority, live):
    live_digest = HASH(canonicalize(live))
    if authority missing or integrity_fail(authority):
        return DENY(NO_OR_INVALID_AUTHORITY)
    if live_digest != act.write_digest:
        return DENY(WRITE_SUBSTITUTION)
    if authority.sink_id != THIS_SINK:
        return DENY(SINK_MISMATCH)
    if live.tag != authority.tag or
       live.device_id != authority.device_id or
       canonical_value(live) != authority.value:
        return DENY(FIELD_MISMATCH)
    if live.mode != authority.mode:
        return DENY(MODE_MISMATCH)
    if expired(authority) or consumed(authority):
        return DENY(STALE_OR_USED)
    ATOMICALLY:
        consume(authority)
        result = drive_io(live)
    record_sink_evidence(act, authority, result)
    return result

drive_io() is unreachable when any check fails. A protocol ACK after a failed check is non-conforming.¶

11. JSON Interoperability Profile

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "urn:ietf:params:json-schema:ot-finality:candidate-act:1",
  "title": "ActuationCandidateAct",
  "type": "object",
  "additionalProperties": false,
  "required": [
    "version", "object_type", "candidate_act_id", "act_type",
    "created_at", "expires_at", "principal", "zone",
    "device_id", "tag", "value", "units", "mode",
    "write_digest", "policy_state", "freshness", "finality_sink"
  ],
  "properties": {
    "version": { "type": "string", "const": "1.0" },
    "object_type": {
      "type": "string",
      "const": "actuation_candidate_act"
    },
    "candidate_act_id": { "type": "string", "minLength": 16 },
    "act_type": {
      "type": "string",
      "enum": [
        "SETPOINT_WRITE", "DISCRETE_WRITE", "PULSE",
        "JOG", "BREAKER_OPERATE", "VALVE_STROKE",
        "RECIPE_DOWNLOAD", "TRAJECTORY_EXECUTE",
        "ENABLE_OUTPUT", "INHIBIT_OVERRIDE", "OTHER"
      ]
    },
    "created_at": { "type": "string", "format": "date-time" },
    "expires_at": { "type": "string", "format": "date-time" },
    "principal": {
      "type": "object",
      "required": ["principal_id"],
      "properties": {
        "principal_id": { "type": "string" },
        "principal_type": {
          "type": "string",
          "enum": ["operator", "agent", "mes", "oem", "service"]
        },
        "agent_id": { "type": "string" },
        "workload_id": { "type": "string" }
      }
    },
    "zone": { "type": "string" },
    "device_id": { "type": "string" },
    "tag": { "type": "string" },
    "value": { "type": "string" },
    "units": { "type": "string" },
    "mode": {
      "type": "string",
      "enum": [
        "REMOTE", "LOCAL", "MANUAL", "AUTO",
        "LOTO", "OUT_OF_SERVICE", "TEST"
      ]
    },
    "interlocks": {
      "type": "object",
      "properties": {
        "all_clear": { "type": "boolean" },
        "ptw_id": { "type": "string" },
        "override": { "type": "boolean" }
      }
    },
    "write_digest": {
      "type": "object",
      "required": ["algorithm", "value", "canonicalization"],
      "properties": {
        "algorithm": {
          "type": "string",
          "enum": ["SHA-256", "SHA-384", "SHA-512"]
        },
        "value": { "type": "string" },
        "canonicalization": {
          "type": "string",
          "enum": ["JCS", "implementation-defined"]
        }
      }
    },
    "policy_state": {
      "type": "object",
      "required": ["policy_epoch", "revocation_epoch"],
      "properties": {
        "policy_epoch": { "type": "integer", "minimum": 0 },
        "revocation_epoch": { "type": "integer", "minimum": 0 },
        "safety_config_epoch": { "type": "integer", "minimum": 0 }
      }
    },
    "freshness": {
      "type": "object",
      "required": ["nonce"],
      "properties": {
        "nonce": { "type": "string", "minLength": 16 },
        "sequence": { "type": "integer", "minimum": 0 }
      }
    },
    "finality_sink": {
      "type": "object",
      "required": ["sink_id", "sink_type"],
      "properties": {
        "sink_id": { "type": "string" },
        "sink_type": {
          "type": "string",
          "enum": [
            "PLC_WRITE", "RTU_OPERATE", "DCS_PUT",
            "ROBOT_MOTION", "DRIVE_ENABLE",
            "GATEWAY_IO", "OTHER"
          ]
        }
      }
    }
  }
}

{
  "version": "1.0",
  "object_type": "protected_validation_evidence",
  "evidence_id": "pve-ot-01",
  "candidate_act_id": "act-ot-11aa",
  "decision": "ALLOW",
  "validated_predicates": {
    "mode_remote": true,
    "interlocks_clear": true,
    "ptw_valid": true,
    "value_in_envelope": true,
    "epoch_valid": true,
    "sink_binding_valid": true
  },
  "issued_at": "2026-08-27T03:10:00Z",
  "protector": { "type": "HSM_MAC", "key_id": "ped-ot-2" }
}

{
  "version": "1.0",
  "object_type": "actuation_finality_authority",
  "authority_id": "afa-ot-44",
  "candidate_act_id": "act-ot-11aa",
  "evidence_id": "pve-ot-01",
  "scope": {
    "act_type": "SETPOINT_WRITE",
    "device_id": "PIC-12",
    "tag": "SP",
    "value": "8.0",
    "units": "bar",
    "mode": "REMOTE"
  },
  "binding": {
    "write_digest": {
      "algorithm": "SHA-256",
      "value": "base64url-write-digest"
    },
    "nonce": "0A1B2C3D4E5F6789",
    "policy_epoch": 21,
    "finality_sink_id": "plc-write-cell-a"
  },
  "lifetime": {
    "issued_at": "2026-08-27T03:10:00Z",
    "expires_at": "2026-08-27T03:10:05Z",
    "single_use": true
  }
}

{
  "operation": "ActuationSinkVerify",
  "decision": "ALLOW",
  "consumption": { "authority_id": "afa-ot-44", "status": "CONSUMED" },
  "effectuation": { "permitted": true, "io_ref": "w-9021" }
}

{
  "operation": "ActuationSinkVerify",
  "decision": "DENY",
  "error": {
    "code": "EF_WRITE_SUBSTITUTION",
    "message": "Live value is not the authorized digest.",
    "retryable": false
  },
  "effectuation": { "permitted": false }
}

{
  "step_1_write": {
    "act_type": "SETPOINT_WRITE",
    "device_id": "PIC-12",
    "tag": "SP",
    "value": "8.0",
    "units": "bar",
    "mode": "REMOTE",
    "status": "NON_EFFECTIVE"
  },
  "step_2_authority": { "authority_id": "afa-ot-44", "single_use": true },
  "step_3_sink": { "decision": "ALLOW", "consumed": true },
  "step_4_effect": "PIC-12.SP written once at 8.0 bar"
}

12. Load-Bearing Bindings

Authority for PIC-12 / SP / 8.0 bar / REMOTE / digest D1 MUST NOT authorize 18.0 bar, PIC-13, LOCAL mode, or digest D2. ENABLE_OUTPUT authority MUST NOT authorize INHIBIT_OVERRIDE. Cell-A sink authority MUST fail at cell-B.¶

13. Worked Denials

{
  "scenario": "VALUE_SWAP",
  "authorized": { "tag": "SP", "value": "8.0" },
  "live": { "tag": "SP", "value": "18.0" },
  "code": "EF_WRITE_SUBSTITUTION",
  "actuated": false
}

{
  "scenario": "LOTO_STILL_HUNG",
  "mode_live": "LOTO",
  "code": "EF_MODE_FORBIDDEN",
  "actuated": false
}

{
  "scenario": "AGENT_THEN_RAW_MODBUS",
  "authorized_sink": "plc-write-cell-a",
  "alternate_path": "modbus-tcp:502 raw",
  "rule": "if raw path can stroke the same coil it is an open alternate path"
}

14. Dual Control, LOTO, and Permit-to-Work

Maker-checker on a write that can kill or spill is industrial instinct. PED MUST treat missing checker shares as validation failure. An agent MAY be the maker. An agent SHOULD NOT be the sole checker for PHYSICAL class above the hot envelope. LOTO and permit-to-work are mode and evidence inputs, not a reason to skip consume. A PTW that names unit U MUST fail on unit V even if both are in the same zone drawing.¶

15. Informative Protocol Mappings

16. Practical Feasibility: Latency and Legacy

17. Combined Agent Tool Call and Actuation

When the write is born as a model tool call, build AgentCandidateAct for dispatch and ActuationCandidateAct for I/O. Dispatch allow MUST NOT drive I/O if the actuation sink denies.¶

{
  "agent_candidate_act": {
    "act_type": "TOOL_CALL",
    "tool": { "tool_id": "plc.write", "tool_protocol": "MCP" },
    "consequence_class": "PHYSICAL"
  },
  "actuation_candidate_act": {
    "act_type": "SETPOINT_WRITE",
    "device_id": "PIC-12",
    "tag": "SP",
    "value": "8.0",
    "mode": "REMOTE"
  },
  "rule": "two sinks: host invoke, then I/O; neither replaces the other"
}

18. OT Threat Catalog

• T1 Stolen jump host or VPN¶
• T2 Stolen agent seat with write tools¶
• T3 Injected work-order text¶
• T4 Value substitution after HMI approval¶
• T5 Tag / device swap¶
• T6 Mode ignore (write while Local)¶
• T7 Replay of a pulse / jog¶
• T8 Raw Modbus beside the gated API¶
• T9 PTW expiry on a queued write¶
• T10 Safety-config epoch rollback¶
• T11 Recipe download to the wrong unit¶
• T12 Robot trajectory swap¶

19. Failure Codes

EF-002 NO_FINALITY_AUTHORITY, EF-005 AUTHORITY_ALREADY_USED, EF-006 REPLAY, EF-023 WRITE_SUBSTITUTION, EF-030 MODE_FORBIDDEN, EF-031 INTERLOCK, EF-032 PTW_MISS, EF-033 VALUE_ENVELOPE, EF-040 SINK_MISMATCH, EF-070 ESCALATE, EF-080 FAIL_CLOSED. Timeout MUST NOT actuate.¶

20. Implementation Checklist

1. Every supervised or agent write has a consumed authority_id.¶
2. Digest covers device, tag, value, units, mode.¶
3. Mismatch is deny, not a log line.¶
4. Raw protocol paths to the same coil are inventoried.¶
5. Timeout does not write.¶
6. Inner PID is not routed through this profile.¶
7. Added gateway latency is measured.¶

21. Security Considerations

If the actuation sink holds unrestricted write rights and skips verification, the profile collapses for that path. Keys that sign authority SHOULD live off the agent host. Override bits are cold-path default.¶

22. Privacy Considerations

Tag names and values can reveal process secrets. Logs SHOULD store digests and tag identifiers, not continuous process traces, unless the plant already archives those traces under existing OT policy.¶

23. IANA Considerations

This document requests no IANA actions.¶

24. Intellectual Property Note

Related concepts appear in the DAS Protocols family, including PCT/IB2026/055615. Disclosure should follow BCP 79 [RFC8179].¶

25. Conclusion

Fieldbuses move coils. Agents and MES APIs now write the setpoint. A signed OPC call, a jump-host session, or a work order is not authority for this value to become motion on this device now. Bind the digest. Consume at the I/O sink. A setpoint write is not actuation.¶

Author's Address