[System Study_004] Crude Oil Washing: The System That Rules Built

Crude oil washing is one of the few shipboard systems whose existence is written directly into an international convention. MARPOL Annex I Regulation 33 requires it on every crude oil tanker of 20,000 tonnes deadweight and above delivered after 1 June 1982, and IMO Res. A.446(XI) specifies clause by clause how it must be designed, operated and verified. Read those rules in the order they were actually made, however, and something unusual appears: the system was permitted only because a different system had already made it safe.

In the bill of materials COW is five rows — two valves, one machine, one pressure instrument, one control panel. Three of those rows hold no firmware, no network port and no accounts, and those same three rows perform the entirety of the physical action inside the tank. The one row that holds all of the software never touches crude oil. Counting components and counting risk are two different jobs here.

Connectivity is not authority — and in this system the most violent physical action of all carries none.

What follows is a typology-based analysis of SYS-012 in four parts: what the system is for and how it works, what it is made of, what authority and physical effect each of its connections carries, and what security follows from that. Statements are tagged with the evidence grade of the typology doctrine they rest on, and nothing is asserted above that ceiling.

Part I — Engineering

1. Why This System Exists

Crude oil does not leave a cargo tank clean. Long after the pumps have started drawing air, a sticky layer of wax and asphaltene remains on the tank walls, the girders, the stringers and the bottom plating. Class and P&I material puts the quantity of this clingage at around 1,000 tonnes for a VLCC, though it varies widely with tank structure and crude properties, so the figure is better read as an order of magnitude than as a number. Typical (UK P&I Club, Carefully to Carry — bulk oil cargo shortage claims.) The problems it creates are not one but three.

The first is commercial. What the owner and charterer contracted for is the delivery at the discharge port of what was loaded at the load port, and oil stuck to the tank is cargo that was not delivered. The physical origin of ship–shore difference and of ROB (remaining on board) disputes sits here.

The second is operational. Crude carriers ballast into some of their cargo tanks. Put seawater into a tank that still holds residue and that seawater becomes oily ballast, which has to go somewhere before the next load port.

The third is environmental, and it is where regulation enters. The traditional way of handling oily ballast was Load-on-Top: water-wash, collect in the slop tank, let it settle, decant the water from above. That reduces the total discharged. It does not eliminate the discharge.

Crude cargo discharged
        |
        v
   Clingage remains on tank steel
        |
        +--> Cargo not delivered  -> ship-shore difference / ROB dispute
        |
        +--> Ballast into dirty tank -> oily ballast -> operational discharge to sea
        |
        +--> Sludge accumulation -> tank entry, manual removal, occupational risk

That is the engineering problem. But the route by which COW — the solution — became standard equipment on merchant ships follows the order of accidents and rules, not the order of engineering. Reverse that order and you will misread the system's entire safety case.

Between 12 and 30 December 1969, three VLCCs of about 210,000 DWT — Marpessa, Mactra and Kong Haakon VII — were severely damaged by cargo tank explosions. Marpessa sank on the ballast leg of her maiden voyage and two crew members died; the other two survived with much of their main decks blown away. Verified All three were cleaning empty cargo tanks at the time. The intensive research the owners launched concluded that the high-pressure water jets then in standard use were building up electrostatic charge inside the large cargo tanks as they struck the steel, and that in a space full of hydrocarbon vapour this discharged as a spark. Verified The response was to fill the cargo tanks with inert gas during cleaning, and that became today's mandatory inert gas system (IGS).

Then in February 1978 the TSPP Conference (International Conference on Tanker Safety and Pollution Prevention) convened by IMO adopted the 1978 Protocol, which amended MARPOL 73 and brought COW inside the rules. Verified New crude tankers above 20,000 DWT were required to fit COW; existing tankers above 40,000 DWT had to choose between segregated ballast tanks (SBT) and COW, with clean ballast tanks permitted during the transition. The clause number at adoption was Annex I Reg. 13(6); after the 2004 wholesale revision of Annex I, the operative provision is MARPOL Annex I Regulation 33.1 — every crude oil tanker of 20,000 tonnes deadweight and above delivered after 1 June 1982 shall be fitted with a cargo tank cleaning system using crude oil washing. Verified

1969  Water washing in a gas-filled tank -> static discharge -> 3 VLCC explosions
        |
        v
1970s Inert gas system mandated  (O2 kept low inside cargo tanks)
        |
        v      [precondition now exists]
1978  TSPP Protocol -> COW required as cargo-tank cleaning method
        |
        v
1979  Res. A.446(XI) -> design, operation and control specification
        |
        v
1982+ MARPOL Annex I Reg. 33 / Reg. 35 -> installation + operation obligations

The order matters. COW could only become a rule after the inert atmosphere had already been secured as a precondition. Spraying crude oil at high pressure is not electrostatically more benign than spraying water. The only reason it is permitted is that the inside of the tank is not a combustible atmosphere — and that fact is produced not by COW but by IGS. We return to it in section 14, but the COW system does not own its own safety case, and that structure is the single most important fact in analysing it.

2. What the System Does

The function of COW is defined in one sentence: spray the crude oil currently being discharged, at high pressure, onto the internal surfaces of the cargo tank, so that clingage dissolves and leaves with the cargo stream.

Every peculiarity of this system is contained in that definition. There is no dedicated washing medium. There is no dedicated storage. In principle there is not even a dedicated pump — the discharge of the cargo pumps is branched off. Much of the piping is shared with the cargo system. IMO Res. A.446(XI) §4.1.2 requires the COW system to be a permanent installation, independent of the fire main, while explicitly allowing parts of the cargo system to be incorporated provided the requirements are met. Verified

The system-level functional decomposition looks like this.

Note that F1 and F4 belong to external systems, and that the information source for F7 is also external. What COW actually owns is F2, F3, F5 and F6 — which is why only five component rows in the bill of materials are attributed to it.

3. Core Functions and Operating Modes

COW has no operating window of its own. It is performed inside the discharge operation itself, while the cargo is flowing out. That fact defines its modes.

Top wash. While the level in the tank is still high, the machine arc is restricted to the upper sector, cleaning the structure and shell exposed above the liquid surface. There is no point spraying below the surface, so the arc programme follows the level down.

Bottom wash. Once the level is low enough, the arc extends downward to cover the bottom and lower structure. This is the phase in which the stripping load is heaviest.

Single-stage / multi-stage. Depending on what the approved manual specifies, the full arc is swept in one pass or the work is divided into several stages that track the falling level. Either way, the mode is not a free parameter but an item in an approved procedure. MARPOL Annex I Reg. 35.3 requires the COW system to be operated in accordance with the Operations and Equipment Manual, except where the cargo is unsuitable. Verified

Ballast-voyage preparation. Reg. 35.2 requires a sufficient number of cargo tanks to be crude oil washed before each ballast voyage so that ballast water is put only into tanks that have been washed. Verified In other words, which tanks get washed is decided not by the convenience of the washing operation but by the ballast plan for the next voyage. The COW programme is logically coupled to cargo and ballast planning — and that coupling is the path by which the propagation chain in section 13 reaches a regulatory outcome.

Verification modes. A.446(XI) requires separate acts that confirm the result and the functioning of the equipment. §4.2.10 requires visual confirmation, after COW and before water washing, that the tank is essentially free of clingage and deposits, and sets the oil content of the departure ballast at not more than 0.00085 by volume as the criterion of stripping effectiveness. §4.2.12 requires deck-mounted machines to have a means of indicating rotation and arc movement from outside the tank. §4.2.13 accepts, for submerged machines, external indication, characteristic operating sound, or periodic verification at intervals of not more than six uses or twelve months. §4.4.4 requires hand dipping facilities at the aftermost point of the tank and at three other locations. Verified

Every one of those verification items is something a human being does with their eyes, ears and hands. The clauses were drafted two decades before the concept of cyber security existed, and yet the result is that this system carries out-of-band integrity verification mandated by rule, independent of any instrumentation signal. Section 12 returns to that property.

4. How the System Works

The washing result — how clean the tank actually got — is not the output of any single piece of equipment. It is a product of several physical quantities.

Wash effectiveness
   = f( driving pressure          [pump discharge, throttled at COW line]
       x nozzle throughput        [machine size, nozzle bore]
       x arc programme            [vertical sector + rotation, per stage]
       x machines run simultaneously  [hydraulic balance limit]
       x tank geometry            [shadow from girders, stringers, bulkheads]
       x stripping rate           [must exceed wash throughput]
       x crude properties         [wax / asphaltene content, temperature]
     )
   subject to  O2 <= 8 vol%  and  positive tank pressure     [external precondition]

A.446(XI) puts a quantitative constraint on each term of that product. §4.2.8 requires that the area shadowed from direct impingement not exceed 10% on horizontal surfaces and 15% on vertical ones — meaning the arrangement, number and arc of the machines has to be verified together with the internal geometry of the tank. §4.4.3 requires the stripping arrangement to remove oil at 1.25 times the total throughput of the machines running simultaneously — a physical inequality stating that oil must be taken off the bottom faster than washing puts it there. §4.3.3 requires the system to remain operable with one pump out of service; §4.1.3 requires pressure relief to discharge to the pump suction side; §4.1.9 requires the piping to be tested at 1.5 times working pressure after installation. Verified

The physical chain resolves as follows.

Cargo pump discharge -> COW main line -> COW supply isolation valve (per tank group)
        -> COW line valve -> Fixed tank washing machine (deck-mounted or submerged)
        -> High-pressure crude jet -> Tank steel surface -> Clingage dissolved
        -> Falls to tank bottom -> Stripping suction -> Back into cargo discharge line -> Ashore

   [monitoring]  COW line pressure transmitter -> COW control panel -> CCR mimic
   [verification] External rotation/arc indicator (A.446 4.2.12) -> Operator eye
   [precondition] IGS -> O2 <= 8 vol% + positive pressure (A.446 6.6) -> Operator decision

Part II — Composition

5. What the System Is Made Of

Viewed as a component list, COW is five rows. But listing five rows is not analysis. Which typology each row belongs to is what determines its authority, its physical effect and its attack surface — and each typology already carries confirmed doctrine.

[Table 1] Typology Composition

TYP-A04 — COW supply isolation valves and COW line valves. The physical switch that decides which tank group receives washing medium. Neither the valve body nor its on/off actuator holds logic, a setpoint or a state machine. Pilot hydraulic pressure arrives and it opens; the pressure is cut and it closes.

TYP-A05 — COW machines. The equipment that actually does the work. Permanently mounted rotating nozzles, driven either by the energy of the crude flow itself or by a separate drive, tracing a pattern that combines a vertical arc with rotation. A.446 §4.2.1 requires the machines to be permanently mounted and of a type accepted by the Administration. Verified

TYP-B02 — COW line pressure instrumentation. The only measurement point that reports whether the driving pressure is within its specified band. This single row is the carrier of the "belief about a physical quantity" described in section 4.

TYP-B08 — COW control panel. Commands the programme steps and displays progress. All of this system's software lives here.

What is not a row. Cargo pumps, stripping pumps and eductors, IGS, tank level gauging, and the internal tank structure that genuinely governs the washing result are not booked as COW items. COW is a textbook case of a system whose functional boundary and procurement boundary do not coincide, and section 7 deals with that mismatch.

6. Typology Profiles

Five attributes have to be unpacked per typology before analysis can start.

TYP-A04 (valve). Programmable: N. Network interface: none (hardwired to the parent CBS). Purdue: L0. Consequence of loss: mostly Operational. Supply boundary: within the parent package. The majority finding for this family is unambiguous — the intelligence sits in the solenoid valve cabinet and the control console; what the field valve offers is one solenoid coil and one position feedback contact. In the family BOM profile 41 of 49 entries are L0 and only 8 are programmable, and most of those 8 are solenoid cabinets and consoles rather than valves. Typical

TYP-A05 (machine). Programmable: N (33 of 41). Network interface: N (33). Purdue: L0 (33). The doctrine here is simpler still — driven machines such as workshop machines, mixers and agitators are electromechanical; they neither generate nor relay information and issue no command to any other equipment. The exception is the 8 programmable entries absorbed into a parent PLC sequence, and the programmable washing pattern of a COW machine is named in the register as an example of exactly those 8. Typical COW machines may therefore belong to the exceptional subset rather than the base case of this typology — which feeds directly into the architecture judgement in section 8.

TYP-B02 (instrumentation). Programmable: model-dependent. Network interface: 34 of 42 are "Likely" — that is, unconfirmed. Purdue: L1 throughout. CBS: 31 of 42 within a parent CBS. Supply boundary: 38 within the parent package. This typology's register is not yet populated, and the present doctrine is inherited from sibling typologies and overwritten with cargo context. Hence the evidence tag is Inferred, and nothing in this article that rests on this row exceeds that ceiling.

TYP-B08 (panel). Programmable: all 17 entries. Network interface: all 17. Purdue: L2 throughout. CBS: all 17 listed separately. Supply boundary: 15 within the parent package, 2 with their own control cubicle. This family sits closest to the cargo control loop while holding executable code and sequence logic that can be replaced.

The asymmetry is unusually sharp in COW. Two of the five rows are CBS candidates (one instrument, one panel), and only one row is to be listed separately. When an inventory author decides whether to strike "the COW system" from the CBS list, the thing actually being judged is not COW as a whole but that one row and the upstream cabinet that governs it.

7. Where the Supply Boundary Falls

COW's typical supply is a maker package. The yard does not assemble it from parts; a vendor delivers it as a package and the yard connects the interfaces.

Administrative ownership, privilege and update path all change at once at that line. It is a trust boundary that exists regardless of where a firewall sits.

+---------------------------- YARD / OWNER SCOPE ----------------------------+
|  Cargo pumps    Stripping system    Tank structure    IGS    Cargo piping   |
+-------------------------------+--------------------------------------------+
                                |  hydraulic + electrical interface
+-------------------------------v----- MAKER PACKAGE (COW) ------------------+
|  COW machines   COW line valves   Pressure instrument   COW control panel   |
|                                                                            |
|  ?? control cubicle: own enclosure, or absorbed into cargo control package? |
+----------------------------------------------------------------------------+
                                |
                                v  vendor service laptop / removable media
                        [ inbound A3 / A6 / A7 ]

A common trap. Of the 17 entries in the TYP-B08 family, 15 have a supply boundary of "within parent package" and only 2 have their own control cubicle. If COW falls on the side of those 15, the COW control cubicle is absorbed into the cargo control package and appears independently in no component row at all. Search the CBS inventory for a "COW control panel" and you will not find one; the controller that actually executes the COW sequence is counted as part of the cargo control CBS. The inventory is not wrong — the boundary was drawn differently — and the problem arises only when that fact is not recorded anywhere.

The legitimate inbound windows: approval, test and verification. The supply boundary matters in cyber terms because it decides when, and by whom, this system may legitimately be touched. COW is one of the rare systems where those windows are written into the rules.

Collapsing these windows into the phrase "remote access" destroys the analysis. Stated precisely, this is a schedule on which inbound authority is opened, and to anyone who knows the schedule it is also a plan.

8. Architecture Patterns

COW's real topology varies by ship and is not settled in this system's brief. Which specific components make up the 8 programmable entries in TYP-A05, and the real values behind the 4 "Likely" network interfaces in TYP-A04 and the 34 in TYP-B02, are all unconfirmed. Rather than assert one, three conceptual variants are presented.

Variant A — Standalone. The COW control panel stands on its own in the cargo control room with machine-running lamps, pressure gauges and valve switches. There is no connection to a higher-level network beyond a few alarm contacts. A person executes each step from the manual.

[A] Operator -> COW panel (local, hardwired) -> Solenoid cabinet -> COW valves
                     ^                                                  |
                     +---- pressure gauge / rotation indicator ---------+
    (no IP interface; attack surface = physical access to CCR and cabinets)

Variant B — Monitored / Online. The COW panel reports status to a higher-level IAS or cargo control console. Pressure, step progress and alarms appear on the CCR mimic, and washing records flow into a CTMS or electronic log. Outbound stops at A2, but as soon as tag databases, alarm limits and display templates come down from above, inbound A3 exists.

[B] Operator -> COW panel -> Solenoid cabinet -> COW valves
                   |  ^
          status A2|  | A3 tag/alarm-limit distribution (inbound)
                   v  |
             IAS / cargo mimic ----> CTMS record ----> shore (commercial)
    (attack surface adds: cargo control network, tag DB distribution, IP conduit to shore)

Variant C — Control-Integrated. The COW sequence is implemented as a programme of the cargo control system, and valve lineup and pump speed setpoints issue from the same console. The washing pattern becomes a software configuration item, and the programmable subset of TYP-A05 belongs here.

[C] Operator -> Cargo control console (L2) -> Cargo controller (L1)
                        |                          |
                        |                          +-> COW valve solenoids -> COW valves
                        |                          +-> Pump speed setpoint  -> driving pressure
                        |                          +-> Machine sequence      -> arc programme
                        v
                  Vendor service laptop / USB  [ inbound A3 / A6 / A7 ]
    (attack surface adds: executable and sequence replacement with persistence)

How the attack surface differs across the three:

One fact runs through all three. In every variant, the external rotation indicator of A.446 §4.2.12 and the hand dipping of §4.4.4 remain in place. However deeply software gets involved, those two verification means sit outside the instrumentation signal path. That the detection path in variant C shrinks to "physical indicator only" is bad news; that what remains is guaranteed by rule is good news.

Part III — Authority and Physical Effect

9. What Information and Commands Flow Through It

Mixing information and commands together under the word "signal" makes authority analysis impossible. Split what flows through COW in two.

Information

Commands

Put the two tables side by side and the character of the system emerges. Half the information originates in external systems or in human senses, and the most important item in the command list — stop washing — is not an automatic trip but a human obligation. A.446 §6.6 requires washing to be stopped if the oxygen content of the inert gas being delivered exceeds 8% or the tank is not at positive pressure, but it does not require the final element that performs that stop to live inside the COW system. Verified 33 CFR 157.164 likewise stops at requiring a crew member to monitor the instrumentation, or an alarm to sound in the cargo control room when oxygen exceeds 8% by volume, and requires COW to be terminated when the condition is not met — an alarm, not a trip. Verified

The most important safety action in COW therefore depends entirely on information reaching a person. That is the basis of scenario 3 in section 16.

10. What Authority Does Each Connection Carry

[Table 2] Authority Matrix — rows are the source, columns the destination. Each cell is the authority exercised in that direction.

Summarised by direction, the system envelope is:

• Outbound: A0 – A5. The maximum, A5, is what a local operator exercises on a valve; the practical ceiling for equipment acting on equipment is the panel's A4 COMMAND. The outbound authority of the COW machines and the valve bodies is A0 NONE — they command nothing.
• Inbound: A0 – A7. The maximum, A7 UPDATE_EXECUTABLE, is what a vendor service tool exercises on the control panel. Because all 17 entries of the TYP-B08 family are programmable, the replaceability of executable code and sequence logic is not a guess but a fact of the profile. Typical

This system's inbound authority is larger than its outbound authority. And the place where they diverge is precisely the place where the software is. The principle that the security-relevant direction is usually inbound is, in COW, confirmed numerically.

11. Can the System Affect the Physical Process

Physical effect is a separate axis from authority. It asks how directly something touches the physical world — not how severe the outcome is, and not how much authority is held.

[Table 3] Authority–Effect Matrix

⚠ A judgement on P5 — this article departs from the system envelope.

Mechanically unioning this system's typology envelope puts P5 SAFETY_CRITICAL_EFFECT in the physical effect list. But it is worth asking where that P5 came from.

• TYP-A04's P5 is assigned not to the whole family but to the subset used as the final element of a safety function — specifically fuel oil quick-closing valves and ESD valves.
• TYP-B02's P5 is limited to independent overfill / high-level alarm arrangements (95/98% independent level switches and overfill alarm panels), on the authority of IBC Code 15.19.5–15.19.7.
• TYP-A05 and TYP-B08 are assigned no P5 at all.

None of COW's five component rows belongs to those subsets. A COW supply isolation valve is neither a fuel oil quick-closing valve nor an ESD valve, and COW line pressure instrumentation is not an independent overfill switch. This article therefore does not assign P5 to the COW system. The P5 in the envelope is inherited from other subsets of the typology families; it is not this system's.

This is the "highest value is not a risk score" principle in live use. An envelope is the union across the whole population a typology covers, not the profile of this system. One honest caveat remains: if on a particular ship a COW supply isolation valve is wired as the final element of cargo ESD logic, then that valve is P5. It has not been confirmed, so it goes to Open Questions.

One more point: withholding P5 does not mean the risk is low. What happens when high-pressure crude is sprayed inside a tank that has lost its inert atmosphere was demonstrated in 1969. But the severity of that outcome is a value on the severity axis, while whether a COW component has a path to defeating a safety function is a question on the physical effect axis. Mix the two axes and the classification scheme loses its descriptive power.

12. Human Gate

COW's human gate is dominantly EXECUTION. Cargo work advances only when a person executes each step at the console, and watches the washing pattern progress. But in COW this gate is not a custom — it is a structure built by rule.

MARPOL Annex I Reg. 35.3 requires the system to be operated in accordance with the approved Operations and Equipment Manual. Verified The procedure binds the person into the loop. And A.446(XI) specifies, clause by clause, what that person must do with their own senses.

Human gate points mandated by rule
   |
   +-- A.446 5.2   Person in charge qualification (1 yr tanker, 2+ COW programmes)
   |                  -> authority to operate is gated on a human credential
   |
   +-- A.446 6.6   Verify O2 at 1 m below deck AND mid-ullage, both <= 8 vol%
   |                  -> gate BEFORE start; continuous during; stop condition
   |
   +-- A.446 4.2.12 Watch external rotation/arc indicator
   |                  -> gate DURING; outside the instrumentation path
   |
   +-- A.446 4.4.4  Hand dipping at aftermost point + 3 locations
   |                  -> gate AFTER; physical, out-of-band
   |
   +-- A.446 4.2.10 Visual inspection: essentially free of clingage and deposits
                      -> gate AFTER; human sensory verification of the physical result

Read the character of that list precisely. Three of those items — §4.2.12, §4.4.4 and §4.2.10 — do not pass through the instrumentation path at all. The indicator is mechanical, hand dipping is a hand, and the visual inspection is an eye. The clauses were written two decades before cyber security existed as a concept, and the result is that this system carries verification means that software cannot forge, mandated by rule.

The principle that a gate disappears once the same equipment is placed in an automatic loop holds here too. When the COW sequence is absorbed into the cargo control programme, as in variant C of section 8, the character of the human role shifts from EXECUTION to SUPERVISION. The person who used to press each step becomes a person watching progress, and a person watching progress watches a screen. Whether the mechanical indicator of §4.2.12 actually gets checked at that point decides the integrity of the system — it is where a rule-mandated gate quietly becomes an omitted custom.

One contrast is worth setting down. The doctrine of the sibling typology TYP-B02 contains paths with no human gate at all — the overflow-control system of IBC Code 15.19.7 raises an alarm and sequentially shuts down pumps and valves, and the oil discharge monitoring and control system of MARPOL Annex I Reg. 31 together with the 15 ppm automatic stopping device of Reg. 14.7 cut discharge automatically on a measured value. But those are not COW's paths. COW's §6.6 stop obligation has no automatic trip; a person stands in that place. Same cargo area, same instrumentation family, opposite gate structure.

13. Authority Escalation and Propagation

There is a path in this system by which low authority at entry produces a high-consequence outcome downstream. And in COW that path runs through a person rather than through machinery.

PROPAGATION CHAIN 1 — through human judgement (no CONTROL anywhere)

  Vendor/service tool at cargo-area junction box
        | A3 CONFIGURE  (HART Command 35: range / span / unit)
        v
  COW line pressure transmitter          [authority of device itself: A1 OBSERVE]
        | A2 PROVIDE_INFORMATION (now false)
        v
  COW control panel / CCR mimic  -- shows 10 bar while line is at 6 bar
        | operator sees nominal driving pressure
        v
  Operator decides the wash is proceeding to the approved programme   [EXECUTION gate passed on false data]
        v
  Actual jet energy below design -> effective shadow exceeds A.446 4.2.8 limits (10% / 15%)
        v
  Clingage remains -> tank recorded as crude-oil-washed
        v
  Ballast admitted to that tank        [MARPOL Reg. 35.2 satisfied on paper only]
        v
  Departure ballast oil ratio exceeds A.446 4.2.10 limit (0.00085)
        v
  CONSEQUENCE: oily ballast, discharge exceedance, ORB entries false without anyone lying

Read the character of that chain carefully. At no step is A5 CONTROL exercised. The highest authority the attacker obtained is A3 on an A1 device. And the outcome is a regulatory breach and an environmental discharge. This is where the judgement "sensors have no control authority, so they are low priority" goes wrong. Authority propagates through human paths as well as machine paths, and the human path leaves no log.

PROPAGATION CHAIN 2 — through the sequence (machine path, with persistence)

  Vendor service laptop / removable media at COW or cargo control panel
        | A6 ADMINISTER + A7 UPDATE_EXECUTABLE
        v
  COW control panel  [TYP-B08: 17/17 programmable]
        | A3 CONFIGURE persists across restart and watch change
        v
  Washing programme altered: more machines simultaneous, arc limits changed, step interlock removed
        | A4 COMMAND to cargo controller
        v
  Cargo controller (L1) -> valve solenoids + pump speed setpoint
        | A5 CONTROL on valves,  P4 at the valve seat
        v
  Wash throughput exceeds stripping capacity   [A.446 4.4.3: stripping must be 1.25x throughput]
        v
  CONSEQUENCE: oil accumulates on tank bottom during washing; free surface and overpressure margins
               eroded; the officer's screen shows a programme that is running normally

Side by side the contrast is clear. Chain 1 propagates indirectly through a person with no direct control at all and is very hard to detect. Chain 2 propagates directly through machinery and has persistence, but entry requires physical access or a legitimate service window. The common line of defence for both is the non-instrumented verification of section 12 — the §4.2.12 rotation indicator, §4.4.4 hand dipping and §4.2.10 visual inspection. When the instrumentation path is contaminated, those are the only things still telling the truth.

Part IV — Uncertainty and Security

14. Trust Boundaries and Dependencies

A trust boundary is not where a firewall sits. It is where an assumption changes — where administrative ownership changes, or exposure, or privilege level, or physical accessibility, or where vendor control begins. COW has five such lines, and one of them is of a different kind from the other four.

TRUST BOUNDARIES AROUND THE COW SYSTEM

  +==========================================================================+
  |  TB-1  SAFETY PRECONDITION BOUNDARY   (owner of the safety case: IGS)    |
  |                                                                          |
  |    IGS  --O2 reading, tank pressure-->  Operator  --stop/continue-->  COW |
  |    COW holds NO instrument, NO interlock and NO trip of its own here.     |
  +==========================================================================+
             |
  +----------v---------------------------------------------------------------+
  |  TB-2  SUPPLY BOUNDARY        yard/owner scope  |  maker package (COW)    |
  |        who may open the cabinet, who ships the firmware, who holds source |
  +--------------------------------------------------------------------------+
             |
  +----------v---------------------------------------------------------------+
  |  TB-3  ZONE BOUNDARY          cargo control zone  |  navigation & comms   |
  |        UR E26 Rev.1 4.2.1.3 forbids the same zone for these two           |
  +--------------------------------------------------------------------------+
             |
  +----------v---------------------------------------------------------------+
  |  TB-4  PHYSICAL ACCESS BOUNDARY       CCR door  =  the actual credential  |
  |        UR E26 Rev.1 4.2.4.4.1 authentication exemption rests on 4.2.4.3.2 |
  |        During discharge the CCR is not a closed room: terminal reps,      |
  |        surveyors and charterer's staff pass through it.                   |
  +--------------------------------------------------------------------------+
             |
  +----------v---------------------------------------------------------------+
  |  TB-5  MAINTENANCE BOUNDARY   service laptop / USB  ->  COW panel         |
  |        UR E26 Rev.1 4.2.4.3.4 removable-media policy is the only gate     |
  +--------------------------------------------------------------------------+

TB-1 is the top-level fact of this analysis. COW's safety case rests on the proposition that the inside of the tank is not a combustible atmosphere — and not one piece of equipment that makes that proposition true is inside COW. IGS produces the inert gas, IGS instrumentation measures the oxygen, and COW's obligation under A.446 §6.6 is merely to confirm the value and stop if it is out of limits. Verified

Why that matters in cyber terms: conventional safety analysis asks what could defeat this system's safety function. In COW the answer lies outside the system. You can collapse COW's safety case without touching a single COW component — distort the IGS oxygen measurement, or break the path by which that value reaches the person. Conversely, defending every COW component does not defend that path. When a zone design places the COW panel and the IGS instrumentation in different zones, if this dependency is not recorded, the zone boundary ends up cutting across the direction in which the safety case flows.

TB-4 is the boundary that most often fails in practice. UR E26 Rev.1 §4.2.4.4.1 permits user identification and authentication to be waived, subject to physical access control, for operator HMIs requiring immediate access. Verified The cargo control console is the device class most likely to receive that waiver, precisely because the operating requirement of not leaving the screen during discharge collides head-on with UR E27 Rev.1 §4.1 Table 1 item 12 (SR 2.5, session lock). Verified But the physical control on which the waiver rests is the visitor access control of §4.2.4.3.2, and during discharge the CCR is a space through which terminal representatives, surveyors and charterer's staff pass. If the door is the credential instead of an account, then the length of time that door stands open under discharge schedule pressure is the effective strength of the authentication. Typical

Set out as dependencies:

Four of six lines are external systems, one is a document and one is a person. COW owns essentially no trust asset of its own. The notion of defending this system independently barely holds — which is why most of its security requirements are absorbed into the requirements of the cargo control zone.

15. What Happens When the System Fails

Engineering failure comes before cyber failure. And COW's failures are mostly silent — a property that becomes the premise of the threat analysis that follows.

⚠ To state it plainly first: this research did not find a public investigation report (MAIB, NTSB, ATSB, TSB Canada, DMAIB, KMST) attributing a casualty to the COW operation itself. Unknown The failure modes below are therefore derived not from demonstrated accidents but from the states A.446(XI) is designed to prevent and from typology failure doctrine. Blurring that distinction would make the claim stronger than its evidence.

FAILURE CHAIN — the characteristic COW failure is silent

  Nozzle blocked / rotor stalled   [no electrical signal exists for this]
        |
        v
  Panel programme step advances on a timer, not on measured coverage
        |
        v
  CCR mimic shows "TANK 3P  WASH COMPLETE"
        |
        v
  Tank entered in the Operations and Equipment Manual record as washed
        |
        v
  Ballast admitted to that tank        [MARPOL Reg. 35.2 satisfied on paper]
        |
        v
  Departure ballast oil layer exceeds 0.00085 by volume   [A.446 4.2.10 limit]
        |
        v
  Either: illegal discharge at sea, or an unplanned slop handling problem in port
        |
        v
  Discovered on tank entry -- weeks later, if at all

What stands out in that chain is the detection delay. There is, in principle, no electrical signal that tells anyone a washing machine has stopped turning. That is why A.446 §4.2.12 requires a mechanical means, outside the tank, of indicating rotation and arc for deck-mounted machines, and why §4.2.13 accepts external indication, characteristic operating sound, or periodic verification for submerged machines. Verified The requirement exists not because instrumentation signals are distrusted but because no such instrumentation signal exists in the first place.

Here is the bridge from section 15 to section 16. In a system whose failures are silent, attacks are silent too. An attacker needs no separate concealment technique — the system's normal failure mode is already covert.

16. Attack Surface and Credible Threat Scenarios

Attack surface

⚠ The valve bodies and machine bodies have no logical attack surface. No firmware, no network port, no accounts. Recording that honestly is what justifies removing those three rows from a CBS inventory. But as sections 6 and 11 noted, striking the valve and striking the cabinet that governs the valve are two different acts.

Scenario 1 — Pressure transmitter re-ranging (maximum harm with no escalation)

Entry Interaction    Physical access to a cargo-area junction box during a port stay,
                     HART handheld or DTM-equipped laptop on the 4-20 mA loop
Initial Authority    A3 CONFIGURE on a device whose own authority is A1 OBSERVE
Mechanism            HART Command 35 changes range/span so that 6 bar reads as 10 bar
Authority Gained     NONE. No escalation occurs anywhere in the chain.
Affected Interaction Pressure Tx -> COW panel -> CCR mimic -> operator judgement
Physical Effect      P1 INDIRECT_DECISION_EFFECT (the jet energy is never commanded down;
                     it was already low, and the display now conceals it)
Consequence          Shadow exceeds A.446 4.2.8 (10% horizontal / 15% vertical);
                     tanks recorded as washed are not washed; ballast admitted under
                     Reg. 35.2 on a false premise; departure ballast exceeds the
                     4.2.10 limit of 0.00085. No alarm, no log entry, no lie told.

The point of this scenario is that it reaches the deepest consequence from the lowest authority. No valve moved incorrectly, no command was forged, no account was stolen. What changed was one configuration value on one device. This is the principle that A3 CONFIGURE can outrank A4 COMMAND in danger, made concrete — and detection is harder still because in HART-family devices a range change leaves no command in a log, only a measured value. Inferred — whether this path is implemented depends on TYP-B02's network interface being 34/42 "Likely", so this description does not exceed the INFERRED ceiling.

The line of defence is not inside the instrumentation path. Only the three non-instrumented verifications — §4.2.12 rotation indicator, §4.4.4 hand dipping, §4.2.10 visual inspection — catch this scenario.

Scenario 2 — Washing programme replacement via the maker package (persistence)

Entry Interaction    Vendor service laptop or USB at the COW / cargo control panel
                     during a scheduled retrofit or terminal-driven procedure change
Initial Authority    A6 ADMINISTER + A7 UPDATE_EXECUTABLE  (TYP-B08: 17/17 programmable)
Mechanism            Washing programme and step interlocks replaced: more machines run
                     simultaneously, arc limits widened, a step-completion interlock removed
Authority Gained     A3 CONFIGURE persisting across restart and watch handover;
                     downstream A4 COMMAND to the cargo controller
Affected Interaction COW panel -> cargo controller (L1) -> valve solenoids + pump setpoint
Physical Effect      P3 INDIRECT_PHYSICAL_CONTROL at the panel, P4 at the valve seat
Consequence          Wash throughput exceeds stripping capacity, breaching the A.446 4.4.3
                     inequality (stripping >= 1.25x simultaneous throughput). Oil accumulates
                     on the tank bottom during washing. Free-surface and pressure margins
                     erode while the officer's screen shows a programme running normally.

This scenario is strongest in variant C (control-integrated) and weakest in variant A (standalone). And it arrives through a legitimate window — the approval, test and verification regime tabulated in section 7 is precisely the schedule of those windows. Commissioning, the 1.5x pressure test, the twelve-month verification, a procedure change driven by a terminal. Each is a normal activity required by rule, and each is a moment when inbound authority opens.

Persistence is the essence of this scenario. Scenario 1 is undone by a recalibration, but replaced executable code survives a restart and a watch handover. That is exactly why UR E26 Rev.1 §4.1.1.1 and §4.1.1.3.2 require hardware and software inventories — application programs, operating systems and firmware — to be maintained across the life of the ship. Verified And do not miss that the approved Operations and Equipment Manual is a detection means for this scenario — the fact that the running programme differs from the manual's procedure surfaces only if the manual is maintained as the authoritative copy and compared against the actual configuration. What MARPOL Reg. 35.1 and 35.3 require is not an administrative document but a configuration baseline.

Scenario 3 — Suppression of the inert-atmosphere precondition (information as safety function)

Entry Interaction    Cargo control network or IGS monitoring path (variant B / C),
                     or physical access to the O2 indication / alarm circuit
Initial Authority    A2 PROVIDE_INFORMATION -- suppressed or falsified, not commanded
Mechanism            The O2 value shown in the CCR is held at a nominal figure, or the
                     high-O2 alarm is inhibited at the display layer
Authority Gained     NONE
Affected Interaction IGS -> operator -> A.446 6.6 stop decision
Physical Effect      P2 OPERATIONAL_STATE_EFFECT (the washing operation continues in a
                     state in which the rules require it to stop)
Consequence          High-pressure crude spraying inside a tank whose atmosphere is no
                     longer verified inert. This is the 1969 condition. The system has
                     no automatic trip for it -- A.446 6.6 and 33 CFR 157.164 both stop
                     at monitoring and alarm, and place the stop action on the person.

This is the most important of the three. As section 9 established, COW's most important safety action is a human obligation rather than an automatic trip, and a person needs information to discharge that obligation. In this system, therefore, the integrity of the information path is the integrity of the safety function. Classifying information as A2 does not make it less important — when the recipient is a person and that person is the only final element, A2 is the input stage of a safety function.

At the same time, one honest note. This path lies not in a COW component but in IGS and its indication path. The scenario is invisible inside a COW CBS inventory, no matter how well that inventory is built. The consequence of TB-1 in section 14 appears here as a concrete risk.

17. Security Architecture and Standards

Controls come from threats, and standards attach after the controls. Start instead from "we comply with E26" and you cannot tell what this system actually needs.

Three points deserve emphasis.

First, the strongest control in this system is not a cyber control. The external rotation indicator of A.446 §4.2.12, the hand dipping of §4.4.4 and the visual inspection of §4.2.10 were written in 1979, and they are verification means that software cannot forge. Two of the three scenarios are caught by them. The job of cyber security design here is not to invent new controls but to bind those three verifications into procedure and records so they are not quietly omitted. When the human role drops from EXECUTION to SUPERVISION in variant C, they are the first things to go.

Second, the approved Operations and Equipment Manual functions as a configuration management control. MARPOL Reg. 35.1 requires a manual describing the system and equipment and prescribing operational procedures, to the satisfaction of the Administration, and Reg. 35.3 requires the system to be operated in accordance with it. Verified Translate those two clauses into cyber language and they read: an approved baseline exists, and actual operation must match it. That purpose overlaps with the software inventory requirement of UR E26 §4.1.1.3.2 — and in COW the regulatory document already performs the role. The implementable design is not to create a new document but to connect the existing regulatory document to the configuration baseline.

Third, avoid unsupported compliance claims. UR E27 Rev.1 §1.3 states that E27 applies to "computer based systems specified in UR E26". Verified Of COW's five rows, therefore, E27 requirements attach only to those judged to be CBS, and attaching E27 Table 1 items to a non-programmable valve or machine is not a requirement but a misapplication. Conversely, UR E26 §6 requires a risk assessment before a CBS is excluded from the application of the requirements — so "the valve is not a CBS" is not a judgement to be made casually either, but a documented one. Verified

18. Open Questions, Takeaways and References

18.1 Open Questions

What this article could not settle. None of it has been filled in by inference.

18.2 Fourteen questions to ask first on a real project

Questions to put to vendors and owners on a newbuilding or retrofit project. The answers close the open questions above.

COMPOSITION AND BOUNDARY
 1. Is the COW control panel an independent cubicle or inside the cargo control package?
    Answer with a drawing number.
 2. Under which CBS item is the controller that executes the COW washing programme listed?
 3. Do the COW machines have position, arc or rotation feedback? If so, into which I/O?
 4. Is the machine arc programme a hardware cam or a software parameter?

AUTHORITY AND INTERFACE
 5. What kind of controller is in the COW valve solenoid cabinet - relay logic or a PLC?
 6. Is the COW line pressure transmitter HART-capable? Is write protection enabled?
 7. Provide the signal list exchanged between the COW panel and the cargo ESD system.
    (Does it participate in a trip path?)
 8. What is the COW panel's communication protocol, and what are its peer nodes?

MAINTENANCE AND SUPPLY
 9. By what medium, and under whose signature, is the washing programme updated?
10. Does vendor remote diagnostic access exist? If so, over which conduit?
11. Who retains the software configuration record for this package after commissioning?

SAFETY CASE AND HUMAN GATE
12. From which instrument and which indication is the 8 vol% oxygen check made? Is there a
    means of confirming it independently of the IGS system?
13. Does the A.446 4.2.12 external rotation indicator physically exist? Show the most
    recent verification record.
14. In automatic sequence phases, is the human role EXECUTION or SUPERVISION? Where in the
    procedure is that stated?

18.3 Engineering Takeaways

1. COW is a system built by regulation, and that regulation stands on a precondition created by a different system. 1969 explosions → IGS mandated → inert atmosphere secured → 1978 TSPP → COW mandated. In the reverse order this system could not have been approved.
2. The washing medium is the cargo itself. No dedicated fluid, pump or storage. That is what puts the functional boundary out of step with the procurement boundary, and why only five rows appear in the BOM.
3. Component count is not a measure of cyber relevance. Three of the five rows are non-programmable L0, and only one row is listed separately as a CBS. Yet those three rows perform all of the physical action.
4. Inbound authority exceeds outbound authority. The envelope is outbound A0–A5, inbound A0–A7, and the place they diverge is exactly the place where the software is.
5. A0 + P4 is normal. The machines and valves perform the most violent physical action with zero authority. Authority is upstream, physical contact downstream.
6. This article does not assign the envelope's P5 to this system. That P5 is inherited from other subsets — fuel oil QCV/ESD valves and independent overfill switches — and none of COW's five rows belongs to them.
7. The cheapest attack path is not the physical quantity but the belief about it. A path exists from the lowest authority (A3 on an A1 device) to a regulatory breach and an environmental discharge, and it leaves no log.
8. The rules mandate out-of-band verification. §4.2.12 external rotation indicator, §4.4.4 hand dipping, §4.2.10 visual inspection — written two decades before cyber security existed and unforgeable by software.
9. The approved manual is the configuration baseline. Rendered in cyber language, MARPOL Reg. 35.1 and 35.3 overlap in purpose with the software inventory requirement of UR E26 §4.1.1.3.2.
10. COW does not own its own safety case. That single sentence is the most important fact in analysing this system, and the zone design, the inventory boundary and scenario 3 all follow from it.

FINAL ANALYTICAL CHAIN — Crude Oil Washing System

 System        Crude oil washing (SYS-012, MARPOL Annex I origin)
   -> Function    dissolve clingage with the cargo itself during discharge
   -> Component   5 BOM rows only (2 valves, 1 machine, 1 instrument, 1 panel)
   -> Typology    A04 valve / A05 machine / B02 transmitter / B08 panel
   -> Interaction supply lineup, jet application, pressure indication, step sequencing
   -> Info/Cmd    info half-sourced outside the system; the critical command is human
   -> Authority   outbound A0-A5  |  inbound A0-A7   (inbound is the larger set)
   -> Phys Effect P0-P4  (P5 NOT assigned -- inherited from other typology subsets)
   -> Human Gate  EXECUTION, mandated by rule, with three out-of-band verifications
   -> Dependency  IGS inert atmosphere, cargo pumps, stripping, gauging, approved manual
   -> Trust       the safety case is owned by a neighbouring system
   -> Failure     silent: no electrical signal exists for a stalled washing machine
   -> Consequence unwashed tanks recorded as washed -> oily ballast -> Reg. 35.2 breach
   -> Threat      S1 re-ranging (A3 on A1)  S2 programme replacement (A7)  S3 info suppression
   -> Requirement configuration baseline, media control, zone separation, physical access
   -> Control     tie the three rule-mandated out-of-band verifications to records
   -> Assurance   UR E26 4.1.1.3.2 inventory + MARPOL Reg. 35.1 approved manual
   -> Evidence    A.446 clause numbers, MARPOL Reg. 33/35, 33 CFR 157.164, UR E26/E27/E22

18.4 References

Standards and regulations

• MARPOL Annex I Regulation 33 — Crude oil washing requirements. Verified
• MARPOL Annex I Regulation 35 — Crude oil washing operations. Verified
• IMO Res. A.446(XI), as amended by A.497(XII) and A.897(21) — Specifications for the Design, Operation and Control of Crude Oil Washing Systems. Verified
• IMO Res. MEPC.3(XII), as amended by MEPC.81(43) — Standard format for the Crude Oil Washing Operations and Equipment Manual.
• 33 CFR 157.164 — Crude oil washing: inert gas requirements (US domestic cross-check). Verified
• IACS UR E26 (Apr 2022; Rev.1 Nov 2023) — Cyber resilience of ships. §1.3, §2, §4.1.1.1, §4.1.1.3.2, §4.2.1.1, §4.2.1.3, §4.2.4.3.2, §4.2.4.3.4, §4.2.4.4.1, §4.2.6.3.2, §6.
• IACS UR E27 Rev.1 (Sep 2023) — Cyber resilience of on-board systems and equipment. §1.3, §4.1 Table 1 items 1, 12, 18, 20.
• IACS UR E22 Rev.3 §3.3 — On-board use and application of programmable electronic systems.
• IBC Code 15.19.5–15.19.7 — Overfill control (cited only for typology contrast).

Historical

• December 1969, cargo tank explosions aboard Marpessa, Mactra and Kong Haakon VII — static discharge during tank cleaning. Per-ship detail rests on secondary sources. Verified (multiple concurring sources)
• February 1978, TSPP Conference, 1978 Protocol to MARPOL 73. Verified
• UK P&I Club, Carefully to Carry — bulk oil cargo shortage and contamination claims (clingage quantity, order of magnitude only). Typical

Not established

• Any public casualty investigation report attributing a casualty to the COW operation itself — not found. Unknown