> ## Content Index > Fetch the complete content index at: https://julius-shin.ghost.io/llms.txt > Use this file to discover other available public pages before exploring further. # [System Study_007] The Cargo That Consumes Its Own Environment - URL: https://julius-shin.ghost.io/live-fish-well-containment-circulation-loading-system/ - Published: 2026-09-09T12:55:15.000Z - Updated: 2026-09-10T17:38:43.000Z - Description: A systems-engineering analysis of the wellboat live-fish well containment, circulation and loading system — typology composition, directional authority, physical effect, and the clause that does not exist. - Author: Julius Shin - Tags: Systems Engineering, Maritime, Cybersecurity, Live Fish Carrier, Cargo Handling, SYS-304 In every cargo system this series has covered, the cargo was inert: crude oil stays crude oil when the control system stops. Failure there is **loss of visibility**. A wellboat is different. The cargo is alive and **consumes the environment that contains it.** Oxygen falls, carbon dioxide and total ammonia nitrogen rise, and from the moment circulation stops the water deteriorates at a rate set by biomass, temperature and volume. > In this system, loss of control is not loss of visibility. It is the start of a countdown, and the control system does not set the length of the clock. The analysis also meets a gap in the rulebook. Chemical tankers must fit an overfill safety arrangement **independent** of gauging; live-fish transport regulation has no equivalent, and that absence is the substantive finding here. ## 1\. Why this system exists The problem states simply: move live fish from A to B. Out of water they die in minutes; in water, the water itself deteriorates. Biomass (tens to hundreds of thousands of fish) contained in a finite volume | +--------+--------+ | | O2 consumption CO2 + TAN production | | Dissolved O2 falls pH shift / toxicity builds +--------+--------+ | Water quality leaves the safe envelope | Stress -> injury -> mortality | (in parallel) pathogen and parasite spread along the route Two branches on different clocks. Survival of the fish on board is a **welfare** problem visible during the voyage; the well water travelling past other farms is a **biosecurity** problem that surfaces weeks later at someone else's site, and it is why the filtration and disinfection train exists. Scale makes it industrial: a 2015 Norwegian Veterinary Institute report counted **63 wellboats** moving roughly **350 million smolt** and **more than 1.4 million tonnes** of harvested fish annually. Typical — **2015 figures, not current ones.** ### Where the requirements came from The document specifying this system's functions clause by clause is not a class rule but national animal-health regulation: the **Norwegian regulation on transport of aquaculture animals** (FOR-2008-06-17-820). Verified - **§3 j)** defines *transportation equipment* as the circulation, oxygen, filtration and vacuum-transfer systems plus valves, caps, hoses and pipes. **The regulator wrote the bill of materials.** - **§4, §6** — the transport unit requires Norwegian Food Safety Authority approval. - **§16** — beyond two hours, systematic measurement of oxygen, pH, salinity and temperature; **§17** covers closed transport separately. - **§18** — for wellboat transport, inspection of the fish **using a camera** is mandatory. Verified for the clause subject; wording per the **official English translation**. - **§9a** — automatic position registration: a second, statutory **outbound** data flow. - **§20** — washing and disinfection between transports involving different sites. This is Norwegian domestic law, cited by attribution and never as a universal IMO-style requirement, though most of the world fleet and of the regulatory template originate there. DNV's July 2024 rule edition created the ship type **Fish carrier (Live)**, covering **tank structural strength, stability, and the loading and unloading piping system.** Verified — from DNV's rule-edition notice; no Pt/Ch/Sec could be confirmed, so no clause number is cited. A class society making stability a live-transport requirement formally acknowledges that **the well water is simultaneously the cargo and a very large free surface.** Biosecurity duties have hardened: wellboats in Norwegian waters must **disinfect all water taken into and discharged from the well**, extended since 2021 to water discharged after carrying fish for slaughter. Typical Those duties push operation toward **closed mode**, and closed mode enlarges the authority held by the control system. Regulation is manufacturing cyber relevance. Key distinction — life support, not containment A tanker's cargo tank is a containment structure. A wellboat's well is a containment structure and a life-support device at once. The difference shows up first not in authority but in **time**: a cargo tank that loses control simply sits there; a well that loses control starts a clock. ![Operational context diagram of a wellboat voyage showing loading at a farm net pen, the well with its circulation pump, oxygen injection, filtration and exchange valve, discharge through dewatering to a processing plant, well water discharged along the route past other farms, and statutory log and position data reported to the authority.](https://github.com/MaritimeCyber/General/blob/main/Asset/img/ei/live-fish-well-containment-circulation-loading-system/context-v2.jpg?raw=true) Figure 1\. The operational context: farm, voyage and processing plant, with the two things that cross the hull — water and statutory data. ## 2\. What the system does Six system-level functions. 1. **Contain** — a water-filled well. Loading and discharge use vacuum and pressure, so it is a **pressure boundary**, not a plain tank. 2. **Circulate and exchange** — pumps move the water; in open mode the well exchanges with the sea (§16). 3. **Condition** — oxygen injection, active airing against total gas supersaturation, temperature management (§16). 4. **Treat** — filtration and disinfection of inlet and outlet water, for biosecurity. 5. **Transfer** — vacuum and pressure move fish in and out; §18 constrains pump distance, height, pressure and drop. 6. **Dewater and grade** — separate water from fish on discharge and sort by size. [ Farm net pen ] --crowding--> [ Vacuum / pressure transfer ] --> [ WELL ] | +-----------------+-----------------+-----------+ | | | | Circulation pump O2 injection Filtration/ Water exchange | + degassing disinfection valve (open mode) | | | | +--------> [ Water quality state ] <------------+ | Instrumentation (O2, temp, salinity, pH/CO2, level) | Camera (Reg. §18) -> Operator judgement | [ WELL ] --> [ Dewatering / grading ] --> [ Processing plant or receiving site ] The regulator's list and the typology composition line up closely. | Regulatory BOM, §3 j) | Corresponding typology | Note | | ---------------------------------------- | ------------------------------------------ | --------------------------------------------------------------------- | | Circulation system for water pumps | TYP-C02 (circulation pump) | Moves the entire well volume | | Oxygen system | No dedicated BOM row | Required by regulation, absent from the 7-row list — an open question | | Water filtration system | TYP-A08 (filter / strainer) | SPLIT: manual versus automatic backflush | | Vacuum pump system for loading/unloading | TYP-C02 (transfer pump / ejector) | Vacuum and pressure transfer | | Valves, valve caps | TYP-A04 (shutoff / isolation valve) | The exchange valve lives here | | Hoses, pipes | Absorbed into the TYP-A04 row | Includes the farm connection hose | | (not in the regulatory BOM) | TYP-A02 (the well itself) | §8 requires tank and well volumes to be known | | (not in the regulatory BOM) | TYP-B02 (instrumentation), TYP-B08 (panel) | §16 and §18 require them only as functions | The last two rows matter. **Regulation does not enumerate measurement and control as equipment; it requires them as functions.** §16 says measure systematically without saying what the measuring system consists of, so its shape is left entirely to the vendor package — the supply-boundary problem of section 7. ## 3\. Core functions and operating modes The axis of this system is the **open / closed** dichotomy, which the regulation itself states: §12 covers water quality "both in open and closed systems," and §16 and §17 address the two separately. **Open mode.** The exchange valve is open and what supplies oxygen and dilutes metabolites is, in effect, **the ocean**. The control system need only confirm sufficient flow — which is why §16 stops at requiring adjustable valves. **Closed mode.** The valve shuts and the vessel becomes the only life-support device: oxygen injected, CO2 stripped, TAN accumulating. §17 applies here alone, requiring exchange planned in advance, recirculation treatment, and **no operations that raise pH sharply while TAN has accumulated.** **Intermittent closure** — valves shut near farms and ports, open elsewhere — is the real pattern, and biosecurity regulation is lengthening the closed segments. | Mode | Exchange | O2 injection | Filtration | Transfer | Control-system authority | | ------------------------ | ------------------- | ------------------------------------------ | ----------------------- | ----------- | -------------------------------------------- | | Open passage | Continuous | Supplementary | Inlet/outlet treatment | Stopped | Low — the sea is life support | | Closed passage | Shut | **Essential, continuous** | Recirculation treatment | Stopped | **High — the ship is the only life support** | | Intermittent closure | Switched by segment | Essential when closed | By segment | Stopped | Varies at every transition | | Loading | Partial | Mandatory monitoring during crowding (§18) | Inlet treatment | **Running** | High — flow and pressure control | | Discharge | Partial | Maintained | Outlet treatment | **Running** | High — interlocked with dewatering | | Wash and disinfect (§20) | System isolated | — | Chemical dosing | Stopped | Medium — procedural | | Standby | Stopped or partial | Idle | Stopped | Stopped | Low | The last column is the second argument of this article. **The position of one valve inverts the authority profile.** Same ship, same instruments, same panel: with the exchange valve open the control system is an observer; with it shut, a life-support machine. **The two-hour threshold.** §16 switches the measurement obligations on when transport exceeds two hours — regulation gating instrumentation duty on elapsed time, which is itself an admission that risk here is a function of time. Verified ## 4\. How the system works The output of this system is "water quality," and water quality is not the output of any device. It is a **balance** of supply, consumption, dilution and removal. [ O2 supply ] [ O2 consumption ] exchange (open) + injection (closed) vs biomass x metabolic rate (f. temperature) | | +---------------> Dissolved O2 <---------+ | [ CO2/TAN removal ] [ CO2/TAN production ] exchange + degassing + treatment vs biomass x metabolic rate | | +---------------> pH / TAN <-------------+ | [ Water quality state ] | instrument -> display -> human -> actuation -> water The left side is what the control system holds; the right side is not, because biomass is fixed at loading and temperature by the sea. **All the control system can do is match the left to the right,** and when the left stops the right keeps running. That is the physical substance of the countdown. §8 adds one condition: dry-mounted pumps, muffs and connections must be sealed against drawing air, because ingress produces **total gas supersaturation** and gas-bubble disease, which §16 requires removed by active airing before transfer. Verified **A mechanical defect in a pump is here directly a water-quality defect.** Engineering note — the thing to protect is not one executable Water quality is decided by a chain, not a program: sensors produce values, the panel displays them, a person looks at the fish through the camera §18 requires, that person actuates valves and oxygen dosing, and the result appears in the water. The chain has at least five owners, and manipulating any single link leaves the rest operating normally while the outcome is wrong. What has to be defended is the **judgement chain**, not the executable. ## 5\. What the system is made of **Required table 1 — Typology composition** | Typology | Equipment class | Components here | Rows | Purdue | CBS (E26) | Evidence | | -------- | -------------------------------- | ---------------------------------------------- | ---- | --------------------- | ------------------------- | ------------ | | TYP-C02 | Centrifugal pump — cargo control | Well circulation pump, transfer pump / ejector | 2 | L0 — physical process | N | TYPICAL | | TYP-A02 | Pressure vessel / tank | Live-fish well / tank | 1 | L0 — physical process | N | TYPICAL | | TYP-A04 | Shutoff / isolation valve | Fish transfer piping and valve manifold | 1 | L0 — physical process | N | TYPICAL | | TYP-A08 | Filter / strainer | Dewatering and grading unit | 1 | L0 — physical process | **Y — separately listed** | TYPICAL | | TYP-B02 | Process transmitter / sensor | Tank level and flow instrumentation | 1 | L1 — sensing | **Y — within parent CBS** | **INFERRED** | | TYP-B08 | HMI / operator console / panel | Fish-handling control panel | 1 | L2 — supervisory | **Y — separately listed** | TYPICAL | **TYP-C02** interprets nothing — outbound authority A0 — yet the physical contact is here. **TYP-A04** holds the exchange valve that decides the mode, with neither logic nor setpoint in the valve body. **TYP-A08** matters most, because the typology is **SPLIT**: a manual strainer is A0/P0, an automatic backflush controller is A5 and P4\. **TYP-B02** carries an **INFERRED** ceiling, and **TYP-B08** is the only supervisory layer — where operator judgement is formed. 7 rows = 4 passive (L0, non-CBS) + 3 CBS candidates | | Well / valves & piping / 2 pumps Dewatering-grading controller (listed) Structure and motive power Instrumentation (within parent CBS) No authority Fish-handling panel (listed) | | Physical contact is here Judgement and authority are here ## 6\. Typology profiles — component count is not a measure of cyber relevance Four of seven component rows are **passive structure and motive power at Purdue L0.** The well, the valves and piping, and both pumps are not programmable electronic devices, so they fall outside the CBS definition in IACS UR E26 Rev.1 §2\. By mass that is 99 per cent of the system; in a cyber inventory, zero. The instrumentation row, the panel row and the dewatering-grading controller are the CBS candidates. **Physical bulk and cyber relevance run close to inversely here.** ### Why the TYP-A08 split matters especially in this system A manual strainer is a passive pressure part with no command and no signal (A0 / P0). An automatic backflush controller starts, sustains and ends a cleaning cycle **on its own** from a differential-pressure threshold or a timer: genuine closed-loop CONTROL (A5) over its own actuators, and P4 because the output turns a backflush motor and opens flushing valves. A local keypad can change duration, threshold and delay times — inbound A3\. Because **the controller actually fitted to a wellboat is unconfirmed**, only the structural fact is inherited. Cache doctrine calls this family's characteristic failure **silent degradation**: adjust the cleaning parameters and filtration is defeated with no alarm. In fuel filtration that eventually surfaces as an engine load limit. **On a wellboat it does not surface at all** — the train protects biosecurity outside the hull, not the fish on board. ### The evidence ceiling on TYP-B02 Instrumentation carries an **INFERRED** grade — empty cache register, doctrine inherited from siblings — so nothing said here about that train is confirmed fact, and **every statement resting on communications behaviour inherits the same ceiling.** Whether the link is bare 4-20 mA or carries HART or Modbus varies by project, and that changes inbound authority entirely: with a HART-family interface, a service laptop can **change range, span and unit (A3)**, never touching the measured value, only its interpretation — which here is the oxygen verdict. ## 7\. Where the supply boundary falls Typical supply is a **maker package**: pumps, piping, valves, instrumentation and panel in one vendor scope. Integrator and owner see an interface list rather than a system, and the configuration inside stays with the vendor. Here the ship-type-specific trust boundary appears. On a wellboat, **the formal channel for inbound authority is not a firewall — it is regulatory approval.** - **§4, §6** — NFSA approval of the transport unit, covering construction (§8), means of transport (§15), and the practicability of procedures for washing and disinfection, dead-fish handling, water exchange, monitoring, sampling and log keeping. Verified - **§15** — new methods and equipment tested and documented before use. Verified - **§20** — washing and disinfection on reuse, and the conditions for exemption. Verified Read through a cyber lens, those clauses answer one question: **who legitimately touches this system, and when.** Each access is inbound authority with a direction and a grade, not undifferentiated "remote access." - Vendor commissioning and retrofit engineer, toward the panel — **A3 CONFIGURE, A6 ADMINISTER, A7 UPDATE\_EXECUTABLE** - Instrument service access (HART/DTM) — **A3**, and depending on model A7 Inferred - Local keypad on the backflush controller — **A3**, on physical access alone - Authority inspection and approval — the **procedural channel that legitimises change** One trap: a control cubicle absorbed into a parent package can fail to appear as an independent component row at all. The panel was captured as "Y — separately listed", but the **oxygen system**, which §3 j) names explicitly, has **no independent row**, and which panel owns oxygen dosing is unconfirmed. Modern wellboats also run **thermal delousing** through the same well and circulation loop. That plant is outside this system's BOM, but **when one physical asset belongs to two systems the CBS boundary and the zone assignment diverge**, and how that was resolved under E26 §6 and §4.2.1.1 needs to be written down. ## 8\. Architecture patterns A / B / C The actual control topology of a wellboat is **UNKNOWN** to this investigation, so three conceptual patterns are set against each other rather than one asserted. **Pattern A — Standalone.** Own cubicle, hardwired instrumentation, IAS integration of a few alarm contacts or none. **Pattern B — Online.** The panel integrates with the IAS and data leaves for shore, motivated by the §9 log — species and quantity, mortality and cause, route and farms visited, exchange and valve operations, oxygen consumption, water-quality parameters, cleaning records — **retained five years** and disclosed to shipper, consignee and authority. **Pattern C — Control-integrated.** The well volume is variable ballast, so well level and transfer control integrate with the stability platform; DNV placing stability inside the *Fish carrier (Live)* scope (Verified) is the pressure behind that. | | A. Standalone | B. Online | C. Control-integrated | | -------------------------------- | -------------------------------- | -------------------------------------------------- | --------------------------------------------------- | | Path off the ship | None (USB / service laptop only) | **Permanent** — shore reporting, remote monitoring | Permanent, plus via the ballast system | | Reach of instrument manipulation | Panel display | Display + statutory log (§9) | Display + log + **stability calculation** | | Worst outcome | Fish mortality | Mortality + falsified statutory record | Mortality + record + **stability casualty** | | E26 §1.3.2 b) IP interface | Not applicable | **Applicable** | **Applicable** | | E27 Table 2 (untrusted network) | Not applicable | In scope for review | In scope for review | | Zone assignment difficulty | Low | Medium | **High** — cargo, ballast and navigation boundaries | Typical architecture — disclaimer A, B and C are conceptual models, not the actual configuration of any vessel. This investigation could not confirm wellboat control topology at the level of a clause or a drawing. Which pattern applies must be established per project from the integrator's architecture drawing, and until it is, leaving the three distinct is more honest than picking one. ## 9\. What information and commands flow through it Separating the two is where authority analysis starts. **Information — measurement, status, record** - Dissolved oxygen, temperature, salinity, and pH or CO2 — the four §16 makes mandatory beyond two hours - Well level, circulation flow, transfer pressure, valve position, pump run and trip status - **Camera imagery** — the observation means §18 makes mandatory for wellboats - The seven §9 log items — statutory record, five-year retention, disclosed to shipper, consignee and authority - **Vessel position** — §9a requires automatic reporting, and unlike the rest it leaves **without passing through shipboard judgement.** **Commands — instructions that change state** - Circulation pump, transfer pump and ejector start/stop and transfer rate - Exchange valve open/close — **the mode transition itself** - Oxygen dosing rate, initiation of active airing - Backflush initiation, or automatic cycle parameter change - Dewatering and grading unit operation ---- INFORMATION (upward) -------------------------------------- O2 / temp / salinity / pH-CO2 --+ Well level / flow / pressure --+--> Fish-handling panel (L2) --+ Valve position / pump status --+ | | Camera image (Reg. §18) ------------------> | +--> §9 log | (5-yr statutory) Vessel position (Reg. §9a) --- automatic ------------------------> Authority v (no operator gate) Operator judgement | ---- COMMAND (downward) ----------------------------------------- v Pump start/stop . Exchange valve open/close . O2 dose rate . Backflush start . Transfer rate . Dewatering unit run | v [ Water in the well ] One clarification. Cache doctrine attaches a custody-transfer apparatus to liquid cargo — metering, bill-of-lading quantity, ship-shore difference, surveyors. **This system has no counterpart,** and the vocabulary is not transplanted. The structurally similar item is the §9 log, and one property carries over: **it is a statutory record, so a motive to distort it exists without any physical incident at all.** ## 10\. What authority each connection carries **Required table 2 — Authority matrix** (YES / NO / UNKNOWN / COND = conditional) | Source -> Destination | Observe (A1) | Provide info (A2) | Configure (A3) | Command (A4) | Control (A5) | Admin (A6) | Update exec (A7) | | -------------------------------------------------------- | ------------ | ----------------- | -------------- | -------------- | ------------ | ---------- | ---------------- | | Instrumentation (B02) -> fish-handling panel | YES | YES | NO | NO | NO | NO | NO | | Camera -> operator | YES | YES | NO | NO | NO | NO | NO | | Panel (B08) -> pump and valve control logic | YES | NO | YES | YES | NO | NO | NO | | Panel (B08) -> final actuating elements | NO | NO | NO | YES (indirect) | NO | NO | NO | | Backflush controller (A08) -> own motor and flush valves | NO | NO | NO | YES | **YES** | NO | NO | | Backflush controller (A08) -> IAS alarm | NO | YES | NO | NO | NO | NO | NO | | Pump (C02) -> panel (run, discharge pressure) | NO | YES | NO | NO | NO | NO | NO | | Valve (A04) -> panel (position feedback) | NO | YES | NO | NO | NO | NO | NO | | Well (A02) -> anything | NO | NO | NO | NO | NO | NO | NO | | **Operator account -> panel** | YES | NO | YES | YES | NO | COND | NO | | **Vendor service laptop -> panel** | YES | NO | **YES** | YES | NO | **YES** | **YES** | | **HART/DTM service tool -> instrumentation** | YES | NO | **YES** | NO | NO | NO | UNKNOWN | | **Local keypad -> backflush controller** | YES | NO | **YES** | YES | NO | NO | NO | | Upstream IAS / shore (patterns B, C) -> panel | YES | YES | UNKNOWN | UNKNOWN | NO | UNKNOWN | UNKNOWN | Key distinction — connectivity is not authority Valve position feedback rides on bidirectional wiring, but authority in the valve's direction stops at A2 PROVIDE\_INFORMATION. A limit switch instructs nothing. In the opposite direction the panel holds A4 over the valve. Two conductors in the same cable carry opposite authority. **Do not count links; count directions.** **The bottom four rows are more dangerous than the top nine.** The upper rows are the normal operating path and mostly stop at A1/A2; the lower rows are inbound, and A3, A6 and A7 cluster there. Configuration change outlives a runtime command, and executable replacement persists beyond any interaction. Two of the four — local keypad and HART service tool — **require no authentication, only physical access.** ## 11\. Can the system affect the physical process **Required table 3 — Authority–effect matrix** | Interaction | Authority | Physical effect | Human gate | Security significance | | -------------------------------------- | ---------------------- | ---------------------------------- | ---------------- | ---------------------------------------------- | | Instrumentation -> panel display | out A1/A2 | **P1** — alters judgement | EXECUTION | A wrong value contaminates a person's decision | | Camera -> operator (§18) | out A1/A2 | **P1** | EXECUTION | A mandated gate that depends on a sensor | | Panel -> pump and valve logic | out A4/A3 | **P3** — indirect physical control | EXECUTION | Directs the sequence without holding the drive | | Panel -> operating state (mode change) | out A4 | **P2** | EXECUTION | Open/closed transition sits here | | Circulation pump (physical contact) | **out A0** / in A4, A5 | **P4** — direct physical control | EXECUTION | **A0 + P4 asymmetry** | | Transfer pump / ejector | **out A0** / in A4, A5 | **P4** | EXECUTION | Where the fish physically pass | | Exchange valve | **out A0** / in A4, A5 | **P4** | EXECUTION | One valve decides the mode | | Backflush controller -> own actuators | out **A5** | **P4** | SUPERVISION | Repeats autonomously with no human step | | Manual strainer | out A0 | **P0** | EXECUTION | Zero cyber-physical contact | | Well (structure) | A0 | **P0** | NONE | A marker that the risk lives elsewhere | | Vendor service -> panel | in A3/A6/A7 | **P3** (via the panel) | REVIEW / UNKNOWN | Authority that persists | ### P5 is not inherited — and the reason is the finding Cache doctrine offered two routes to P5, and neither survives. **On TYP-B02**, the cache confines the basis to IBC Code 15.19.6 (high-level alarm) and 15.19.7 (overflow control), which are **safety functions**, with 15.19.5 requiring that arrangement to be **independent of the gauging system** — so defeating it defeats a safety function. But the IBC Code applies to ships carrying dangerous chemicals in bulk, and **a wellboat's cargo is fish in seawater.** **On TYP-A04**, the basis was fuel-oil quick-closing and ESD valves as final elements of a safety function; the exchange valve of a live-fish well is not one. **The physical-effect ceiling here is P4** — which does not mean the risk is low. The opposite. Key distinction — physical effect is not severity, and A0 coexists with P4 Total loss of cargo is a very high severity, yet physical effect stops at 4, because the two are separate axes. Likewise the circulation pump's outbound authority is A0 — it interprets nothing — while its physical effect is P4\. **Authority sits upstream; physical contact sits here.** Fold that asymmetry into P0 and the whole train renders as "Physical Effect: P0," which does not match the equipment. **The real finding is the reason for that absence.** Live-fish transport regulation has **no clause requiring safety measurement independent of the water-quality chain** — §16 mandates that measurement happen, not that it be independent. On a chemical tanker, gauging can lie completely and an independent high-level switch still lives. On a wellboat, if the oxygen measurement lies, that is the end of it — the camera excepted. ## 12\. Where the human stands in the architecture What is unusual here is that the human gate is written into the regulation. **§18 — mandatory camera observation.** "When transportation by well-boat occurs, inspection of the fish shall also be performed using a camera." Verified for the clause subject; wording per the official English translation. The clause strengthens and weakens the gate at once: it makes a person look at the fish, but **the looking passes through a sensor.** A well is not a space a person can look into, so a mandated gate stands on top of the instrumentation train. **§18 also requires oxygen monitoring during crowding**, a gate of type **EXECUTION**. **In automatic loops the gate drops away** — automatic oxygen dosing and automatic backflush repeat against thresholds with no intervention, which is why cache doctrine assigns the backflush filter a **SUPERVISION** gate. **The §9 log** is an after-the-fact gate, but **the record can be correct while reality is wrong**: faithfully logged exchange and valve times conceal rather than reveal if the valve was actually elsewhere. **The §15 time clause** gives the argument a normative foothold: > "Should there be a power failure, technical failure or other error, the user, without unnecessary delay, shall ensure fish welfare by using alternative solutions until the fault has been rectified." Verified **Regulation is recognising time as a safety margin** — but only if **a person finds out in time.** A silent failure, proceeding while instrumentation displays normal values, voids the clause. The regulation assumes "if a fault occurs," not "if a fault occurs and nobody knows." ## 13\. Authority escalation and propagation Two paths take low authority in and produce high-authority effects downstream. **Path 1 — propagation through a person (dominant in open mode)** False O2 reading (A1/A2, P1) | Panel display reads "normal" | Operator judgement: no action required | Exchange valve left as is / no increase in O2 dosing <-- a legitimate human action | Actual dissolved oxygen keeps falling | Mortality begins (a P4 outcome, though no A5 authority was ever used) The sensor holds no CONTROL authority; the outcome is physical anyway, because **authority propagated through the person.** The defensive point is the integrity of the display, not the valve. **Path 2 — propagation through an automatic loop (dominant in closed mode)** Local keypad parameter change (A3, no authentication) | Backflush cycle threshold raised / duration shortened | Controller operates correctly per its own logic (A5, P4) | Filtration performance degrades -- no alarm | [on board] nothing happens | [along the route] untreated pathogens and parasites discharged | Weeks later, infection at another farm (attribution effectively impossible) On path 1 the person is inside the chain and is therefore both the defence and the vulnerability; on path 2 the person is outside it, and there is no defensive point at all. **The open-to-closed transition shortens the chain.** In open mode false instrumentation still meets a physical buffer, because the sea supplies oxygen regardless. In closed mode that buffer is gone. **The more biosecurity regulation lengthens closed operation, the shorter this chain becomes.** ![Comparison diagram of open and closed transport modes on a wellboat, showing that with the exchange valve open the sea provides oxygen and buffers instrumentation error, while with the valve shut the control system alone sets oxygen dosing and any measurement error reaches the water directly.](https://github.com/MaritimeCyber/General/blob/main/Asset/img/ei/live-fish-well-containment-circulation-loading-system/authority-modes-v2.jpg?raw=true) Figure 2\. The same equipment, two authority profiles. In open mode the sea holds life support and the control system observes; in closed mode the control system is life support and the propagation chain is short. ## 14\. Trust boundaries and dependencies +-- VENDOR PACKAGE BOUNDARY ---------------------------------+ | Fish-handling panel (L2) . Instrumentation (L1) | | Filtration control . Pump & valve control logic | | [ vendor holds configuration, firmware, service access ] | +------------------------------------------------------------+ | | | (approval / inspection) | (alarms, data - patterns B/C) v v +-- AUTHORITY APPROVAL ------+ +-- SHIPBOARD IAS ---------+ | §4/§6 unit approval | | Alarm & monitoring | | §15 new-equipment testing | | (pattern B/C only) | | §20 wash & disinfect | +--------------------------+ +----------------------------+ | | v | +-- SHORE REPORTING -------+ | | §9 log (5-year, legal) | | | §9a automatic position | | | registration | | +--------------------------+ v +-- FARM INTERFACE -----------------------------------------+ | Hoses connect ship to ANOTHER ORGANISATION'S equipment | | Every single voyage. Water crosses. Data may cross. | +-----------------------------------------------------------+ Four of the five boundaries exist in other cargo systems. The fifth is specific to this ship type. **The farm interface.** A wellboat **physically connects to another organisation's equipment on every voyage.** Tankers connect to terminals too, but terminals are few, standardised and governed by codified procedures; farms are numerous, differently owned and variably equipped. The regulation's animal-health chapter (**§§19–24**) treats this as a biological boundary, and **§20** — confirmed at clause-number level — mandates washing and disinfection between transports involving different sites. Verified One cyber question follows. **Does only water cross, or does data cross too?** Any exchange of stock numbers or biomass estimates is an interface reopened every voyage, with the counterparty's security posture outside the ship's control. Whether it exists could not be confirmed. ## 15\. What happens when the system fails Engineering failure comes before cyber failure. **Loss of circulation -> oxygen collapse -> mortality** Circulation pump stops (any cause: level, power, mechanical) | [ OPEN ] exchange with the sea is cut [ CLOSED ] the only O2 path is cut | | DO falls (rate = biomass x metabolic rate / volume, f. temperature) | Emergency O2 (where fitted) admitted | +--> sufficient: time is bought and §15's "alternative solutions" hold | +--> insufficient: below threshold -> mass mortality This chain is not hypothetical. At **Proximar Seafood** in Japan on the night of **28 May 2025** the whole chain ran. Filling an empty tank (preparation for transfer) | Automatic valve fails -> operation switched to MANUAL | (the automation failure pushes a person into the loop) Manual operation departs from procedure | Pump sump level < minimum setpoint -> circulation pump protective trip | DO in two tanks falls below threshold | Emergency oxygen operates -- but cannot deliver the required level | About 170,000 fish (roughly 550 t) lost . Financial impact about NOK 12 million Typical — trade press reporting, not an official investigation report. This was a **land-based RAS facility**, not a shipboard requirement. It is worth citing because the chain from loss of circulation to mass mortality is measured rather than assumed, because **emergency oxygen was present and still insufficient**, and because **the failure began as a failure of automation, and only after that failure pushed a person into manual mode did the fatal action become possible.** A human gate carries its heaviest load at the moment automation breaks. **Air ingress giving total gas supersaturation** is why §8 requires dry-mounted pumps, muffs and connections sealed. A seal defect becomes a water-quality defect, and §16 requires removal by active airing before transfer. If instrumentation watches oxygen alone, supersaturation is invisible — oxygen partial pressure can read normal while nitrogen is supersaturated. **pH rise on accumulated TAN gives ammonia toxicity**, which §17 requires operations to avoid. TAN is an equilibrium between ionised ammonium and the far more toxic un-ionised ammonia, strongly pH-dependent: **a rise of one pH unit increases NH3 concentration roughly tenfold.** **Total TAN can be unchanged and toxicity created by pH manipulation alone** — the reason §16 lists pH, and the mechanism behind scenario S2\. Verified **Scale of consequence.** In Chile the wellboat **Heimdall**, operated by **Detroit Chile**, sank; 13 crew were rescued and roughly **180 t, about 24,000 salmon** from the **Punta Ramón** site (Australis Seafoods) was lost. **The reported sequence was grounding followed by flooding, not a stability casualty** Typical, so it is not a free-surface example. What it shows is that **live cargo cannot be transferred out quickly** — for a tanker cargo transfer is a mitigation; for fish in a well there is no alternative container at sea, so cargo loss is total loss. **Searched for and not found:** official MAIB, NTSB or DMAIB reports on wellboat systems, and any cyber incident targeting live-fish carriage — which is why this article cites none. ## 16\. Attack surface and credible threat scenarios | Attack surface | What it is here | Pattern A / B / C | | ----------------------- | --------------------------------------------------------------------------- | ------------------------------------ | | Local (physical access) | In front of the panel, backflush controller keypad, field instrument wiring | A, B, C | | Removable media | Vendor service laptop, panel configuration update by USB | A, B, C | | Connected OT | Panel to IAS alarm integration, ballast and stability platform | B, C | | Ship-shore | §9 log reporting ashore, remote monitoring of the treatment package | B, C | | **Farm interface** | Physical connection to a different organisation's plant every voyage | A, B, C (specific to this ship type) | | Vendor | Commissioning, retrofit, remote support, ownership of package configuration | A, B, C | | Supply chain | The package vendor's panel and instrument supply route | A, B, C | ### S1 — Silent defeat of the filtration and disinfection train | Step | Content | | -------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Entry interaction | Local keypad on the automatic backflush controller (physical access in machinery space), or the remote monitoring gateway Inferred | | Initial authority | **A3 CONFIGURE** — on physical access alone, no authentication | | Mechanism | Raise the backflush differential-pressure threshold and shorten cleaning duration. The controller operates correctly per its own logic and no alarm condition is met | | Authority gained | None — no escalation needed. A3 alone suffices | | Affected interaction | Backflush controller -> own actuators (A5 / P4) | | Physical effect | **P4** — filtration performance materially degraded | | Consequence | No effect on the fish on board. **Untreated water discharged along the route**, spreading pathogens and parasites; expression weeks later at another farm, attribution effectively impossible | S1 is representative because **detection delay and deniability combine**; the only trace is a backflush log of unconfirmed retention. ### S2 — Manipulation of closed-mode life-support instrumentation | Step | Content | | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Entry interaction | HART/DTM service tool, or physical access to instrument wiring Inferred (communications method unconfirmed) | | Initial authority | **A3 CONFIGURE** — range, span and unit. It changes the **interpretation**, not the value | | Mechanism | Offset the dissolved-oxygen indication high, or the pH indication low. Instrumentation stays alive and alarms still function; only the baseline for threshold judgement has moved | | Authority gained | None. **It propagates through the person** (section 13, path 1) | | Affected interaction | Instrument -> panel display -> operator judgement -> oxygen dosing rate, exchange valve | | Physical effect | **P4** — reaches the water through the operator's legitimate action | | Consequence | Dissolved oxygen proceeds below threshold in a closed segment, or a pH-raising operation is approved while TAN has accumulated and ammonia turns toxic. **Either path can cost the entire cargo** | **Nothing normative stands behind S2.** What remains is the §18 camera — a gate that operates only once abnormal fish behaviour is visible, already late in the chain. ### S3 — Falsified transfer valve position, free surface and stability | Step | Content | | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Entry interaction | Valve position feedback I/O, or the panel display layer | | Initial authority | **Integrity loss on A2 PROVIDE\_INFORMATION** — the valve itself holds no authority | | Mechanism | Display a position other than the actual one. During a transfer or exchange sequence the operator misreads the lineup | | Authority gained | None. The operator exercises A4 legitimately | | Affected interaction | Transfer pump / ejector (A4/A5 inbound, P4) plus well level distribution | | Physical effect | **P4** — actual fluid movement diverges from plan | | Consequence | Well levels depart from plan and **the free-surface moment differs from the calculated one.** DNV putting stability inside the *Fish carrier (Live)* scope is the normative acknowledgement of that physics Verified. In pattern C the calculation inputs are contaminated along with the display | S1 and S2 are cargo and biosecurity events; **S3 is a ship casualty** — three kinds of outcome from one layer of one system. Generic lists such as phishing and ransomware do not appear here, because no cyber incident for this system has been published. ## 17\. Security architecture and standards Controls are derived from the threats first; standards are mapped afterwards. **From S1, silent defeat of filtration** - Configuration management and change recording for backflush parameters — E26 Rev.1 §4.1.1.1 and §4.1.1.3.2 require software inventories across the ship's life, and panel parameters are a software configuration. - Keypad lock levels and change of delivery defaults — E27 Rev.1 §4.1 Table 1 item 1 (IEC 62443-3-3 SR 1.1). - On-board retrievability and retention of the backflush cycle log — the only trace of silent degradation, and therefore a detection requirement. - Applying the E26 §6 CBS exclusion judgement row by row, so excluding the manual strainer does not sweep the automatic controller out with it. **From S2, instrument manipulation** - Control of instrument service access — E26 Rev.1 §4.2.4.3.4 requires a removable-media policy with malware scanning and signature verification; the HART service laptop falls here. - Explicit statement of the panel's authentication exemption. E26 Rev.1 §4.2.4.4.1 permits waiving identification and authentication for operator HMIs needing immediate access, subject to physical access control, but **requires those devices to be identified**. - Realism in the session-lock policy. E27 Rev.1 §4.1 Table 1 item 12 (SR 2.5) requires access blocked after inactivity, colliding with an operation where the panel cannot be left during transfer; in practice the timeout is lengthened and that compromise goes undocumented. - Deterministic output behaviour on abnormal conditions — E27 Rev.1 §4.1 Table 1 item 20 (SR 3.6). **What "safe state" means here is not self-evident:** in open water, opening the exchange valve is safe; alongside another farm, biosecurity requires shutting it. **The fail-safe direction is a function of position**, and that belongs in the design documentation. - Malicious code protection — E27 Rev.1 §4.1 Table 1 item 18 (SR 3.2). **From S3, falsified valve position** - Zone separation — E26 Rev.1 §4.2.1.1 on zone grouping with explicitly permitted traffic only, and §4.2.1.3 on keeping navigation and communication out of machinery and cargo zones. Pattern C engages this directly. - Physical access control — E26 Rev.1 §4.2.4.3.2; during cargo work, farm personnel are on board. - System category determination — E26 Rev.1 §1.3.1 refers categorisation to IACS UR E22, whose Rev.3 §3.3 gives 'control, monitoring and safety system for cargo containment system' and 'liquid cargo transfer control system' as Category II examples. Whether a live-fish well train corresponds is a class determination; this article notes the **structural similarity only.** **One question about scope itself.** E26 Rev.1 §1.3.2 a) defines in-scope OT as "those CBSs using data to control or monitor physical processes," and §1.3 a) lists 'Cargo handling system (limited to safety-related elements).' **Is the well oxygen alarm a "required safety system"?** Yes, because the cargo's life depends on it — or no, because this is cargo damage, not ship or life safety. The answer changes which E26 and E27 requirements attach to the whole train, and **this article raises it rather than settling it.** **Reading the Norwegian regulation as cyber controls** | Clause | Original requirement | Meaning as a cyber control | | ------ | -------------------------------------------------- | ----------------------------------------------------------------------------------- | | §4, §6 | Authority approval of the transport unit | The formal channel for configuration change — an approval gate on inbound authority | | §9 | Seven log items, five-year retention, disclosure | Integrity requirement on a statutory record; an asset needing tamper detection | | §9a | Automatic position registration | A statutory outbound flow that bypasses shipboard judgement | | §15 | Testing and documentation of new equipment | Does a software configuration change pass through this procedure? | | §15 | "Without unnecessary delay," alternative solutions | **A timeliness-of-detection requirement** — a silent failure voids the clause | | §16 | Systematic measurement of four parameters | Instrument integrity is the effectiveness of the requirement | | §18 | Mandatory camera observation | A mandated human gate standing on a sensor | | §20 | Washing and disinfection | Operation with the system isolated — an authority state unlike normal running | **And the one thing the rules do not require** No clause requires safety measurement **independent** of the water-quality chain, so vendor standard scope is unlikely to include it. Yet as S2 shows, if that chain is a single point of failure, manipulating it is the whole cargo. The owner-specification remedy is not elaborate: **two oxygen measurement chains in closed mode, on different measuring principles, different power supplies and different cable routes** already breaks the common mode. The cost is a handful of instruments. The rules have simply not yet translated "this cargo is alive" into a safety requirement. ## 18\. Open questions, takeaways and references ### Six questions to ask first on a real project 1. **Do class and flag treat the well oxygen alarm as a "required safety system" under E26 §1.3.2 a)?** That answer sets the scope for the entire train. 2. Which panel owns the oxygen system? §3 j) names it, yet it has no independent BOM row. 3. Is the fish-handling panel **identified** as authentication-exempt under E26 §4.2.4.4.1? 4. Is water-quality instrumentation bare 4-20 mA, or is HART/Modbus carried on top? 5. Where is the backflush cycle log retained, can it be read on board, and are the controller's delivery defaults changed? 6. Does **data** cross the farm interface, or only water? ### What this article does not assert - The actual control topology — Unknown, presented as patterns A, B and C; TYP-B02 instrumentation carries an Inferred grade with an empty cache register. - The scope of the DNV *Fish carrier (Live)* notation is Verified, but **no Pt/Ch/Sec was confirmed**; the clause number for a prohibition on mixing farms in one unit was not confirmed either, so attribution stops at §§19–24. - Biosecurity regulatory state and both incidents are Typical; the Chilean case was grounding then flooding, not a stability casualty, and the fleet figures are **2015 data**. ### Engineering takeaways FINAL CHAIN Live cargo consumes its own environment (why this system exists) | Contain -> Circulate -> Condition -> Treat -> Transfer -> Dewater | 6 typologies, 7 rows, 4 at Purdue L0, 3 CBS candidates | Exchange valve position decides the mode (open vs closed) | Open: the sea is life support, control authority is low Closed: the ship is life support, control authority is absolute | Pump A0 out + P4 . Filter panel A5 + P4 . Sensor A1/A2 + P1 | Camera is a MANDATED human gate standing on a sensor (Reg. §18) | No clause requires instrumentation independence (the finding) | Loss of control = start of a countdown, not loss of visibility | Clock length set by biomass, temperature, volume - not by the CBS 1. **The failure clock is not set by the control system.** Calculate the response time budget from biomass, temperature and volume; that number is the detection requirement. 2. **One valve position inverts the authority profile.** Model open and closed as separate operating states — and note that regulation is pushing operation toward closed. 3. **Do not inherit P5, and record why.** The ceiling stopped at P4 because the enabling clause set does not apply, not because the risk is low. 4. **That the rules do not require measurement independence is the most actionable finding here**, and duplicating to owner specification costs a handful of instruments. 5. **A silent failure here leaves no trace on board**, so detection belongs in the cycle log rather than the outcome — and **the farm interface is a trust boundary specific to this ship type.** ### Sources - Norway, *Regulation on transport of aquaculture animals* (FOR-2008-06-17-820) — §3 j), §4, §6, §8, §9, §9a, §12, §14, §15, §16, §17, §18, §20 and the animal-health chapter §§19–24 Verified - IACS, *UR E26 Rev.1* — §1.3, §1.3.1, §1.3.2, §2, §4.1.1.1, §4.1.1.3, §4.2.1.1, §4.2.1.3, §4.2.4.3.2, §4.2.4.3.4, §4.2.4.4.1, §6 - IACS, *UR E27 Rev.1* — §4.1 Table 1 items 1, 12, 18, 20 - IACS, *UR E22 Rev.3* — §3.3 (structural similarity reference, not a determination) - DNV, *Rules for Classification of Ships*, 2024-07 edition — **Fish carrier (Live)** notation; scope covering tank structural strength, stability and loading/unloading piping Verified (no clause number confirmed) - Norwegian Veterinary Institute, *Risk of disease transfer with wellboats in Norway* (Technical report 15/2015) Typical - Wikborg Rein, *Using well-boats in Norwegian aquaculture — a complicated legislative framework* Typical - Incident reporting: Proximar Seafood oxygen loss, 28 May 2025, land-based RAS; wellboat *Heimdall* (Detroit Chile) grounding and sinking, Chile Typical Article classification This is a **typology-based system analysis**, not vendor or vessel documentation. Evidence grades are INFERRED for TYP-B02 and TYPICAL for the other five, and no statement exceeds that ceiling. **Cache contamination excluded:** all six typologies inherit doctrine from liquid-bulk siblings, and IBC Code 15.19.x, MARPOL Annex I, SOLAS II-2 Reg.4.5.10 and custody-transfer vocabulary are cited nowhere — the one IBC Code reference in section 11 exists to explain why P5 is *not* inherited. **The seven-row component list is not vendor-confirmed**, architecture patterns A, B and C are conceptual models, and the Norwegian regulation is **domestic law**, not a universal requirement.