[System Study_007] The Cargo That Consumes Its Own Environment

In every cargo system this series has covered, the cargo was inert: crude oil stays crude oil when the control system stops. Failure there is loss of visibility.

A wellboat is different. The cargo is alive and consumes the environment that contains it. Oxygen falls, carbon dioxide and total ammonia nitrogen rise, and from the moment circulation stops the water deteriorates at a rate set by biomass, temperature and volume.

In this system, loss of control is not loss of visibility. It is the start of a countdown, and the control system does not set the length of the clock.

The analysis also meets a gap in the rulebook. Chemical tankers must fit an overfill safety arrangement independent of gauging; live-fish transport regulation has no equivalent, and that absence is the substantive finding here.

1. Why this system exists

The problem states simply: move live fish from A to B. Out of water they die in minutes; in water, the water itself deteriorates.

   Biomass (tens to hundreds of thousands of fish) contained in a finite volume
                 |
        +--------+--------+
        |                 |
   O2 consumption    CO2 + TAN production
        |                 |
   Dissolved O2 falls  pH shift / toxicity builds
        +--------+--------+
                 |
        Water quality leaves the safe envelope
                 |
        Stress -> injury -> mortality
                 |
   (in parallel) pathogen and parasite spread along the route

Two branches on different clocks. Survival of the fish on board is a welfare problem visible during the voyage; the well water travelling past other farms is a biosecurity problem that surfaces weeks later at someone else's site, and it is why the filtration and disinfection train exists.

Scale makes it industrial: a 2015 Norwegian Veterinary Institute report counted 63 wellboats moving roughly 350 million smolt and more than 1.4 million tonnes of harvested fish annually. Typical — 2015 figures, not current ones.

Where the requirements came from

The document specifying this system's functions clause by clause is not a class rule but national animal-health regulation: the Norwegian regulation on transport of aquaculture animals (FOR-2008-06-17-820). Verified

• §3 j) defines transportation equipment as the circulation, oxygen, filtration and vacuum-transfer systems plus valves, caps, hoses and pipes. The regulator wrote the bill of materials.
• §4, §6 — the transport unit requires Norwegian Food Safety Authority approval.
• §16 — beyond two hours, systematic measurement of oxygen, pH, salinity and temperature; §17 covers closed transport separately.
• §18 — for wellboat transport, inspection of the fish using a camera is mandatory. Verified for the clause subject; wording per the official English translation.
• §9a — automatic position registration: a second, statutory outbound data flow.
• §20 — washing and disinfection between transports involving different sites.

This is Norwegian domestic law, cited by attribution and never as a universal IMO-style requirement, though most of the world fleet and of the regulatory template originate there.

DNV's July 2024 rule edition created the ship type Fish carrier (Live), covering tank structural strength, stability, and the loading and unloading piping system. Verified — from DNV's rule-edition notice; no Pt/Ch/Sec could be confirmed, so no clause number is cited. A class society making stability a live-transport requirement formally acknowledges that the well water is simultaneously the cargo and a very large free surface.

Biosecurity duties have hardened: wellboats in Norwegian waters must disinfect all water taken into and discharged from the well, extended since 2021 to water discharged after carrying fish for slaughter. Typical Those duties push operation toward closed mode, and closed mode enlarges the authority held by the control system. Regulation is manufacturing cyber relevance.

2. What the system does

Six system-level functions.

1. Contain — a water-filled well. Loading and discharge use vacuum and pressure, so it is a pressure boundary, not a plain tank.
2. Circulate and exchange — pumps move the water; in open mode the well exchanges with the sea (§16).
3. Condition — oxygen injection, active airing against total gas supersaturation, temperature management (§16).
4. Treat — filtration and disinfection of inlet and outlet water, for biosecurity.
5. Transfer — vacuum and pressure move fish in and out; §18 constrains pump distance, height, pressure and drop.
6. Dewater and grade — separate water from fish on discharge and sort by size.

[ Farm net pen ] --crowding--> [ Vacuum / pressure transfer ] --> [ WELL ]
                                                                    |
                    +-----------------+-----------------+-----------+
                    |                 |                 |           |
             Circulation pump   O2 injection     Filtration/    Water exchange
                    |            + degassing     disinfection   valve (open mode)
                    |                 |                 |           |
                    +--------> [ Water quality state ] <------------+
                                      |
                              Instrumentation (O2, temp, salinity, pH/CO2, level)
                                      |
                              Camera (Reg. §18)  -> Operator judgement
                                      |
[ WELL ] --> [ Dewatering / grading ] --> [ Processing plant or receiving site ]

The regulator's list and the typology composition line up closely.

The last two rows matter. Regulation does not enumerate measurement and control as equipment; it requires them as functions. §16 says measure systematically without saying what the measuring system consists of, so its shape is left entirely to the vendor package — the supply-boundary problem of section 7.

3. Core functions and operating modes

The axis of this system is the open / closed dichotomy, which the regulation itself states: §12 covers water quality "both in open and closed systems," and §16 and §17 address the two separately.

Open mode. The exchange valve is open and what supplies oxygen and dilutes metabolites is, in effect, the ocean. The control system need only confirm sufficient flow — which is why §16 stops at requiring adjustable valves.

Closed mode. The valve shuts and the vessel becomes the only life-support device: oxygen injected, CO2 stripped, TAN accumulating. §17 applies here alone, requiring exchange planned in advance, recirculation treatment, and no operations that raise pH sharply while TAN has accumulated. Intermittent closure — valves shut near farms and ports, open elsewhere — is the real pattern, and biosecurity regulation is lengthening the closed segments.

The last column is the second argument of this article. The position of one valve inverts the authority profile. Same ship, same instruments, same panel: with the exchange valve open the control system is an observer; with it shut, a life-support machine.

The two-hour threshold. §16 switches the measurement obligations on when transport exceeds two hours — regulation gating instrumentation duty on elapsed time, which is itself an admission that risk here is a function of time. Verified

4. How the system works

The output of this system is "water quality," and water quality is not the output of any device. It is a balance of supply, consumption, dilution and removal.

   [ O2 supply ]                        [ O2 consumption ]
   exchange (open) + injection (closed)  vs  biomass x metabolic rate (f. temperature)
        |                                        |
        +---------------> Dissolved O2 <---------+
                             |
   [ CO2/TAN removal ]                  [ CO2/TAN production ]
   exchange + degassing + treatment      vs  biomass x metabolic rate
        |                                        |
        +---------------> pH / TAN <-------------+
                             |
                     [ Water quality state ]
                             |
        instrument -> display -> human -> actuation -> water

The left side is what the control system holds; the right side is not, because biomass is fixed at loading and temperature by the sea. All the control system can do is match the left to the right, and when the left stops the right keeps running. That is the physical substance of the countdown. §8 adds one condition: dry-mounted pumps, muffs and connections must be sealed against drawing air, because ingress produces total gas supersaturation and gas-bubble disease, which §16 requires removed by active airing before transfer. Verified A mechanical defect in a pump is here directly a water-quality defect.

5. What the system is made of

Required table 1 — Typology composition

TYP-C02 interprets nothing — outbound authority A0 — yet the physical contact is here. TYP-A04 holds the exchange valve that decides the mode, with neither logic nor setpoint in the valve body. TYP-A08 matters most, because the typology is SPLIT: a manual strainer is A0/P0, an automatic backflush controller is A5 and P4. TYP-B02 carries an INFERRED ceiling, and TYP-B08 is the only supervisory layer — where operator judgement is formed.

   7 rows  =  4 passive (L0, non-CBS)  +  3 CBS candidates
              |                            |
   Well / valves & piping / 2 pumps    Dewatering-grading controller (listed)
   Structure and motive power          Instrumentation (within parent CBS)
   No authority                        Fish-handling panel (listed)
              |                            |
   Physical contact is here            Judgement and authority are here

6. Typology profiles — component count is not a measure of cyber relevance

Four of seven component rows are passive structure and motive power at Purdue L0. The well, the valves and piping, and both pumps are not programmable electronic devices, so they fall outside the CBS definition in IACS UR E26 Rev.1 §2. By mass that is 99 per cent of the system; in a cyber inventory, zero. The instrumentation row, the panel row and the dewatering-grading controller are the CBS candidates. Physical bulk and cyber relevance run close to inversely here.

Why the TYP-A08 split matters especially in this system

A manual strainer is a passive pressure part with no command and no signal (A0 / P0). An automatic backflush controller starts, sustains and ends a cleaning cycle on its own from a differential-pressure threshold or a timer: genuine closed-loop CONTROL (A5) over its own actuators, and P4 because the output turns a backflush motor and opens flushing valves. A local keypad can change duration, threshold and delay times — inbound A3. Because the controller actually fitted to a wellboat is unconfirmed, only the structural fact is inherited.

Cache doctrine calls this family's characteristic failure silent degradation: adjust the cleaning parameters and filtration is defeated with no alarm. In fuel filtration that eventually surfaces as an engine load limit. On a wellboat it does not surface at all — the train protects biosecurity outside the hull, not the fish on board.

The evidence ceiling on TYP-B02

Instrumentation carries an INFERRED grade — empty cache register, doctrine inherited from siblings — so nothing said here about that train is confirmed fact, and every statement resting on communications behaviour inherits the same ceiling. Whether the link is bare 4-20 mA or carries HART or Modbus varies by project, and that changes inbound authority entirely: with a HART-family interface, a service laptop can change range, span and unit (A3), never touching the measured value, only its interpretation — which here is the oxygen verdict.

7. Where the supply boundary falls

Typical supply is a maker package: pumps, piping, valves, instrumentation and panel in one vendor scope. Integrator and owner see an interface list rather than a system, and the configuration inside stays with the vendor.

Here the ship-type-specific trust boundary appears. On a wellboat, the formal channel for inbound authority is not a firewall — it is regulatory approval.

• §4, §6 — NFSA approval of the transport unit, covering construction (§8), means of transport (§15), and the practicability of procedures for washing and disinfection, dead-fish handling, water exchange, monitoring, sampling and log keeping. Verified
• §15 — new methods and equipment tested and documented before use. Verified
• §20 — washing and disinfection on reuse, and the conditions for exemption. Verified

Read through a cyber lens, those clauses answer one question: who legitimately touches this system, and when. Each access is inbound authority with a direction and a grade, not undifferentiated "remote access."

• Vendor commissioning and retrofit engineer, toward the panel — A3 CONFIGURE, A6 ADMINISTER, A7 UPDATE_EXECUTABLE
• Instrument service access (HART/DTM) — A3, and depending on model A7 Inferred
• Local keypad on the backflush controller — A3, on physical access alone
• Authority inspection and approval — the procedural channel that legitimises change

One trap: a control cubicle absorbed into a parent package can fail to appear as an independent component row at all. The panel was captured as "Y — separately listed", but the oxygen system, which §3 j) names explicitly, has no independent row, and which panel owns oxygen dosing is unconfirmed.

Modern wellboats also run thermal delousing through the same well and circulation loop. That plant is outside this system's BOM, but when one physical asset belongs to two systems the CBS boundary and the zone assignment diverge, and how that was resolved under E26 §6 and §4.2.1.1 needs to be written down.

8. Architecture patterns A / B / C

The actual control topology of a wellboat is UNKNOWN to this investigation, so three conceptual patterns are set against each other rather than one asserted.

Pattern A — Standalone. Own cubicle, hardwired instrumentation, IAS integration of a few alarm contacts or none.

Pattern B — Online. The panel integrates with the IAS and data leaves for shore, motivated by the §9 log — species and quantity, mortality and cause, route and farms visited, exchange and valve operations, oxygen consumption, water-quality parameters, cleaning records — retained five years and disclosed to shipper, consignee and authority.

Pattern C — Control-integrated. The well volume is variable ballast, so well level and transfer control integrate with the stability platform; DNV placing stability inside the Fish carrier (Live) scope (Verified) is the pressure behind that.

9. What information and commands flow through it

Separating the two is where authority analysis starts.

Information — measurement, status, record

• Dissolved oxygen, temperature, salinity, and pH or CO2 — the four §16 makes mandatory beyond two hours
• Well level, circulation flow, transfer pressure, valve position, pump run and trip status
• Camera imagery — the observation means §18 makes mandatory for wellboats
• The seven §9 log items — statutory record, five-year retention, disclosed to shipper, consignee and authority
• Vessel position — §9a requires automatic reporting, and unlike the rest it leaves without passing through shipboard judgement.

Commands — instructions that change state

• Circulation pump, transfer pump and ejector start/stop and transfer rate
• Exchange valve open/close — the mode transition itself
• Oxygen dosing rate, initiation of active airing
• Backflush initiation, or automatic cycle parameter change
• Dewatering and grading unit operation

   ---- INFORMATION (upward) --------------------------------------
   O2 / temp / salinity / pH-CO2  --+
   Well level / flow / pressure   --+--> Fish-handling panel (L2) --+
   Valve position / pump status   --+          |                    |
   Camera image (Reg. §18) ------------------> |                    +--> §9 log
                                               |                         (5-yr statutory)
   Vessel position (Reg. §9a) --- automatic ------------------------> Authority
                                               v                      (no operator gate)
                                        Operator judgement
                                               |
   ---- COMMAND (downward) -----------------------------------------
                                               v
   Pump start/stop . Exchange valve open/close . O2 dose rate .
   Backflush start . Transfer rate . Dewatering unit run
                                               |
                                               v
                                        [ Water in the well ]

One clarification. Cache doctrine attaches a custody-transfer apparatus to liquid cargo — metering, bill-of-lading quantity, ship-shore difference, surveyors. This system has no counterpart, and the vocabulary is not transplanted. The structurally similar item is the §9 log, and one property carries over: it is a statutory record, so a motive to distort it exists without any physical incident at all.

10. What authority each connection carries

Required table 2 — Authority matrix (YES / NO / UNKNOWN / COND = conditional)

The bottom four rows are more dangerous than the top nine. The upper rows are the normal operating path and mostly stop at A1/A2; the lower rows are inbound, and A3, A6 and A7 cluster there. Configuration change outlives a runtime command, and executable replacement persists beyond any interaction. Two of the four — local keypad and HART service tool — require no authentication, only physical access.

11. Can the system affect the physical process

Required table 3 — Authority–effect matrix

P5 is not inherited — and the reason is the finding

Cache doctrine offered two routes to P5, and neither survives. On TYP-B02, the cache confines the basis to IBC Code 15.19.6 (high-level alarm) and 15.19.7 (overflow control), which are safety functions, with 15.19.5 requiring that arrangement to be independent of the gauging system — so defeating it defeats a safety function. But the IBC Code applies to ships carrying dangerous chemicals in bulk, and a wellboat's cargo is fish in seawater. On TYP-A04, the basis was fuel-oil quick-closing and ESD valves as final elements of a safety function; the exchange valve of a live-fish well is not one.

The physical-effect ceiling here is P4 — which does not mean the risk is low. The opposite.

The real finding is the reason for that absence. Live-fish transport regulation has no clause requiring safety measurement independent of the water-quality chain — §16 mandates that measurement happen, not that it be independent. On a chemical tanker, gauging can lie completely and an independent high-level switch still lives. On a wellboat, if the oxygen measurement lies, that is the end of it — the camera excepted.

12. Where the human stands in the architecture

What is unusual here is that the human gate is written into the regulation.

§18 — mandatory camera observation. "When transportation by well-boat occurs, inspection of the fish shall also be performed using a camera." Verified for the clause subject; wording per the official English translation. The clause strengthens and weakens the gate at once: it makes a person look at the fish, but the looking passes through a sensor. A well is not a space a person can look into, so a mandated gate stands on top of the instrumentation train.

§18 also requires oxygen monitoring during crowding, a gate of type EXECUTION. In automatic loops the gate drops away — automatic oxygen dosing and automatic backflush repeat against thresholds with no intervention, which is why cache doctrine assigns the backflush filter a SUPERVISION gate. The §9 log is an after-the-fact gate, but the record can be correct while reality is wrong: faithfully logged exchange and valve times conceal rather than reveal if the valve was actually elsewhere.

The §15 time clause gives the argument a normative foothold:

"Should there be a power failure, technical failure or other error, the user, without unnecessary delay, shall ensure fish welfare by using alternative solutions until the fault has been rectified." Verified

Regulation is recognising time as a safety margin — but only if a person finds out in time. A silent failure, proceeding while instrumentation displays normal values, voids the clause. The regulation assumes "if a fault occurs," not "if a fault occurs and nobody knows."

13. Authority escalation and propagation

Two paths take low authority in and produce high-authority effects downstream.

Path 1 — propagation through a person (dominant in open mode)

   False O2 reading (A1/A2, P1)
        |
   Panel display reads "normal"
        |
   Operator judgement: no action required
        |
   Exchange valve left as is / no increase in O2 dosing   <-- a legitimate human action
        |
   Actual dissolved oxygen keeps falling
        |
   Mortality begins (a P4 outcome, though no A5 authority was ever used)

The sensor holds no CONTROL authority; the outcome is physical anyway, because authority propagated through the person. The defensive point is the integrity of the display, not the valve.

Path 2 — propagation through an automatic loop (dominant in closed mode)

   Local keypad parameter change (A3, no authentication)
        |
   Backflush cycle threshold raised / duration shortened
        |
   Controller operates correctly per its own logic (A5, P4)
        |
   Filtration performance degrades -- no alarm
        |
   [on board] nothing happens
        |
   [along the route] untreated pathogens and parasites discharged
        |
   Weeks later, infection at another farm (attribution effectively impossible)

On path 1 the person is inside the chain and is therefore both the defence and the vulnerability; on path 2 the person is outside it, and there is no defensive point at all.

The open-to-closed transition shortens the chain. In open mode false instrumentation still meets a physical buffer, because the sea supplies oxygen regardless. In closed mode that buffer is gone. The more biosecurity regulation lengthens closed operation, the shorter this chain becomes.

14. Trust boundaries and dependencies

   +-- VENDOR PACKAGE BOUNDARY ---------------------------------+
   |  Fish-handling panel (L2) . Instrumentation (L1)           |
   |  Filtration control . Pump & valve control logic           |
   |  [ vendor holds configuration, firmware, service access ]  |
   +------------------------------------------------------------+
        |                                    |
        | (approval / inspection)            | (alarms, data - patterns B/C)
        v                                    v
   +-- AUTHORITY APPROVAL ------+     +-- SHIPBOARD IAS ---------+
   |  §4/§6 unit approval       |     |  Alarm & monitoring      |
   |  §15 new-equipment testing |     |  (pattern B/C only)      |
   |  §20 wash & disinfect      |     +--------------------------+
   +----------------------------+                |
        |                                        v
        |                              +-- SHORE REPORTING -------+
        |                              |  §9 log (5-year, legal)  |
        |                              |  §9a automatic position  |
        |                              |      registration        |
        |                              +--------------------------+
        v
   +-- FARM INTERFACE -----------------------------------------+
   |  Hoses connect ship to ANOTHER ORGANISATION'S equipment   |
   |  Every single voyage. Water crosses. Data may cross.      |
   +-----------------------------------------------------------+

Four of the five boundaries exist in other cargo systems. The fifth is specific to this ship type.

The farm interface. A wellboat physically connects to another organisation's equipment on every voyage. Tankers connect to terminals too, but terminals are few, standardised and governed by codified procedures; farms are numerous, differently owned and variably equipped. The regulation's animal-health chapter (§§19–24) treats this as a biological boundary, and §20 — confirmed at clause-number level — mandates washing and disinfection between transports involving different sites. Verified

One cyber question follows. Does only water cross, or does data cross too? Any exchange of stock numbers or biomass estimates is an interface reopened every voyage, with the counterparty's security posture outside the ship's control. Whether it exists could not be confirmed.

15. What happens when the system fails

Engineering failure comes before cyber failure.

Loss of circulation -> oxygen collapse -> mortality

   Circulation pump stops (any cause: level, power, mechanical)
        |
   [ OPEN ] exchange with the sea is cut   [ CLOSED ] the only O2 path is cut
        |                                     |
   DO falls (rate = biomass x metabolic rate / volume, f. temperature)
        |
   Emergency O2 (where fitted) admitted
        |
   +--> sufficient: time is bought and §15's "alternative solutions" hold
   |
   +--> insufficient: below threshold -> mass mortality

This chain is not hypothetical. At Proximar Seafood in Japan on the night of 28 May 2025 the whole chain ran.

   Filling an empty tank (preparation for transfer)
        |
   Automatic valve fails  ->  operation switched to MANUAL
        |                     (the automation failure pushes a person into the loop)
   Manual operation departs from procedure
        |
   Pump sump level < minimum setpoint  ->  circulation pump protective trip
        |
   DO in two tanks falls below threshold
        |
   Emergency oxygen operates -- but cannot deliver the required level
        |
   About 170,000 fish (roughly 550 t) lost . Financial impact about NOK 12 million

Typical — trade press reporting, not an official investigation report.

This was a land-based RAS facility, not a shipboard requirement. It is worth citing because the chain from loss of circulation to mass mortality is measured rather than assumed, because emergency oxygen was present and still insufficient, and because the failure began as a failure of automation, and only after that failure pushed a person into manual mode did the fatal action become possible. A human gate carries its heaviest load at the moment automation breaks.

Air ingress giving total gas supersaturation is why §8 requires dry-mounted pumps, muffs and connections sealed. A seal defect becomes a water-quality defect, and §16 requires removal by active airing before transfer. If instrumentation watches oxygen alone, supersaturation is invisible — oxygen partial pressure can read normal while nitrogen is supersaturated.

pH rise on accumulated TAN gives ammonia toxicity, which §17 requires operations to avoid. TAN is an equilibrium between ionised ammonium and the far more toxic un-ionised ammonia, strongly pH-dependent: a rise of one pH unit increases NH3 concentration roughly tenfold. Total TAN can be unchanged and toxicity created by pH manipulation alone — the reason §16 lists pH, and the mechanism behind scenario S2. Verified

Scale of consequence. In Chile the wellboat Heimdall, operated by Detroit Chile, sank; 13 crew were rescued and roughly 180 t, about 24,000 salmon from the Punta Ramón site (Australis Seafoods) was lost. The reported sequence was grounding followed by flooding, not a stability casualty Typical, so it is not a free-surface example. What it shows is that live cargo cannot be transferred out quickly — for a tanker cargo transfer is a mitigation; for fish in a well there is no alternative container at sea, so cargo loss is total loss.

Searched for and not found: official MAIB, NTSB or DMAIB reports on wellboat systems, and any cyber incident targeting live-fish carriage — which is why this article cites none.

16. Attack surface and credible threat scenarios

S1 — Silent defeat of the filtration and disinfection train

S1 is representative because detection delay and deniability combine; the only trace is a backflush log of unconfirmed retention.

S2 — Manipulation of closed-mode life-support instrumentation

Nothing normative stands behind S2. What remains is the §18 camera — a gate that operates only once abnormal fish behaviour is visible, already late in the chain.

S3 — Falsified transfer valve position, free surface and stability

S1 and S2 are cargo and biosecurity events; S3 is a ship casualty — three kinds of outcome from one layer of one system. Generic lists such as phishing and ransomware do not appear here, because no cyber incident for this system has been published.

17. Security architecture and standards

Controls are derived from the threats first; standards are mapped afterwards.

From S1, silent defeat of filtration

• Configuration management and change recording for backflush parameters — E26 Rev.1 §4.1.1.1 and §4.1.1.3.2 require software inventories across the ship's life, and panel parameters are a software configuration.
• Keypad lock levels and change of delivery defaults — E27 Rev.1 §4.1 Table 1 item 1 (IEC 62443-3-3 SR 1.1).
• On-board retrievability and retention of the backflush cycle log — the only trace of silent degradation, and therefore a detection requirement.
• Applying the E26 §6 CBS exclusion judgement row by row, so excluding the manual strainer does not sweep the automatic controller out with it.

From S2, instrument manipulation

• Control of instrument service access — E26 Rev.1 §4.2.4.3.4 requires a removable-media policy with malware scanning and signature verification; the HART service laptop falls here.
• Explicit statement of the panel's authentication exemption. E26 Rev.1 §4.2.4.4.1 permits waiving identification and authentication for operator HMIs needing immediate access, subject to physical access control, but requires those devices to be identified.
• Realism in the session-lock policy. E27 Rev.1 §4.1 Table 1 item 12 (SR 2.5) requires access blocked after inactivity, colliding with an operation where the panel cannot be left during transfer; in practice the timeout is lengthened and that compromise goes undocumented.
• Deterministic output behaviour on abnormal conditions — E27 Rev.1 §4.1 Table 1 item 20 (SR 3.6). What "safe state" means here is not self-evident: in open water, opening the exchange valve is safe; alongside another farm, biosecurity requires shutting it. The fail-safe direction is a function of position, and that belongs in the design documentation.
• Malicious code protection — E27 Rev.1 §4.1 Table 1 item 18 (SR 3.2).

From S3, falsified valve position

• Zone separation — E26 Rev.1 §4.2.1.1 on zone grouping with explicitly permitted traffic only, and §4.2.1.3 on keeping navigation and communication out of machinery and cargo zones. Pattern C engages this directly.
• Physical access control — E26 Rev.1 §4.2.4.3.2; during cargo work, farm personnel are on board.
• System category determination — E26 Rev.1 §1.3.1 refers categorisation to IACS UR E22, whose Rev.3 §3.3 gives 'control, monitoring and safety system for cargo containment system' and 'liquid cargo transfer control system' as Category II examples. Whether a live-fish well train corresponds is a class determination; this article notes the structural similarity only.

One question about scope itself. E26 Rev.1 §1.3.2 a) defines in-scope OT as "those CBSs using data to control or monitor physical processes," and §1.3 a) lists 'Cargo handling system (limited to safety-related elements).' Is the well oxygen alarm a "required safety system"? Yes, because the cargo's life depends on it — or no, because this is cargo damage, not ship or life safety. The answer changes which E26 and E27 requirements attach to the whole train, and this article raises it rather than settling it.

Reading the Norwegian regulation as cyber controls

And the one thing the rules do not require

No clause requires safety measurement independent of the water-quality chain, so vendor standard scope is unlikely to include it. Yet as S2 shows, if that chain is a single point of failure, manipulating it is the whole cargo. The owner-specification remedy is not elaborate: two oxygen measurement chains in closed mode, on different measuring principles, different power supplies and different cable routes already breaks the common mode. The cost is a handful of instruments. The rules have simply not yet translated "this cargo is alive" into a safety requirement.

18. Open questions, takeaways and references

Six questions to ask first on a real project

1. Do class and flag treat the well oxygen alarm as a "required safety system" under E26 §1.3.2 a)? That answer sets the scope for the entire train.
2. Which panel owns the oxygen system? §3 j) names it, yet it has no independent BOM row.
3. Is the fish-handling panel identified as authentication-exempt under E26 §4.2.4.4.1?
4. Is water-quality instrumentation bare 4-20 mA, or is HART/Modbus carried on top?
5. Where is the backflush cycle log retained, can it be read on board, and are the controller's delivery defaults changed?
6. Does data cross the farm interface, or only water?

What this article does not assert

• The actual control topology — Unknown, presented as patterns A, B and C; TYP-B02 instrumentation carries an Inferred grade with an empty cache register.
• The scope of the DNV Fish carrier (Live) notation is Verified, but no Pt/Ch/Sec was confirmed; the clause number for a prohibition on mixing farms in one unit was not confirmed either, so attribution stops at §§19–24.
• Biosecurity regulatory state and both incidents are Typical; the Chilean case was grounding then flooding, not a stability casualty, and the fleet figures are 2015 data.

Engineering takeaways

   FINAL CHAIN

   Live cargo consumes its own environment        (why this system exists)
        |
   Contain -> Circulate -> Condition -> Treat -> Transfer -> Dewater
        |
   6 typologies, 7 rows, 4 at Purdue L0, 3 CBS candidates
        |
   Exchange valve position decides the mode       (open vs closed)
        |
   Open: the sea is life support, control authority is low
   Closed: the ship is life support, control authority is absolute
        |
   Pump A0 out + P4 . Filter panel A5 + P4 . Sensor A1/A2 + P1
        |
   Camera is a MANDATED human gate standing on a sensor   (Reg. §18)
        |
   No clause requires instrumentation independence        (the finding)
        |
   Loss of control = start of a countdown, not loss of visibility
        |
   Clock length set by biomass, temperature, volume - not by the CBS

1. The failure clock is not set by the control system. Calculate the response time budget from biomass, temperature and volume; that number is the detection requirement.
2. One valve position inverts the authority profile. Model open and closed as separate operating states — and note that regulation is pushing operation toward closed.
3. Do not inherit P5, and record why. The ceiling stopped at P4 because the enabling clause set does not apply, not because the risk is low.
4. That the rules do not require measurement independence is the most actionable finding here, and duplicating to owner specification costs a handful of instruments.
5. A silent failure here leaves no trace on board, so detection belongs in the cycle log rather than the outcome — and the farm interface is a trust boundary specific to this ship type.

Sources

• Norway, Regulation on transport of aquaculture animals (FOR-2008-06-17-820) — §3 j), §4, §6, §8, §9, §9a, §12, §14, §15, §16, §17, §18, §20 and the animal-health chapter §§19–24 Verified
• IACS, UR E26 Rev.1 — §1.3, §1.3.1, §1.3.2, §2, §4.1.1.1, §4.1.1.3, §4.2.1.1, §4.2.1.3, §4.2.4.3.2, §4.2.4.3.4, §4.2.4.4.1, §6
• IACS, UR E27 Rev.1 — §4.1 Table 1 items 1, 12, 18, 20
• IACS, UR E22 Rev.3 — §3.3 (structural similarity reference, not a determination)
• DNV, Rules for Classification of Ships, 2024-07 edition — Fish carrier (Live) notation; scope covering tank structural strength, stability and loading/unloading piping Verified (no clause number confirmed)
• Norwegian Veterinary Institute, Risk of disease transfer with wellboats in Norway (Technical report 15/2015) Typical
• Wikborg Rein, Using well-boats in Norwegian aquaculture — a complicated legislative framework Typical
• Incident reporting: Proximar Seafood oxygen loss, 28 May 2025, land-based RAS; wellboat Heimdall (Detroit Chile) grounding and sinking, Chile Typical