---

name: cyber-physical description: | Cyber-physical / industrial control system (ICS-SCADA) architecture in general: the Purdue model levels, control loops, IT/OT convergence, OT security (IEC 62443, segmentation, zero-trust for OT), safety, determinism, and redundancy. Architect-level, beyond any specific DCS/PLC product.

USE WHEN: designing/evaluating industrial control, SCADA, robotics, energy, automotive, or IoT-at-scale systems, "OT security", "Purdue model", "PLC/RTU/ SCADA architecture", "IT/OT convergence", "IEC 62443", "control loop", safety instrumented systems.

DO NOT USE FOR: specific DCS platforms / IEC 61131 / ISA formats (use the industrial/* skills); pure RTOS scheduling (use embedded-rtos); app security (use security-architecture). allowed-tools: Read, Grep, Glob

Cyber-Physical / ICS-SCADA Architecture (general)

Generalizes the product-specific industrial/* skills (DCS, IEC 61131, ISA) into engine-agnostic control-system design. A cyber-physical system couples computation with physical processes through sensors and actuators in closed control loops, where a software fault can have physical consequences.

The Purdue reference model (segment by level)

L5/4  Enterprise / MES / ERP         (IT)
------------------- IT/OT boundary (DMZ) -------------------
L3    Operations / historians / engineering workstations
L2    SCADA / HMI / supervisory control
L1    Controllers: PLC / RTU / DCS
L0    Field devices: sensors, actuators, drives  (physical process)

Architecture is organized by these levels; the IT/OT boundary is the critical trust boundary to design and defend.

Defining constraints

• Determinism & real-time: control loops have hard cycle times and deadlines (see embedded-rtos); jitter degrades control.
• Safety: safety-instrumented systems (SIS) are separated from control; fail-safe/fail-operational design, redundancy (TMR), and standards like IEC 61508 / 61511.
• Availability over confidentiality: unlike IT, OT prioritizes uptime and safety — you cannot just patch/reboot a running plant.

OT security (IT/OT convergence)

• The air gap is largely a myth now — connectivity for analytics/remote ops is pervasive. Design for it.
• IEC 62443 is the reference standard. Apply zone-and-conduit segmentation, an IT/OT DMZ, least-privilege, and increasingly zero-trust for OT (authenticate every cross-zone flow). Pairs with security-architecture.
• Legacy devices have weak/no auth → compensate with network segmentation, monitoring, and protocol-aware firewalls rather than assuming endpoint security.

Guidance

Treat the IT/OT boundary as the primary trust boundary; segment by Purdue level; keep safety functions independent and redundant; design for determinism and availability first; and assume connectivity — secure it (IEC 62443) rather than relying on isolation.