Beyond Purdue

Beyond Purdue  /  The levels of authority

Six levels of authority

A level is not a network segment. A level is a grant of authority, and every level states who is allowed to vote on what.

The principle of inverse authority. The simpler and more predictable a level, the more authority it holds. A relay and a copper wire hold absolute authority. A model with billions of parameters holds the least. Authority is earned by predictability, not by intelligence.

LevelAuthorityAllowed toNever allowed to
L0Protection and isolationAbsoluteTrip. Veto over every level. Hold the lock.Be overridden, or depend on any other level.
L1ControllerActsActuators, within its logic and protection limits. Shouts every command it executes.Act outside protection limits.
L2ChannelsGatekeeperWhat crosses, and in which direction. Every level speaks only through L2. Data diodes, passive by preference.Originate a command. Mix data and commands.
L3Data nodesHolds and servesNothing. It processes, stores and presents data on demand, and holds every command given and executed.Grant access. Act on the plant. Pass a command.
L4OperatorDecidesCommands to controllers, each one shouted to L3 as given. Override and stop of any advice.Disable protection.
L5AIVoice, no voteNothing. It analyzes, interprets and supports the operator.Touch an actuator.

Only L0 and L1 touch the process. L4 is the operator. L5 is the AI. AI has a voice, not a vote.

The standards behind each level

  • L0: IEC 61508, IEC 61511, ISO 13849, IEC 60255, API 670, ISO 14118
  • L1: IEC 61131-3
  • L2: Data diodes, passive by preference. IEC 62443-3-3
  • L3: DNS and DNSSEC, OPC UA, MQTT or other open standards
  • L4: EU AI Act Article 14

Statements of authority

Users carry their level. Every user, device and application holds a level of authority, and a credential grants only what that level is allowed to do. Authority is checked where the action happens: the controller checks the stamp on every command, not only the login screen.

Roles follow the levels. Viewer: reads data nodes. Engineer: changes L1 logic offline, every version recorded. Operator: issues L4 commands. Permit issuer: releases equipment for work and returns it to service, an L4 role; the lock stays with the person at work. AI service: reads only, L5. Nobody receives protection authority through the system; protection settings are changed only at the protection equipment, under its own procedure.

The levels follow The Laws of Authority. L2 is described on Channels, L3 on L3 Data nodes.

Sources

  1. EU AI Act, Article 14, Human oversight. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-14
  2. IEC 62443-3-3, System security requirements and security levels. https://webstore.iec.ch/en/publication/7033