💡 SYS-035 Dry Bulk Handling 4 typologies / 5 components Band A

Hold Washing: When Clean Is Defined by Contract

The completion criterion for this system is written in a charterparty, not a regulation — and that single fact reorganises its authority structure, its human gates, and the list of things worth attacking.

Julius Shin

Maritime Technical Consultant · Shipboard Cybersecurity & Compliance
- LinkedIn : linkedin.com/in/abysstoinfinity

Engineering Intelligence · System Anatomy

A bulk carrier loads coal on one voyage and grain on the next, and between them sits whatever the first cargo left on the hold surfaces. The system that removes it is unusual in one respect that reorganises everything else about it: no regulation asked for the washing. What counts as finished is settled by a charterparty and judged by a surveyor's eye at the load port.

That single fact moves the acceptance criterion outside the ship, removes any instrument that could cross-check it, and turns the system's most valuable asset into evidence rather than a setpoint. This article works the system through the full chain — function, typology, interaction, authority, physical effect, human gate, failure, threat, control — and shows where the commercial nature of the criterion becomes, directly, a detection gap.

Most shipboard systems work toward a regulatory threshold. The hold washing system does not. What counts as "clean enough" is settled by the next cargo and the charterparty, and judged by a surveyor's eye rather than an instrument — which reorganises this system's authority structure, its human gates, and the list of things worth attacking.

---

Part I — Engineering

1. Why this system exists

Residues can contaminate the next cargo (coal dust in grain), react with it (residual fertiliser meeting moisture), or downgrade it (iron ore dust staining a white mineral sand). That is the whole reason this system exists — not pollution prevention, but cargo compatibility.

Previous cargo (coal, iron ore, fertiliser, cement) | Residue on hold surfaces -- dust, adhered deposits, hygroscopic salts, oil | Next cargo contacts that surface | +----------------+----------------+---------------------+ | Contamination | Reaction | Downgrade | | (coal in grain)| (fertiliser + | (staining of a | | | moisture) | white cargo) | +----------------+----------------+---------------------+ | Surveyor's judgement at the load port -- pass or fail | Fail -> re-wash, berth delay, off-hire, demurrage, cargo claim

Here is the first peculiarity. No regulation asked for the washing. No IMO instrument says a hold shall be grain clean. Regulation intervened not in the result but in its by-product: MARPOL Annex V treats hold wash water and the non-recoverable cargo residues it carries as garbage and sets the conditions for discharge. Verified A ballast water treatment plant is a system regulation created; hold washing is work commerce created, which regulation later followed only to govern what it leaves in the sea.

The document defining completion is the charterparty. The market sorts cleanliness into a ladder roughly as follows. Typical

• Hospital clean — the most onerous: all residue, loose scale and paint flakes removed, washed, dried and ventilated, with coatings 100% intact on every surface. Kaolin, mineral sands, barytes.
• Grain clean — the grade most commonly demanded: free of insects, odour, previous residue and loose scale; swept, fresh-water washed, dried, ventilated. Grains, cement, sulphur, fertilisers.
• Normal clean — the default when the charterparty is silent: swept, washed, dried. Coal, bauxite, iron ore.
• Shovel / swept clean — the least onerous: bulk residue removed, typically without washing.

Key point

There is no universally accepted definition of these grade names. The P&I clubs publish broadly consistent ladders, but the Shipowners' Club states the terms have no universally accepted definition and that the charterparty should be provided to the vessel each voyage so the required standard is settled. The document defining the target state is not a standard but a contract. The same wash passes for coal and fails for grain — not a matter of degree, but the acceptance criterion itself being swapped out according to the next cargo.

2. What the system does

Four functions at system level.

F1 — Supply and delivery of wash water. Sea or fresh water delivered to internal hold surfaces at working pressure, from the fire main or a dedicated wash pump, through hoses and wash guns or fixed nozzles and monitors.

F2 — Mechanical removal of residue. The work is done by the momentum of water — pressure, throw, angle of incidence, dwell time — supplemented by sweeping and, where needed, chemical cleaning agents.

F3 — Recovery of wash water and selection of a disposal route. Fallen water and residue collect in hold bilge wells and pass through settling and drainage to overboard discharge or retention on board. This branch is the only place regulation bites.

F4 — Determination and recording of completion. F1–F3 exist in any washing installation. In F4 the judge is not on board: the surveyor at the load port determines the result, and what the ship produces is only the evidence submitted to that judgement — wash records, photographs, timestamps and positions.

3. Core functions and operating modes

A typical sequence runs through four stages. Typical

[sweeping] -> [sea water wash] -> [fresh water rinse] -> [drying / ventilation] | | | | bulk residue detach adhered remove chlorides remove residual removed deposits by (corrosion and moisture (mould, (manual, momentum rejection risk) caking) bulldozer) (pressure, throw) | (branch) oil or adhered chemicals remaining -> [apply cleaning agent -> contact time -> re-wash] | MARPOL Annex V discharge constraints change here

Operating modes are defined by resource constraints, not by a normal/emergency split.

• Fresh water stock. The rinse is mandatory for chloride removal, but fresh water is finite. Britannia P&I's guidance suggests on the order of 20–25 tonnes per hold on a Panamax — an order of magnitude, not a specification value. Typical
• Voyage time. Washing normally happens on the ballast leg; time to the next load port caps the grade achievable at all.
• Where discharge is permitted. When wash water may be released governs when washing may be done. MARPOL Annex V Reg. 4.1.3 permits discharge of wash water containing non-recoverable cargo residues outside special areas only under conditions including the ship being en route and not less than 12 nautical miles from the nearest land; Reg. 6.1.2 sets separate conditions inside special areas. Wash water containing residues of a cargo declared harmful to the marine environment (HME), or harmful cleaning agents, may not be discharged at sea. Verified

Because the three constraints bind one another, this system's operating plan is in practice part of the passage plan. Even where a control panel exists, what it decides is the wash sequence, not the wash plan.

4. How the system works

A pass result is not the output of one device. It is a product of terms:

pass = f( pressure , throw and angle , dwell time , manpower and access , water quality (sea/fresh) , cleaning agent , drying , and the surveyor's standard )

Each term belongs to a different owner. Pressure to the pump and fire main; throw and angle to the nozzles and the person holding them; dwell time to the passage plan; water quality to the fresh water generator; and the acceptance standard to the charterparty and the surveyor. Not one of these sits wholly inside a control panel.

Engineering note — the thing to protect is not one executable

The panel's program holds the wash sequence, valve line-ups, pump speed setpoints and alarm limits. But the chain producing the result extends far outside that executable — fire main pressure, fresh water stock, nozzle condition, human access, the surveyor's standard. On a ship with no panel at all the system still works completely. What has to be protected is a judgement chain, not an executable.

---

Part II — Composition

5. What the system is made of

Listed as individual equipment this system is five rows. Grouped by typology it is four families.

Typology	Equipment family	Components	Count	Purdue	CBS (E26)	Evidence
TYP-A01	Piping, ducting and fittings	Hose stations, settling / drain arrangement	2	L0 — physical process	N	TYPICAL
TYP-C02	Centrifugal pump (cargo control context)	Hold wash pumps	1	L0 — physical process	N	TYPICAL
TYP-B02	Process transmitter / sensor	Wash monitors / nozzles	1	L1 — sensing	Y — within parent CBS	INFERRED
TYP-B08	HMI / operator console / panel	Hold washing control panel	1	L2 — supervisory	Y — list separately	TYPICAL

TYP-A01 (2 rows) — hose stations and the settling/drain arrangement: passive conduit, no data and no programmable element. IACS UR E26 Rev.1 §1.3.2 a) scopes OT as CBSs using data to control or monitor physical processes, and §2 defines a CBS as a programmable electronic device or interoperable set of such devices; these rows exercise no authority in any direction.

TYP-C02 (1 row) — the wash pump, inheriting the centrifugal pump doctrine unchanged: a motor load started and stopped from a starter panel or MCC, interpreting no information itself.

TYP-B02 (1 row) — a classification anomaly. Wash monitors / nozzles sit in the "process transmitter / sensor" family, but a wash monitor is a rotating jet nozzle — functionally a delivery device, not an instrument. The cache records that this family's boundary is impure, and this is the only row of the four carrying an INFERRED grade. Inferred Its authority therefore forks: a purely mechanical nozzle is A0; a powered monitor returning position or drive-confirmation signals is A1/A2. The BOM does not settle which, so it goes to Open Questions.

TYP-B08 (1 row) — the wash control panel: the only row at Purdue L2, the only row E26 asks to be listed separately, and effectively the whole of this system's cyber relevance.

6. Typology profiles — component count is not a measure of cyber relevance

Of five rows, two are CBS candidates and one is separately listed. The remaining three — two piping rows and one pump row — are Purdue L0 and not programmable. Most of the physical volume and capital cost sit in those three; what reaches the inventory is two. Each profile axis shows why.

• Programmable — none of the L0 rows. Piping has nothing to configure; the pump is a load a starter energises. Programmable are the panel, and the monitor only if powered.
• Network interface — none on the piping, none on the pump (started from a starter panel or MCC, it does not communicate itself). The panel has one, which is the basis for separate listing.
• Purdue level — three rows at L0, one at L1, one at L2. Spreading across three levels in a five-row system is unusual: thin, but a complete vertical chain.
• Consequence of loss — predominantly Operational. Losing the plant does not stop the ship; it makes the ship unable to load the next cargo. A commercial consequence, not a safety one.
• Supply boundary — typical supply is a Yard-designed system, the subject of section 7.

Key distinction — the limit of inherited doctrine

This system's typology doctrine is written in the cache in a liquid-cargo context: TYP-C02 concerns transfer to a shore manifold, TYP-B02 cargo tank gauging, TYP-B08 crude oil washing panels and custody transfer metering. The properties of the equipment family — direction and code of authority, the rules for assigning physical effect, the character of the human gate, the physics of failure — do not depend on the state of the cargo and are inherited intact.

The liquid-cargo-specific regulatory clauses are not. A dry bulk hold has no overfill prevention, no oil discharge monitoring equipment and no custody transfer metering, so this article does not cite IBC Code 15.19 or MARPOL Annex I Reg. 14.7, 31, 33 or 35. Carrying inherited doctrine as far as the clause text would mean describing compliance that does not exist.

7. Where the supply boundary falls

For this system the supply boundary question starts one step earlier than usual. Not "where does the package end" but "does this equipment exist at all?" The requirement origin is Trade / owner option — equipment an owner specifies after judging which trades the ship will serve, not equipment a rule demands. In practice a large share of bulk carriers wash holds with fire main pressure, hoses, wash guns and people. Typical That arrangement contains no programmable element, so the CBS count for SYS-035 is zero.

Specification decision point | +-------------------+--------------------+ | | [portable only] [fixed installation] fire main + hoses + guns + crew dedicated pump + fixed monitors + panel | | 0 CBS 2 CBS rows (monitor conditional, no E26 inventory entry panel confirmed) | E26: 1 separately listed row, document the exclusion under E26 §6 zone assignment required | | who owns that cubicle?

Where a fixed installation exists, Yard-designed system implies two things. Integration responsibility rests with the yard, so the plant is unlikely to be a single vendor package — pump, panel and piping come from different sources. And consequently ownership of the software configuration becomes unclear: whether the wash sequence logic belongs to the yard integrator or the panel vendor determines the maintenance path after delivery. That is a trust boundary with nothing to do with where a firewall sits.

Approval and survey regime — this system has none. A ballast water treatment plant has type approval and an oily water separator has approval testing; hold washing has no corresponding regime. What is inspected is not the equipment but the result, and the inspector is the surveyor at the load port rather than a class surveyor. The cyber implication is direct: nobody touches this plant through a scheduled survey window. The legitimate inbound-authority channels are exactly two — operator action at the panel, and a service laptop during modification or repair. The second arrives with neither schedule nor record.

Figure 1. The hold washing system in its operating context. Authority enters at the top and from the right; water travels downward; the two parties that decide whether the work was acceptable — the load-port surveyor and MARPOL Annex V — both sit off the ship.

8. Architecture patterns

The actual topology is UNKNOWN. Beyond Yard-designed system nothing in the BOM fixes the communication structure, so three conceptual patterns are contrasted rather than one asserted.

A. Standalone [wash panel] --hardwired--> [pump starter / valve solenoids] --> [monitors, nozzles] ^ | operator action only No external network. A service laptop is the only inbound digital path. B. Monitored (one-way reporting) [wash panel] --hardwired--> [pump / valves] | +--(status and alarms only)--> [IAS / cargo monitoring] --> [records / shore report] No inbound control. But records flow upstream, so record integrity is decided here. C. Control-Integrated [IAS / integrated control] <==(bidirectional)==> [wash panel] --> [pump / valves] ^ | | +--> shared bilge / ballast valves Sequence and line-up commands descend from upstream. Inbound A4/A3 exists over the network.

• In A the only digital entry points are the service laptop and removable media. There is no network attack surface; in exchange, control of that single path is the entire defence, and E26 §4.2.4.3.4 is effectively the only barrier the pattern has.
• In B control authority does not travel upstream, but information does — and the information travelling upstream is the regulatory and commercial evidence. B is "control is safe, evidence is exposed." Scenario S1 targets precisely this pattern.
• In C access inside the IAS zone translates into inbound authority at the wash panel, and if bilge and ballast valves are genuinely shared, this system's boundary widens to include them. The zone separation judgement demanded by E26 §4.2.1.3 becomes operative.

Typical architecture — disclaimer

A, B and C are conceptual models, not the configuration of any particular ship. Which pattern applies is settled only by the integrator's zones-and-conduits drawing and the panel interface drawing; they are presented to show how the consequences differ.

---

Part III — Authority and physical effect

9. What information and commands flow through it

Information (observation and reporting): wash water pressure and flow; pump running state (run / trip contacts); monitor and nozzle position or drive-confirmation signals, only where powered Inferred; wash program stage and elapsed time; hold bilge well level as a proxy for water recovered; and time, position and cargo type at wash water discharge.

Commands (direction): pump start and stop; wash program start, stop and stage transition; valve line-up on the supply and drainage paths.

That last item is unique. Elsewhere information is consumed by a controller or an operator; here, the time, position and cargo type at discharge are consumed by regulators and inspectors. Under MARPOL Annex V the lawfulness of a discharge is determined by the conditions at the moment of discharge, and only the record can demonstrate those conditions afterwards. Verified Its integrity is therefore not an operational question but one of legal standing. The same holds for the progress record: a work status to the operator, but in front of the surveyor the basis for the assertion "we washed this hold as required."

10. What authority does each connection carry

Source → Destination	Observe A1	Provide info A2	Configure A3	Command A4	Control A5	Admin A6	Update exec A7
Piping / hose stations → anything	NO	NO	NO	NO	NO	NO	NO
Wash pump → wash water line	NO	NO	NO	NO	NO	NO	NO
Wash pump → panel (hardwired status, pressure)	NO	YES	NO	NO	NO	NO	NO
Monitors, nozzles → panel (if powered)	CONDITIONAL	CONDITIONAL	NO	NO	NO	NO	NO
Panel → pump starter / valve solenoids	YES	NO	YES	YES	NO	NO	NO
Panel → upstream IAS / recording (patterns B, C)	NO	YES	NO	NO	NO	NO	NO
Operator → panel	YES	NO	YES	YES	NO	NO	NO
Upstream IAS → panel (pattern C only)	NO	YES	CONDITIONAL	CONDITIONAL	NO	NO	NO
Vendor service laptop / removable media → panel	YES	NO	YES	YES	NO	YES	YES
MCC / starter panel → pump	NO	NO	NO	YES	NO	NO	NO

First, the outbound ceiling stops at A4. The panel directs programs and sets parameters but does not close the loop — the actual signals to valves and pump come from subordinate controllers and I/O. The reasoning behind the cache withholding A5 from TYP-B08 applies unchanged.

Second, the inbound ceiling is A7 — held by neither the operator nor the IAS but by the vendor service laptop. Wash sequences and program parameters are software configuration, replaced at modification or on a change of trade. This is why E26 §4.1.1.3.2 makes application programs, operating systems and firmware inventory items across the ship's whole life.

Third, one row switches on and off with the pattern — the CONDITIONAL in Upstream IAS → panel. In A and B that row is all NO; only in C do A3/A4 exist. The same equipment presents a completely different attack surface depending on that one row.

Key distinction — connectivity is not authority

In pattern B the panel and the IAS are cabled together and data passes between them, but the authority that connection carries is a single outbound A2 — the upstream IAS cannot start a wash. Conversely the pattern A panel is on no network at all, yet the moment a service laptop connects physically, A7 UPDATE_EXECUTABLE exists. In this system the highest authority arrives not over a permanent link but over an intermittent physical attachment.

11. Can the system affect the physical process

Interaction	Authority	Physical effect	Human gate	Security significance
Piping / hose stations conveying water	A0 (both directions)	P0	NONE	No logical attack surface. Rupture has large physical consequences, but they cannot be reached through a control system
MCC / panel → wash pump start	inbound A4	P4	EXECUTION	A0 outbound + P4. The system's physical contact point
Monitor / nozzle jet delivery (mechanical)	A0	P4 (mechanical)	EXECUTION	If powered, add A1/A2; the evidentiary basis is CONDITIONAL
Panel → program start, stage transition	outbound A4/A3	P3	EXECUTION / SUPERVISION	Directs the sequence but does not hold the drive lines
Panel → valve line-up (supply, drainage)	outbound A4	P3	EXECUTION	Selecting the drainage route creates the regulatory outcome
Panel → progress and completion record	outbound A2	P1	REVIEW	Never returns to the physical world; flows only into judgement and documents
Panel → status display (mimic, alarms)	outbound A2	P2	SUPERVISION	Distorting the display is misleading the human directly
Vendor laptop → panel configuration	inbound A3/A6/A7	P3 (via downstream)	AUTHORIZATION (if any)	Highest authority, on the path with no survey window

P5 is not assigned. No component here serves as the final element of a designated safety function, and no approval drawing or clause establishing one has been confirmed. Typical

Key distinction — A0 outbound and P4 coexist

The wash pump interprets no information. It is a motor load that turns when its starter energises it; having no information recipient, its authority.outbound is A0. Yet this is exactly where the physical event happens — the moment the pump turns, a jet of water at tens of bar exists inside the hold, and that state change is itself the physical process, so it is P4 DIRECT_PHYSICAL_CONTROL.

Authority sits upstream (panel, MCC, service laptop); physical contact sits downstream (pump, nozzles). Collapse that asymmetry into P0 and the system renders as "hold washing has no physical effect," which contradicts the plant in front of you. Where to draw the defensive line is told by authority.inbound; what actually happens is told by physical effect — not the same axis.

12. Human gate

This system has three human gates of genuinely different character.

Gate 1 — execution (EXECUTION). Pump start, program start, valve line-up: a person must act at the panel or the starter for anything to proceed. Where an automatic sequence runs, the character shifts to SUPERVISION — the human watches progress and intervenes on abnormality. This is the dual character the cache prescribes for TYP-B08.

Gate 2 — completion judgement (REVIEW, and effectively off-ship). The crew judge completion against their own standard and present the hold; the surveyor at the load port decides pass or fail against the charterparty grade. No instrument can replace this gate, because no sensor reads "grain clean." That is not a weakness but an accidental defensive asset — no pass can be manufactured inside the system. What can be manufactured is the evidence supporting a claim of one, and that claim still meets an off-ship pair of eyes.

Gate 3 — hold entry (AUTHORIZATION). Washing puts people inside a cargo hold, and this gate is held not by the wash panel but by permit-to-work and the SOLAS regime. Since 1 July 2016 SOLAS XI-1/7 has required ships of 500 gross tonnage and above on international voyages to carry a portable instrument able, as a minimum, to measure oxygen, flammable gases or vapours, hydrogen sulphide and carbon monoxide before enclosed space entry; the regulation does not itself enumerate the spaces — MSC.1/Circ.1477 lists cargo spaces among those concerned. Verified SOLAS III/19.3.6 requires entry and rescue drills. The recommendation framework is now IMO Res. MSC.581(110) (adopted 27 June 2025, effective 3 December 2025, superseding A.1050(27)), which newly requires a ship-specific enclosed space register and extends testing to carbon dioxide. Verified Cargo holds go on that register, so the amendment raised the documentation requirement on the very gate washing depends upon.

Gate 3 (entry authorisation) Gate 1 (execution) Gate 2 (completion judgement) permit-to-work operator / panel load port surveyor SOLAS XI-1/7 atmosphere test pump start, program start charterparty grade | | | a person goes inside ------> water comes out ----------> pass or fail | | +---------- these two must never hold at once -------------+ (mutual exclusion of gates 3 and 1)

That last line is the most important safety relationship in the system: a person inside the hold and a high pressure jet discharging must be mutually exclusive states. Whether that exclusivity is a hardwired permissive or is left to procedure and a soft interlock is the first design question to ask about this system.

13. Authority escalation and propagation

Path 1 — direct (mechanical).

service laptop (A7) -> panel configuration -> sequence logic (A4) -> pump starter -> pump runs (P4) -> valve solenoid -> line-up (P3)

This does not start low. It enters at A7 and descends, so the defence has to sit on entry itself.

Path 2 — indirect, through a person.

program parameter change (A3) | progress display diverges from actual nozzle coverage <- no physical manipulation | operator judges "complete" on the basis of the display <- gate 1 is passed | hold presented to the surveyor | +----------------------+-----------------------+ | surveyor catches it | surveyor misses it | | -> fail, re-wash | -> load into a | | -> berth delay, | contaminated hold | | off-hire | -> cargo claim | +----------------------+-----------------------+

Path 2 contains no A4 and no A5. Authority stops at A3, and from there human judgement carries it. The structure matches the cache's sensor-family chain of False Data → Wrong Calculation → Operator Decision → Physical Action, except that the final term is a commercial act of presentation. Because gate 2 sits at the end of that chain, propagation completes only probabilistically — the distinction to draw against the direct control path.

---

Part IV — Uncertainty and security

14. Trust boundaries and dependencies

+---------------------------------------------------------------+ | On board / yard integration responsibility | | | | [wash panel] --- [starter / MCC] --- [pump] --- [monitors] | | | | | | ................................................. | | | : shared boundary with fire main, bilge, ballast : | | | : supply source and drainage route owned : | | | : by other systems : | | | ................................................. | +---------|------------------------------------------------------+ | ==========|============ administrative ownership changes ============= | +------+------+ +--------------------+ +------------------+ | vendor / | | shipper (off-ship) | | surveyor | | service | | HME declaration | | (off-ship) | | laptop, USB | | premise for | | pass / fail | | A3/A6/A7 | | discharge legality | | defines "done" | +-------------+ +--------------------+ +------------------+

(a) Shared boundary with neighbouring systems. Wash water comes from the fire main or a dedicated pump; recovered water goes to hold bilge wells and drainage, so the physical boundary overlaps the fire, bilge and ballast systems. Where pattern C genuinely shares valves, zone boundary judgement becomes difficult and the zone grouping and explicitly-permitted-traffic requirement of E26 §4.2.1.1 is what bites.

(b) Vendor and service access. This plant has no survey window. Service laptops and removable media carry authority as far as A7 with neither schedule nor approval flow, and the removable media policy of E26 §4.2.4.3.4 is the only procedural barrier there is.

(c) The shipper's HME declaration. Whether wash water may be discharged depends on whether the previous cargo was HME, and the ship does not produce that determination — the shipper declares it, and it reaches the ship through the cargo information procedure of the IMSBC Code (currently amendment 07-23, resolution MSC.539(107), adopted June 2023 and mandatory from 1 January 2025). Verified No shipboard control can verify it, and a wrong declaration carries the ship into a violation it has no means of detecting — a supply chain trust boundary in textbook form.

(d) The surveyor. The party owning the definition of completion sits off the ship. Called an accidental defensive asset above, it is simultaneously an acceptance criterion the ship cannot control: the same hold can be judged differently by different surveyors.

15. What happens when the system fails

Engineering failure first. Translating the cache's failure modes into a dry bulk washing context gives five.

• Corrosion or erosion wastage of piping and hoses, or coupling leakage — the medium is sea water and the residue abrasive. Observed as UT thickness below allowance or a pinhole leak → isolation and spool renewal; the wash schedule collapses.
• Poor assembly of hose stations and couplings — observed as deck leakage and pressure loss → reduced throw and inadequate coverage of upper areas and corners.
• Pump suction loss and cavitation — observed as a sharp drop in discharge pressure and fluctuating current → washing stops, impeller damage accumulates.
• Dead-head operation from misoperation of a discharge valve — pressure and temperature rise with no flow → pump overheating and line overpressure.
• Loss of monitor / nozzle position or drive-confirmation signal (where powered). The progress display keeps advancing while the actual spray pattern diverges. In this family the dangerous failure is not the screen going dark; it is the screen being quietly wrong. Inferred

Failure chain -- the quiet failure nozzle position feedback lost (or never fitted) | panel advances stages on the program timer alone | progress shows 100% <-------- actual coverage is partial | operator judges completion from the display (gate 1 passed) | hold presented -> surveyor's judgement (gate 2) | fail -> re-wash, berth delay, off-hire, demurrage (or) pass -> contamination -> cargo claim

One more catastrophic failure mode has nothing to do with cyber — the space itself. Washing puts people inside a cargo hold, usually just after discharging a cargo that consumes oxygen. MAIB Report 5/2025 demonstrates the hazard: on 27 June 2022 at Bunyu Island anchorage, Indonesia, a stevedore aboard the bulk carrier Berge Mawson mistakenly entered the access space of No. 8 hold while trying to reach a bulldozer in No. 7, and was overcome; two more collapsed attempting rescue and all three died. MAIB identified an oxygen-depleted atmosphere in the access space, access hatches not locked when not in use, and stevedores untrained in enclosed space hazards. Verified The casualty did not occur during washing, but it shows that the physical consequence segment of this system's chains is evidence, not assumption. Hold washing is structurally the act of putting people into a space with a history of oxygen depletion — while operating high pressure jet equipment in it.

16. Attack surface and credible threat scenarios

Attack surface classes. Local (physical access) — the panel itself, frequently sited on deck or in a deck store; this becomes the central argument of section 17. Removable media — wash program updates and log extraction; in pattern A the only digital entry. Connected OT — one-way reporting in B, bidirectional integration in C. Ship–shore — wash and discharge records leaving for shore reporting. Vendor — the service laptop, carrying authority to A7 with no survey window. Supply chain — the panel software configuration entering at yard integration.

S1 — Falsification of wash water discharge records

Entry Interaction : service laptop or removable media connects to the panel (during modification or a change of trade) Initial Authority : inbound A3 CONFIGURE (logging parameters, time sync, record format) Mechanism : alter the rules for recording discharge time and position, or make the record itself editable after the fact Authority Gained : A6 ADMINISTER (administrative rights over the recording function) Affected Interaction: panel -> progress and discharge record (outbound A2) Physical Effect : P1 INDIRECT_DECISION_EFFECT / P2 -- the physical washing is unchanged Consequence : wash water containing HME cargo residues, or a discharge outside permitted conditions, is recorded as lawful -> MARPOL Annex V violation, collapse of Garbage Record Book reliability -> PSC deficiency or detention, criminal exposure to flag and coastal states

What makes this scenario distinctive is that the physical damage is zero and the consequence is among the heaviest on the list. The attacker breaks nothing and injures nobody; the object of manipulation is purely the evidence. Discharge is the only point at which regulation engages this system, and the record is the only means of demonstrating a discharge's lawfulness afterwards. The motive is regulatory avoidance and cost saving, so the most plausible actor is a pressured insider rather than an external adversary. In pattern B the surface widens from one panel to the whole IAS zone.

S2 — Falsified wash program progress leading to a wrong completion judgement

Entry Interaction : IAS zone access in pattern C, or a service laptop in patterns A and B Initial Authority : inbound A3 CONFIGURE (stage durations, nozzle sequence, progress calculation) Mechanism : shorten stage durations, or fix progress computation to the timer alone, so that 100% is displayed regardless of actual coverage Authority Gained : none. It stops at A3 Affected Interaction: panel mimic -> operator's completion judgement (gate 1) Physical Effect : P1 / P2 -- the water was sprayed and the pump ran normally. What is wrong is only the judgement that enough was done Consequence : hold presented to the surveyor with unwashed areas remaining -> (if detected) fail, re-wash, berth delay, off-hire, demurrage -> (if missed) loading into a contaminated hold -> cargo damage claim

Its chain is identical to the quiet failure in section 15: a fault and an attack produce the same symptom. And this system has no independent measurement that would separate them, because no sensor reads "grain clean." In another system a regulatory threshold has a corresponding instrument reading to cross-check; here no such reference exists. The commercial nature of the completion criterion becomes, directly, the detection gap. The remaining defence is gate 2 — after-the-fact discovery rather than prevention, by which point the cost is already incurred.

S3 — Pump or monitor start while personnel are inside the hold

Entry Interaction : physical access to the panel, remote start at the MCC, or a command via the IAS in pattern C Initial Authority : inbound A4 COMMAND (pump start / program start) Mechanism : where the entry permissive is a soft interlock or procedural only rather than a hardwired interlock, the command succeeds irrespective of whether personnel are inside the hold Authority Gained : none. The A4 held at entry is sufficient Affected Interaction: panel -> pump starter -> pump -> monitors and nozzles Physical Effect : P4 DIRECT_PHYSICAL_CONTROL -- high pressure water inside an enclosed hold Consequence : injury or death. Delayed escape from an enclosed space worsens the outcome

This scenario reaches the heaviest consequence from the lowest authority — neither A7 nor A6, but an ordinary A4. That is the practical meaning of the A0+P4 asymmetry: the defensive line is on the upstream command path and the result emerges at the downstream pump. It is also the thinnest-evidenced of the three. The cache leaves the pump family's remote-start permissive unconfirmed as hardwired or soft, and this system's BOM contains no interlock item, so the scenario is presented not as a claim that the attack works but as a design question. Unknown If the answer is "hardwired permissive," it closes; if it is "procedure only," there is a safety defect that predates any cyber concern.

17. Security architecture and standards

Controls derived from S1 (record falsification). Integrity control over the generation, retention and extraction of records: discharge timestamps bound to a trusted ship's time source rather than a locally editable setting; records that cannot be edited after the fact, or that retain an edit history; and, where extraction uses removable media, that medium brought inside the media control regime.

→ IACS UR E26 Rev.1 §4.1.1.3.2 (software configuration inventory — a logging format is configuration), §4.2.4.3.4 (removable media policy, with malware scanning and signature verification before use), and IACS UR E27 Rev.1 §4.1 Table 1 item 18 (IEC 62443-3-3 SR 3.2). In patterns B and C, E26 §4.2.1.1 (only explicitly permitted traffic across a zone boundary) and §4.2.1.3 (navigation and communication systems not in the same zone as machinery and cargo systems) apply additionally.

Controls derived from S2 (progress falsification). Separation of the privilege to change program parameters from the privilege to operate, plus a change history. If the routine operating account and the account that can alter stage durations and the progress computation are the same, this scenario is simply not controlled.

→ IACS UR E27 Rev.1 §4.1 Table 1 item 1 (SR 1.1), identification and authentication of all human users, and item 12 (SR 2.5), access termination after inactivity. The configuration change itself is an inventory subject under E26 §4.1.1.1 and §4.1.1.3.2.

Key point — an exemption that does not transfer

The authentication exemption in E26 §4.2.4.4.1 is not inherited by this panel. It permits an exemption from user identification and authentication for operator HMIs requiring immediate access, but conditional on physical access control, and the devices concerned must be specified. In the cache's TYP-B08 doctrine that exemption rests on the premise of a cargo control room console, where the door substitutes for the account. A panel in a deck store or on open deck has no equivalent boundary, so transplanting the exemption produces an unfounded one. Until the installed location settles the judgement, the default is no exemption.

Controls derived from S3 (start with personnel inside). What is needed is not a cyber control but a hardwired permissive. If the pump start circuit is physically broken while a hold entry permit is in force, no attacker at any level of authority can execute this scenario; if it is a soft interlock, that logic sits on the same A3 path as S2.

→ IACS UR E27 Rev.1 §4.1 Table 1 item 20 (IEC 62443-3-3 SR 3.6) — deterministic output, placing outputs in a predefined state when normal operation cannot be maintained. That state must plainly be stopped, and whether it is defined in the design documents is a check item. Human-side controls already exist in SOLAS XI-1/7, SOLAS III/19.3.6 and IMO Res. MSC.581(110); the test for the cyber design is whether it weakens that regime.

And the judgement most often required here is exclusion. On a ship with portable equipment only, SYS-035 has no CBS, and that has to be documented rather than assumed.

→ IACS UR E26 Rev.1 §6, justification of exclusions and removals. Absence from the asset inventory required by §4.1.1.3 must be recorded as a conclusion, not an omission. In classification terms the system falls under E26 §1.3 a), "Cargo handling system (limited to safety-related elements)" — and what counts as a safety-related element of a washing plant is itself a point of argument at review, where the category determination of E22 Rev.3 §3.3 connects.

18. Open questions, takeaways and references

Open questions

Cache open questions specific to liquid cargo — tank strapping tables, custody transfer legal metrology, COW panel and ESD interfaces, CTMS shore transmission — do not apply here. What remains:

1. Are the wash monitors and nozzles purely mechanical, or powered monitors with position and angle feedback? The former is A0, the latter A1/A2 — this single answer switches a row of the authority matrix on or off. Unknown
2. Is the permissive on remote start hardwired or a soft interlock? Whether S3 works is decided here. Unknown
3. Which of architecture A, B or C applies? Settled only by the zones-and-conduits and panel interface drawings.
4. Does the panel's software configuration belong to the yard integrator or the panel vendor?
5. Where is the panel physically installed? This is the premise for the E26 §4.2.4.4.1 exemption judgement.
6. In what format, where, and by what route are wash water discharge records held and extracted?
7. Is there any element of the plant that classifies as a "safety-related element" under the limiting condition in E26 §1.3 a)?

Twelve questions to ask first on a real project

1. Fixed hold washing installation, or portable equipment only?
2. If portable only, is that documented as a basis for exclusion under E26 §6?
3. On which drawing, under what name, does the wash control panel appear, and is it in the asset inventory?
4. Where is the panel installed, and does that space have physical access control?
5. What is the panel connected to — nothing, one-way reporting, or bidirectional integration?
6. Are the wash supply and drainage valves shared with the fire, bilge or ballast systems? If so, where is the zone boundary?
7. Is there a hardwired permissive on remote pump start, interlocked with the hold entry permit?
8. Is the deterministic behaviour of pump and valves on panel failure defined in the design documents?
9. Who can change the wash sequence and program parameters, and where is that change recorded?
10. Does the removable media and service laptop procedure list the wash panel among the equipment it applies to?
11. What is the time source for discharge records, and can they be edited after the fact?
12. Do the monitors and nozzles have position feedback, or is progress computed from a timer alone?

Engineering takeaways

FINAL ANALYSIS CHAIN a commercial requirement -- cargo compatibility (why it exists) | a combination of water, pressure, time and people (what makes the result) | 5 rows, 4 typologies, 2 CBS rows, 1 separately listed (what it is made of) | outbound ceiling A4 / inbound A7 (vendor laptop) (what authority flows) | pump A0 outbound + P4 / panel A4 outbound + P3 (how it touches the physical world) | gate 1 execution, gate 2 off-ship judgement, (where the human stands) gate 3 entry authorisation | the target is not a setpoint but evidence and judgement (what gets attacked) | the criterion comes from a contract, so there is no (why detection is hard) instrument reading to cross-check against

1. The target state arrives from outside the system. The charterparty sets the grade and a surveyor judges it; regulation governs the discharge of wash water and entry into the hold, not completion.
2. On many ships the CBS count is zero. The first question is whether the equipment exists, and a negative finding must be recorded under E26 §6.
3. A0 outbound with P4 on the wash pump is not an error. Authority is upstream, physical contact downstream; folding that into P0 renders the system at odds with the plant.
4. The highest authority arrives on an intermittent physical attachment, not a permanent link — the vendor laptop's A7, with no schedule and no approval flow, because this plant has no survey window.
5. The CCR console's authentication exemption is not inherited by a deck panel. E26 §4.2.4.4.1 is conditional on physical access control.
6. The commercial nature of the completion criterion is itself the detection gap. With no regulatory instrument reading to compare against, a quiet failure and a manipulation produce the same symptom, and both surface only at the load port.

Closing thought

Ask about this system on a real ship and the first honest answer is often that nobody is sure it exists as equipment at all. That is not a gap in the analysis; it is the finding. Where the plant is portable, the work is to record the exclusion properly. Where a panel exists, the work is to find out what it is attached to, who can change its program, and whether a person inside the hold can be reached by a pump that starts. None of those questions is answered by a network diagram, and all of them are answered by the drawings and the permit-to-work file.

---

Sources

• IACS, UR E26 Rev.1 — §1.3 a), §1.3.2 a), §2, §4.1.1.1, §4.1.1.3, §4.1.1.3.2, §4.2.1.1, §4.2.1.3, §4.2.4.3.2, §4.2.4.3.4, §4.2.4.4.1, §6
• IACS, UR E27 Rev.1 — §4.1 Table 1 items 1, 12, 18, 20 (IEC 62443-3-3 SR 1.1, SR 2.5, SR 3.2, SR 3.6)
• IACS, UR E22 Rev.3 — §3.3
• IMO, MARPOL Annex V — Reg. 4.1.3, Reg. 6.1.2 (discharge of cargo residues, wash water and cleaning agents)
• IMO, SOLAS XI-1/7 — portable atmosphere testing instruments for enclosed space entry
• IMO, MSC.1/Circ.1477 — guidelines for the selection of portable atmosphere testing instruments
• IMO, SOLAS III/19.3.6 — enclosed space entry and rescue drills
• IMO, Res. MSC.581(110) — Revised recommendations for entering enclosed spaces aboard ships (adopted 27 June 2025, effective 3 December 2025, superseding A.1050(27))
• IMO, IMSBC Code, Amendment 07-23 (Res. MSC.539(107), adopted June 2023) — mandatory 1 January 2025
• UK MAIB, Report 5/2025 — Berge Mawson, three fatalities in a cargo hold access space
• Britannia P&I, Cargo Hold Cleaning Standards Guidance (2024) — fresh water quantities, wash procedure
• The Shipowners' Club, Hold Cleanliness — absence of universally accepted grade definitions
• The Swedish Club, Practical guide: Hold cleaning of bulk vessels (2023)
• ITOPF / UK P&I — bulk cargo hold wash water discharge and cargo declarations under MARPOL Annex V

Article classification

This is a typology-based system analysis, not a vendor or ship-specific document. Typology-level statements follow doctrine already fixed in the cache; evidence grades are INFERRED for TYP-B02 and TYPICAL for the other three families. The cache doctrine is written in a liquid cargo context; this article inherits only the properties of the equipment families and does not apply liquid-cargo-specific regulatory clauses (IBC Code 15.19, MARPOL Annex I Reg. 14.7, 31, 33, 35). Architecture patterns A, B and C are conceptual models, not actual configurations.

Julius Shin

Maritime Technical Consultant · Shipboard Cybersecurity & Compliance

Owner-side maritime cybersecurity advisor covering IACS UR E26/E27 compliance, zone and conduit design, and OT/IT security architecture for commercial vessels — working across LR, ClassNK, DNV, ABS, and BV newbuilding projects.

🌐 More Articles ↗

⚓ Join the ShipPaulJobs Community

Join →