A detection is evidence for a requirement

How each plant alert is placed in exactly one zone and attached to one foundational requirement, with a reason.

By the end you can

Given an alert, name its zone and the requirement it is evidence for.
Explain why the zone is the one that raised it, not the one that was harmed.
Read a conduit label on a boundary finding.

One alert, one zone, one requirement

Every detection the plant range raises is placed in exactly one zone, and the placement carries a reason written in the plant's terms. That is what makes the alert usable in an assessment: it is not just a red row, it is a statement that a named requirement in a named zone did or did not hold.

Detection (zone)	Requirement, technique and reason
Write function code from a host registered as read-only (Z-CONTROL)	FR1 · T0836 — The write lands on a controller inside the line control zone. Whatever sent it, the identification failure is measured where the command took effect.
Fill weight above tolerance on line 2 (Z-CONTROL)	FR3 · T0831 — Fill weight is the process the control zone owns; the deviation is the integrity finding for that zone, not for the historian that reported it.
Setpoint moved twice within thirty seconds — faster than an operator works (Z-CONTROL)	FR6 · T0855 — A step rate no operator could work at is judged against the panel that is supposed to be the only source of setpoints.
New MAC learned on a patch-panel port that belongs to the office side (Z-CONTROL)	FR5 · T0822 — The address was learned on a plant-side patch panel port, so the control zone is the one whose restricted data flow has been broken.
Plant-side host has no session through the OT DMZ (Z-DMZ)	FR5 · T0822 — The finding is an absence in the DMZ: the plant-side session has no brokered leg, so the zone that should have carried it has nothing to show.
Device identification read from an address not in the asset register (Z-CONTROL)	FR1 · T0846 — Device identification is read off controllers in the control zone, and the unknown address is missing from that zone's register.
Safety controller key switch reported in PROGRAM (Z-SAFETY)	FR2 · T0858 — The key switch is the safety zone's own state, and PROGRAM during a run is the profile breach by itself.
Force active on interlock IL-7, refreshed on a keep-alive (Z-SAFETY)	FR3 · T0878 — An interlock force lives in the safety instrumented system and nowhere else.
Pressure above trip point, trip suppressed by active force (Z-SAFETY)	FR7 · T0880 — A trip point reached without a trip is the safety zone failing its availability requirement in the only way that matters.
Controller mode changed RUN to PROGRAM during a production run (Z-CONTROL)	FR2 · T0858 — RUN to PROGRAM is a use-control decision about a controller in the line control zone during production.
Program download from a host that is not the licensed engineering workstation (Z-OPS)	FR2 · T0843 — The licensed engineering workstation lives in site operations, so a download from anywhere else is that zone's identification failure before it is the controller's.
HMI lost communications with the capper mid-transfer (Z-CONTROL)	FR3 · T0857 — Loss of view sits with the panel and controller pair in the control zone, which is where the operator notices it.
Capper controller stopped answering its poll — line function unavailable (Z-CONTROL)	FR7 · T0814 — A controller that stops answering its poll is a control-zone availability finding.
Control protocol from an address with no asset-register entry (Z-CONTROL)	FR1 · T0848 — Control protocol from an address with no register entry is measured in the zone whose register it should have been in.

Where the alert is filed

The zone is where the finding is observable and owned — the zone whose profile it breaches — not always the zone that ends up harmed. A dual-homed laptop is an enterprise finding even though the danger is to the control zone, because the enterprise profile is the one that says no office host holds a plant address.

See every alert placed in its zone