Silicon never saw the world

A silicon-based sensor does not report the state of the world. It reports a voltage, converted by an analog-to-digital stage into a number, associated with a bus address. When a MEMS accelerometer or a pressure transducer sits on an I2C or SPI line and answers a read request, the value it returns is a measurement of its own internal electrical condition, transduced and quantized. Nothing in that value certifies what is actually happening in the environment the sensor is presumed to observe. The system downstream treats the number as ground truth. That substitution, the reading standing in for the reality it represents, is the whole architecture. The Siloxane affair is a study of what happens when the substitution holds structurally while it stops holding in fact.

The layers that carry these readings were never built to question them. Classic Modbus, still running under a large fraction of industrial control, has no authentication and no integrity check on register contents; a holding register is a holding register, and whatever value it presents is accepted as read. A CAN frame carries an identifier that arbitrates bus priority, not authenticity. On an I2C bus the sensor is known by its device address and nothing more. In each case the identity of the source is the credential, and the content rides in behind it unexamined. The silicon-based sensor is trusted not because its output is verified but because the channel it arrived on was previously established as trusted.

So the system behaves exactly as specified. It issues a read, receives a well-formed value from a known address, and feeds that value into a control loop or a fusion stage that combines it with other trusted streams. There is no bypass in this. There is no exploit in the classical sense. The Siloxane affair does not describe a control that was defeated. It describes a control that executed its intended function on an input whose meaning had quietly stopped matching the assumption the function was written against. The sensor was doing its job. The bus was doing its job. The consuming system was doing its job. The trust was doing something else.

The assumption underneath all of it was that a reading from a known source is a valid statement about the world. Trust was bound to the origin of the data, not to the integrity of what the data asserted. Once a silicon-based sensor was integrated, addressed, and observed to return plausible values during commissioning, its position in the trust model was set. From that point the design treated the mapping between the sensor’s identity and the physical reality it stood for as fixed. Every subsequent reading inherited the validity established at that first moment of acceptance.

This is trust modeled as persistent and transferable. Persistent, because the sensor that was trustworthy yesterday is assumed trustworthy today, with no mechanism that re-establishes the claim. Transferable, because the confidence earned by one correct reading is extended, silently, to the next reading and to every reading after it. A MEMS device that reported correctly at time zero is granted the same standing at time N, not on the basis of any renewed verification but on the basis of continuity of address. The system does not ask whether the sensor still means what it meant. It asks only whether the sensor still answers, and it does.

Nothing in the protocols carrying that data contradicts the assumption, because nothing in them was built to test it. Modbus, CAN, and raw I2C transport values without asserting anything about their correspondence to reality. The validation the system believes it has is validation of form, not of fact. The frame is well constructed, the checksum passes, the address is recognized, and the value falls inside an expected range. All of those checks confirm that a message arrived intact from where it was supposed to come from. None of them confirm that the message is true. The assumption was that source integrity implies content integrity. That assumption was never enforced. It was inherited.

What changed was not the capability of any adversary and not the diligence of any operator. What changed was the validity of the assumption itself. The physical or contextual meaning of the silicon-based sensor’s output drifted away from the meaning the control system was written to expect, while every observable property that the system uses to establish trust stayed constant. The sensor still answered to the same address. It still returned well-formed, in-range values at the expected cadence. It still passed every structural check the bus and the consuming logic could perform. The bytes remained valid. What they now represented did not.

It did not start this way, and that is the point. At commissioning the mapping between sensor and reality was sound, and the trust granted then was appropriate to that state. The system did not re-evaluate that mapping at any later moment. It carried the original grant forward unchanged. Trust was inherited from past states rather than re-derived from present ones. So when the correspondence between the reading and the world shifted, whether through contamination of the sensing surface, degradation of the transducer, a change in the medium being measured, or a change in what the surrounding system had come to assume the reading meant, there was no point in the pipeline where that shift could register as a change in trustworthiness. The condition for trust was continuity of identity, and identity had not changed.

This is where things shifted, and it shifted without any event that a log would record as an event. A drifted sensor and a healthy sensor are indistinguishable to a system that verifies address and format. Both return numbers. Both sit at the expected place on the bus. Both are consumed by the same fusion stage with the same weight. The assumption that a trusted stream inherently validates the broader system context no longer held, but the system had no faculty for noticing that it no longer held. The trust established once continued to operate as though the world it was granted against had stood still. The reading was still accepted. What it certified had already moved.

The failure does not live in the silicon-based sensor and it does not live in the bus. It lives in the resolution step, the moment the consuming system needs a fact about the world and, instead of measuring the world, reads an address. The address is a reference. The read is a dereference. Whatever comes back is accepted because the reference resolved, not because the returned value was tested against anything outside itself. Modbus resolves a register number to whatever value occupies that register. An I2C master resolves a device address to whatever the addressed device places on the line. In each case the system asks where, receives an answer, and treats the answer to where as an answer to what. Reference stood in for validation, and once that substitution is made the content is never examined on its own terms again.

Everything the system does after that point is observable and unremarkable. The read completes. The value falls inside the configured band. It arrives at the expected cadence. The fusion stage combines it with the other trusted streams at the weight assigned during commissioning, and the control loop actuates on the result. There is only ever one path to the fact, and that path terminates at the sensor’s own report of its own electrical condition. The system never poses a second, independent question about the same quantity. It has no faculty for cross-examination because cross-examination was never part of the contract. The identity of the source became the whole of the credential, and the integrity of the content rode in behind that credential unchecked, exactly as the earlier layers were built to allow.

So a drifted reading and a true reading generate identical observable behaviour. The bus reports success. The value sits within range. No error frame is raised, no checksum fails, no address goes unrecognized. From outside, the system emits precisely the telemetry it emits when everything is correct, because for a mechanism that verifies reference and not fact, that telemetry is the correct output. This is the part that resists detection. The condition is not marked by an anomaly. It is marked by the continued, undisturbed production of normal signals over a fact that has quietly stopped being true. The control executed its intended function. The function was written against an assumption the input no longer satisfied. Nothing in the observable behaviour distinguishes the two states, because the observable behaviour was never a function of the state that changed.

The pattern underneath the Siloxane affair is execution based on reference, not verification. A reference is a durable token that certifies one thing and one thing only, that at the instant it was formed, resolution corresponded to a fact. The system then reuses the token indefinitely and never returns to re-establish the correspondence. It trusts the address because the address resolves, and it trusts what resolves because the address was once correct. The gap the pattern opens is the gap between the persistence of the reference and the impermanence of the referent. The token does not decay. The thing it points at does. Nothing in the design closes that gap, because closing it would mean re-deriving trust from the present state instead of inheriting it from a past one, and inheritance was the cheaper contract.

The same mechanism operates in memory, far from any industrial bus. A pointer holds an address that was valid when it was taken. Later the program dereferences it. In the interval the allocator has freed that memory and handed it to something else. The address still resolves. The read succeeds. The bytes are well-formed and sit exactly where the pointer says they should. What those bytes now represent is a different object, or no object at all, but nothing in the dereference asks that question. The use-after-free is not a broken pointer; it is a pointer that kept its meaning while its referent lost theirs. Identity of location stood in for integrity of content, precisely as device address stood in for physical truth on the I2C line. The reference outlived the referent, and the system executed on the reference.

In both cases the system optimized for resolution and for the reuse of trust, and in both cases a proxy replaced the reality it was standing for. The reading stood for the state of the world. The address stood for the object. Neither correspondence was re-checked, not because anyone chose to skip the check, but because the check was never in the contract to begin with. The reference was always going to be more durable than the fact it was minted against. That is not a defect introduced later. It is the shape of the thing from the moment reference was allowed to substitute for verification.

A trusted stream is resolved once and carried forward until something external forces the question again. Nothing in the design forces the question. The control exists. The outcome does not.