A field controller polls the breaker with periodic status/command messages, each stamped with a rising sequence number. Recording captures a slice of that genuine traffic; replaying it back later reuses those exact bytes — correct format, once-real values — alongside one forged command the attacker crafts by borrowing an old, valid-looking sequence number.
- No validation — the receiver accepts every message it gets. The replayed "all normal" status buries the real state, and the forged command reaches the breaker unchallenged.
- Sequence/timestamp check — the receiver only accepts a message whose number is strictly newer than the last one it kept. Every replayed or forged message carries a stale number, so it is flagged and dropped, and the log exposes the attempt.