Find the value that will bypass safety checks and destabilize connected hardware. Just sending random noize might not help, so the fuzzer could try to steadily increase some values or execute another logic that is known to be harmful for typical process control mechanisms. I called it fuzzer because I assume it doesn't know what is the real mechanism on the other end. If you have source code and schematic of the plant, you don't need to guess and can directly write targeted destructive code.