Chapter 21 — Critical infrastructure and sector security: system models | Bachelor's Critical infrastructure and sector security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 21 published. Map, example, EX041.

flowchart TD
  N0["Learning outcomes and connection"]
  N1["21.1 The control loop"]
  N2["21.2 A layered reference model"]
  N3["21.3 Service chains and degraded modes"]
  N4["21.5 Practical activity"]
  N5["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX041"]

Logical drawing

flowchart LR
  N0["Learning outcomes and connection"]
  N1["21.1 The control loop"]
  N2["21.2 A layered reference model"]
  N3["21.3 Service chains and degraded modes"]
  N4["21.5 Practical activity"]
  N5["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX041"]

[Learning outcomes and connection]
    |
    v
[21.1 The control loop]
    |
    v
[21.2 A layered reference model]
    |
    v
[21.3 Service chains and degraded modes]
    |
    v
[21.5 Practical activity]
    |
    v
[Chapter synthesis]
    |
    v
[Worked example] --> [Exercise EX041]

Learning outcomes and connection

After this chapter you can (1) describe a control loop and the components of a SCADA or industrial control system; (2) place assets in a layered reference model from field devices to enterprise; (3) model a service as a chain of functions with degraded modes; and (4) say what kinds of attack or failure each part of the model is exposed to. It builds on Chapters 7, 16 and 19 and prepares Chapter 22 (data and dependencies) and Chapter 28 (failure analysis).

21.1 The control loop

Every physical process controlled by computers follows a loop: a sensor measures (tank level, line current, train position); a controller compares the measurement with a setpoint and computes an action; an actuator acts (pump speed, breaker trip, signal aspect); the process responds; the sensor measures again. Programmable logic controllers (PLCs) and remote terminal units (RTUs) run the loop locally. A SCADA system (supervisory control and data acquisition) supervises many loops across a wide area: it collects measurements, shows them to operators on human–machine interfaces (HMIs), stores history in a historian and sends setpoints and commands. Safety instrumented systems (SIS) watch for dangerous conditions and act independently to bring the process to a safe state (NIST SP 800-82 Rev. 3).

The loop gives a precise vocabulary for what can go wrong: false measurements (the controller acts on a lie), false commands (the actuator does something unintended), loss of view (operators cannot see), loss of control (operators cannot act), and compromise of protection (the SIS cannot act). MITRE ATT&CK for ICS organises impacts in similar terms, such as loss of view, loss of control and manipulation of control (ATT&CK for ICS).

21.2 A layered reference model

A layered model — widely known as the Purdue model — places assets by function: level 0 the physical process with sensors and actuators; level 1 basic control (PLCs, RTUs, SIS); level 2 supervisory control (HMIs, local SCADA); level 3 site operations (historians, engineering workstations); a DMZ; and levels 4–5 enterprise IT. The model is a teaching and segmentation aid, not a law of nature: cloud-connected sensors, vendor remote services and wireless field devices cross levels. Use it to ask "which paths cross levels, and are they controlled?"

21.3 Service chains and degraded modes

Operators care about services, not levels. Model a service as a chain of functions with degraded modes: Calder Water's "supply safe water" = abstract raw water → treat → monitor quality → store → pump → distribute. Each function has normal, degraded and failed states. "Monitor quality" degraded might mean manual sampling every hour instead of continuous analysers; "pump" degraded might mean local control by staff at the station without SCADA. A service model that includes degraded modes shows how long the service can continue when automation is lost — the question Ukraine's operators answered in 2015 (Chapter 20).

21.4 Worked example: CPN feeder restoration (synthetic)

This case is synthetic. Calder Power Networks' service "restore supply after a feeder fault": a protection relay trips the faulted section (level 1, independent of SCADA); the RTU reports the trip (level 1→2); the operator sees it on the HMI (level 2) and remotely recloses or reconfigures (level 2→1); customers are informed via the outage system (level 4). Failure analysis by element: if the relay fails, a fault persists — safety issue; if the RTU link fails, operators lose view of that feeder — degraded mode: dispatch a crew; if the HMI is compromised, false status could lead operators to energise a line where crews are working — safety issue that procedures (locks, permits, verbal confirmation) must catch; if the outage system fails, customers are not informed — a service-quality issue. The model shows that the most severe consequences sit where cyber manipulation meets human safety procedures.

21.5 Practical activity

Draw the control loop and layered model for one Calder service other than water or power (rail signalling or hospital theatre ventilation). Label each component with its level, which of view/control/protection it supports, and one degraded mode.

For theatre ventilation, the sensor might be a duct pressure or air-change sensor at level 0, the BMS controller at level 1, the estates workstation at level 2, and the BMS server at level 3. A degraded mode is local manual control of the air-handling units. Mark which component supports view, control or protection; a hard-wired minimum-airflow interlock, if present, is protection.

21.6 Common errors and limits

Treating the layered model as a description of real traffic.
Ignoring safety systems or assuming they are always independent.
Modelling assets without the service they support.
Assuming loss of SCADA means loss of the service.

CPN's feeder model shows the first two: the relay sits at level 1 and acts without SCADA, but if it were networked with the HMI its independence would need evidence. The third error would list RTUs without saying they serve feeder restoration. The fourth ignores the degraded mode of dispatching a crew when an RTU link fails.

Exercises — chapter 21

EX041 — Name the loss. Objective: use the loop vocabulary. Inputs: (a) a historian outage; (b) an HMI showing frozen values; (c) a forged setpoint accepted by a PLC; (d) a disabled SIS trip. Steps: classify each as loss of view, loss of control, manipulation or loss of protection, and state the immediate risk. Expected evidence: four classifications. Rubric: 3 = (a) loss of historical view, low immediate risk; (b) loss of view, dangerous because operators may act on stale data; (c) manipulation of control; (d) loss of protection, highest severity; 2 = one wrong; 1 = two wrong; 0 = none.

EX042 — Degraded modes. Objective: model continuity without automation. Inputs: Calder Transit's "run a safe train service". Steps: write the function chain and a degraded mode for three functions, with the constraint each imposes (e.g. reduced frequency). Expected evidence: chain and modes. Rubric: 3 = sensible chain (signalling, train control, crew communication, passenger information, ticketing) with realistic degraded modes and constraints; 2 = chain without constraints; 1 = vague; 0 = none.

Chapter synthesis

Control systems are loops of sensing, deciding and acting, supervised by SCADA and protected by independent safety systems. Layered models aid segmentation; service chains with degraded modes show how long a service can survive without automation. The worst consequences arise where manipulation meets safety and human procedure.