◇ OpenCyber Academy
Bachelor's · Chapter 21 · English

Chapter 21 — OT, IoT and cyber-physical security: system models

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 21 — OT, IoT and cyber-physical security: system models

Lesson map

Lesson 21 published. Map, example, EX061.

flowchart TD
  N0["Learning outcomes"]
  N1["21.1 Why model"]
  N2["21.2 A buffer tank with proportional control"]
  N3["21.3 Reading the model"]
  N4["21.4 Using the model for security"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX061"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["21.1 Why model"]
  N2["21.2 A buffer tank with proportional control"]
  N3["21.3 Reading the model"]
  N4["21.4 Using the model for security"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX061"]

[Learning outcomes]
    |
    v
[21.1 Why model]
    |
    v
[21.2 A buffer tank with proportional control]
    |
    v
[21.3 Reading the model]
    |
    v
[21.4 Using the model for security]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX061]

Learning outcomes

You will (1) build a discrete-time model of a tank or loop; (2) explain proportional control and its steady-state offset; (3) use a model to predict how fast a manipulated setpoint changes the process; and (4) state what a simplified model leaves out.

21.1 Why model

A model turns "the attacker changes the setpoint" into "the level reaches the overflow alarm in 12 minutes". Defenders use that time to size detection and response: if the process gives 12 minutes, a detector that takes 20 is useless for that scenario.

For LDHP the question is concrete: if register 100 is written to 30 °C at 02:10, how long before radiators in the district cool enough for residents to notice, and how long before pipes in the coldest streets are at risk? Chapter 29's tabletop had the operator restore 90 °C by 02:15, five minutes after the alert. A model tells you whether five minutes is comfortable or close to the limit, and therefore whether the monitor's alert, rather than a resident's phone call, has to be the detection.

21.2 A buffer tank with proportional control

LDHP's expansion vessel buffers water volume as temperature changes. The lab models its level with a proportional controller that sets inflow to kp·(setpoint − level), clipped to the pump's 0–5 range, against a constant outflow.

"""Lab 21: discrete-time model of a synthetic buffer tank with a proportional level loop."""
level, sp, kp = 40.0, 60.0, 0.08
for step in range(0, 61):
    inflow = max(0.0, min(5.0, kp * (sp - level) * 10))
    outflow = 2.0
    if step % 10 == 0: print(f"t={step:2} level={level:5.1f}% inflow={inflow:4.2f}")
    level += (inflow - outflow) * 0.5
print("steady-state error ~", round(sp - level, 1), "pct (P-only offset)")

Run with python3 lab_tank.py. Verified output:

t= 0 level= 40.0% inflow=5.00
t=10 level= 55.0% inflow=4.00
t=20 level= 57.5% inflow=2.01
t=30 level= 57.5% inflow=2.00
t=40 level= 57.5% inflow=2.00
t=50 level= 57.5% inflow=2.00
t=60 level= 57.5% inflow=2.00
steady-state error ~ 2.5 pct (P-only offset)

The lab uses kp = 0.08, scaled by 10 in the inflow line to an effective gain of 0.8, a setpoint of 60 %, a starting level of 40 % and outflow fixed at 2.0, so the pump runs at its 5.0 limit at first. Its output prints the level every 10 steps: 55.0 % at t = 10, then 57.5 % from t = 20 onward, with inflow 2.01 at t = 20 and 2.00 from t = 30. The numbers are invented for LDHP's vessel, but the shape is general: a proportional loop that cannot quite reach its setpoint.

21.3 Reading the model

The level rises quickly while inflow is saturated at 5, then settles at 57.5 % rather than 60 %. That 2.5-point gap is the classic proportional-only offset: at equilibrium inflow must equal outflow (2.0), which requires a non-zero error (2.0 / 0.8 = 2.5). Integral action removes the offset; engineers usually use PI or PID control.

For security this offset matters in a way that is easy to miss: an operator used to seeing 57.5 % against a 60 % setpoint will not notice a further small gap. A sensor bias or a modest setpoint change hides inside a difference everyone already accepts as normal.

21.4 Using the model for security

If an attacker moves the setpoint from 60 % to 95 %, the model predicts how long the level takes to cross a high alarm at 85 %. The same model tells you how a sensor bias of +10 points would make the controller under-fill the vessel. Models connect cyber actions to process time.

To use the lab this way, change the setpoint in a copy of the script from 60 to 95 at a chosen step and print the first step at which the level passes 85; with the pump limited to 5.0 against outflow fixed at 2.0, the level can rise by at most (5.0 − 2.0) × 0.5 = 1.5 points per step. Record the edit and the output together. A +10 sensor bias works the other way round: the controller sees the level 10 points higher than it is, so it settles about 10 points low, and nobody sees it on HMI-1.

Worked example (synthetic LDHP)

Using the lab's dynamics, with inflow saturated at 5 and outflow 2, level rises at (5 − 2) × 0.5 = 1.5 points per step. From the 57.5 % steady state to an 85 % alarm is 27.5 points, so about 18–19 steps. If one step represents 20 seconds, operators have roughly six minutes.

Synthetic case — Lakeside District Heating Plant. The tank gains and step length are invented.

Errors and limits

Real vessels have nonlinear geometry, valve dynamics and measurement noise. A model validated on normal operation may be wrong in the extreme states an attacker seeks. Never derive real plant limits from a classroom model.

Exercises

Synthesis

Simple process models give defenders a clock: how long a manipulated loop takes to reach harm, and therefore how fast detection and response must be.

Continue studying — chapter 21 of 40

← Chapter 20 (draft) · Course chapter index · Chapter 22 (draft) →