OpenCyber AcademyLearning outcomes
After this chapter you can (1) turn a plant sentence into a quantity with units; (2) estimate an order of magnitude before computing; (3) state the assumption that makes a calculation valid; and (4) recognise when a precise-looking number hides a guess. The running case is the synthetic Lakeside District Heating Plant (LDHP).
1.1 Why an OT student needs proof habits
Security claims about a heating plant are quantitative whether we admit it or not. "The network change is low risk" really means "the probability of losing supply-temperature control, multiplied by the harm to households, is below a threshold we accept." Mathematical reasoning makes the hidden terms visible. The habit is simple: write every quantity with its unit, name the assumption that links it to the next quantity, and check the result against a rough estimate made before any calculator is touched.
1.2 Units and dimensional checks
District heating mixes kilowatts, cubic metres per hour, degrees Celsius and seconds. Delivered heat power is approximately P = ρ · c · Q · ΔT, with water density ρ ≈ 1000 kg/m³ and specific heat c ≈ 4.19 kJ/(kg·K). If you write Q in m³/h you must divide by 3600 to obtain kg/s. A dimensional check catches that slip before it becomes a wrong boiler sizing argument in a risk register.
Maya's first memo needed exactly this check: a 5 K setpoint error is a ΔT, so the shortfall scales with flow, and a flow quoted in m³/h gives a number 3600 times too large unless it is converted to kg/s first.
1.3 Implication, contrapositive and counter-example
"If the SIS is independent, then a SCADA compromise cannot disable the trip." The contrapositive — "if a SCADA compromise can disable the trip, the SIS is not independent" — is logically equivalent and often easier to test. The converse is not equivalent: a trip that survives one test does not prove independence. One documented counter-example, such as a shared engineering workstation that can download to both controllers, refutes a universal claim.
At LDHP the counter-example to look for is EWS-1: if one engineering workstation can download logic to both PLC-H and SIS-H, the claim that SIS-H is independent of a control-zone compromise is false, however many trip tests SIS-H has passed.
Worked example (synthetic LDHP)
LDHP pumps Q = 180 m³/h with ΔT = 30 K. Estimate first: 0.05 m³/s × 1000 kg/m³ × 4.19 kJ/(kg·K) × 30 K ≈ 6,300 kW. Exact: 180/3600 = 0.05 m³/s, so P = 50 kg/s × 4.19 × 30 = 6,285 kW ≈ 6.3 MW. If an attacker could only change the supply setpoint by 5 K, ΔT falls to 25 K and the delivered heat drops to 5,237.5 kW, a 1,047.5 kW shortfall. That shortfall, not the packet, is the consequence a risk owner can weigh.
Synthetic case — Lakeside District Heating Plant. Student Maya Chen joins LDHP's engineering office. Her first memo must express the heat shortfall caused by a 5 K setpoint error in kilowatts, with every assumption listed.
Errors and limits
The heat formula ignores pipe losses and the fact that density and heat capacity drift with temperature. A two-significant-figure answer is honest; six digits imply knowledge you do not have.
Exercises
- EX001 — Heat at reduced flow. LDHP's flow falls to 150 m³/h while ΔT stays 30 K. Compute the delivered power and show the unit conversion.
Show marking criteria
Rubric: 3 = 5,237.5 kW with m³/h→kg/s shown; 2 = correct value, no conversion; 1 = forgot /3600; 0 = no attempt. - EX002 — Contrapositive of a zoning claim. Write the contrapositive of "if the meter gateway has no route to the control zone, it cannot write to PLC-H".
Show marking criteria
Rubric: 3 = correct contrapositive and why it is testable; 2 = correct form only; 1 = gives converse; 0 = none. - EX003 — Estimating before computing. Give a one-line order-of-magnitude estimate of daily heat delivered at 6.3 MW.
Show marking criteria
Rubric: 3 = ≈150 MWh/day with method; 2 = right order; 1 = unit error; 0 = none.
Synthesis
Quantities with units, assumptions said aloud and counter-examples sought: these three habits turn a security opinion about a plant into an argument someone can check.