Chapter 33 — Critical infrastructure and sector security: safety and resilience
Lesson map
Lesson 33 published. Map, example, EX034.
flowchart TD
N0["Learning outcomes and connection"]
N1["33.1 STPA"]
N2["33.2 Safety instrumented systems and independence"]
N3["33.3 Resilience"]
N4["33.5 Practical activity"]
N5["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX034"]
Logical drawing
flowchart LR
N0["Learning outcomes and connection"]
N1["33.1 STPA"]
N2["33.2 Safety instrumented systems and independence"]
N3["33.3 Resilience"]
N4["33.5 Practical activity"]
N5["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX034"]
[Learning outcomes and connection]
|
v
[33.1 STPA]
|
v
[33.2 Safety instrumented systems and independence]
|
v
[33.3 Resilience]
|
v
[33.5 Practical activity]
|
v
[Chapter synthesis]
|
v
[Worked example] --> [Exercise EX034]
Learning outcomes and connection
After this chapter you can (1) apply System-Theoretic Process Analysis (STPA) to a control structure, including security-related causes; (2) describe safety instrumented systems and why they need independence; (3) define and engineer resilience — anticipate, withstand, recover, adapt; and (4) integrate safety, security and resilience in one analysis. It builds on Chapters 10, 17, 23 and 32 and prepares Chapters 34 and 47.
33.1 STPA
Leveson (2004) proposed STAMP, an accident model that treats safety as a control problem: accidents arise when constraints on system behaviour are not enforced. STPA, the analysis method built on it, proceeds: (1) define losses and hazards; (2) model the control structure — controllers, control actions, feedback; (3) identify unsafe control actions (UCAs) in four types: not provided when needed, provided when unsafe, provided too early/late or in the wrong order, stopped too soon or applied too long; (4) identify loss scenarios — why each UCA could occur, including flawed feedback, flawed process models and, for security (STPA-Sec), adversary action. STPA's strength is that it finds hazards from interactions where no component has failed — exactly the situation of a false-data attack.
33.2 Safety instrumented systems and independence
A safety instrumented system (SIS) takes a process to a safe state when a hazardous condition is detected, independent of the basic process control system. Functional safety standards (IEC 61508 and sector derivatives) assign safety integrity levels. Independence means separate sensors, logic and final elements, and in modern terms separate networks and engineering access, because a compromised engineering workstation that can reprogram both control and safety logic removes the independence. TRITON targeted SIS controllers directly (CISA HatMan report).
33.3 Resilience
NIST SP 800-160 Vol. 2 Rev. 1 frames cyber resiliency around the goals to anticipate, withstand, recover and adapt, with techniques such as diversity, segmentation, redundancy, non-persistence and adaptive response. Haimes (2009) argues that resilience must be defined relative to specific threats and system states. Engineering resilience means: design degraded modes (Chapter 22), keep capacity and buffers (storage, batteries, spares), make recovery fast and practised (Chapter 47), and learn after events.
For LRWA, the hospital tank, cabinet batteries and 72 hours of local automatic operation are buffers; the recovery trial is practice.
33.4 Worked example: STPA on Hollin Hill level control (synthetic)
Loss L1: hospital without water; L2: reservoir overflow and flooding. Hazards: H1 level below floor while demand continues; H2 level above overflow. Control structure: SCADA operator → PI controller (PS3 pump speed) → pump → reservoir; feedback via level transmitter. UCAs: UCA1 "controller reduces inflow when level is low" (provided when unsafe → H1); UCA2 "operator does not intervene when level falls" (not provided → H1); UCA3 "controller increases inflow when level is high" (→ H2). Scenario for UCA1: the controller's process model believes the level is high because the level feedback is falsified (Lab 7). Scenario for UCA2: operator's display shows the same falsified level. Constraints: independent level measurement with alarm (EX034); hard-wired high-level pump trip for H2; low-level alarm to operator from the independent measurement. STPA arrived at the same control as the residual detector, but from the hazard rather than from the attack.
33.5 Practical activity
Extend §33.4 with the dosing loop: losses, hazards, control structure, at least four UCAs (one of each type) and one loss scenario each, one of them adversarial.
Start with losses such as harm to consumers from overdosing or underdosing, and hazards such as residual chlorine outside its limits. Draw the control structure: the operator, the dosing controller, the dosing pump and the analyser that feeds back the residual. Use the controller-side bounds and the independent analyser alarm from TMRP's dosing controls when you derive constraints, and make your adversarial scenario one in which the controller's feedback is falsified.
33.6 Common errors and limits
- Hazard analysis that ignores adversaries, or security analysis that ignores hazards.
- SIS "independence" with shared engineering workstation or network.
- Resilience defined as "uptime".
- STPA reduced to a checklist without a control structure.
EX066 shows the second error at Fenwick, where the chlorine gas shutdown system shares the engineering workstation and network switch with the process controllers. TMRP's analysis of Hollin Hill avoids the first error by including the falsified level feedback as a loss scenario alongside random faults, and treats resilience as service delivered over time rather than server uptime.
Exercises — chapter 33
EX065 — UCA table. Objective: identify unsafe control actions. Inputs: §33.5. Steps: produce the UCA table with four types and scenarios. Expected evidence: table. Rubric: 3 = four types correctly applied, scenarios include flawed feedback and adversary action, constraints derived; 2 = types confused; 1 = list of failures, not control actions; 0 = none.
EX066 — Independence audit. Objective: test SIS independence. Inputs: Fenwick's chlorine-gas leak shutdown system shares the engineering workstation and network switch with the process controllers. Steps: identify the independence violations and propose an architecture restoring independence, with residual risks. Expected evidence: half page. Rubric: 3 = shared workstation and switch identified, separate engineering access with physical key or separate workstation, separate network or hard-wired, residual stated; 2 = one violation missed; 1 = generic; 0 = none.
Chapter synthesis
STPA treats losses as failures of control and finds unsafe control actions arising from interactions, including adversarial ones. Safety instrumented systems must be independent in sensors, logic, networks and engineering access. Resilience — anticipate, withstand, recover, adapt — must be defined against specific threats and engineered through degraded modes, buffers and practised recovery.
Continue studying — chapter 33 of 50
← Chapter 32 · Course chapter index · Chapter 34 →
Continue to the next authored lesson.