Chapter 1 — Calculus I
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 Level is accumulated flow"]
N2["1.2 Why a security engineer cares"]
N3["1.3 Varying draw"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 Level is accumulated flow"]
N2["1.2 Why a security engineer cares"]
N3["1.3 Varying draw"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 Level is accumulated flow]
|
v
[1.2 Why a security engineer cares]
|
v
[1.3 Varying draw]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) model a tank level as the integral of net flow; (2) use that model to compute how long operators have after a pump stops; (3) explain why that time is a security quantity, not only a process one.
1.1 Level is accumulated flow
Feed tank T-1 at Ashford Batch Plant (ABP) holds V(t) cubic metres. If the make-up pump stops at t = 0 and the reactor keeps drawing q(t) m³/h, then V(t) = V₀ − ∫₀ᵗ q(s) ds. The level falls exactly as fast as the outflow, and the time until it reaches the minimum safe hold-up V_min is the t* that solves ∫₀^t* q(s) ds = V₀ − V_min. When q is constant this is (V₀ − V_min)/q; when q varies, you integrate.
1.2 Why a security engineer cares
An attacker who can stop a pump or spoof a level reading changes this integral. The hold-up time is the window in which operators or a safety system must notice and act. If T-1 holds 12 m³, the minimum is 2 m³ and the reactor draws about 1.8 m³/h, operators have roughly 5.5 hours. That number goes straight into the detection requirement: an alarm that fires after six hours detects nothing useful. Calculus turns "detect quickly" into "detect within 5.5 hours, with margin".
Lena writes the number into the requirement together with how it was calculated.
1.3 Varying draw
ABP's draw oscillates with the batch recipe: q(t) = 1.8 + 0.4 sin(2πt/6). Its integral has a closed form, and the lab solves for t* by bisection. The answer, 5.53 h, is close to the average-rate estimate of 5.56 h because the oscillation averages out over a full six-hour cycle; with a shorter window or a skewed recipe the two would diverge, and the conservative choice is the smaller time.
# Lab 1 - tank hold-up after feed pump stop (Ashford Batch Plant, synthetic)
import math
V0, VMIN = 12.0, 2.0 # m3 in feed tank T-1
def outflow(t): # m3/h to reactor; t hours after stop of makeup
return 1.8 + 0.4*math.sin(2*math.pi*t/6)
def drawn(t):
return 1.8*t - (0.4*6/(2*math.pi))*(math.cos(2*math.pi*t/6)-1)
lo,hi=0.0,24.0
for _ in range(50):
mid=(lo+hi)/2
lo,hi=(mid,hi) if drawn(mid)<V0-VMIN else (lo,mid)
print(f"time to min level: {lo:.2f} h")
print(f"average-rate estimate: {(V0-VMIN)/1.8:.2f} h")
Expected output:
time to min level: 5.53 h
average-rate estimate: 5.56 h
Synthetic case — Ashford Batch Plant. Lena Okafor, engineer on the Control Network Hardening Programme (CNHP), used the hold-up calculation to argue that a low-level alarm on T-1 must be independent of PLC-A, because a compromised PLC could suppress both pump status and the alarm inside the 5.5-hour window.
1.4 Errors and limits
Models assume the level sensor is honest; Chapter 29 treats sensor spoofing. Mixing m³/h with minutes is the most common slip. Always choose the conservative root when uncertainty is large.
A spoofed level reading is the case this model cannot handle: if the transmitter reports a full tank while T-1 drains, the integral is correct but nobody is looking at it. That is why Lena pairs the hold-up calculation with an independent level switch. Check units at every step, write the time in hours with the assumed draw beside it, and repeat the calculation whenever the recipe changes the reactor's demand.
Exercises
- EX001 — Constant draw. T-2 holds 9 m³, minimum 1.5 m³, constant draw 1.25 m³/h. Time to minimum? Rubric: 3 = 6.0 h with working; 2 = right method, arithmetic slip; 1 = formula only; 0 = none.
- EX002 — Requirement. Turn your EX001 answer into a detection requirement with margin. Rubric: 3 = time bound with stated margin and independence from the controlling PLC; 2 = time bound only; 1 = vague "fast"; 0 = none.
- EX003 — Lab reading. Why are the bisection and average-rate answers so close here, and when would they not be? Rubric: 3 = full sine cycle averages to 1.8; skewed or short window diverges; 2 = one half; 1 = vague; 0 = wrong.
Synthesis
Hold-up time is an integral and a security budget at once: it bounds how late detection may be.