# A Configurable Dependency Model of a SCADA System for Goal-Oriented Risk Assessment
## 6 Illustrative Example: Water Distribution System
### Scenario Description  
The pipeline is equipped at intervals along its length with pressure transducers (sensors), pumps and valves. The valves can be placed every 5 to 20 miles along the pipeline. A Remote Terminal Unit (RTU) periodically collects data from the pressure sensors, which are scattered over the pipeline, and sends commands to valves and pumps.  
We examine the section of the pipeline where RTU 1 collects the pressure readings from Sensor 1 and controls the safety shut-off valve, and where its neighbouring RTU 2 collects the pressure readings from Sensor 2 and controls the pump. Both RTUs are commonly used data logging components CR1000 Measurement and Control Systems [28].  
The business process diagram expressed in Business Process Model and Notation (BPMN) [29] in Figure 4 shows the process of communication between the control centre, RTU 1, RTU 2 and other field equipment. On the initiation of the control process RTU 1 requests a pressure value from Sensor 1 (_P1_) and verifies whether the pressure exceeds a threshold value (_Pmax_). If _P1_ is greater than _Pmax_, then control actions are taken to adjust the flow rate and pressure in the pipeline. We indicate this in the diagram with an intermediate throwing Link Event \"Pressure Correction\". The actions required to correct the pressure may be depicted in a separate diagram, but in this example, we do not focus on this scenario. If _P1_ does not exceed _Pmax_, RTU 1 requests the pressure reading from RTU 2, which it receives from Sensor 2 (_P2_). RTU 1 calculates the pressure difference between its own sensor and the sensor of RTU 2 (\(\Delta P=|P1-P2|\)). The threshold (\(\Delta Pmax\)) is typically exceeded by \(\Delta P\) when the pipeline is broken. If \(\Delta P\) does not exceed its threshold, then RTU 1 repeats the request to its sensor after a scan interval. A scan interval is set for each CR1000 and may vary between 1 s and 1 h. If \(\Delta P\) exceeds the threshold, then RTU 1 sends an alarm signal to the control centre. The control centre answers with an emergency control order to RTU 1 to shut down the valve and to RTU 2 to stop the pump. The CR1000 has 8 Digital I/O ports selectable under program control as binary inputs or control outputs. One of these ports is used as output to switch power to the pump via a solid state relay. The orders from the control centre allow shutting down the portion of the pipeline in the event of an accident or for other safety reasons.  
The physical access to the RTUs is controlled in this segment of pipeline (in this scenario, a 40 foot by 40 foot area around a mainline valve site is surrounded by a chain-link fence and the devices are placed in a locked enclosure), and video surveillance is in place. For the sensors, neither physical access is controlled nor is a video surveillance system for monitoring these field devices installed. The RTUs are locally installed on pumps and valves, and they control their operation-communicating via a unidirectional wired link over fieldbus cables transmitting digital (binary) output from a digital port on CR1000 to the two-state field devices. High-precision pressure sensors have RS485 digital interface and an optional USB or RS232 converter cable. In our segment, the sensors are connected to the CR1000s via RS232 port.  
The RTUs communicate with the control centre, which is located hundreds of kilometres away from the pipeline over public networks. The RTUs communicate with the HMI at the control center over Modbus TCP communication protocol. RTUs communicate with  
Figure 4: Exchange of Information between Devices in a SCADA System in the Water Distribution Scenario.  
each other to exchange pressure readings over a bidirectional wireless link using Modbus RTU protocol.