## 4 Cybersafety Analysis
### Model the Functional Control Structure
\begin{table}
\begin{tabular}{l l l} \hline \hline \multicolumn{1}{c}{**Unacceptable Losses**} & \multicolumn{1}{c}{**System-Level Threats/Hazards**} & \multicolumn{1}{c}{**System-Level Constraints**} \\ \hline L-1: Death, dismember or & T-1: Attacker operates chiller plant beyond normal operational limits & SC-1: System must not operate beyond normal operational limits \\ injury to personnel & H-1: System is operated beyond normal operational limits (temperature, pressure, flow-rate) & operational limits \\  & pressure, flow-rate) [L-1, L-2, L-3] & T-2: Attacker prevents chiller plant from meeting cooling load \\ L-2: Physical damage to critical & H-2: System does not meet cooling load [L-3] & SC-2: System must be adequately controlled to \\ equipment & H-2:1. Inadequate throttling of cooling capacity & meet cooling load \\  & H-2:2. Inadequate distribution of chilled water to facility buildings & H-2:3. Inadequate rejection of waste heat to atmosphere \\  & S-3: Attacker forces Chiller plant to violate order and/or timing sequence & \\ L-3: Loss of mission, i.e., inability to & (permissive functions, lube oil system) & SC-3: System must not violate order or timing \\ deliver chilled water & H-3: System violates order and/or timing sequence of operations & sequence of operations \\  & [L-1, L-2, L-3] & T-4: Attacker causes a refrigerant leakage \\  & H-4: System is unable to prevent contamination of environment with & SC-4: System must prevent environment \\  & refrigerant leakage [L-1] & contamination due to refrigerant leakage \\ \hline \hline \end{tabular}
\end{table} 
Table 1: System-level Losses, Hazards and Constraints. Although each of the field devices are operated as individual components, they together interact in indirect ways to produce complex, emergent behavior that is greater than the sum of the parts. Each control decision is made in such a way so as to achieve a global optimum for the plant to maximize efficiency. An Energy Management System  
Figure 3: Detailed Hierarchical Functional Control Structure for the Chiller Plant. (EMS) service provider is contracted to provide recommendations for optimum integrated performance. The EMS combines aggregated data from the plant's DCS, IIoT sensors and real-time market, weather and fuel prices with predictive analytics to recommend operating points that maximize efficiency for the plant. The EMS has the ability to automatically update the plant control parameters remotely as well; although this feature is currently not employed. In addition to the operational technology (OT) field equipment (including PLCs, chiller controllers, HMI, etc. ), there are a number of information technology (IT) controllers as well that are primarily responsible for enforcing security constraints on the system. These include IT tools such as network firewalls, identity management and access control, vulnerability and patch management software, network management, etc. The IT tools are primarily managed by the corporate IT team which is responsible for formulating and enforcing the IT security policy on the plant personnel and equipment. For the purpose of this paper, we limit our focus to the chiller cooling capacity control loop. The chillers at the plant are equipped with a controller that regulates the cooling capacity of the chiller in response to chilled water temperature deviation from a set-point by adjusting the speed of the compressor motor [24]. The PLC receives feedback from several sensors, monitoring various physical processes, including refrigerant discharge and suction temperatures and pressures, condenser and evaporator water temperatures, pressures and flows, compressor lube oil temperature and pressure, guide vane position, etc., and computes the required compressor speed which is then implemented via a Variable Frequency Drive (VFD).