CYBER THREAT MODEL AND PROTECTION ARCHITECTURE FOR THE AUTOMATED CONTROL SYSTEM OF A WASTE-TO-ENERGY PLANT

Abstract

A control system for thermal waste conversion has to be protected even when the plant documentation cannot be fully disclosed. This paper builds a reproducible threat model for such a system and tests how three mechanisms affect control quality: message validation, a consistency check between two measurement channels, and local limits on setpoints. The proposed architecture separates remote access, an industrial demilitarized zone, the operator zone and the local control zone. An independent local measurement channel supports fallback control, and the safety instrumented system stays outside the authority of any cyber detector. Since no identified plant model is available, the quantitative part relies on a dimensionless first-order surrogate process. The main series has 720 runs: eight scenarios, three protection variants and 30 random seeds. With a constant bias injected into one channel, the mean absolute error fell from 0.13643 to 0.04140, and the share of samples outside the comparison band fell from 59.20% to zero. For a slow drift, the median delay to the first alarm was 31 model steps. Equal bias in both channels went undetected, and the combined variant then performed exactly like the baseline. A further 540 runs examined noise and threshold. At a fixed threshold of 0.04, raising the measurement noise from 0.005 to 0.02 increased the per-sample false alarm rate from zero to 15.42%. The rate depends on the ratio of threshold to noise and agrees with a simple Gaussian estimate. All figures describe the surrogate model only. They are not plant test results and do not certify functional safety. The practical outcome is a traceable link between threats, acceptance rules, fallback behavior and measurable control outcomes, plus a list of the data needed to move the procedure to a hardware test bench.