Physical process invariants

"You can lie to me about the tank level. You cannot lie to me about the tank, the pump, and the level all at once and still balance the books."

An Unbribable AI Agent

What an invariant is, precisely

Let the plant expose a vector of process variables \(z_t = (s_t, a_t)\) at time \(t\), where \(s_t\) collects sensor readings (levels, flows, pressures, temperatures) and \(a_t\) collects actuator states (pump on/off, valve position, motor speed). A process invariant is a predicate \(\phi(z_t, z_{t-1}, \ldots)\) that evaluates to true for every physically consistent trajectory of the plant. Two flavours matter. A stateless invariant constrains a single snapshot, for example "if pump P101 is ON then flow FIT101 exceeds \(0.5\) m\(^3\)/h." A stateful invariant constrains change over time and usually encodes a conservation law, for example the mass balance of a tank,

where \(L\) is level, \(A\) the tank cross-section, and \(Q_{\text{in}}, Q_{\text{out}}\) the metered flows. Discretised, this says the measured level change over one step should equal the net flow times \(\Delta t / A\); any persistent gap is an invariant residual \(r_t = |\Delta L_t^{\text{meas}} - (Q_{\text{in}} - Q_{\text{out}})\,\Delta t / A|\) that a healthy plant keeps near sensor-noise size and an attack drags away from zero.

The security value comes from redundancy across variables. A single reading has no internal consistency to check; it is whatever the wire says. But a mass balance couples three meters, and an actuator-flow rule couples a command to its effect. To defeat the invariant, an attacker must corrupt every variable in the predicate in a mutually consistent way, in real time, without access to the true physical state. That is a qualitatively harder attack than flipping one number, which is exactly why invariants are a security primitive and not merely a plausibility filter.

A taxonomy: physical, control, and data-driven invariants

Invariants come from three sources, and knowing which you are holding tells you how much to trust it. First-principles physical invariants follow from conservation of mass, energy, and momentum, or from device physics: a mass balance, an energy balance, a pump curve relating speed to head and flow. These are the strongest because they hold by law, independent of the historian data, so no amount of clever training data can erase them. Control and design invariants follow from how the plant was engineered and programmed: the piping-and-instrumentation diagram (P&ID) says valve MV201 gates the line feeding tank T2, and the PLC logic says P101 turns on only when level LIT101 is below its low setpoint. These encode the intended cause-effect wiring of actuators and sensors. Data-driven invariants are relationships mined from historian logs of normal operation: a strong correlation, a linear relation among pressures, a discretised association rule that always held across a year of clean data. They are the easiest to obtain at scale and the weakest to trust, because a relation that merely held in the training window may be a coincidence of operating conditions rather than a law, a subtlety that the physics-informed modelling of Chapter 55 takes up in depth.

Two properties cut across the taxonomy. An invariant can be state-dependent: the flow-versus-pump rule only applies while the pump is commanded ON, so the predicate must be guarded by the actuator state rather than asserted unconditionally. And an invariant has a tolerance: no real plant satisfies \(r_t = 0\) exactly, because sensors are noisy and models are approximate, so every invariant ships with a band \(r_t \le \tau\) whose width you set from clean data to trade false alarms against missed attacks, precisely the threshold-selection problem of Chapter 12.

Deriving and mining invariants

There are two routes to a rulebook, and mature deployments use both. The design-led route reads the P&ID, the control narrative, and the PLC ladder logic, and transcribes the physics and the intended interlocks into predicates by hand. It yields few rules but strong ones, each auditable by an engineer and each grounded in law or specification. The data-led route runs an automated miner over a clean historian dump: discretise continuous signals into a few levels, then search for relations that hold on (almost) every logged row, whether linear equalities among analog variables or association rules among the discretised states. This yields many candidate rules cheaply, at the cost of a validation burden, because the miner cannot tell a physical law from a habit of the operating schedule.

The listing below makes the stateful case concrete. It simulates a tank under a mass balance, injects a sensor-freeze attack, and shows that a single physics invariant, thresholded from clean early data, separates the attack from normal operation cleanly. The residual is referenced in the discussion that follows.

import numpy as np
rng = np.random.default_rng(0)

T, A, dt = 2000, 1.5, 1.0                       # steps, tank area (m^2), step (s)
t = np.arange(T)
Qin  = 0.020 + 0.005*np.sin(t/50)               # metered inflow  (m^3/s)
Qout = 0.020 + 0.005*np.cos(t/60)               # metered outflow (m^3/s)

# True level integrates the mass balance; the sensor adds small noise.
level = 1.0 + np.cumsum((Qin - Qout)*dt)/A
meas  = level + rng.normal(0, 1e-3, T)

# ATTACK: from t=1200, freeze the level sensor while the tank keeps filling.
meas_att = meas.copy()
meas_att[1200:] = meas[1200]

# INVARIANT residual: measured level change vs. what the flow balance predicts.
pred_dL = (Qin - Qout)*dt / A
resid   = np.abs(np.diff(meas_att) - pred_dL[1:])

tau   = 6 * resid[:1000].std()                  # threshold from clean early window
alarm = resid > tau
print(f"threshold tau           : {tau:.2e} m")
print(f"false-alarm rate  t<1200: {alarm[:1199].mean():.3f}")
print(f"detection rate    t>=1200: {alarm[1199:].mean():.3f}")

As Listing 38.1 shows, the invariant needs no library of past attacks, only a clean baseline to size its tolerance \(\tau\). That is the structural gift of physics-based detection: it defends against manipulations it has never observed, because it defends the law rather than a memorised signature. The data-led route trades some of that certainty for coverage, mining the analog and discrete relations that no one thought to transcribe by hand.

from mlxtend.frequent_patterns import apriori, association_rules
# df_onehot: historian rows one-hot encoded as "SENSOR=level" boolean columns
freq  = apriori(df_onehot, min_support=0.02, use_colnames=True)
rules = association_rules(freq, metric="confidence", min_threshold=0.999)
# keep near-certain rules as candidate invariants, then validate against physics