Security protects the system.
CIE protects the function.
Cyber-Informed Engineering is the consequence-driven framework developed by Idaho National Laboratory for the U.S. Department of Energy. Cybersecurity asks how to keep an attacker out of the control system. CIE asks what happens to the plant if they get in anyway — and designs so that the worst case is bounded by physics, not firmware. Founder Timothy Porritt is a member of the INL Cyber-Informed Engineering Community of Practice; Porritt Inc. applies the framework to every control architecture it designs.
Critical function identification
Name the functions the facility must never lose: cooling, containment, shutdown, pressure relief, power delivery. Rank by consequence. Trace every digital and physical path that could cause their loss.
Consequence-driven design
Engineer the unacceptable consequence out: mechanical limits, relief sized for the real worst case, interlocks that do not depend on the network, process chemistry that cannot be driven past its envelope by software.
Mission assurance
Prove each critical function survives the loss of any single system, including the control network itself. Non-digital backstops, independent protection layers, and verified manual fallback.
Functional resilience
Keep running under degraded conditions: islanding, ride-through, graceful degradation, segmented architectures where a compromised zone cannot reach a protective one.
Operational recovery
Pre-engineered recovery sequencing, known-good configuration baselines, and a restart path the operators have rehearsed, so a disruption is an entry in the log, not a headline.
Critical infrastructure
Refineries, power generation, hydrogen, LNG, carbon capture, HPC halls, and fusion balance of plant: the same six disciplines, scaled to the consequence of each.
What the plant must never lose.
What must survive?
The functions above. Each gets an engineered backstop that does not depend on the digital system: a relief valve, a relay, a gravity drain, a hard-wired trip.
What may fail safely?
Everything that can be allowed to stop: optimization, advisory analytics, remote access, historians. Designed to fail to a known state and to stay out of the protective path.
What must recover first?
The restart sequence, written and rehearsed: power, cooling, protection, control, then supervision. Known-good configurations held offline so recovery is a procedure, not an investigation.
Resilience is the plant’s behavior between “everything works” and “everything is off”. CIE designs that middle state on purpose: degraded operation with the control network segmented or lost, recovery planning with sequencing, baselines and roles decided in advance, and mission assurance as the test that every critical function survives the loss of any single system, the network included.
- Critical function register with consequence ranking
- Independent protection layer map and non-digital backstops
- Segmentation and degraded-mode operating procedures
- Recovery sequence and known-good configuration baselines
- Mission-assurance test plan per critical function
Crude unit charge heater
Firing control stays digital; low-flow and high-skin-temperature trips are hard-wired and relief is sized for blocked-outlet. A compromised DCS cannot overfire the heater.
Exothermic reactor
Quench and emergency cooling on independent logic with a manual line-up; the advisory optimizer may fail freely because it never touches the protective path.
Generator step-up and switchyard
Protective relaying clears faults on measured quantities; SCADA supervises but cannot inhibit a trip. Islanding and black-start are rehearsed, not improvised.
Compressor station
Unit shutdown and blowdown on local logic; pipeline pressure limits enforced by relief and mechanical overpressure protection before any remote command matters.
The industrial examples describe design patterns Porritt Inc. applies; they are not customer case studies and name no facilities.
Interlocks that do not depend on the network
Machine-protection trip paths engineered outside the supervisory layer; one tag namespace for traceability.
Consequence traced to the standard
Every critical function mapped to the OSHA PSM element and the RAGAGEP that governs it.
Fusion plant designed consequence-first
Cryogenic, tritium, vacuum, and electrical systems with engineered limits ahead of digital control.
Critical infrastructure & national labs
Mission assurance and resilience engagements for DOE programs, laboratories, utilities and owners.
Cyber-Informed Engineering is a framework published by Idaho National Laboratory for the U.S. Department of Energy. Porritt Inc. is an independent company; references to INL and DOE describe the framework applied and the audiences served, not endorsement or an existing contractual relationship.
Start with the consequence you cannot accept.
A CIE review begins with your critical functions and ends with an engineered answer for each one.
REQUEST A CIE REVIEW → Critical Infrastructure & National Labs →