Safety System (SIS) Defense Lab
A hazardous process runs under its control system, and a separate Safety Instrumented System stands ready to trip it to a safe state at a hard limit. An adversary — the TRITON/Trisis playbook — is trying to disable, reprogram or spoof that safety controller so the trip never fires. Read each event, tell a real attack from legitimate maintenance, and pick the one right response. Keep the SIS independent and provably able to trip, and the process survives the demand. Get it wrong and the safety layer fails exactly when it is needed.
The real job. More noise, a tighter clock.
Safety demand drill
Event 1 / 5
A hazardous process runs under the BPCS; the SIS must independently trip to a safe state at 550°C. Work each event — is it a legitimate operation or an attack on the safety system — and pick the one right response.
Engineering workstation is downloading modified safety logic
ENG-WS opened a session to the Triconex safety controller. The physical key-switch is reported in PROGRAM, not RUN.
Your response
Exothermic reactor · HMI
408°CThe SIS is armed and independent — it will trip the process to a safe state when the limit is reached.
Progress
0/5 events worked · 0 safety-defeating slip(s) · 0 over-reaction(s).
Live arena
4 activeadversary staging…
What this lab is
- A free, browser-based OT safety lab: defend a Safety Instrumented System (SIS) against a TRITON/Trisis-style attack while a hazardous process climbs toward its trip limit.
- The BPCS runs the process; the SIS is a separate, independent layer that must trip to a safe state at a hard limit — the lab models why those two must never share a controller, network or workstation.
- Each round is an event — a logic download, a trip setpoint pushed out of reach, a spoofed valve, or a perfectly legitimate maintenance bypass — and you pick the one right response.
- Some wrong answers leave the SIS unable to trip; when the safety demand arrives, a defeated SIS means the process reaches an unsafe state and you lose.
- Scored on preserving the safe-state trip, countering every attack, and not over-reacting to sanctioned work — with difficulty tiers, a speed bonus and an S–D grade.
Frequently asked questions
What is the SIS Defense Lab?
A free, in-browser exercise where you defend a Safety Instrumented System (SIS) on a hazardous process against a TRITON/Trisis-style attack. The process runs under a Basic Process Control System (BPCS); the SIS is a separate layer that trips the process to a safe state at a defined limit. Across a series of events you decide whether each is a legitimate operation or an attack on the safety controller, and choose the correct response. If the SIS is disabled, reprogrammed or spoofed before the safety demand arrives, the process reaches an unsafe state.
What was TRITON / Trisis?
TRITON (also called Trisis or HatMan) was malware discovered in 2017 that targeted Schneider Electric Triconex safety controllers at a petrochemical plant. It reached the safety controller because the engineering workstation was compromised and the controller key-switch had been left in PROGRAM mode, which allowed safety logic to be downloaded remotely. It is the first known malware built specifically to attack a safety instrumented system — the layer meant to prevent loss of life.
Why must safety and control be independent?
The SIS exists to act when everything else has failed or been compromised, so it must not depend on the thing it is protecting against. Sharing a controller, a network segment or an engineering workstation between the BPCS and the SIS means a single compromise can defeat both the control layer and the safety layer at once. Independence — separate hardware, network and tooling, plus the physical key in RUN, signed logic under change control, and regular proof-testing — is what keeps the safety trip trustworthy.
Is this a real safety system?
No. It is a teaching model of SIS/BPCS independence and TRITON-style attack techniques (remote logic download, trip-setpoint tampering, sensor and final-element spoofing, firmware abuse). It deliberately simplifies the instrumented functions so the one lesson — keep the safety layer independent and provably able to trip — is clear. The scenarios and events are invented.