# Systems Perspective Description Language — OT Cyber-Physical Security (SPDL-ZONES)
**Specification Document ID:** `SPDL-ZONES-SPEC-2026-v4.2`  
**Classification:** Open Epistemic Standard / Hard Real-Time Physics-Aware Zero-Trust Substrate  
**Principal Architect:** Asse van Nix | Systems Perspective Framework & Proof-Driven Architecture Group  
**Target Environment:** Zig 0.16.0 Freestanding · Industrial Security Conduits · FPGA Security Boundary · IEC 62443  
**Applied Standards:** ISO/IEC 14977 EBNF · GBNF Maskable · IEC 62443-3-3 / IEC 62443-4-2 (IACS Security) · NIST SP 800-82 · NERC CIP-005  

---

## 1. Epistemic Architecture: Why Traditional IT Firewalls Fail in OT

1. **Deep Packet Inspection Blindness:** IT firewalls (Palo Alto, Fortinet) inspect Ethernet headers and payload byte signatures. However, they do not understand industrial process physics. A cryptographically valid, authorized Modbus or OPC-UA write command can command an overpressure excursion that explodes a pipeline.
2. **Non-Deterministic Packet Jitter:** Stateful IT firewalls introduce unpredictable millisecond queueing delays, disrupting hard real-time motion control and protective trip coordination.

**SPDL-ZONES** introduces **Physics-Aware Zero-Trust Conduits**: packets are dropped on silicon if the commanded actuation pushes the plant manifold outside its Lyapunov-stable safe set ($\mathcal{S}$), regardless of cryptographic credentials.

---

## 2. Physical Invariants, DAEs & Mathematical Proof Gates

```
                           SPDL-ZONES SECURITY MANIFOLD
 ┌─────────────────────────────────────────────────────────────────────────────┐
 │ CONDUIT PHYSICAL STATE-SPACE GATING EQUATION                                │
 │   Decision(Packet) = (Verify_Crypto(Auth) && (Forward_Sim(Cmd) in Safe_Set))│
 ├─────────────────────────────────────────────────────────────────────────────┤
 │ IEC 62443 UNIDIRECTIONAL DIODE TRANSMISSION INVARIANT                       │
 │   Data_Flow(Safety_Zone -> Enterprise_Zone) == ALLOW                        │
 │   Data_Flow(Enterprise_Zone -> Safety_Zone) == HARDWARE_BLOCKED             │
 ├─────────────────────────────────────────────────────────────────────────────┤
 │ REPLAY & COMMAND TAMPERING BARRIER                                          │
 │   h_tamper(Nonce, Timestamp) = (t_now - t_pkt <= 25ms) && IsFresh(Nonce)   │
 └─────────────────────────────────────────────────────────────────────────────┘
```

---

## 3. Formal ISO/IEC 14977 EBNF Grammar

```ebnf
ZonesManifest     = { Line } ;
Line              = [ Whitespace ] , ( Comment | ZonesRecord ) , Newline ;
Whitespace        = { " " | "\t" | "\r" } ;
Newline           = "\n" | "\r\n" ;
Comment           = "#" , { AnyChar - Newline } ;

ZonesRecord       = "(I) @ZONES_INVARIANT"   , " " , InvariantFields
                  | "(A) @SECURITY_ZONE"     , " " , ZoneFields
                  | "(B) @PHYSICS_GUARD_BAR" , " " , PhysicsGuardFields
                  | "(M) @CONDUIT_POLICY"    , " " , PolicyFields
                  | "(T) @CONDUIT_OBSERVER"  , " " , ObserverFields ;

InvariantFields   = "id:" , Token , " sec_level:" , SecurityLevel , " max_latency_us:" , Integer , " alloc_policy:ZERO_HEAP" ;
SecurityLevel     = "SL_1" | "SL_2" | "SL_3" | "SL_4" ;

ZoneFields        = "id:" , Token , " zone_type:" , ZoneType , " subnet:" , Token ;
ZoneType          = "SAFETY_INSTRUMENTED_SIS" | "BASIC_PROCESS_CONTROL" | "PLANT_SUPERVISORY" | "ENTERPRISE_DMZ" ;

PhysicsGuardFields= "id:" , Token , " protected_asset:" , Token , " invariant_rule:" , QuotedStr ;

PolicyFields      = "id:" , Token , " from_zone:" , Token , " to_zone:" , Token , " mode:" , ConduitMode ;
ConduitMode       = "UNIDIRECTIONAL_DIODE" | "PHYSICS_INSPECTED_MUTEX" | "BLAKE3_AUTHENTICATED" ;

ObserverFields    = "id:" , Token , " pass_count:" , Integer , " drop_physics_violation:" , Integer , " latency_us:" , Number ;

QuotedStr         = '"' , { AnyChar - ( '"' | Newline ) } , '"' ;
Token             = Letter , { Letter | Digit | "_" | "-" | "." | "/" } ;
Number            = [ "-" ] , Digit , { Digit } , [ "." , { Digit } ] ;
Integer           = [ "-" ] , Digit , { Digit } ;
Letter            = "A".."Z" | "a".."z" ;
Digit             = "0".."9" ;
AnyChar           = ? Any valid Unicode code point ? ;
```

---

## 4. GBNF Structured Sampling Grammar

```gbnf
root ::= ZonesRecord "\n"

ZonesRecord ::= "(I) @ZONES_INVARIANT" " " InvariantFields
              | "(A) @SECURITY_ZONE" " " ZoneFields
              | "(B) @PHYSICS_GUARD_BAR" " " PhysicsGuardFields
              | "(M) @CONDUIT_POLICY" " " PolicyFields
              | "(T) @CONDUIT_OBSERVER" " " ObserverFields

InvariantFields ::= "id:" [A-Za-z0-9_-]+ " sec_level:" ("SL_1"|"SL_2"|"SL_3"|"SL_4") " max_latency_us:" [0-9]+ " alloc_policy:ZERO_HEAP"
ZoneFields      ::= "id:" [A-Za-z0-9_-]+ " zone_type:" ("SAFETY_INSTRUMENTED_SIS"|"BASIC_PROCESS_CONTROL"|"PLANT_SUPERVISORY"|"ENTERPRISE_DMZ") " subnet:" [0-9./]+
PhysicsGuardFields ::= "id:" [A-Za-z0-9_-]+ " protected_asset:" [A-Za-z0-9_-]+ " invariant_rule:\"" [^"\n]* "\""
PolicyFields    ::= "id:" [A-Za-z0-9_-]+ " from_zone:" [A-Za-z0-9_-]+ " to_zone:" [A-Za-z0-9_-]+ " mode:" ("UNIDIRECTIONAL_DIODE"|"PHYSICS_INSPECTED_MUTEX"|"BLAKE3_AUTHENTICATED")
ObserverFields  ::= "id:" [A-Za-z0-9_-]+ " pass_count:" [0-9]+ " drop_physics_violation:" [0-9]+ " latency_us:" [0-9.]+
```

---

## 5. Production SPDL-ZONES Manifest Exemplar

```spdl
# ==============================================================================
# SPDL-ZONES v4.2 MANIFEST: REFINERY HYDROCRACKER OT SECURITY ARCHITECTURE
# Standard: IEC 62443-3-3 SL-4 | Engine: Hardware FPGA Conduit (<15us latency)
# ==============================================================================

(I) @ZONES_INVARIANT id:INV-ZONE-CORE sec_level:SL_4 max_latency_us:15 alloc_policy:ZERO_HEAP

# --- SECURITY ZONE TOPOLOGY ---
(A) @SECURITY_ZONE id:ZONE_SIS_SAFETY zone_type:SAFETY_INSTRUMENTED_SIS subnet:10.0.1.0/24
(A) @SECURITY_ZONE id:ZONE_BPCS_CONTROL zone_type:BASIC_PROCESS_CONTROL subnet:10.0.2.0/24

# --- UNYIELDING PHYSICS INVARIANT GUARD ---
(B) @PHYSICS_GUARD_BAR id:BAR_REBOILER_VALVE protected_asset:VALVE_REBOILER_101 invariant_rule:"Commanded_Pressure <= 24.0 bar"

# --- INTER-ZONE CONDUIT POLICY ---
(M) @CONDUIT_POLICY id:CONDUIT_SIS_TO_BPCS from_zone:ZONE_SIS_SAFETY to_zone:ZONE_BPCS_CONTROL mode:UNIDIRECTIONAL_DIODE
(M) @CONDUIT_POLICY id:CONDUIT_BPCS_TO_SIS from_zone:ZONE_BPCS_CONTROL to_zone:ZONE_SIS_SAFETY mode:PHYSICS_INSPECTED_MUTEX

# --- CONDUIT PERFORMANCE TELEMETRY ---
(T) @CONDUIT_OBSERVER id:TEL_CONDUIT_01 pass_count:421894 drop_physics_violation:12 latency_us:4.8
```

---

## 6. Standards Compliance Matrix

```
╔═════════════════════════════════╦══════════════════════╦═════════════════════════════════════════════════════╗
║ Dimension                       │ Verification Standard│ Enforced Implementation Evidence                    ║
╠═════════════════════════════════╬══════════════════════╬═════════════════════════════════════════════════════╣
║ IACS Security Level 4           │ IEC 62443-3-3        │ Physics-aware state checking prevents valid exploits║
║ Unidirectional Security Diodes  │ NIST SP 800-82       │ Hardware-enforced outbound-only telemetry flow.     ║
║ Bounded Packet Processing Jitter│ Hard Real-Time OT    │ Inspection completes in < 15 microseconds on FPGA.  ║
║ Zero-Heap Security Evaluation   │ Freestanding Silicon │ Zero dynamic allocations; immune to buffer attacks. ║
╚═════════════════════════════════╩══════════════════════╩═════════════════════════════════════════════════════╝
```