Gas (LPG) Attack Taxonomy

This taxonomy was developed from an interview I did with an engineer many years ago at a gas company in Kuwait. This company manufactures and produces liquefied petroleum gas (LPG) and fills it in cylinders. The cylinders are then delivered to customers. So I decided to share it with you to learn about gas physical properties and processes. The taxonomy provides information about LPG gas properties such as gas mass and flow rate, and factors within the process , that if they have been changed due to an attack or a mistake , a resulted physical or production impact would follow . I will also provide information about the gas and cylinder properties below. This information and taxonomy enabled me to build a gas filling process model. You can see the model source code here.

The gas operation processes are controlled mainly by two types of PLCs according to the engineer. One of them is used for operation and the second for safety . Our simulated attacks target the operation PLC and it could target the safety PLC if its accessible to the attacker or if it’s in program-mode as in the Triton incident scenario. Both PLCs could disrupt gas operations if something goes wrong. The difference between the two is the safety PLC is responsible and observing the operation PLC to make sure everything is in check .


  • Mass of empty cylinder (m1) = 16 kg
  • Mass of gas (m2) = 12 kg
  • Total mass (m = m1 + m2) = 28 kg
  • The volume of the cylinder = 21 m3
  • Filling time for cylinder = 75 seconds
  • Flowrate (Qin) = 45 m3/hr


  • Density of the gas (ρ) = 0.564 kmol/m3
  • Molecular weight (M.W) = 22.695 kg/kmol
  • Filling temperature (T) = 273 K

GAS attack taxonomy:

Comments are closed.