Purdue Model Segmentation for the Plant

The plant network is layered into Purdue levels 0 to 5 with a hardened level 3.5 DMZ, so a breach at one level cannot traverse directly to the physics.

Levels 0 through 5

The Purdue Enterprise Reference Architecture partitions an industrial system into levels. Kronos maps them explicitly for both machines:

• Level 0: field devices - magnet coils, gas valves, gyrotrons, NBI, diagnostics sensors, direct-energy-conversion grids on the burner.
• Level 1: real-time control - the L1 fast loop on edge FPGAs closing plasma shape/position at sub-millisecond cadence.
• Level 2: supervisory control - discharge sequencing, the operator HMI, the L3 KRONOS-CTRL digital twin runtime.
• Level 3: site operations - historian, batch coordination, byproduct-material accountancy.
• Level 3.5: industrial DMZ - the only crossing to enterprise.
• Levels 4/5: enterprise IT and external L7 API.

The 3.5 DMZ as a chokepoint

All north-south traffic funnels through level 3.5. Rather than a pair of firewalls, Kronos places a data diode for outbound telemetry and a small, formally reviewed broker for the rare inbound update. This makes the DMZ a place where every crossing is enumerable and auditable, feeding the decision-audit lineage.

East-west containment

Purdue levels alone do not stop lateral movement within a level. Kronos adds microsegmentation so that, for example, the magnet power-supply controller and the gas-injection controller cannot address each other even though both sit at level 1. The default east-west rule is deny.

Safety carve-out

The safety-instrumented system is not merely a Purdue level 1 peer. It is isolated further (see SIS isolation) so that no path through levels 1-3 can defeat an independent shutdown. Segmentation is a designed layout validated in the twin network model; the physical cabling, VLAN enforcement, and DMZ appliances are staged for FOAK, not yet live.