Reason from evidence.

What it teaches

Every observation has a source, a time and a limit. A checked workstation does not establish that every other system is clean; a passed test describes the configuration tested at that time.

Containment, evidence, control recovery and field operations compete for the same hours and people. The debrief connects each decision to the evidence that was available.

How a mission works

You hold the site for 72 simulated hours while the valley is evacuated. Keeping the reservoir inside its 15–85 operating envelope until T+72 is the only victory condition.

Upstream inflow arrives in two pulses announced by bulletins; their timing and strength change from one mission to the next. When the gates enter high travel, they stop following their setpoint: three causes produce the same signal, and each remedy is wrong for the other two.

The field crew can hold independent local control for 8 hours in the whole mission. When that time runs out, the gates are locked at minimum release until a tested return to automatic control. An opponent works only from the access it holds and the replies it obtains; it does not see your orders.

Difficulty: extreme

The rules were tuned on a measurement bench of seeded missions. On 3,000 reserved missions, a player who reads the evidence held the site every time; one who acts only every other hour held 95 %; one who guesses the cause of the gate deviation instead of diagnosing it held 33 %; random play never held. The best fixed sequence of orders found by an automated search over 16,000 candidate plans held 30 % (tested on 10,000 other missions).

No fixed sequence of orders wins every mission. Winning requires reading the evidence: the change register, a field inspection, the observed trend.

Who it is for

Students, players and people exploring operational technology security. Familiarity with industrial control helps; the briefing introduces the main concepts.

Duration

At the slowest speed the simulated clock alone takes about 15 minutes; reading and planning happen while the game is paused. A typical play time with real players has not been measured yet.

How it is constructed

A fictional installation, a rule-based water balance, scoped observations and an opponent whose actions depend on reachable paths. The same mission seed and the same decisions replay identically, which makes comparisons repeatable.

The simulator runs entirely in your browser. It is built with React and bundled with its fonts and icons; it sends nothing over the network.

What it is not

Not a model of a real dam, an operating procedure, a penetration-testing environment or a safety assessment. Not a certification or evidence of compliance with IEC 62443.

The simulation simplifies engineering, organizational and emergency-response conditions. Decisions made in it are not instructions for operating an actual installation.