Good morning. What I am going to do in next couple of hours is go through some of these thermodynamic procedures which you need to do simulations through commercial process simulators. And focus in this particular talk will be on vapor liquid equilibrium. So I have divided this talk in three parts. Part one which I am calling as preliminaries, this covers a quick revision or you can say going through the definitions of items such as equilibrium constant, then how do we normally calculate liquid and vapor enthalpies. And these two are put together because these are the two properties, the equilibrium constant as well as the enthalpies which are required for material and energy balance calculations when you do simulation of any piece of equipment. In this particular case, we are going to work with distillation systems. I have put another two properties, the enthalpies and densities. These can also be predicted once we go through this material, I will show you how this is done. Entrepies normally are not required for distillation unless you want to do an exergy analysis. Exergy analysis essentially tells you something about the energy efficiency of distillation systems. So if you prefer to do that, then you may require enthalpies also. But for design and simulation, normally we do not do that analysis. And when it comes to sizing, sizing of columns, obviously we require densities. So we need thermodynamic procedures to calculate liquid and vapor densities. So my focus primarily is on equilibrium constant and liquid and vapor enthalpies though I will make some passing remarks on entropies and densities. So I take you back to the very basic PVT phase diagram for a substance which is shown here in a 3D form. So as you can see that three axes namely pressure, volume and temperature have been plotted. And our focus is on the surface of this object. And different regions are shown such as solid and vapor. Then there is a dividing line here called the triple point line. Then the liquid and vapor zone which when we project on a 2D plot will take the shape of a dome. And then of course you have Healy type of terrain. It is a typical PVT diagram for a pure component. In this particular case we can assume that maybe it is just some substance. The name is not written but it could be a single substance. The slopes here for this portion or the cut point here or the segments they may look different for different compounds. Right here shown is a dotted line which passes through what is known as the critical point and this is the critical isotherm. I say isotherm because this particular line it represents a slice. For example if I consider this P versus V as the area through which I am projecting and T becomes a parameter. And then if I start cutting these slices at constant value of T just like cutting a loaf of bread or a distorted loaf of bread you can think of. So I am cutting the slices here. So this is a slice which I am cutting at certain temperature T. So then this becomes the isotherm. Similarly this is another isotherm, this is another isotherm so on and so forth. And in this direction the temperature is increasing. So there is this critical isotherm which passes through the critical point and at the critical point as we know that we will not be able to distinguish between the properties of the vapor and the liquid. Beyond this we have the gaseous phase. So this is temperature greater than Tc the critical temperature. So what we are going to do is we are going to assume temperature T as a parameter and project this 3D plot on a 2D and you get a diagram which appears like this. It is only a segment which is shown here. Another thing which is slightly different in this diagram is that rather than showing the absolute temperatures, pressures and volume this is shown as a generalized diagram meaning that for a given component the normalization has been done for the pressure, for the corresponding volume and the corresponding temperature by using the respective critical properties. So you have the critical pressure here, the critical volume here and the critical temperature here. The advantage of doing this is that though as I mentioned that 3D object looks different for different substances, when you do the normalization for majority of substances occurring in nature these curves look very similar. And that takes us to the concept of theory of corresponding states where we know that in terms of reduced temperature, reduced pressure and reduced volume a large number of substances show similar behavior. So this is the critical point and this is the dome underneath we have vapor and liquid coexisting. So when we are talking about distillation we are interested in finding out the properties within this dome because that is where the vapor and liquid are coexisting. Let us quickly review what are the conditions for phase equilibrium. So what we have shown here are four phases just to make the discussion more general. The vapor phase and let us say we have two liquid phases. In hydrocarbon industry these two liquid phases typically are the hydrocarbon phase and the aqueous phase and sometimes you may have a solid phase also. So given certain number of phases in this particular case we have four phases. The first and foremost condition for equilibrium is the thermal equilibrium. Thermal equilibrium requires that the temperatures of all the four phases are identical. Then we have the mechanical equilibrium. This requires that the pressure in all the four phases is also equal and then if these are in chemical equilibrium then additional condition that the chemical potential of ith species it is if it is a multi-component system we talk in terms of species. So the chemical potential of ith species in all the four phases should be identical. Now as you know this chemical potential is related with the Gibbs free energy. So essentially it is representing Gibbs free energy. These three conditions put together form the conditions for phase equilibrium. Temperature and pressure being properties which can be measured and put in absolute terms there is no difficulty but these energy terms they can vary from a very small quantity all the way up to a very large quantity. So therefore the physical comprehension of this particular property remained difficult. So way back 1901 Lewis defined another property which is shown here which is called the fugacity which relates to this particular property but has very specific values. It does not go beyond certain value. It can be bounded by the physics of the process and in ideal terms it approaches the pressure. So this is called fugacity and this is what the relationship is between the fugacity and the chemical potential. There are three observations which are made here comparing the chemical potential and the fugacity. Number one it says that can be expressed like an absolute value which is very true and when the pressures are low and let us say if we talk about a pure component then this will become the pressure. If it is a multi-component system and we are talking about fugacity of ith component then this will become the partial pressure. So it does have a physical significance and it becomes a measurable property. You can measure pressure and then calculate the fugacity. Easily related to readily understood physical quantities no here, yes here and as I said approaches a finite value at low pressure which is nothing but either the pressure for the pure component or the partial pressure for ith component in a mixture. So this then becomes a convenient property to be measured along with temperature and pressure which are anyway measurable properties. So here is a quick review of the fugacity and some related properties which come handy for calculations. So we have the quantities, their basic definitions, their physical significances and the limiting values for ideal gas and ideal solution. When we talk about ideal solution we are going to define ideal solutions as those solutions which essentially follow Raoult's law. So fugacity which I already mentioned here is therefore termed as thermodynamic pressure. In a multi-component system it is termed as a thermodynamic pressure. So you can see here that when we talk about vapor fugacity or liquid fugacity of ith component it is nothing but some sort of partial pressure because we are multiplying this by the mole fraction. Then you have pure fugacity coefficient which means it is normalized with respect to the pressure of the system. So if this is equal to the P then it will be the coefficient will be 1 otherwise this measures the deviation to the fugacity due to change in pressure. Similarly for mixture we have fugacity coefficient where we are dividing by the composition. This composition if it is vapor phase will be replaced by y, if it is liquid phase it will be replaced by x and from here only we derive the definition of the activity which is nothing but the ratio of two fugacities, the fugacity of ith component existing in the mixture divided by the standard state fugacity. So it is basically a comparison and that therefore it is known as relative thermodynamic pressure and then you have the activity coefficient. So if activity coefficient goes to 1 then it is ideal solution it will follow Raoult's law. So at equilibrium the fugacity of ith component in the vapor phase is equal to fugacity of ith component in the liquid phase and we have already said that the temperature should be same, the pressure should be same in all the phases. Now if you are talking about vapor liquid equilibrium so we have only two phases with us. So we will only talk about vapor and liquid, second liquid is dropped out and solid is dropped out. K value which is by definition is nothing but the ratio of the vapor composition and the liquid composition typically depends upon four parameters, number one the temperature, the pressure, the liquid composition and the vapor composition. So there are two ways the fugacities can be related with the compositions and through other parameters so that we can then make the fugacity is equal, one which is known as the symmetric form or it is also known as the form which normally is used for equation of state. So equation of state form you can call this, where we are saying that the fugacity of ith component in the vapor phase is equal to the fugacity coefficient which is nothing but normalized multiplied by the vapor phase composition of ith species multiplied by the total pressure of the system. Similarly the fugacity of ith component in the liquid phase again is derived from the fugacity coefficient of the ith component in the liquid phase multiplied by the liquid composition of that particular species multiplied by the pressure. So you can see that there is a symmetry, there is the same set of representation which is used for definition of fugacity. And therefore when we equate the two we find that Ki which is by definition Yi over Xi is nothing but the ratio of two fugacity coefficients. The only thing to remember is that here the vapor composition is in the numerator and the liquid composition in the denominator. On the right hand side it is the liquid fugacity coefficient which comes in the numerator and the vapor fugacity coefficient which comes in the denominator. So it is the ratio of two fugacity coefficients. So this is known as the symmetric form. Now typical problems in distillation could involve given X is find Y's it could be your bubble point calculation, given Y is find X due point calculation or given general composition which normally is represented by Z find Y and X for the known values of Ki. So that will be a flash calculation. So these are some of the calculations which we need to carry out. So which means a relationship between Y and X needs to be established and that will be established through Ki and Ki will be calculated as ratio of two fugacity coefficients for every IH species. Now this form works fairly well for high pressures, wide range of temperatures and equation of states are put in a very convenient way to enable us to do the calculations of these fugacity coefficients. But when the systems are highly non-ideal in terms of their liquid behavior and we will define a little later in this lecture what exactly is meant by highly non-ideal system, this approach may not work very well. So what we do is we go for what is known as the non-symmetric approach. Non-symmetric approach means that the vapor phase is still characterized by the fugacity coefficient formula, the way it is written here it is exactly the same formula but the liquid phase is characterized through a standard state fugacity and we have to define that, we have to first define what is our reference which we can call as the standard state and then we take the deviations. So it is something like Raoult's law and then apply the activity coefficient, the activity coefficient and calculate the fugacity in the liquid phase. So the k value then which is again ratio of Y i over X i takes this form where you can see in the numerator we have a standard state fugacity for the liquid phase multiplied by an activity coefficient and the denominator and the pressure here. So this is known as the unsymmetric form or sometimes it is also called use of liquid models or liquid activity coefficient models for calculation of fugacities which in turn enable you to calculate the k values. So here is the summary. So definition of k is Y i over X i which we know can be calculated from either the ratios of the two fugacity coefficients if it is symmetric form or a ratio in which you have a combination of activity coefficient and the fugacity coefficient, the activity coefficient primarily characterizes the non-ideality in the liquid phase and the fugacity coefficient characterizes the non-ideality in the vapor phase. Now there can be some special cases where the calculations may not be that difficult and some of the situations are highlighted here. If the k value depends only on temperature and pressure of the system and is not influenced by the composition either the liquid composition or the vapor composition then the system is characterized as the ideal system. So for ideal system k value is a function of temperature and pressure alone. We also have for hydrocarbon systems for high pressure another concept which is known as the convergence pressure concept. The convergence pressure concept essentially says that at a very high pressure for most of the hydrocarbons the k value approaches 1 and therefore there is a point of convergence which is at a very high pressure every pure component has a well defined convergence pressure. So that becomes a third parameter and that can be used to characterize the non-ideality and k can be calculated. This is the case which I already had mentioned the Raoult's law where the k value is simply calculated from vapor pressure. So vapor pressure upon total pressure and k is a function of T and P again. If the vapor phase behaves like an ideal gas and that will be the scenario when the pressures are low, temperatures are fairly high. So the vapor behavior will be close to ideal gas behavior but there is certain amount of non-ideality in the liquid phase which is characterized by gamma then Raoult's law can be used. So Raoult's law essentially says that k is a function of temperature pressure and liquid composition. Well it is not Raoult's law, Raoult's law is here. This is modified Raoult's law or the activity coefficient model. So I should not have said Raoult's law, it is modified Raoult's law. So at the end of this part what we need to remember is that there are two rigorous ways to calculate the value of the equilibrium constant. One which is the ratio of the two fugacity coefficients and we will call this as a symmetric approach and equation of state will be normally used to do this calculation. The second is the activity coefficient model where gamma will come from certain models which we are yet to describe and there will be a standard state fugacity coefficient and then the fugacity coefficient for the vapor phase. This is just for taking you back to what we typically do in undergraduate courses on thermodynamics. We have these kind of curves available for various hydrocarbons. You can see here it is a nomograph where you have pressure on this side, you have temperature on this side then you can take a ruler and then pick the pressure, operating pressure, pick the operating temperature, keep the ruler here and for the given component you can read the value. These type of nomographs were developed quite some time ago, normally they are known as the deep rooster charts. Now as you have seen that when it is unsymmetric approach or the liquid activity coefficient model approach we will require standard state fugacity. The standard state fugacity typically gets related to the vapor pressure of the pure component and therefore, we must go back and try to recall how does the vapor pressure of a component depend on temperature. So, this is just showing you the plot which has a very specific character. Sometimes it is called Cox chart and there are various ways these charts are developed. You have on the ordinate vapor pressure and this scale is logarithmic scale as you can see, 0.1 is here then 1 and 10 like that. So, this is a logarithmic scale. So, when I say vapor pressure, this is basically I am I am reading ln. I am reading directly vapor pressure, but actually ln or natural log of vapor pressure has been calculated and this scale which is on the abscissa is a very peculiar scale. It is neither linear scale nor it is logarithmic, it is 1 by T scale if you remember. So, 1 by T where T is the absolute temperature. So, this scale is specially designed scale and the scale is adjusted for selected components in such a way that these curves remain straight lines. Now, this is what was done quite some time ago and charts were produced and those were known as Cox charts. Now, today for simulation purposes it is converted into correlations and one simple correlation which replaces Cox chart is your Antoine equation which has this form. It has three constants these are called Antoine parameters and then the extended Antoine equation which has this form which has seven parameters. The problem with this equation is that it does not fit in the whole range of interest for variety of compounds and one very good example of failure of this particular form is water itself. Water vapor pressure if you need to calculate let us say starting from the melting point all the way up to the critical point you cannot have one set of Antoine constants and fit the vapor pressure in a satisfactory way. You have to divide the range into 3 or 4 or 5 sub ranges and then fit this equation separately. So, this used to be a bothersome exercise because there used to be discontinuities at the point where the curve fitting has been done. So, extended Antoine equation this is one such form there are many other equations which were proposed containing seven parameters and once you fit these seven parameters then you can very safely predict vapor pressure all the way from melting point to the critical temperature. So, in simulators today majority of simulators commercial simulators they use extended Antoine equation. So, this was part one where we introduced the definition of the K value and we said that what is the kind of information which is required to calculate the K value either we need to calculate the fugacity coefficients in both the phases or we need to calculate the activity coefficient for the liquid phase and the fugacity coefficient for the vapor phase. If activity coefficient is needed in the liquid phase we need a standard state fugacity standard state fugacity frequently is related to the vapor pressure of the component and for vapor pressure we normally use the extended Antoine equation. So, frequently is related to the vapor pressure of the component and for vapor pressure we normally use the extended Antoine equation. So, now in part two I will take you through So, some equation of state based models which are popular in simulators and give you a little bit of background for each how the development occurred in a chronological way and then make some observations about the applicability of these models. So, let us go back again just to refresh our memory that PV equal to RT is what represents the simplest equation of state which is known as the ideal gas law, it is a relationship between pressure volume and temperature. So, PV equal to RT and whenever we had deviations from the ideal conditions either if the pressures are high, if the pressures are high then the deviations will be there or if the temperatures are low or may be a combined effect of both high pressures and low temperatures. So, in the earlier days using the concept of theory of corresponding states which I mentioned a little earlier the definition of compressibility factor was thrown in which is defined as ratio of PV by RT. So, if z the compressibility factor if it is 1 then you have the ideal gas law otherwise you have description of a real system. So, for real gases if we talk about in equation of state we are basically then saying that PV is equal to Z RT, Z represents the compressibility factor. As you can see here this observation I made earlier also that if you plotted these things in terms of reduced pressures and reduced temperatures and a set of some 10 components are shown here all the way from light hydrocarbon methane and then ethylene etc. and water is also there, carbon dioxide is also there. The bullets here are the open circles they represent the experimental data and the lines are the fitted curves. So, it one can see that once these curves are plotted in terms of reduced properties. So, reduced pressure and reduced temperature irrespective of what the component is the curves sort of coincide and which is the basis for the corresponding states theory. For majority of pressures of course, in this diagram it is not very clearly visible I need to have a wider range, but you can see for the pressure range which is plotted here the Z value typically goes below 1 and there are cases where it has gone all the way close to about 0.2 alright 0.4 like that and then it takes a turn and it starts increasing. So, as pressure increases the Z value has a tendency to go down and then further again as pressure increases the Z value starts increasing. It is not visible in this diagram, but one could go to better diagrams and try to see that it is possible for very large values of p that this curve may cross 1 and the compressibility factor may even become larger than 1. But for majority of pressures it remains less than 1 and therefore, the term compressibility factor is a meaningful term because the real volumes are going to be smaller than the ideal volumes. This is the plot in this plot if you really see I have the compressibility factor here and I have the reduced pressure here. So, you can see that there comes a range in which the curves go upwards. So, the values can become larger than 1. Now all these plots were made based on the experimental data in the beginning and then using the theory of corresponding states. When it comes to simulators we need well defined equations or correlations so that we can automate the calculations. So, let us see how the development took place in this particular direction. Before I go to that let me just go through may be 3, 4 slides to mention that it is not only that correction in volume was modeled through the compressibility factor the various thermodynamic properties they are related as you know. So, from ideal gas enthalpy these type of charts were calculated to find out the actual enthalpies and the difference between the actual enthalpy and the ideal gas enthalpy again normalized with the temperature here the critical temperature which is known as the departure function. So, these plots were also made which are plotted with respect to normally they are plotted with respect to pressure on the abscissa and again the temperature as one of the parameters and they are available for the whole range. This is the dome which represents saturated liquid on this side the critical point is here and then you have the saturated vapor on the other side. Similarly, you had plots giving you the entropy departure. So, this is the entropy of the ideal gas and then you have the entropy of the real gas or the real system and again it is available for the whole range. All this is coming from the generalized concept of the corresponding states. For us to understand now how this can be modeled through equations let us go back to the very first and fundamental description of a real gas done by van der Waals. So, we are going to focus attention on the van der Waals equation of state. This is the form of van der Waals equation of state. If I put this constant B here 0 and if I put this constant A also equal to 0 and if V is characterized as the molar volume then this equation will be simply P V equal to R T and that will be the ideal gas, ideal gas law. So, we need to understand why there is a B and why there is an A. So, we go back to the definition of the ideal gas. So, what is an ideal gas? An ideal gas is a gas in which it is assumed that there are no intermolecular forces that is number 1. Number 2, the volume of the molecules or the volume occupied by the molecules is 0. All the volume is occupied by the void by the gas. Now, if it may if it is not 0 you can say that it is assumed to be 0 it is negligible. So, the volume of the gas essentially is the void volume, the molecules occupy very small volume. So, that is assumption number 1 and the assumption number 2 is that intermolecular forces are 0. And therefore, the pressure exerted by gas is nothing but the pressure which is measured on the wall of the vessel and the volume of the vessel is nothing but the volume of the void. Void means the volume which is there between the molecules, molecules are in random motion. So, that is your ideal gas. So, Van der Waal theory says that this is not true. The volume occupied by molecules is not negligible, but it is a real value that should be taken into account. So, then what is the volume which is the void volume? The void volume is nothing but V minus B where B is nothing but the total of the volume occupied by different molecules. And there are intermolecular forces which are inversely proportional to the square of the volume and these forces need to be taken into account. So, P plus A over V square represents the pressure exerted by the molecules, pressure exerted by the molecules alright, out of which A by V square takes care of the intermolecular forces and therefore, the pressure which is there on the surface of the vessel is only P. So, molecules do have interactive forces, forces of attraction repulsion that has to be accounted for. So, if you did that and then took the final pressure exerted by the molecules and the void volume which is present effectively which is V minus B then the product of the 2 equal to RT alright. If you expanded this, if you multiplied this and expanded this, this will turn out to be a cubic equation in volume, a cubic equation in volume which means for a given pressure and temperature I should be able to get 3 roots for the volume, it will be a cubic polynomial. So, what is the significance attached to A and B? It says here that constant A is proportional to molecular force of attraction and constant B is proportional to the molecular volume. So, I go back to this particular description which essentially comes from the plot of such a equation of state. I can draw a horizontal line here, let us say somewhere at this pressure or may be a little lower at this pressure. So, if I say that the pressure is constant and if I draw a horizontal line, I can see that a given isotherm will intersect this line at three different points.  So, there are three roots. So, I am solving it for a given T and given P for the three volumes. So, there are three roots. The lowest root will represent the liquid volume which will be read here. The highest root will represent the vapor volume and there is a root in between which needs to be interpreted. It again is a volume, but does it make any sense to have three volumes? We have to interpret that. Well, when we look at the slope of this line, slope of this line, this is negative. So, it makes sense that as pressure increases, volume decreases. So, it reflects the physics of the process. Similarly, when we come to this side again the slope is negative. So, again it satisfies the physics of the process, but the cut point here and if I put a horizontal line, the middle root here shows a positive slope. That means that if pressure increases the volume increases which violates the physics of the process and therefore that root is dropped. That cannot be accepted because it violates the physics of the process. So, if I solve the Van der Waal equation for volume, cubic equation for volume, I have three roots. I accept the smallest root and label that as the liquid volume, the largest root as the vapor volume. The middle root can be discarded and this is the scenario which arises when we are in two phase zone. We are in two phase zone. The question now comes how good is this characterization? How good is the volume, vapor volume and the liquid volume which is predicted by Van der Waal equation? Well, the answer is that Van der Waal equation works fairly well to characterize the real behavior of gases at high pressures. So, non-ideality is captured very nicely when the whole system is in gaseous phase. But when we come to the zone where we have the vapor and liquid in equilibrium and we have these three roots, neither the liquid volume nor the vapor volume is satisfactory. It does not match with what you measure experimentally. So, Van der Waal equation does bring in some real behavior into the system, but it is not satisfactory for vapor liquid equilibrium calculation. But it is very important because that was the starting point. How do we get A and B? That is a question. Well, the procedure is very straightforward. It says that at the critical point we are not able to distinguish between the vapor properties and the liquid properties. So, if you look at critical isotherm which is somewhere here T is equal to Tc, we see this behavior that the gradient is becoming 0. The gradient of this curve dp by dv if I talk about its negative and it is becoming 0. It is decreasing, it is becoming 0 and then again it starts increasing. So, the critical point here is the point of inflection which means the second derivative d2p by dv 2 s that also goes to 0. So, the first derivative dp by dv is 0 at the critical point, the second derivative is also 0. So, I have a cubic equation in which p and t are specified and I am trying to calculate v. Now, I have I know that I will have three values of v at the critical point I am not able to distinguish between the vapor and the liquid. So, all the three roots coincide and therefore, I have two equations by differentiating the equation of state and I have two parameters which are sitting in the equation A and B. So, if I differentiate Van der Waals equation once pressure versus temperature, pressure versus volume rather at the critical temperature and then I differentiate it second time and equate both the differences to 0, I have two algebraic equations to solve and those equations will give me the value of A and B. So, that is essentially what is done. So, A and B will take this form and as you can see that other than the universal gas constant R, the parameters are in terms of critical temperature and critical pressure because the equations have been solved at the critical point. This is simple to do if I had pure components. Let us say I was applying Van der Waals equation on carbon dioxide or methane, then this is a very straightforward calculation. What if I had a mixture of gases, a multi-component system or may be a binary system? Well, the suggested approach which works fairly well is that assume the gas mixture to be just one component and assign pseudo critical properties, pseudo critical properties and therefore, what one can do is you can calculate pseudo critical temperature, you can calculate pseudo critical pressure by using the weighted averages. And when it comes to calculation of the Van der Waals parameters A and B, you simply use the mixing rules. So, this is the Van der Waals parameter for, Van der Waals parameter A for the jth species, this is kth species and therefore, I can take summation, this is geometric mean essentially yj and yk are the compositions and I can calculate an average value of A parameter for Van der Waals for the mixtures, whole mixture is being treated as one species. Take for example, simplest example is air. Air contains oxygen, air contains nitrogen, you can also include the small amount of argon which is present there. So, if I can write down the composition of air and if I have the Van der Waals parameters for pure oxygen, pure nitrogen and pure argon, then I can use the mixing rule and calculate the Van der Waals parameter for the mixture. Similarly, the B parameter which is again a weighted average, this is arithmetic mean, this is geometric mean and they seem to work very well. So, as I said that Van der Waals equation works well when you have non-ideality due to high pressure, but the moment you try predicting the three roots and we are going into the vapor liquid equilibrium zone, the predictions are not satisfactory, which means something more is happening in terms of intermolecular forces when we are getting into the liquid zone, particularly below the critical condition. So, Radley-Kwang way back in 1949 proposed this model that Van der Waals had V square sitting here. V square simply means that your intermolecular force is being calculated in terms of the volume. Here the suggestion was that yes, volume does play a significant role in the intermolecular force, but temperature also has a very strong role to play because the molecular energies are very much related to the temperature at which the material is. So, this particular term was modified and you can see here that rather than having a V square alone, there is a little more general parabolic representation. This will translate to V square plus VB which is more general than V square alone, inverse of that and then square root term for the temperature here. So, this equation was proposed with similar physical background, similar means that for mixture you calculate the pseudo critical temperatures, pseudo critical pressures, etcetera. For the parameters, these parameters now will not be called Van der Waals parameters because the equation, the form of the equation has been changed. So, they will now be called as Redlich-Kohm parameters. So, I still have a parameter which is responsible for intermolecular forces. I still have another parameter which is responsible for the molecular size, contribution of the molecular size. So, I go to the critical point and calculate these A and B applying the same principle that the first derivative dP by dV goes to 0 and the second derivative d2P by dV2 also goes to 0. And what I get will now be known as the Redlich-Kohm parameters A and B. Again, this is a cubic equation. If it is expanded in terms of volume, again we will have three roots, but the beauty with this equation was that for hydrocarbon systems, it started giving fairly good values for the vapor and reasonably good for the liquid when it is solved in the two phase region, but only for hydrocarbon systems. So, this equation became much more popular than the Van der Waals equation. And then a lot of effort was spent to automate the calculations and to make sure that the methods which were proposed to solve this equation numerically, they were stable and convergent. So, there is a form which was proposed, which worked in terms of the compressibility factor, which is more likely to converge without much of difficulty than solving the equation in terms of volume. The problem of solving the equation in terms of volume is that volume can go anywhere from a very small number for liquid to a very large value if the pressures are low and depending upon the units which you may be using, let us say cubic centimeter per gram mole or something, it could go anywhere from a very small positive value to a very large value which could run into hundreds of thousands cubic centimeter per gram mole. So, numerical computing becomes difficult when the variables take values from very small value to a very large value. Whereas, if you did iterations in terms of compressibility factor, you know that the value will hover around 1. It may be slightly less than 1, may be significantly less than 1 or may be sometimes slightly larger than 1. So, the computations can be very nicely controlled if the equations are solved in terms of compressibility factor rather than solving in terms of volume. So, that H value which I had on the screen here which is nothing but B by Z which is ratio, simple ratio, B is our parameter, Z is the compressibility factor. If you put that, you finally get a polynomial in compressibility factor and this polynomial if you then solve you are guaranteed to get solutions and there is no convergence problem. So, this methodology became extremely popular when people started working with simulators. So, given T and P, the above equation then is solved in terms of Z and once again the same logic applies that it will have three roots. I have not mentioned so far about what is how to interpret the roots when two of them are imaginary. If two roots are imaginary and only one root is real then there is no presence of the liquid phase in the system which means you are in the gaseous zone, you are in the gaseous zone. Gaseous zone will simply mean that you are above the critical isotherm. But if you are in the two phase zone then all the three roots will be real and they are to be interpreted. As I already mentioned the highest root will tell us the compressibility factor for the vapor and the lowest root will tell us the compressibility factor for the liquid, the middle root will be discarded just like we said about the Van der Waal equation. While this development was occurring in terms of automation, in terms of people trying to understand solution of these equations of state, on the corresponding state side efforts were being made to make the theory stronger by bringing in additional parameters because earlier Z was viewed as a function of T R and P R, the reduced temperature and reduced pressure and then it was realized that for a large number of compounds the critical compressibility factor, critical compressibility factor is the factor which occurs at the critical point for majority of compounds this value converts to 0.27. So, that became another handle to improve upon the predictions through the theory of corresponding states. So, whenever I say theory of corresponding state which means we are writing the equation, the equation of state as P v equal to Z R T and some modifications were done by some researchers to get reasonably good density predictions using these kind of things. So, this is another parallel development which was occurring, but this did not become that popular as far as simulations were concerned. But just to have completeness on the subject, I have mentioned this that one should not forget that there was parallel development going on on the corresponding states theory also. Now, so the intermolecular forces were brought in by van der Waals and then the temperature effect was proposed by Redlich-Kwong and still the vapor liquid equilibrium predictions were not very satisfactory. It worked, Redlich-Kwong worked fairly well for hydrocarbon systems, but for large molecules within hydrocarbons at the same time for non hydrocarbon systems Redlich-Kwong was not working all that well. So, people were still trying to understand that something is missing in the modeling part and in the corresponding state theory also the predictions as I mentioned were being improved by bringing in the concept of the critical compressibility factor. So, these are the days I think it was 1961 or so, Pitzer came up with another explanation why the predictions by all these methods are not satisfactory and he suggested that nowhere in the calculations the shape of the molecule has been taken into picture. And the intermolecular forces very true that they depend upon the proximity which in terms of distance basically it also depends on the temperature, but it also depends on the shape of the shape and the size of the molecule. So, he defined what is known as a centric factor which has this kind of definition and it is represented by omega and omega deviates from 0 for molecules having non-central forces due to non-spherical shape. So, what are those molecules which are expected to have spherical shape? Well, these are noble gases essentially. So, gases such as argon, krypton they are supposed to have spherical molecules. All other constituents take for example, methane if we talk about the molecule is not expected to be spherical. So, there is an eccentricity and that needs to be calculated. And once this eccentric factor is brought into picture then the compressibility factor they were calculated by following a two part approach. In fact, those of you who have gone through the theory of corresponding states for prediction of enthalpy departures, entropy departures, etcetera would have seen that after Pitzer's eccentric factor theory caught on all those charts were revised and there are procedures not only to calculate the compressibility factor, but also you can calculate the enthalpy departure for spherical molecules at the same time the contribution when the molecules are non-spherical. So, you have H equal to H for the spherical molecule plus omega times H for non-spherical. Similarly, entropies and other properties 61 as I mentioned that is the time this theory was popularized and a very popular k value correlation was then developed by these two authors Chow and Cedar to characterize hydrocarbons for the k values. And what they did they used the unsymmetric approach for vapor liquid equilibrium. Hydrocarbon systems they are mildly non-ideal systems. Mildly non-ideal would mean that the activity coefficients they are not one, but they are not two different from one also. So, where typical values will be 1.1, 1.2 of that order. So, they are mildly non-ideal systems. Now, it turns out that for those kind of systems the gamma value which is the activity coefficient can be calculated from the pure component properties and using the regular solution theory. There is Hildebrand theory for regular solutions and I will show you the expression there and gamma can be calculated. So, if gamma could be calculated from the pure component properties which means liquid phase could be characterized for the non-ideality. The standard state fugacity for liquid can be simply calculated from the vapor pressure data. And so the only thing we need to then do is that for pressures away from the atmospheric pressure, higher pressure where vapor phase is expected to be non-ideal we need to calculate the fugacity coefficient. And this then could be calculated from the Redlich-Kohang equation. So, it is a mixture of two theories. One, the Redlich-Kohang giving the phi IV and the regular solution from pure component properties giving the characterization of the liquid non-ideality. So, this method was proposed by Chow and Cedar and it worked fairly well on a large range of hydrocarbon liquids and the light gases. This method was adapted, Chow-Cedar method was adapted as one of the standard techniques for prediction of the K values by American Petroleum Institute for hydrocarbon applications. And in fact, it appeared in the API handbook as one of the standard methods. Now where was the difficulty? The difficulty was that the method was good only for K value prediction and you had to rely on other methods to calculate the enthalpies. In hydrocarbon industry the unit operation which probably is used more than any other process industry is distillation. And distillation calculations cannot be perfected unless you have a mechanism to calculate the K values and the enthalpies simultaneously. If you do not pay attention to enthalpies, if you do not have right enthalpies then the calculations will not be reliable. So, K values is a good starting point you can do fairly good flash calculations, fairly good bubble point calculations, but when it comes to distillation, enthalpy predictions are equally important. And that is something which was missing in the Chow-Cedar approach. They got reasonably well values of the equilibrium constants, but enthalpies were still calculated by either empirical formulae or by making assumptions that the systems behave in an ideal way. And therefore, the distillation calculations remained in error though flash calculations were nicely done. In 1972, Chow-Cedar looked at the Redlich-Quang equation of state and tried to bring in the Redlich-Quang equation of state and tried to bring in the influence of the eccentric factor or eccentricity of the molecule into the intermolecular forces which was not there in the Redlich-Quang. So, what it simply means is that we are now saying that the intermolecular forces have dependence on the proximity of the molecule because as the pressure increases the proximity is more and more, the molecules come near to each other. So, intermolecular forces are dominating. The temperature certainly has a significant role to play, but now we are saying that the eccentric factor also has a very strong role to play as far as intermolecular forces are concerned. So, if we go back and try to see what we had earlier. So, this is the Redlich-Quang equation. So, in addition to the temperature effect and the proximity effect here which is in terms of volume we are going to introduce the eccentric factor effect. So, what not to make the situation too complicated, this is represented in terms of a parameter here which is dependent on temperature and which is also dependent on eccentric factor and the volume part can be explicitly kept either this way or may be in a slightly modified way. So, parameter alpha which is a temperature function introduced by Sowe in Redlich-Quang equation of state, if you really see here what we are doing is we are saying alpha which is a function of temperature has this particular form where there is a parameter m and this parameter m in turn depends upon the eccentric factor. Now, you may wonder from where these values came well for large number of data points collected from experiments these are fitted parameters. So, basically they have come from regression. So, if you bring in the effect of omega along with temperature keeping rest of the theory same keeping rest of the equation same then the predictions for the liquid volume as well as for the vapor volume and not only the volume the enthalpies the corresponding enthalpy departures calculated by the same equation of state improved a lot. So, this was a turning point an article published by Sowe in Cammin Science in 1972 where he showed that if you could bring in the influence of the eccentric factor the cubic equation of state which was earlier Redlich-Quang equation of state the same equation in a slightly different representation. So, popularly people call this as Sowe Redlich-Quang equation because the form of equation was not changed that equation enables fairly good predictions of the volumes the liquid volumes and the vapor volumes and also the corresponding enthalpies. And that was sufficient for us to do material and energy balance calculations on a piece of equipment. In distillation when we are doing simulation the two thermodynamic properties which you require are the k values and the enthalpies. As I said it was a turning point and within few years of its development there have been so many modifications primarily modifying the form of this alpha in different mathematical expressions or the form of the dependence of M on omega which is the eccentric factor lot of modifications were produced or developed. So, today if we look at simulators this particular method which has been written here Boston Matthias extrapolation of the same equation of state this is from Aspen plus. But if you go to any simulator whether it is Aspen plus or Proto you will find that lot of variants of Sowe Redlich-Quang are available and they only differ in the temperature dependence form as well as the form for omega which is the eccentric factor. Well, the fact remains the bottom line is that the intermolecular forces now are being modeled in terms of the proximity in terms of the temperature of the system. Proximity essentially comes from the pressure higher the pressure better is the or the molecules are nearby. So, proximity the temperature and the third effect is the shape and the size of the molecules which is reflected in the eccentric factor. The Sowe Redlich-Quang equation predicted the hydrocarbon system behavior extremely well in terms of the k values in terms of the vapor enthalpies both at high pressure and moderate pressures low pressures liquid enthalpies also were predicted fairly well vapor densities were predicted very well, but it failed to a great extent in good prediction of liquid densities. So, it was a good equation of state for modeling and simulation of distillation systems, but it could not be used as a satisfactory model thermodynamic model for sizing the distillation columns, because many a times the columns are sized based on the liquid internal traffic. If it is being sized based on the vapor internal traffic error may not be large, because the predictions are good, but if it is being sized based on the liquid internal traffic if the flooding is due to liquid then you may have erroneous results.


Live from the MGM Grand Convention Center in Las Vegas, Nevada, it's The Cube at Splunk.com 2014. Brought to you by headline sponsor Splunk. Here are your hosts, John Furrier and Jeff Kelly. Okay, welcome back everyone. We are live here in Las Vegas with The Cube, our flagship program where we go out to the events and extract the signal from the noise. I'm John Furrier, co-founder of Slick and Angle Medium with the number one big data analyst at Wikibon, Jeff Kelly. Splunk Conference is going on here, dotconf2014, happy customers, a lot of new product stuff, a lot of amazing talk about security. Our next guest is Andrew Worcester, network consulting engineer with Cisco Cyber Range project, product, welcome to The Cube. Thank you. So what are you seeing out here right now? I'm honestly, the vibe is pretty hot right now. I want to break everyone's coming in and out. And usually I can tell the conference is good by the tweet volume. If the tweet volume is a little bit light but heavy on content, you know it's pretty damn good. So it's not a lot of pimping going on, a lot of action. What's your take of the show? What's the vibe? Share with the folks what's going on. Well, it's pretty fun so far. I see a good mix of attendees like myself. I'm sort of part-time attendee also speaking as well tomorrow and just enjoying. I've got some colleagues here in the partner area doing some demos and things like that, stuff we've been working on. So it's like a little bit of a mix all around. So share with the folks out there your vision and work you're doing around security. The role of Splunk, the role of big data, really around what we've heard in the keynote. I mean cybersecurity is huge. You know, you got attacks coming from foreign countries in America, you have all kinds of other security threats. One, what's your take and what's the general sentiment in the security industry? And then what are you working on? Oh, great, yeah. So what I do is I'm basically in professional services and so I go and help customers implement Cisco gear and also give them consulting and advice on how to best use it. And traditionally we left off at dropping the gear in and leaving it there but now it's people are asking us, well, can you help us integrate with this? Can you help us learn how to use it? And that's sort of where the cyber range concept came up is like people were not comfortable using the equipment to the best of their ability. You have lots of incidents where even people have security technology that's detecting events and incidents, whether it's something easy or something long and drawn out over time. And really they just need every bit of help they can get. And so one of the big shifts that we're seeing in the market is going towards big data, collecting as much as possible and storing it in a nice organized fashion and then giving people like myself and the customers we work with the tools to easily search into it. That's interesting. So the hardware business is definitely being impacted by this big data trend. So tell us a little bit more about cyber range specifically. I think you mentioned earlier, you're based out in Australia so you moved out there specifically for this project. Tell us a little bit about more of what you're doing. Yeah, so I originally am from the East Coast here and then I joined Cisco's Advanced Services in San Francisco and so I was traveling around doing lots of US based companies and then a big project came up, systems integration style project and needed a little bit more mental flexibility than the average Cisco box installation. And so we went out there and we did that and I was working with Splunk and that's sort of how I got started. And so I did a little bit of Splunk on the side and I continued to get better and better at it but then I come here every year and I realize I don't know anything and so I had to start over again. And then also I do all the Cisco gear installations and tuning and making sure it's all plugged in the right way. So making sure the gear is working properly, making sure that you're responding to customer concerns or issues, a very data driven challenge. So what role is Splunk playing in helping you do that and be more I guess responsive to customers and kind of what's impacting them in the real world? So whereas Splunk is meeting a sort of gap honestly in our product but every product that you'll see out here on the floor we've got some competitors of ours, some people we work together in joint solutions as well. The problem is that there is always going to be attacked and other incidents that make it past all the scanners or maybe you can't afford to have a scanner in every part of your network or maybe your scanner is misconfigured or something like that. And so Splunk is taking all the bits of information from disparate systems and trying to glue it together or join it together. And it's also giving you the statistical capabilities to look for patterns that maybe even the scanners themselves or the sensors themselves can't figure out just from one source of truth. So it's sort of a glue and also at the same time a tool and analysis tool as well. So walk us through a little bit from your perspective the evolution of some of these network security approaches. So intrusion detection, perimeter security, these things have been topics for a while. How has that market evolved? And now we're at Splunk Conference. Now Splunk doesn't necessarily market themselves as a security company but obviously that's one of the killer apps for Splunk. How has this market kind of developed to the point where Splunk who is not a security specialist is not necessarily what they set out to do is really one of the leading security providers. Godfrey told him this earlier, they're a leader in the Gartner's Magic Squadron in the space. So how did we get here? So again, people recognize that you can't get one perfect source of truth from one box, right? And I think for a long time even Cisco itself might have thought that it had the best that could block not just about anything but as attackers evolve they're doing techniques such as lateral movement or pivoting so they're getting into one system and then moving to another. So in some cases they're evading even the best in class sensors. So you need something like Splunk to take information from all these different points and pull it together and then make sense of it somehow. And also assist the humans, assist the users in making sense of that and reacting to it. Now from Cisco's perspective, did it make, apparently it made sense to look to a provider like Splunk rather than develop that software internally or those capabilities internally? Well we used to have a product that we end of life that was a SIM and it was taking logs and stuff like that and it was tough to maintain and it didn't sell very well, right? So they, you know, end of life that and then now it's kind of coming back up is that we need this SIM technology to compete for our customers to succeed and not get hacked and not get exploited and things like that. And so now it's things like Splunk and honestly other companies are starting to come up to the top again and now this big data concept is coming back is it's simply so much information and it's not well organized and you know, not many people understand it.  So yeah, expand on that a little bit around the big data component. So you've got Splunk and you've got other tools that are, you know, other approaches, tools, frameworks, whatever you want to call them, Hadoop and all the related technologies and the ecosystem that's developed around there. Talk a little bit about how that the larger big data movement is impacting essentially hardware manufacturers, in your case, you know, networking equipment. How is that impacting those, the kind of the core hardware markets? Right, so some, I think the hardware market's so strong but we've got, you know, other folks within the company working to make our boxes better, right? Give off better intelligence, that's a big drive so that we can play more evenly with the big data movement, right?  So when you're designing the product, thinking about the types of data you want to come off of these boxes and potentially even running some level of analytics on the box itself. Right, and so we've got even in the partner area here we've got some folks from our source fire team, from our identity services trust sec team and they're developing these APIs or these partner ecosystems so that they can play nicely with Splunk and they, you know, we pony up our developer resources, we engage with their developer resources, make sure that their products understand what they're looking at and make sure the visualizations make sense to the ultimate users which might be more familiar with the platform than the developers of the tool. So it's very much requires deep integration among the different providers. That's where the movement's going is that there will be instead of just a subscription model where you just look at all the information I'm giving you it's more of a back and forth, you know, maybe we can push some mitigations out to systems, refresh some analytics from one box to another and things like that. That's where things are going. So what is your take on customers and enterprises in terms of their understanding and appreciation of the security situation that we're dealing with today? When you hear about a new threat, a new attack pretty much every day in the press, do they understand, do you feel like, or is the understanding of the enterprise that your customers up to date with kind of reality what's really happening out there or they, is it over hyped at all? And how do you see customers and their reaction to what's going on in the security arena? That's a great point. Customers are actually scared and you would have seen the security keynote today. The reality is that we see it on the news now, you know, the target incidents, home depot incidents, what have you. We were talking about Stuxnet and the keynote. That stuff is reality and it's well known in the industry even outside of the industry. Like, you know, our parents can understand these concepts now because they have their actual credit cards being stolen and personal information being stolen. So as more information goes into a company's, you know, bottom line, it becomes more valuable. So people understand that. But the problem is that budgets are always hindering what people can do with their software and hardware solutions to keep up to date and hire the right people, analysts to find these incidents. And so people are woefully underprepared. So they're really concerned, scared, but they're not ready. Exactly, exactly. So that's the problem. That's something that's blunt we'll have to solve. Other vendors will have to solve, Cisco has to solve. And so that's the problem of our time. It's an industry-wide problem. It's not, no one vendor or group of vendors is going to solve. Exactly, it's not 100% automated yet, not even close. So this is the whole, we were at Cisco Booth last week at Oracle OpenWorld. And the unified servers thing is UCS systems, which is getting a lot of traction, where it's not just a server anymore, which really speaks to where DevOps is in the cloud and you know about security. There's no more perimeter anymore. The cloud and mobile infrastructure kills the perimeter. So what's your take on this? I mean, obviously, not Cisco, I don't want to get the Cisco commercial, but they have proven that unifying stuff together as a unit, kind of an operating model, if you will, versus siloed approach is working. Amazon with integrated stack is working for developers. But it brings up the security issues of, okay, no perimeter, that changes the game. APIs, notification economy, whatever you want to call it, whatever the hyped up is, means there's doors to open. A ton, ton more doors. What's the impact of security? The impact of security is it's more permeable, permeated, and it's everything's just looser, right? And so the DevOps culture is just go as quickly as possible, build as quickly as possible. And the security culture is like, no, slow down a bit. And so the push is going to be, how do we steer to the right cloud services and how do we control how our users or how our employees or our developers communicate with that cloud and how do our customers communicate back with us? And so it's really about controlling that, whether you're using a file service like Dropbox or Google or something like that, or whether you're using a SaaS like Salesforce or something like that, or even Splunk has its own cloud solution. It's all about making sure that it's well, those clouds are communicating information about usage back to the intelligence people back within the company. So your security operations center needs to understand what exactly's happening. So it's all about trade-offs. We had the banking guy on earlier and it's pretty clear banked, money, protect the money, protect the credit cards. I'll see highlights there, worry-ness or fear as you mentioned. But what is the trade-off? What are you seeing successful today where, hey, I still want to move the ball down the field on security, I mean on being, having cool apps and good user experience, same time having awesome security. What are those trade-offs? What has been a good mix and success have you seen? A good mix that I'm seeing in mobility, for instance, is sandboxing applications, giving the companies like a kill switch to wipe a mobile device or to wipe a laptop if they think it's been compromised. Giving people the power to mitigate because Splunk's all about giving the- And developers, specifically developers to the sandbox, the play-in. Yeah, exactly. So you have to be smarter about where the data's living and where it's resting and what exactly is the data. So if you have your mobile app with email, that potentially has confidential attachments in the email app. So it's like, what happens if that's stolen or compromised? How can you remotely wipe that? And developers don't always think about that stuff. Yeah, and this is where the DevOps angle comes in good. We were talking about it last week and all the shows we go to, the impact of virtualization really changes the game. So what kind of new software do the inner-circle security industry guys talk about as we need to do more of that? Is it more virtualization? Is it more, I want just better flash memory in devices? Or what's the elite taste makers conversations around? So the thing- More of blank. The thing Cisco's pushing for in the virtual space because everyone's virtualizing, right? That's happened already and it will continue to happen almost to the end, right? Until it's 100%. Virtualize the compiler inside the compiler inside the compiler. Exactly. So the push now is how do you lock down those tenancy issues? How do you prevent your customer environments from contacting each other? So Cisco's building virtual firewalls. We've got SourceFire doing host-side stuff, analyzing the actual virtual machines, looking at the processes being launched between them and connections being launched between them because traditionally we could put a sensor in between the physical network, right? Just put a tap in there and block stuff in line. If it's in the virtual network, you don't have your hands in so deep. So we've got to collaborate with the virtual vendors to put our software and our solutions inside the virtual network to get better visibility and better control. And this is just natural evolution. This is like soon we'll be walking erect and being human again. I mean, because that's what we're at right now. We're in a bad distressed state with security. I mean, the China attacks, stuff going on is pretty dangerous. It feels calm, but it's a lot of worrying going on. So given that perspective, what is the craziest thing that you've seen in security? Just kind of like, could be anything, like the weirdest, the craziest, most awesome, or crazy bad, good? One of the technologies I work a lot with is the web security appliance, basically a proxy that's scanning for like virus outbreaks, malware outbreaks, and also controlling, you know, employees going to certain sites. And without fail, once you install that in a company, there's always stuff that goes off. And so that's sort of my look into the real world to see what exactly happens, because the customers will always say, well, we kind of know we have a problem, but we're pretty good, right?   You're like, I've been compromised. That's the reality. I've already been compromised. So no crazy horror stories or anything like that. But it's more of an awakening. It's an awakening. It's an awakening. Hey, we've been breached. Yeah, correct. So long no one knows. Correct. And one of the things we're working with on our project cyber range is that we're using some of our pen testers and some of our colleagues in the research side who actually go in and help us write sort of zero day modeling attacks that actually bypass all our sensors. And then we're using things like Splunk to make sense of all the different information sources to piece it all together. Yeah, I mean, I think one of the things that comes up is the machine learning meets human curation, right? So the human role of the human is key. So you got to program the machine learning. It's got to learn from someone. So what's your take on that? I mean, share with things that you've observed and best practices or just observations around the role of the humans with the machine learning and some of the, I won't say quote AI, it's not really AI, but like machine learning is very good. But it could be looking for the wrong patterns. So the humans are critical in this. Correct, correct. One of the best ways I think of being prepared for this is being organized, right? Same with like cleaning your room or what have you.  So all these legacy applications and even Cisco stuff, it just puts out messy information and it's not well documented. It's poorly formatted, things like that. So we look to Splunk to- It can be noisy. Correct, correct. And Splunk actually publishes standards and recommended best practices. How should you format your information? And so I look at that as a sort of Splunk kind of developer and I say, well, this is information I should be feeding back to my guys that I work with at Cisco to make their products better and more easy to understand. Well, Guido who runs the product group at Splunk and I were talking with Jeff and the thing that he's most excited about is the feed extractor and how that can come in and actually be kind of a munch of the data and at least get some of that sense out of that unstructured noise. Exactly. Or structured noise, in some cases, structured. The hardest part of our job is that there's a lot of legwork that goes in to organize all the information and classify it before Splunk can even do anything with it, right? So that's why people look to me as a Cisco expert to go in and configure the routers and switches to do it the right way because without the right level of information you can't make any decisions. It's like the Cisco has its own dialect. Correct, yeah. The machine language or the exhaust. There's at least a few dialects. Well, we hear all about the data science world. You hear all about 80% of the time spent getting the data ready for analysis. Is that kind of similar to what you're talking about? Yeah, I would say 80% definitely, yeah, at least. And that's the challenge. I have a question, being related, but not quite on topic, but I'm just curious if you have an opinion on, so when companies are getting breached, there's security breaches at Home Depot, Target and others and a lot of them are getting criticized for waiting too long to inform the public to inform regulators, et cetera. What are your thoughts on that? Should companies be, as soon as they get attacked, should they make it public? Or is there benefit to waiting and where's that line? I think it's generally best to share. That's like sort of my personality, maybe not my professional stance, but I think that waiting a certain amount of time to be safe, if it will prevent something from happening to other organizations that's similar, I think we have a responsibility sort of as a society to share that information. Same as we have an ethical sort of ethical code against some pen testers and white hats and even black hats to share vulnerability information before going public with the vendor, so we have time to patch and time to inform our customers of something that's coming. You never bet against open and open source. That's one thing that we've definitely validated on theCUBE. It's always better just trust in crowds and trust in the open. As it's open things up, good things normally happen. What we've seen. So, Andrew, we really appreciate it. We got to wrap it right there. Got our next segment. Getting the hook here from Greg, the producer. Thanks for coming on. I really appreciate it. Great insight and you're a tech athlete out there.  If I was going to be a computer science guy again, I was, but the old days, but now if I was a young kid, I'd definitely be in security. It's fun. It's serious fun. Certainly awesome. Well, we'll open a rec for you. No, no, no, I haven't coded in 15 years. We'll be right back live in Las Vegas. We are here at Splunk.conference 2014. This is theCUBE. John Furrier with Jeff Kelly. We'll be right back.


and right on time. So right now we're going to listen to Jean-Christophe Delonnet who's a former pentester who used to play a lot with Microsoft Active, Microsoft Active Directory infrastructures both on defensive and offensive aspects of synactive, a French offensive security company. He is now in the reverse engineering team within his company focusing on Windows and hardware topics. His talks is IOMMU and DMA attacks or input output memory management unit and direct memory access attacks. So let's start. Hi everyone. In this presentation I'm going to talk about IOMMU and direct memory attacks. But first of all I'd like to thanks NorthSex staff for their incredible work in order to organize these events online. You guys rock really. Thank you very much. Also I hope everyone is safe. A bit of presentation. I'm Jean-Christophe Delonnet, he stores on Twitter. I'm working for a French offensive security company called Synactive. We have three polls, pentests, reverse engineering and developments. And as it was announced I'm working in the reverse engineering team now but was previously in the pentest one and used to focus on Windows related subjects like Active Directory stuff, authentication schemes, etc. In the reverse engineering team we focus mainly on low level subjects like reverse, hardware, porn, etc. And if you understood well, yeah, I'm French. I speak croissant. So, please excuse my poor English and accent. Now we do a quick roadmap. First I'll proceed to short introduction on DMS subjects. Then I'll focus on the various IOMMU implementation within mainstream OECs. And finally I'll explain some attacks then conclude and talk a bit on our ongoing works. First a quick disclaimer. In this presentation I'll talk about known attacks on internet technology only and I'll say quite high level. This is mostly state-of-the-art stuff so no real brand new fancy things for DMA experts. Even though I'll talk a bit about Thunderbolt at the end. Attacks in this presentation target are already switched on computer. The considered attack vector being the AVMADE one. For example, when your room being accessed during a conference or so. This is the AVMADE scenario. What is DMA? Well, on this slide I've put a simplified explanation of what it is. On the left you can see the normal workflow occurring when transferring data with an external peripheral. It goes through the CPU, involves your request, interrupts, etc. In order to interact with the main memory. On the right is the DMA workflow. You can see that there's not as many elements as on the left illustration. In fact, in order to increase performances, a dedicated bus is used with a dedicated controller to be able to access the main memory directly. Here are the various technologies using DMA. You've probably heard of all of them. We have the good old PCI and AGP. We have Firewire, PCI Express, etc. You can see that I've put many illustrations regarding PCI Express. The graphic card, which is well known to be using PCI Express, but also an NME SSD drive and a USB-C connector with Thunderbolt support. These two also rely on PCI bus and offer DMA. Now we'll talk about the IOMMU. Intel implements what it calls virtualization technology for directed IO, which is also known as the short VTD. Basically, this is the IOMMU stuff I will talk about. Its purpose is to proceed to DMA remapping in order to control which memory locations are reachable and by who. This DMA remapping works as a classical MMU, thus the term IO MMU, in that it takes addresses manipulated by peripherals and translates them to physical addresses. Actually, if the functioning is similar to a classical MMU, these peripheral addresses are not bound to any real virtual addresses that we could observe while debugging a process, for example. They have their own address space. A really important notion I will often refer to is the domain term. In PCI world, peripherals are organized by what they call domains. Each domain has its proper MMU configuration and what is important to remember here is that all peripherals within a single domain share the same memory mapping. Basically, what it means is that, for example, if I have a graphic card and a network card which are under the same PCI domain, then the network card could access graphic card's memory pages. We'll see later how that is important. In order to be identified, peripherals are assigned triplets, bus, dev, fun, where bus is the bus number, dev is obviously for device number, and fun represents the function of the device. For example, if we stick with the graphic card example, let's say that we have a cyber-digital NSE compliant graphic card which also makes, I don't know, coffee. Well, we would have two triplets, one with a function for graphics and one with a function for coffee. So we have two triplets. So we'll finish this short introduction with some use cases of IOMMU implementation. The first one, which is actually the well-known one, is the hypervisor use case. Imagine I have a virtual machine and a peripheral attached to it. Because my peripheral is attached to this VM, I don't want it to be able to access to my host's main memory. In the OS use case, well, it's pretty the same thing, except that I want to protect my OS kernel from rock peripherals. So I must ensure that peripherals can only access their memory pages. Now that we've seen a bit what is DMA and IOMMU, we'll take a close look on implementations on various OSs. First, let's take a look at Microsoft Windows. On Windows, IOMMU is used by technologies such as Hyper-V virtualization based security, which is also called VBS, and the new kernel DMA protection. Hyper-V, well, you've normally heard about it, is the Microsoft virtualization technology. VBS on its side relies on Hyper-V and permits to isolate critical components as LSA-SS or stuff like that from an insecure world. We'll see what it is after. And finally, the kernel DMA protection is a new feature introduced with Windows 10 version 1803. Basically, what does kernel DMA protection is, it's preventing peripheral, which have not a driver with memory isolation capability, like DMA remapping to work while the computer is locked. And you can see that I wrote on the slides that this is according to Microsoft, because unfortunately, Windows being close to us, we can be 100% sure there are no, and there are not so much of technical documentation on the IOMMU usage in here. So reverse engineering work is needed and actually is in progress on our side. On this slide, I've put a scheme of what is VBS. We won't go a lot in details on it, as this is not the purpose of this presentation. But on the right is where the user evolves when using his computer. It's called VTL-0. And on the left, you have the secure world which is called VTL-1 and is isolated from VTL-0. Technologies such as credential Guards, device Guards, etc. They all rely on VBS. And the underlying stuff is the IOMMU. Now let's talk about Linux IOMMU implementation. On Linux, the IOMMU is not activated by default. And you can change this with a special boot arguments until IOMMU on, but it's not here by default. And by the way, there is also an AMD IOMMU, but this talk is on Intel. So each IOMMU type defines an IOMMU OPS structure which serves as an abstraction layer while interacting with the hardware. We'll see this on the slide after. And here on the slide, when I say platform type, I don't refer to x86, 64, etc., but more on Intel, Equinox, Mikrotik also. In Linux world, virtual address as seen by a peripheral is called NIOVA. It is associated with a physical address PADDR with its corresponding CELs. On Linux, my mapping is achieved per domain and not per peripheral. But also each peripheral has its own domain. So in fact, each peripheral has its own address space. So here is the IOMMU OPS structure for the Intel platform. And looking at it, you can see why it is considered as an abstraction layer. And I've also put on the right the map function and the corresponding unmap function. You have all the function pointers in here. So we have here for Intel, but we would have the same for AMD, Equinox, etc. And we finish the implant implementation part with the macOS. Apple understood many years ago that hardware security is really important. They've been adding IOMMU support for quite some time actually. And if a lot of parts are open source, we can take a look. But unfortunately, all the driver parts is not. So at SynActive, we began to reverse engineering the UEFI part in order to understand how it is implemented. In our reversed work, we saw that UEFI is involved in the IOMMU configuring process. This in particular means that IOMMU is enforced at boot time. Also, we saw that there is a custom UEFI protocol permitting drivers to configure IOMMU mappings for peripheral precision. Here, when I say protocol, where it is protocol in a UEFI context, basically, there is an interface implementing functionalities. And this interface has a custom GUID. Drivers can talk to this interface. They just have to specify the GUID they want to talk to. And when the UEFI hands off to the OS, the Apple IOPC family driver reinstallizes the IOMMU for the OS context. This driver also declines the Apple VTD device mapper class, which overrides the IOMapper class. Well, here you can easily guess what this class do as their names are pretty talkative. Also, the Apple VTD device mapper class really defines IOVM map memory and the corresponding IOVM and map memory API, which permit to add and remove memory mapping within the IOMMU. And what is really, really, really important is like it's unlike Linux, Mac OS uses a single domain for all peripherals. And we'll see after why this is really important. Okay, we've seen the theoretical stuff and we'll now see the attacks. Actually, if you get bored until now, I hope it will change now, we'll see. Once again, we'll start with Windows, a quick reminder first that we consider here that the target computer is already switched on and is locked. As we saw earlier, Windows does not use IOMMU by default. The workflow of this attack is pretty easy to understand actually. First, we find a way to connect to the PCI bus and we then probe the target computer main memory searching for the unlocking routine. We patch the password checking routine. Voila, you can log whatever password is entered. Now we'll see a bit more in details how to do so. So I said we are probing main memory searching for unlocking routine. This routine is called MSVP password validates and is located in Intel and share.dll. In red, I've highlighted the RTL compare memory API which is used in this routine to compare the answer password with a normally valid password. On the left, I've displayed the opcode corresponding to the instruction in IDA Pro. Now, as I said, we want to patch the password checking routine in order to be able to log in whatever password is entered. Here is the result of such a patch. As you see, I've not the previous conditional jump to ensure that we continue in the branch we are interested in. By the way, this branch being the one that basically says this is the good password. So we managed to have a good password, whatever password we are entering. To proceed to this attack, we have to search for specific opcode in main memory. For that, we use the awesome PCL-H2 from the no less awesome of Frisk. If you look at this slide, you can notice many things. First, my amazing Microsoft Paint skills. I'm quite proud of it. But more importantly, the two opcodes patterns I'm searching for in memory. We can see that the C60FA4 in red and FBF, etc., in orange. We are looking for them at the offset 73a and 73e in memory. Here on the slide, I haven't highlighted these offsets as they were not aligned. But we will see the offset on the next slide. Now we can take a look at the patch. We are patching at offset 73b with opcodes, nope, nope, nope, etc. So what you can understand from this slide is that we are searching for two specific patterns at two specific offsets and provide a patch to be applied at a specific offset. This kind of signature is all you need to be able to use a PCL-H. Well, apart from the hardware, of course. So the prerequisites to proceed to these attacks are hardware and software. You can use an FPGA spartan with a USB 3 extension card for performances or the PCIe Screamer R2. There is a more recent version of it which is based on the M2 form factor too. And whatever adapter permitting to connecting to the PCIe bus actually. On the software side, you can use PCIe-H on Linux or Windows and you also need the signatures as I've been talking about in the previous slides. Here is an example of my FPGA with its USB extension card on the top. So in blue you can see the extension card. Actually, the FPGA is quite big. We'll use it more for tests, etc. When you will want to attack, you will prefer the PCIe Screamer because it's much slower, much tinier. On Linux, there is also no IOMMU used by default. The attack principle, it's exactly the same actually. You are searching for the password unlocking routine, which is in this case verified password hash from the pamunix.sulibrary. Then all you have to do is two patches and you have here in the bottom of the slides, you have the signature for this specific library. And finally, macOS. So this part is the most interesting as the IOMMU is enabled by default, as we said earlier. So in order to be able to compromise our targets, we must find a way to bypass this IOMMU protection. Colin Rothwell found some interesting vulnerabilities during his PhD thesis. He did a really, really great job. And following his thesis, he released with other researchers the Thunder Clap platform. And this platform contains both hardware and software and permits, among other things, to compromise a system running with macOS prior to version 10.12.4. The principle is the following. You may recall that I told you that on macOS, the reference are under the same domain. This means that they share the same address space. So this is possible to access my network cards memory pages. Well, provided that these network cards relies on PC express technology, of course. Colin Rothwell exploited this behavior to be able to execute commands as root on macOS before version 10.12.4. Let's see the attack now. First, we have to understand how network packets are described. These packets are described by what we call an Mbuff structure, which you can see on the slide in here. We'll see also this structure on the next slide, so I'm switching to it. And this particular structure has many fields across C unions. Among these fields, we can see that we have m dates in red, m packets dates in orange, and mx in blue. These elements represent data, which is a story in the packet. And because of the union type, there can be only one type at a time, depending on specific flags. You can see these flags in commands in the structure. It's a mx set, m packet header set, et cetera. And spoiler alert, we are interested in here, in the mx1, which stores data in external buffer. So if you look at the mx, I said that we are interested in it, and this means that we are interested in the corresponding flag, which will enable it. And this corresponding flag, which is a mx, but with uppercase, is stored in the mbuff structure header, as you see on the slide in purple. So in this specific structure, we have a field which contains the flag, which maybe we can set. Okay, so let's say we have the mx flag set, which, by the way, occurs when there are big packets. So pretty often because an external buffer is allocated to store the data, it must be freed when it is no longer needed. Okay, the function in charge of freeing the buffer is stored in the mx structure, actually, and it is stored as a function pointer. So you should now normally see what is the problem. Because we have a DMA access, we can modify this function pointer through DMA and also control its parameters. There are also members of the mx structure. So we have complete access to this structure. We can alter it. And all we have to do is override this pointer with the KUNC Execute API. And this specific API permits to launch a binary as root in the user land. And all you have to do is to wait for the buffer to be freed. And when it's freed, this function will be called. Apple patched this vulnerability by adding some random values, which are absorbed with data to be protected. So what it means is that if you don't know these random values, you can't proceed to this attack anymore. And these random values are set during the boot process. So this attack is no longer feasible. And if you remember in our attack vector, we said it was heavy made. So the computer must be already switched on. And we don't want it to reboot. Now let's conclude. DMA attack vectors are more and more discussed and are still a real threat model, despite being known for ages, actually. As expected, Mac OS is ahead of its contestants regarding hardware security. But Windows seems to take the physical attack vector very, very seriously. We plan to go further than the current state of the arts during our French rapid project, which I'll be talking a bit now. So this state of the arts was achieved because we plan to go further. And our project is called DMR vests and consists in studying DMA subjects relying on a PCI bus from software to hardware. We plan to look at each mainstream OSes, whether it's open source or not, and various technologies such as M2 Thunderbolts, et cetera, and also architectures like AAC-T6, ARM, et cetera, and much more things. At the moment, we are studying Thunderbolts on Windows. And because it's closed source, we are reversing it. The Intel software suite for Thunderbolts contains what we call the universal Windows platform application. You probably know this stuff. It's the new Microsoft, well, not the new Microsoft application model with the online store, et cetera, we used to call it Metro. So this is the UWP application. This suite also has a service which communicates with the application, but also with the Windows driver frameworks drivers. And there are two drivers. There is a userland driver and there is a kernel driver. These are the UMDF for userland and KMDF for kernel. And to finish, here's the first schematic we've done to represent the Intel Thunderbolts stuff. You can see that the UWP application and the service are through another binary. And the UWDF interacts with the plug-and-play manager. And this is what we are doing at the moment and plan to publish about it later. The aim is to keep digging always to do a hardware layer to understand how IOMMU is used, actually. Thank you if you have any questions. Thank you very much. Thank you. We'll give maybe two to three minutes for the participants to go and have a look at the questions, maybe of both some of them or ask for three minutes ahead. So things are good. Hi. Welcome back. Okay. So first question, are you planning to do some IOMMU DMA, the RTSRT research on the iPhone? Yes, we plan to do it. Actually, the rapid stuff, the French stuff, at the beginning we targeted solely the PCI Express technologies because there are so many things. But as iOS, iPhone or the phones are a target of interest, they are more and more targeted. We plan to do it, yes. And I think it will be a good thing to look at it, yes. In the near future or more like in a few years? Difficult to say. As I said, we've began to reverse the thunderbolt stuff on Windows and it's pretty fast. So let's finish that and after we'll see. I bet. Okay, good. So if you did some DMA research on the iPhone already, are you planning to release this research as well? We haven't done the research on iPhone and because this project is public, yes, we will publish if we find something. Okay. Is the latest macOS still vulnerable to thunder clap DMA attacks? No, no, no. As I said, this particular vulnerability was patched and the Thunder Club platform uses this vulnerability. So not exploitable anymore, but it's interesting. Good. Sorry, are there any kind of signal, signature or behavior that threat hunter could monitor to detect such attacks in real life? Signal, signature or behavior? I don't think so. Maybe if the workstation that was targeted wasn't rebooted and if, yeah, I think it's the only thing because the principle of this kind of attacks is that you access the direct memory. So the RAM and when you reboot the RAM, it's just flashed for the most part. So maybe if you don't reboot the computer, but it's more likely very difficult to spot this kind of stuff, except if there are some backdoors after that, it's not the DMA stuff. Okay. Have you heard about DMA attacks targeting embedded devices using architecture such as ARM MIPS? Embedded device, not really. A guy in my company did some stuff on the HP ILO. It's not really embedded, but it's kind of server. And there is also the guy which produces the PCI Screamer Ramzin Amin, who did some DMA on the iPhone. So, well, it's not really embedded devices, but you have this kind of architecture beside the ARM, etc. Could we say that it's like a little bit under research or...? I don't know. I don't know. Okay. Can you read write TPM registers at physical address fed 40,000 through DMA when the IMM or U is disabled? Which address? So I've heard the TPM, yeah. Registrar is at physical address fed 40,000. You mean in the CPR of the TPM? Because the TPM has some registers and the principle of the TPM is that it's a secure device, it's secure competence, so you can't access it. I don't know if I understood well the question. Because if it's that, no, you can't access the TPM, but whatever the TPM is exporting should be used by the exploitation system. At this moment, yes, you can, because it's in main memory. Okay. I think, yeah, you pretty much answered it. Are there IMM US embedded systems such as STM32F stock? Good question. I don't think so for the STM. Well, honestly, I don't really know. I don't really know. I don't think so. Okay. Are you leveraging the work done by the Inception project in your research? Yes, the Inception project was really cool. Actually, I've done some pull requests in it, but the Inception project, the guy who did this really great work, he doesn't commit a lot. So actually, what is done is Inception is basically the same thing as PCI-LH. It's just that Inception also supports the Firewire case.  Otherwise, you'll use PCI-LH. Okay. And one last question. For non-Apple hardware, does IOMMU seem to be correctly implemented at the UFI level? We haven't looked at it, so I can't answer, unfortunately. But we plan to. Near or from future? Same thing. But actually, because as I said, there are a lot of stuff, which is open source. I think they probably already some stuff on the internet. So somebody probably looked at it. I don't know. Good. Well, thank you very much, Narkistof, for being with us today. Thank you to you. Thank you very much. Big round of applause to you through the chat. Thank you, guys. And we'll take a short break and we'll be back.