Laws of Thermodynamics Explained: Zeroth to Third, With Worked Examples

The four laws of thermodynamics say that temperature is a shared property of bodies in equilibrium (zeroth), that energy is conserved (first), that the entropy of an isolated system never decreases, which caps every engine and heat pump (second), and that entropy approaches a minimum as temperature approaches absolute zero, which can never be reached (third). Together they explain why no engine converts all its heat into work, why a heat pump can deliver more heat than the electricity it uses, and why erasing one bit of data has a minimum energy cost.

Below, each law gets worked numbers (a Carnot engine, a heat pump, a refrigerator, a data centre, the Landauer limit), then thermodynamic entropy is contrasted with the Shannon entropy behind cryptographic randomness. Constants come from NIST's CODATA tables, and a short Python script reproduces every calculation. This is a physics explainer: Safeguard's models are single purpose security models and do not do physics.

Key takeaways

• Zeroth law: bodies each in equilibrium with a third share a temperature, which is what makes thermometers work.
• First law: energy is conserved. Every watt a server draws ends up as heat the cooling plant must remove.
• Second law: no process turns heat completely into work, and heat does not flow by itself from cold to hot.
• Carnot limit: an engine running between 1,000 K and 300 K can convert at most 70 percent of its heat input into work, whatever its design.
• Heat pumps: the ideal heating coefficient of performance between 5°F outdoors and 35°C supply water is about 6.2. DOE's cold climate challenge asks for a real COP of 2.1 to 2.4 at 5°F, roughly 34 to 39 percent of that ideal.
• Third law: as temperature approaches absolute zero, entropy approaches a minimum (zero for a perfect crystal), and absolute zero cannot be reached in a finite number of steps.
• Landauer limit: erasing one bit at 300 K must dissipate at least k T ln 2, about 2.87 × 10^-21 joules or 0.018 eV. A 2012 Nature experiment measured heat approaching this bound.
• Shannon entropy shares a formula with statistical entropy but is a different quantity; for keys the stricter measure is min-entropy (NIST SP 800-90B).

The four laws at a glance

The numbering is historical: the zeroth law was named after the others, though it is logically more basic.

What is the zeroth law of thermodynamics?

The zeroth law defines temperature. MIT's Unified Engineering notes put it as two observations. First, if two bodies touch through a boundary that conducts heat and are left long enough, no further observable changes take place: they reach thermal equilibrium. Second, two systems that are each in thermal equilibrium with a third are in thermal equilibrium with each other, and all three share the property we call temperature.

That sounds obvious, but it is what lets a thermometer work: if equilibrium were not transitive, no single number could describe how hot something is.

How is temperature measured in SI units?

The SI unit of thermodynamic temperature is the kelvin. NIST explains that from 1954 the kelvin was defined as 1/273.16 of the thermodynamic temperature of the triple point of water, the single temperature and pressure at which ice, liquid water and water vapour coexist. When the revised SI was approved in November 2018, the definition changed: the kelvin's size is now set by fixing the Boltzmann constant at exactly 1.380649 × 10^-23 joules per kelvin.

NIST's CODATA entry lists that value as exact, so in the Landauer calculation below any uncertainty comes from the temperature, not from k. NIST gives 0 K = -273.15 °C = -459.67 °F. Every formula here that uses a ratio of temperatures needs kelvin; using Celsius in a Carnot calculation is the most common error in the subject.

What does the first law of thermodynamics say?

The first law is conservation of energy applied to heat and work. For a closed system it is usually written:

ΔU = Q - W

ΔU  change in the system's internal energy (J)
Q   heat added to the system (J)
W   work done by the system on its surroundings (J)

Some texts write ΔU = Q + W with W as work done on the system; check a source's sign convention before mixing its numbers with yours.

MIT's notes make two points about heat that clear up a lot of confusion. Heat is energy transferred because of a temperature difference and nothing else. And bodies do not "contain" heat: heat is identified only as it crosses a system boundary. What a body contains is internal energy. A hot brick has more internal energy than a cold one, not more heat.

Worked example: a gas in a cylinder

Add 500 J of heat to a gas in a cylinder with a piston. The gas expands and pushes the piston, doing 200 J of work on the surroundings.

ΔU = Q - W = 500 J - 200 J = 300 J

The internal energy of the gas rose by 300 J. Its temperature went up. None of the 500 J disappeared; 200 J left as work and 300 J stayed as internal energy.

Worked example: a server at steady state

A server draws 500 W of electrical power. In steady state its temperature is constant, so its internal energy is not changing: ΔU per second is zero. Electrical energy coming in is work done on the server. The only significant thing leaving is heat (a tiny amount leaves as light from status LEDs and as radio emissions, and a negligible amount as sound).

Power in  = 500 W (electrical work on the server)
ΔU / time = 0     (steady state)
Heat out  ≈ 500 W

This is why data centre engineers treat IT load and heat load as the same number. A 1 MW hall of servers is a 1 MW heater that happens to compute. That fact drives the cooling discussion later in this article.

What does the second law of thermodynamics say?

The second law gives processes a direction. A hot and a cold brick end up at one medium temperature, and a released gas fills its chamber. The reverse never happens on its own, though it would conserve energy, so another principle must forbid it.

The MIT notes give three equivalent statements:

1. Kelvin Planck statement: no process is possible whose sole result is the absorption of heat from a reservoir and the conversion of all of that heat into work.
2. Clausius statement: no process is possible whose sole result is the transfer of heat from a cooler body to a hotter one.
3. Entropy statement: every system in equilibrium has a property called entropy, S. For a reversible process the change is dS = dQ_rev / T, and the entropy of a system and its surroundings taken together increases for any real process, approaching zero change only as the process approaches reversibility.

The word "sole" matters. A refrigerator moves heat from cold to hot, but it also consumes work. A turbine turns heat into work, but also rejects heat to a condenser. What is forbidden is the free lunch.

Worked example: entropy when heat flows downhill

Let 1,000 J of heat flow directly from a large reservoir at 400 K to another large reservoir at 300 K. Each reservoir is big enough that its temperature does not change.

ΔS_hot  = -Q / T_hot  = -1000 / 400 = -2.500 J/K
ΔS_cold = +Q / T_cold = +1000 / 300 = +3.333 J/K
ΔS_total = +0.833 J/K   (greater than zero, so the process is allowed)

Run the same numbers with heat flowing from 300 K to 400 K and the total is -0.833 J/K. That is the Clausius statement in arithmetic form: spontaneous heat flow from cold to hot would destroy entropy, so it does not happen.

Where did entropy come from?

Rudolf Clausius developed entropy in his papers on the mechanical theory of heat in the 1850s and 1860s; his lecture on the second law was published in 1867 (scan on the Internet Archive). His entropy is macroscopic, defined by heat flows and temperatures.

Ludwig Boltzmann gave entropy a microscopic meaning: a macrostate (pressure, temperature, volume) can be realised by an enormous number W of microstates. His relation, as usually written today, is:

S = k ln W

k  Boltzmann constant, exactly 1.380649e-23 J/K
W  number of microstates consistent with the macrostate

MIT's notes derive a more general statistical form for the case where microstates are not equally likely:

S = -k Σ p_i ln p_i

where p_i is the probability of microstate i. When all W microstates are equally likely, p_i = 1/W and this reduces to S = k ln W. The notes stress that entropy is largest, for a given energy, when all quantum states are equally probable. Hold on to that formula; it reappears almost unchanged in Shannon's 1948 paper.

Worked example: a gas doubles its volume

One mole of ideal gas expands freely into a vacuum, doubling its volume at constant temperature. Each molecule now has twice as many places to be, so W is multiplied by 2 for every molecule. For one mole the entropy change is:

ΔS = R ln 2
   = 8.314462618 J/(mol K) × 0.693147
   ≈ 5.763 J/K

R, the molar gas constant, is exact in NIST's CODATA table (8.314 462 618... J mol^-1 K^-1). No heat flowed in this free expansion, yet entropy rose: entropy is a property of the state.

Heat engines and the Carnot efficiency

A heat engine takes heat Q_H from a hot source at T_H, turns part of it into work W, and rejects the rest Q_C to a cold sink at T_C. Its thermal efficiency is work out divided by heat in.

Sadi Carnot analysed this problem in his 1824 book Réflexions sur la puissance motrice du feu (Reflections on the Motive Power of Fire), a scan of which is on the Internet Archive. The ideal cycle that carries his name has four reversible steps. MIT's notes describe them: an isothermal expansion while absorbing heat from the hot reservoir, an adiabatic expansion during which the temperature falls to T_C, an isothermal compression while rejecting heat to the cold reservoir, and an adiabatic compression back to the start.

Because the cycle is reversible, entropy taken in at T_H equals entropy rejected at T_C, which gives:

Q_H / T_H = Q_C / T_C

η_Carnot = W / Q_H = 1 - Q_C / Q_H = 1 - T_C / T_H     (temperatures in kelvin)

MIT's notes add a point that is easy to skip: all Carnot engines running between the same two temperatures have the same efficiency, whatever the working fluid. That statement is itself one way of expressing the second law. No real engine operating between those temperatures can beat it.

Worked example 1: 1,000 K to 300 K

η = 1 - 300 / 1000 = 0.70   →  70 percent maximum

At least 300 J of every 1,000 J must go to the cold side. That is the second law's price, not waste you can engineer away.

Worked example 2: a steam cycle between 565 °C and 30 °C

Convert to kelvin first: 565 °C is 838.15 K and 30 °C is 303.15 K.

η = 1 - 303.15 / 838.15 ≈ 0.638   →  63.8 percent maximum

Real plants run well below this because heat is added over a range of temperatures and because of friction and finite temperature differences in heat exchangers. Carnot gives the ceiling and how to raise it: a hotter hot side or a colder cold side.

Worked example 3: why you cannot boil water with waste heat from a server room

Suppose a data hall exhausts air at 35 °C (308.15 K) into a 20 °C (293.15 K) outdoor environment. What is the most work you could ever get from that heat?

η = 1 - 293.15 / 308.15 ≈ 0.049   →  4.9 percent maximum

Under 5 percent before any real world losses. This is why the industry talks about reusing data centre heat as heat (warming buildings, preheating water) rather than turning it back into electricity. The DOE Federal Energy Management Program's data centre guide says the same thing in engineering terms: the direct use of waste heat for low temperature heating gives the greatest savings, and the higher the temperature leaving the server, the greater the opportunity.

Refrigerators and heat pumps

Run a Carnot cycle backwards and it becomes a refrigerator or heat pump. Work goes in, heat is drawn from the cold side, and a larger amount of heat comes out of the hot side. MIT's notes summarise the bargain as "what we pay for" (the work) against "what we get" (the heat moved). The ratio is the coefficient of performance, COP.

Refrigerator (cooling):  COP_C = Q_C / W
Heat pump (heating):     COP_H = Q_H / W = COP_C + 1

Carnot limits:
COP_C,max = T_C / (T_H - T_C)
COP_H,max = T_H / (T_H - T_C)

The MIT notes point out that a COP can be much larger than one. That is not a violation of anything. A heat pump does not create heat; it moves heat that already exists outdoors to the inside, and the electricity pays for the move.

Worked example: a refrigerator

Fridge interior at 4 °C (277.15 K), kitchen at 25 °C (298.15 K).

COP_C,max = 277.15 / (298.15 - 277.15) = 277.15 / 21 ≈ 13.2

Ideally each joule of electricity removes about 13 J of heat. Real fridges need a colder evaporator and hotter condenser than the air around them, plus compressor losses, so their COP is much lower. Small temperature lifts are cheap; large ones are expensive.

Worked example: a cold climate heat pump at 5°F

The US Department of Energy launched a Residential Cold Climate Heat Pump Technology Challenge because, as its fact sheet puts it, the performance of conventional heat pumps declines in colder climates. The challenge specification asks for a minimum COP of 2.1 to 2.4 at an outdoor temperature of 5°F (-15 °C), along with an 8.5 HSPF2 seasonal rating in Region V and full capacity at 5°F compared with 47°F.

How does that compare with the thermodynamic ceiling? Take an outdoor coil at -15 °C (258.15 K) and a heating supply at 35 °C (308.15 K), a typical value for underfloor heating or a low temperature radiator loop.

COP_H,max = 308.15 / (308.15 - 258.15) = 308.15 / 50 ≈ 6.16

DOE challenge minimum: 2.1 to 2.4
Fraction of Carnot:    2.1 / 6.16 ≈ 0.34   to   2.4 / 6.16 ≈ 0.39

A heat pump meeting the challenge delivers 2.1 to 2.4 joules of heat per joule of electricity at 5°F, roughly 34 to 39 percent of the ideal. COP falls in colder weather because T_H - T_C grows, which is also why low supply temperatures help: at a 30 °C supply the ceiling rises to about 6.8.

What does the third law of thermodynamics say?

The third law describes what happens near absolute zero. In one common form: as the temperature of a system approaches 0 K, its entropy approaches a constant minimum value, which is zero for a perfect crystal. A second, equivalent form, often called the unattainability principle: absolute zero cannot be reached in a finite number of steps.

The law grew out of Walther Nernst's heat theorem. In his Nobel lecture, delivered on 12 December 1921, Nernst describes his 1906 paper on calculating chemical equilibria from thermal measurements. His principle, in his words as translated, was that chemical affinity and the evolution of heat "become identical at low temperatures", and not by crossing at absolute zero but by becoming tangent some distance before it. The Nobel Foundation lists Nernst as the 1920 laureate in chemistry "in recognition of his work in thermochemistry", and notes he received the prize one year later, in 1921.

Is there any motion at absolute zero?

Yes. NIST notes that classical physics predicted all motion stops at 0 K, but quantum theory says matter retains "zero point motion" even there, because the uncertainty principle forbids a particle having both a definite position and a definite momentum. Absolute zero is the state of minimum energy, not zero energy.

Why the third law matters in practice

Each step toward absolute zero removes a smaller amount of entropy than the last, so cooling gets progressively harder. The Carnot refrigerator formula shows the same thing from another angle: COP_C,max = T_C / (T_H - T_C) goes to zero as T_C goes to zero. Pumping heat out of something at 0.01 K into a room at 300 K costs about 30,000 joules of work per joule of heat removed, even in the ideal case. Dilution refrigerators for superconducting quantum computers and low temperature physics live with this every day.

Data centre cooling and PUE: the laws at industrial scale

In a data centre the first law turns every watt of IT power into heat, and the second law makes moving that heat outdoors cost work.

How much energy do US data centres use?

On 20 December 2024 the US Department of Energy announced the 2024 Report on U.S. Data Center Energy Use, produced by Lawrence Berkeley National Laboratory. According to DOE's summary, data centres consumed about 4.4 percent of total US electricity in 2023 and are expected to consume about 6.7 to 12 percent by 2028. Total data centre electricity use rose from 58 TWh in 2014 to 176 TWh in 2023, with an estimated 325 to 580 TWh by 2028.

What is PUE and what is a good value?

Power Usage Effectiveness is the standard efficiency metric. DOE's Best Practices Guide for Energy-Efficient Data Center Design (Federal Energy Management Program, published July 2024) defines it as the ratio of total annual facility energy to the total annual energy drawn by IT equipment:

PUE = total facility energy / IT equipment energy

The guide's benchmarks are 1.6 standard, 1.4 good and 1.1 better. It says the average data centre is at 1.6, some recent facilities run below 1.1, and cites Uptime Institute's 2022 average of 1.55 for large data centres. PUE cannot go below 1.0, which would mean no energy at all for cooling, lighting or other non IT loads.

The yearly figures are simple arithmetic (overhead in MW times 8,760 hours). Moving a constant 1 MW IT load from PUE 1.6 to 1.1 saves 0.5 MW, or 4,380 MWh a year.

How do the laws of thermodynamics shape data centre cooling?

The DOE guide's recommendations read like a thermodynamics textbook applied to buildings:

• Raise the temperature. It recommends the ASHRAE Recommended range of 65°F to 80°F at IT air intakes. A warmer cold side shrinks T_H - T_C and raises the chillers' ideal COP.
• Use free cooling. When outdoor air or water is cold enough, heat flows downhill on its own and you pay only for fans and pumps.
• Separate hot and cold air. Mixing them is pure entropy generation; the guide notes hotter return air extends economizer hours.
• Move heat with liquid. Direct liquid cooling captures heat near where it is generated and can be much more efficient than air.
• Reuse the heat as heat. Exhaust near 35 °C has a Carnot ceiling under 5 percent for electricity but can still warm a building.

Landauer's principle: the energy cost of forgetting

In 1961 Rolf Landauer of IBM connected thermodynamics to computing. His paper "Irreversibility and Heat Generation in the Computing Process" appeared in the IBM Journal of Research and Development, volume 5, number 3, and was reprinted by IBM in 2000.

The argument, as the 2012 Nature paper by Bérut and colleagues summarises it, is that erasing information is a dissipative process. Erasing a bit maps two possible states (0 or 1) onto one (say 0). That reduces the number of possible states of the memory, so its entropy falls by k ln 2. The second law says total entropy cannot fall, so at least that much entropy must go into the environment as heat. At temperature T, the minimum heat is:

E_min = k T ln 2

Worked example: the Landauer limit at room temperature

Use the exact CODATA value k = 1.380649 × 10^-23 J/K and T = 300 K.

E_min = 1.380649e-23 J/K × 300 K × 0.693147
      ≈ 2.871e-21 J per bit

In electronvolts (1 eV = 1.602176634e-19 J):
      ≈ 0.0179 eV per bit

At 298.15 K (25 °C) the figure is about 2.853 × 10^-21 J. At 4.2 K, the boiling point of liquid helium, it drops to about 4.02 × 10^-23 J. The bound scales directly with temperature, which is one reason cold computing is discussed in this context, although you then pay the third law's price to keep things cold.

Put that number in human terms:

Erase 1 terabyte (8e12 bits) at 300 K:
  8e12 × 2.871e-21 J ≈ 2.3e-8 J   (about 23 nanojoules)

Bits erasable per joule at 300 K:
  1 / 2.871e-21 ≈ 3.48e20 bits

Bits erasable per second on a 100 W budget at the bound:
  100 × 3.48e20 ≈ 3.5e22 bits per second

The limit is a floor, not a forecast. No practical processor comes near erasing 3.5 × 10^22 bits per second on 100 W, so real chip heat comes overwhelmingly from other losses. The bound matters as a long run boundary on irreversible computing and as proof that information is physical.

Has Landauer's principle been tested?

Yes. On 7 March 2012 Nature published "Experimental verification of Landauer's principle linking information and thermodynamics" by Antoine Bérut, Artak Arakelyan, Artyom Petrosyan, Sergio Ciliberto, Raoul Dillenschneider and Eric Lutz (Nature 483, pages 187 to 189). The authors trapped a single colloidal particle in a modulated double well potential, a physical one bit memory, and showed that the mean dissipated heat approaches the Landauer bound in the limit of long erasure cycles. Erase fast and you dissipate more; like the Carnot cycle, the bound is approached only by slow, nearly reversible processes.

Does Landauer's principle apply to all computation?

It applies to logically irreversible operations, where the output does not determine the input, such as erasing a bit or an AND gate. Reversible computing, which tries to avoid the bound, remains a research topic.

Shannon entropy and why cryptography cares

In 1948 Claude Shannon published "A Mathematical Theory of Communication". In it he proves that the only function satisfying three reasonable requirements for a measure of uncertainty has the form:

H = -K Σ p_i log p_i

where K is a positive constant that just sets the unit. With logarithms in base 2, H is measured in bits. Shannon then writes that the form of H "will be recognized as that of entropy" in statistical mechanics, and points to Boltzmann's H theorem. Compare it with the statistical entropy formula from MIT's notes earlier. They are the same shape.

Are Shannon entropy and thermodynamic entropy the same thing?

They share mathematics and they are linked by Landauer's principle, but they are not the same quantity:

The bridge between the first two columns is the factor k ln 2: one bit of Shannon uncertainty, when physically stored and then erased, corresponds to at least k ln 2 of thermodynamic entropy pushed into the environment, which at temperature T costs at least k T ln 2 of heat.

Why security engineers use min-entropy, not Shannon entropy

Shannon entropy is an average. An attacker guessing a key does not care about the average; they start with the most likely value. That is why NIST SP 800-90B, the recommendation for entropy sources used by random bit generators (published January 2018, with a planning note in May 2025 about two errata), lists min-entropy among its keywords and builds its validation tests around it. These entropy sources are meant to be combined with the deterministic random bit generators of SP 800-90A to build complete random bit generators as described in SP 800-90C.

A biased coin shows the difference clearly. Suppose heads comes up with probability 0.9.

Shannon entropy:  H = -(0.9 log2 0.9 + 0.1 log2 0.1) ≈ 0.469 bits per flip
Min-entropy:      H_min = -log2 0.9 ≈ 0.152 bits per flip

If you sized a key using Shannon entropy you would believe you had about three times as much unpredictability per flip as an attacker actually faces. For a fair coin both measures give exactly 1 bit.

For passwords: one word chosen uniformly from 10,000 carries about 13.3 bits; four independent words from a 7,776 word list carry about 51.7 bits; 32 bytes from a properly seeded secure generator carry up to 256 bits. Safeguard's blog covers the practical side in more depth: see insecure randomness vulnerabilities explained, CSPRNG secure random number generation, CWE-331 insufficient entropy and how long a session ID should be.

Step by step: reproduce every number in this article

You do not need special software to check the physics here. The script below uses only the Python standard library. It computes each worked example, with the CODATA constants written in as exact values.

1. Save the script

# thermo_check.py: reproduce the worked examples in this article
import math

K_B = 1.380649e-23        # Boltzmann constant, J/K (exact, CODATA 2022 via NIST)
R = 8.314462618           # molar gas constant, J/(mol K), first digits of the exact value
EV = 1.602176634e-19      # joules per electronvolt (exact)

def c_to_k(c):
    return c + 273.15

def carnot_efficiency(t_hot_k, t_cold_k):
    return 1 - t_cold_k / t_hot_k

def cop_heating_max(t_hot_k, t_cold_k):
    return t_hot_k / (t_hot_k - t_cold_k)

def cop_cooling_max(t_hot_k, t_cold_k):
    return t_cold_k / (t_hot_k - t_cold_k)

def landauer_joules(t_k):
    return K_B * t_k * math.log(2)

def shannon_bits(probs):
    return -sum(p * math.log2(p) for p in probs if p > 0)

def min_entropy_bits(probs):
    return -math.log2(max(probs))

print("Carnot 1000 K to 300 K:", round(carnot_efficiency(1000, 300), 3))
print("Carnot 565 C to 30 C:", round(carnot_efficiency(c_to_k(565), c_to_k(30)), 3))
print("Carnot 35 C exhaust to 20 C:", round(carnot_efficiency(c_to_k(35), c_to_k(20)), 3))
print("Fridge COP max 4 C in 25 C:", round(cop_cooling_max(c_to_k(25), c_to_k(4)), 1))
print("Heat pump COP max -15 C to 35 C:", round(cop_heating_max(c_to_k(35), c_to_k(-15)), 2))
print("Entropy, 1000 J from 400 K to 300 K:", round(-1000/400 + 1000/300, 3), "J/K")
print("Free expansion, 1 mol doubles volume:", round(R * math.log(2), 3), "J/K")
e = landauer_joules(300)
print("Landauer at 300 K:", f"{e:.4e} J", f"{e/EV:.4f} eV")
print("Erase 1 TB at 300 K:", f"{8e12 * e:.2e} J")
coin = [0.9, 0.1]
print("Biased coin Shannon:", round(shannon_bits(coin), 3), "bits")
print("Biased coin min-entropy:", round(min_entropy_bits(coin), 3), "bits")
for pue in (1.6, 1.4, 1.1):
    overhead_mw = pue - 1.0
    print(f"PUE {pue}: overhead {overhead_mw:.1f} MW per MW IT, {overhead_mw * 8760:,.0f} MWh/yr")

2. Run it

python3 thermo_check.py

You should see a Carnot efficiency of 0.7 for 1,000 K to 300 K, 0.638 for the steam example, 0.049 for server exhaust, a refrigerator COP of about 13.2, a heat pump COP of about 6.16, a Landauer energy of about 2.8710e-21 J (0.0179 eV), and the biased coin values of 0.469 and 0.152 bits.

3. Generate key material from the right source

For anything security related, take randomness from the operating system's cryptographically secure generator, never from a general purpose pseudo random function. Two standard ways:

# 32 random bytes as hex, from OpenSSL
openssl rand -hex 32

# 32 random bytes as a URL safe token, from Python's secrets module
python3 -c "import secrets; print(secrets.token_urlsafe(32))"

Python's random module is for simulation, not secrets (details). Repeatable simulations need the opposite: an explicitly seeded generator with the seed recorded (more).

4. Watch the floating point

When T_H and T_C are close, 1 - T_C / T_H subtracts nearly equal numbers, and in long simulations cancellation error can build up. Compute (T_H - T_C) / T_H directly when you know the difference, and keep temperatures in kelvin from the start.

Where software security comes in, honestly

Thermodynamics is not a software security topic, and Safeguard does not model physical systems. The real connections are two. First, keys and tokens are only as strong as the min-entropy behind them, and weak randomness is a recurring vulnerability class. Second, simulation, thermal modelling and data centre management tools are built on open source libraries and container images; a vulnerable dependency there is a supply chain problem handled like any other. Safeguard does not scan firmware or operational technology devices; facilities systems you do not build stay with their vendors.

Common mistakes

These are the misconceptions that come up most often when people first meet the laws.

• "Heat and temperature are the same thing." Temperature is a property a body has; heat is energy in transit because of a temperature difference. A bath at 40 °C holds far more internal energy than a cup of tea at 80 °C, and can transfer more heat, despite the lower temperature.
• "Entropy means disorder." Disorder is a loose metaphor. Entropy counts microstates (Boltzmann) or tracks reversible heat over temperature (Clausius). Some ordered looking systems, such as certain liquid crystals, form because ordering in one respect frees up many more states in another.
• "A refrigerator breaks the second law." Local entropy can fall; total entropy, including your warmer kitchen, still rises.
• "A heat pump with a COP of 3 is 300 percent efficient, so it is creating energy." It is moving heat, not creating it. The first law is satisfied: heat out equals heat drawn from outside plus electrical work in.
• "Carnot efficiency can be calculated in Celsius." It cannot. 1 - 30/565 gives 94.7 percent for the steam example, which is badly wrong. In kelvin the answer is 63.8 percent.
• "Better engineering can reach 100 percent heat to work efficiency." Only with a cold sink at absolute zero, which the third law says cannot be reached. The Carnot limit is a law, not a technology gap.
• "Landauer's limit is why my laptop gets hot." At 300 K the bound is about 2.87 × 10^-21 J per erased bit. Real processors dissipate their heat almost entirely through other losses.
• "High Shannon entropy means a key is strong." For security the relevant measure is min-entropy, which can be much lower, as the biased coin example shows.

FAQ

What are the 4 laws of thermodynamics in simple terms?

Zeroth: things in thermal equilibrium with the same third thing share a temperature. First: energy is conserved; heat and work just move it around. Second: entropy of an isolated system never goes down, so no engine turns all heat into work and heat does not flow uphill on its own. Third: as you approach absolute zero, entropy approaches a minimum, and you can never actually reach 0 K.

Why is it called the zeroth law?

Because it was recognised as a separate law after the first and second laws were already named, yet it is logically more basic: it defines temperature, which the other laws use. Rather than renumber the established laws, physicists called it the zeroth.

What is the Carnot efficiency formula?

The maximum efficiency of any heat engine running between a hot reservoir at T_H and a cold reservoir at T_C is 1 - T_C / T_H, with both temperatures in kelvin. Between 1,000 K and 300 K that is 70 percent.

How can a heat pump be more than 100 percent efficient?

It does not convert electricity into heat; it uses electricity to move existing heat from outside to inside. The ratio of heat delivered to electricity used, the COP, can exceed 1. The ideal COP between -15 °C outside and 35 °C supply is about 6.2. DOE's cold climate challenge targets a real COP of 2.1 to 2.4 at 5°F.

Can absolute zero ever be reached?

No. The third law, in its unattainability form, says 0 K cannot be reached in a finite number of steps. The ideal COP of a refrigerator falls toward zero as the cold side approaches 0 K, so each further step costs more work.

What is the Landauer limit at room temperature?

At 300 K, erasing one bit must dissipate at least k T ln 2, which is about 2.87 × 10^-21 joules or 0.018 eV, using the exact Boltzmann constant 1.380649 × 10^-23 J/K. A 2012 Nature experiment by Bérut and colleagues showed the dissipated heat approaching this bound for slow erasures.

What is a good PUE for a data centre?

DOE's Best Practices Guide lists 1.6 as standard, 1.4 as good and 1.1 as better, says the average data centre is about 1.6, and notes some recent facilities run below 1.1. A PUE of 1.0 is the theoretical floor.

Is Shannon entropy the same as thermodynamic entropy?

Not exactly. Shannon himself noted that his formula has the same form as entropy in statistical mechanics. The two are linked by Landauer's principle through the factor k ln 2, but Shannon entropy is measured in bits over a probability model, while thermodynamic entropy is measured in joules per kelvin over physical microstates.

Fix it without waiting for upstream

Thermodynamics needs no patches, but the simulation and monitoring software built around it uses open source libraries and images that do get vulnerabilities, and that is where Safeguard can help.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

None of these demos do physics; they cover the software side. Download Safeguard or read the CLI docs to try them.

The first demo is a real Safeguard CLI session. Asked to fix a lodash CVE, it reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with your approval, and pushes nothing. The same approve each step flow applies when a dashboard or data pipeline built around your simulation code needs a dependency upgrade.

Click through it at your own pace, or open it full screen.

The second demo sets up Safeguard's local runner on your own machine, approves it with its device code, and runs a scan from the terminal. On a workstation or build host that runs numerical or scientific code, the same flow lists the open source packages that went in, so you know what you are shipping before a vulnerability makes you ask.

Click through it at your own pace, or open it full screen.

The third demo connects Claude to the Safeguard MCP server with OAuth and lets you choose which tools Claude can use. That lets you ask which of your projects carry a given package version while keeping control over what the assistant can touch.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• NIST CODATA: Boltzmann constant (2022 CODATA recommended values)
• NIST CODATA: molar gas constant
• NIST: SI redefinition, kelvin
• MIT Unified Engineering, Thermodynamics and Propulsion notes (Greitzer, Spakovszky, Waitz): contents
• MIT notes 1.3: heat, work and the zeroth law
• MIT notes 3.3: the Carnot cycle
• MIT notes 3.4: refrigerators and heat pumps
• MIT notes 5.1: concept and statements of the second law
• MIT notes 7.3: a statistical definition of entropy
• MIT notes 8.4: the Clausius Clapeyron equation and Carnot engines with two phase media
• Sadi Carnot, Réflexions sur la puissance motrice du feu (1824), Internet Archive scan
• Rudolf Clausius, Über den zweiten Hauptsatz der mechanischen Wärmetheorie (1867), Internet Archive scan
• NobelPrize.org: Walther Nernst, Nobel Prize in Chemistry 1920, facts
• NobelPrize.org: Walther Nernst, Nobel lecture "Studies in Chemical Thermodynamics", 12 December 1921 (PDF)
• R. Landauer, Irreversibility and Heat Generation in the Computing Process, IBM Journal of Research and Development 5(3), 1961, IBM reprint 2000 (PDF)
• Bérut et al., Experimental verification of Landauer's principle linking information and thermodynamics, Nature 483, 187 to 189 (2012)
• C. E. Shannon, A Mathematical Theory of Communication (1948), PDF
• NIST SP 800-90B: Recommendation for the Entropy Sources Used for Random Bit Generation
• US DOE: DOE Releases New Report Evaluating Increase in Electricity Demand from Data Centers, 20 December 2024
• US DOE FEMP: Best Practices Guide for Energy-Efficient Data Center Design, July 2024
• US DOE FEMP: Best Practices Guide for Energy-Efficient Data Center Design (PDF)
• US DOE: Residential Cold Climate Heat Pump Challenge
• US DOE: Residential Cold Climate Heat Pump Technology Challenge fact sheet (PDF)

Last reviewed: 23 October 2026.