## 3 Proposed S&S Analysis Methodology  
The proposed analysis method basically consists of 7 steps, as summarized in Figure 3, which may be iterative until the applicable safety and security requirements are reasonably satisfied. Note that the proposed methodology's flow (from _Step 1_ to _Step 6_) is similar to those of STPA [12] and STPA-Sec [13]; all seven steps of the proposed methodology are described in the following. The analysis (_Step 1_) starts with definition of the system. It should describe the interactions between the system and its environment (e.g., stakeholders and weather) as well as between hardware/software components of the system. This initial step may involve materials and diagrams that describe the system from various perspectives--for example, control structure/loop (as in STPA), hardware architecture, and data flow. The gathered information is then utilized in _Step 2_ to deduce the relevant hazards/vulnerabilities that may result in undesired accidents or loss events. For example, an ill-trained maintenance worker overlooking particular ageing machine parts, which eventually leads to machine failure and hence service interruption. _Step 3_ of the proposed method aims to identify all necessary and unnecessary signals that may exist within the system. Necessary signals (e.g., commands, data, feedback, and power) are those transmitted among the system components to ensure intended functionality of the system. Unnecessary signals are usually byproducts of their emitters, or those not beneficial to the components who receive them intentionally or unintentionally. For instance, loud noises or high heat output by machines can be unnecessary (and thus hazardous) signals to nearby users or flammable substances; besides, a router's Wi-Fi signal, which is needed for enabling authorized personnel to remotely access the networked devices, also exposes the router to hacking if it can be captured by attacker using dedicated tools. Therefore, any unnecessary signals identified ought to be removed immediately if possible. For each necessary signal, _Step 4_ identifies the adverse impact that may arise should the signal become inappropriate in the following ways: (1) the signal is not provided; (2) the signal provided is wrong; (3) the signal is untimely provided; and (4) the signal is stopped/applied too soon/long. These four types of inappropriate signal are adapted from four types of unsafe control action mentioned in STPA; note that not all four ways of inappropriate signal (or unsafe control action) are always applicable. The adverse impact is deduced considering how the components (receiving inappropriate signals) would react internally as well as its resultant actions towards all of its dependent components; as this probably looks into the behaviours/algorithms of the involved components, additional or more specific hazards/vulnerabilities (e.g., hardware limitations and software bugs) may be identified. Moreover, any pre-identified unnecessary yet non-removable  
Figure 3: Overview of the proposed Safety and Security (S&S) analysis method. The methodology is basically comprised of 7 steps, which may be iterated until the derived set of S&S requirements is deemed reasonably satisfied. The 8-Matrix Diagram (8 MD), constructed and constantly updated using analysis artefacts, is utilized to oversee correlations between Safety and Security of the analysed system. signals are also considered as inappropriate signals. This step ultimately produces a list of inappropriate signals. _Step 5_ identifies the potential causes (PCs) of identified inappropriate signals, by utilizing the _template_ illustrated in Figure 4. The _template_ is manifested as a tree that summarizes the generic reasons behind a malfunctioning component. Component Malfunction (CM) denotes that the component is unable to produce the correct/desired output; it can potentially be due to any of three main factors, namely Algorithm Failure (AF), Input Failure (IF), and Damage/Disruption (DD).