## 1 Introduction  
Thanks to the advances in ICT (Information and Communications Technology), critical infrastructure systems such as power grids, public transportation and water distribution networks are getting increasingly connected and sophisticated. Desire for better real-time monitoring and control, additional functionality, greater efficiency, etc., is also a driving factor. Such modern system or even systems of systems, whose physical processes are remotely controllable/accessible over any telecommunication means (e.g., computer networks and the Internet), are also known as Cyber-Physical Systems (CPSs). CPSs, like their traditional counterparts, have inherent safety risks that must be identified and sufficiently addressed. However, assessing the safety of CPS can be comparatively challenging and complicated due to the intertwining nature of CPS' physical processes and cyber elements. Most of the popular hazard/safety analysis techniques such as FMEA (Failure Modes and Effects Analysis) [1] and FTA (Fault Tree Analysis) were initially created for analysing systems whose reliance on software and network connectivity is minimal. Though progressively improved over the years, these techniques seem insufficient for analysing today's complex software-intensive systems (including CPSs). In CPSs, the faults/failures are no longer primarily caused by hardware reliability issues but hazardous interactions between system components. Hazardous interactions may occur accidentally because of poor/inadequate system design, or perhaps more likely be triggered by security attacks. Security attacks can result in significant physical damage to CPSs (e.g., German steel mill [2] and Iranian nuclear facilities [3]), which in turn jeopardize the overall safety. Realizing the pressing need for holistic approaches to addressing Safety and Security (S&S) of CPSs, various integrated S&S analysis methods have been recently proposed in the literature [4, 5]. Among them are systems theory-based approaches that adopt/extend STPA (System Theoretic Process Analysis). STPA is a hazard analysis technique that has been applied in various domains such as aerospace [6], automobile [7], and nuclear facilities [8]. Some studies have shown that STPA can identify not only the loss scenarios found by other traditional safety analysis techniques (e.g., FTA and FMEA), but also many that are irrelevant to component failures; meanwhile, it consumes less resources including time. Another notable advantage of adopting STPA is that it can be applied in early phases of the system development lifecycle. Analysis can commence as soon as the high-level goals of the system are defined, and can be further elaborated as the system design specification matures progressively. Nevertheless, STPA has some limitations that may make it difficult to apply especially when analysing the security of a system. Therefore, some extended versions of STPA have been proposed recently. However, even from these existing STPA-based analysis methods, we note two major gaps as follows: (1) little or no explicit guidance on deriving Security requirements; and (2) lack of discussion on managing the relationships (especially conflicts) between the derived Safety and Security requirements. To address these gaps, this paper proposes a novel S&S analysis method that utilizes custom matrices. Graphical and tabular representations of data/information are typically used to facilitate analysis; and matrices are no exception. The custom matrices presented in this paper are inspired by our earlier works--e.g., [9, 10]--where unique combination of matrices were utilized in managing the S&S of automated vehicles (a kind of CPS). Nonetheless, these combinations of matrices and even other existing ones are generally different in terms of (1) quantity of matrices, (2) sequence/arrangement of matrices, and (3) semantics. Obviously, there's no one-size-fits-all combination of matrices.