## 5 Conclusions  
STPA is a hazard analysis technique that has been widely applied in various domains including aerospace and automobile. In this paper, we review a selection of existing works which adopt or extend STPA for addressing both Safety and Security of CPS, and note two major gaps as follows: (a) little or no explicit guidance on deriving Security requirements; and (b) lack of discussion on overseeing the correlations between the derived Safety and Security requirements.  
The proposed S&S analysis methodology aims to address the aforementioned gaps. Specifically, we derive both safety and security requirements from a template (depicted in Figure 4), and subsequently integrating them with the results of STRIDE analysis. It is worth mentioning that the presented template is not exhaustive but could be tailored for specific applications. For instance, a template tailored for an (offline) autonomous vehicle is probably inadequate for defining the S&S requirements for an CAV (Connected and Automated Vehicle); the latter, as it is online and tele-operated, it is likely to have greater attack surface and thus more cybersecurity concerns; to derive relevant templates with high level of granularity, domain/application-specific expertise is needed.  
To facilitate overseeing the correlations between the derived S&S requirements (e.g., conflict resolution), we introduce an 8-Matrix Diagram (8 MD); as illustrated in Figure 8, it consists of eight matrices that capture various correlations among five crucial aspects of the analysed system. We illustrate the proposed methodology using a case study of a realistic and commercial safety-critical CPS, and also discuss how 8 MD is utilized for addressing a particular conflict between the derived requirements.  
Nevertheless, this paper by no means intends to suggest that STPA outperforms other existing techniques (e.g., FTA, FMEA and attack trees/graphs) in terms of analysing hazards/threats. The authors believe that all these existing techniques are useful, as in general they help analysts perceive/deduce potential safety/security issues of the analysed system from different angles with different scopes. Additionally, some techniques may be user-friendly to one but complex to another. There is a learning curve in mastering any of these techniques.  
As for future work, the authors shall explore enhancing the user-friendliness and comprehensiveness of the proposed S&S analysis methodology by (1) integrating aforementioned existing techniques besides STPA, (2) designing a systematic set of rules/instructions on applying the matrices, and (3) discussing how the S&S risks may be estimated.  
Conceptualization, L.-S.L. and G.S.; methodology, L.-S.L. and G.S.; validation, G.S., N.K.K., and C.-Y.W.W.; formal analysis, L.-S.L. and G.S.; investigation, L.-S.L.; resources, N.K.K. and C.-Y.W.W.; software, L.-S.L.; data curation, N.K.K. and C.-Y.W.W.; writing--original draft preparation, L.-S.L.; writing--review and editing, L.-S.L. and G.S.; visualization, L.-S.L.; supervision, G.S., N.K.K., and C.-Y.W.W.; project administration, N.K.K. and C.-Y.W.W.; funding acquisition, N.K.K. and C.-Y.W.W. All authors have read and agreed to the published version of the manuscript.  
This work was supported in part by the National Research Foundation (NRF), Prime Minister's Office, Singapore, under its National Cybersecurity R&D Programme (NRF2018-NCR003-0018) and administered by the Energy Market Authority (EMA) Singapore.  
Not applicable.  
Data Availability Statement: Data sharing is not applicable to this article.  
The authors declare no conflict of interest. The fund has no role in the design of the study; in the collection, analyses, or interpretation of data; in the writing of the manuscript, or in the decision to publish the results.