# Cybersecurity and Safety Co-Engineering of Cyberphysical Systems--A Comprehensive Survey
## 3 Analysis  
In order to provide a comprehensive description of the current landscape of methods for the joint analysis of safety and security of CPSs, the following list of attributes is used. Several of these attributes have been used in previous reviews or elsewhere. Each attribute is followed by a short description and a reference to the source(s) where it was originally used.  
1. **Type of joint analysis (Type):** This attribute may assume either the value \"Integrated (I)\" or the value \"Unified (U)\". In the former case the analysis is done in two separate, yet interrelated processes, whereas in the latter the analysis is performed following a single, unified process. The attribute was originally used in References [4; 7].
2. **Model type (Model):** Describes the model that the analysis is based on. Possible values are \"Graphical (G)\", \"Formal (F)\" and \"Both graphical and formal (Both)\". In graphical methods the analysis is carried out by leveraging graphical models, whilst in formal methods the analysis is based on formulas, equations, and modelling languages. This attribute was originally used in References [4; 8].
* [3]**Standards:** The method is informed by and leverages safety/security standards. Possible values are \"Yes (Y)\" and \"No (N)\". This attribute was originally used in Reference [7].
* [4]**Application domain (Domain):** The application domain(s) where the method is applicable or has been applied. Possible values are \"CPS\", \"IoT\", \"Automotive (A)\", \"Control Systems (CS)\" or combinations thereof. This attribute was originally used in References [5; 7].
* [5]**Approach:** The type of approach followed. Possible values are \"Quantitative (QNT)\" and \"Qualitative (QLT)\". This attribute was originally used in References [4; 8].
* [6]**Goal of the analysis (Goal):** Describes the overall goal of the analysis and whether the approach aims to ensure safety, security, or both. Possible values are \"Security\", \"Safety\" and \"Both\". This attribute was originally used in Reference [7].
* Generic (GE)\". This attribute was originally used in Reference [4].
* [8]**Stakeholders:** Describes which stakeholders are involved, either by applying it (users) or by giving input (participants); when applying the method. Possible values are \"Safety experts (A)\", \"Security experts (B)\", \"Developers (C)\", \"Designers (D)\", and \"Users or system experts (E)\". This attribute was originally used in Reference [27].  
The above attributes are depicted in Figure 1. Further, the following characteristics provide additional insight into understanding the operational capacity of each method; these have been inspired by the work in Reference [27]. Each of them, with the exception of _Process_, may assume the value \"Yes (Y)\", \"No (N)\", or \"Partially (P)\". _Process_ may only assume the values \"Yes (Y)\" or \"No (N)\".  
Figure 1: Attributes  
1. **Process:** Is the method supported by a systematic and structured process?
2. **Scalability:** Does the method scale well with the size and complexity of the system under assessment?
3. **Creativity:** Does the method include mechanisms to stimulate creativity among the stakeholders? Examples of such mechanisms are guide-words, checklists and questionnaires.
4. **Communication:** Is the method offering features to facilitate communication between different stakeholders during its application? Examples of such features are guidelines, diagrams, schematics, and so forth.
5. **Conflict resolution (Conflict):** Does the method facilitate the identification and study of potential conflicts between safety and security aspects?
6. **Software tool (Tool):** Does a software tool or toolkit that supports the application of the method exist?  
Table 1 depicts both the attributes and the characteristics of all methods reviewed in the surveys of Section 2.1 and of those reviewed in Section 2.2.2.  
\begin{table}
\begin{tabular}{|c|c c c c c c c c c c c c c c|} \hline
**Method** & **Type** & **Model** & **Standards** & **Domain** & **Approach** &