Academic literature on the topic 'Functional Safety, Cyber-Physical Systems'

Automated vehicles are getting closer each day to large-scale deployment. It is expected that self-driving cars will be able to alleviate traffic congestion by safely operating at distances closer than human drivers are capable of and will overall improve traffic throughput. In these conditions, passenger safety and security is of utmost importance. When multiple autonomous cars follow each other on a highway, they will form what is known as a cyber-physical system. In a general setting, there are tools to assess the level of influence a possible attacker can have on such a system, which then describes the level of safety and security. An attacker might attempt to counter the benefits of automation by causing collisions and/or decreasing highway throughput. These strings (platoons) of automated vehicles will rely on control algorithms to maintain required distances from other cars and objects around them. The vehicle dynamics themselves and the controllers used will form the cyber-physical system and its response to an attacker can be assessed in the context of multiple interacting vehicles. While the vehicle dynamics play a pivotal role in the security of this system, the choice of controller can also be leveraged to enhance the safety of such a system. After knowledge of some attacker capabilities, adversarial-aware controllers can be designed to react to the presence of an attacker, adding an extra level of security. This work will attempt to address these issues in vehicular platooning. Firstly, a general analysis concerning the capabilities of possible attacks in terms of control system theory will be presented. Secondly, mitigation strategies to some of these attacks will be discussed. Finally, the results of an experimental validation of these mitigation strategies and their implications will be shown.

Cyber-Physical Systems (CPSs) are the core of modern critical infrastructure (e.g. power-grids) and securing them is of paramount importance. Anomaly detection in data is crucial for CPS security. While Artificial Neural Networks (ANNs) are strong candidates for the task, they are seldom deployed in safety-critical domains due to the perception that ANNs are black-boxes. Therefore, to leverage ANNs in CPSs, cracking open the black box through explanation is essential. The main objective of this dissertation is developing explainable ANN-based Anomaly Detection Systems for Cyber-Physical Systems (CP-ADS). The main objective was broken down into three sub-objectives: 1) Identifying key-requirements that an explainable CP-ADS should satisfy, 2) Developing supervised ANN-based explainable CP-ADSs, 3) Developing unsupervised ANN-based explainable CP-ADSs. In achieving those objectives, this dissertation provides the following contributions: 1) a set of key-requirements that an explainable CP-ADS should satisfy, 2) a methodology for deriving summaries of the knowledge of a trained supervised CP-ADS, 3) a methodology for validating derived summaries, 4) an unsupervised neural network methodology for learning cyber-physical (CP) behavior, 5) a methodology for visually and linguistically explaining the learned CP behavior. All the methods were implemented on real-world and benchmark datasets. The set of key-requirements presented in the first contribution was used to evaluate the performance of the presented methods. The successes and limitations of the presented methods were identified. Furthermore, steps that can be taken to overcome the limitations were proposed. Therefore, this dissertation takes several necessary steps toward developing explainable ANN-based CP-ADS and serves as a framework that can be expanded to develop trustworthy ANN-based CP-ADSs.

L'Internet of Things (IoT), una rete globale emergente di dispositivi elettronici embedded identificabili in modo univoco all'interno della rete Internet, sta trasformando il modo in cui viviamo e lavoriamo aumentando la connessione di persone e cose su una scala che un tempo era inimmaginabile. Oltre a una maggiore efficienza di comunicazione tra gli oggetti connessi, l'IoT comporta anche nuove sfide in termini di sicurezza e privacy. La specifica della sicurezza deve essere implementata in dispositive IoT che hanno il vincolo di memoria limitata, middleware vincolato, bassa potenza di calcolo e basso consumo. La sicurezza è uno degli aspetti fondamentali che differenzia l’IoT dai generici dispositivi embedded. L'implementazione hardware su circuito integrato di diverse funzionalità di sicurezza migliora la protezione di un sistema implementando il controllo degli accessi a risorse critiche, il rilevamento di manomissioni e guasti, la protezione dei canali laterali e la protezione contro il reverse engineering e il furto di IP. La presente tesi ha come obiettivo la definizione di una metodologia di progettazione hardware che garantisca sicurezza e protezione. Questa metodologia è stata implementata in un framework sviluppato per estendere le capacità del sistema al controllo delle minacce alla sicurezza del sistema attraverso una protezione a livello hardware. In questa tesi presentiamo il framework dell'architettura hardware, che combina la TAMMU (Translation and Allocation Memory Management Unit) utilizzata in SoC eterogenei che supportano la virtualizzazione integrata con un'architettura di protezione hardware (MSU). Questi miglioramenti hardware si concentrano sull'isolamento dei compartimenti della memoria fisica applicando regole di accesso. Il framework, pertanto, consente l'applicazione di politiche dinamiche di sicurezza sull'hardware per la protezione da componenti hardware o software non affidabili. D'altra parte, nelle Networks-on-Chip la velocità di iniezione del traffico è gestita principalmente impiegando tecniche complesse. Questo lavoro propone un Traffic Shaper Module che supporta sia il monitoraggio che il controllo del traffico sull'interfaccia di rete su chip o sul controller di memoria. Il vantaggio di questo Traffic Shaper Module è che garantisce una larghezza di banda di memoria alle applicazioni critiche limitando il traffico di attività non critiche. Il sistema è sviluppato hardware Xilinx ZYNQ7000 system-on-chip, mentre le misurazioni sono state acquisite su una scheda di sviluppo Xilinx Zed-board. Abilitando il Traffic Shaper nella nostra architettura, abbiamo raggiunto il controllo della larghezza di banda con un sovraccarico trascurabile, fornendo allo stesso tempo una larghezza di banda dello 0,5-5 per cento in meno rispetto alla larghezza di banda teorica specificata. L'architettura TAMMU proposta offre funzionalità innovative uniche che supportano più istanze di macchine virtuali (VM) simultaneamente attive con commutazione del contesto con latenza zero e abilitando i servizi di traslazione degli indirizzi per un massimo di mille domini virtuali mentre servono più dispositivi. Allo stesso tempo, il progetto proposto consente di soddisfare più richieste di traslazione di indirizzi in parallel e una in invalidazione per dominio del Translation Look-aside Buffer (TLB). L’architettura proposta è innovative rispetto allo stato dell’arte in quanto combina i servizi di enabling address translation con una larghezza di banda di memoria garantita e protesione della memoria. L’implementazione sulla piattaforma programabile FPGA Xilinx XC5VLX110T ha permesso il confronto con architetture alternative. La tesi è organizzata nel seguente modo: lo stato dell’arte è presentato nell’introduzione. Le caratteristiche del framework proposto sono descritte nella Sezione 2. La viosione generale del Sistema è presentato nella Sezione 3. La Sezione 4 riporta il test del sistema con la valutazione delle performances e le risorse richieste. Un confronto con le prestazioni di altre architetture è presentato nella Sezione 5.Un esempio applicativo sull’healtcare è presentato nella Sezione 6. Infine, la Sezione 7 riporta le conclusioni.<br>The Internet of Things (IoT), an emerging global network of uniquely identifiable embedded computing devices within the existing Internet infrastructure, is transforming how we live and work by increasing the connectedness of people and things on a scale that was once unimaginable. In addition to increased communication efficiency between connected objects, the IoT also brings new security and privacy challenges. The security requirements for the huge base of connected embedded devices are distinct on account of their limited memory, constrained middleware, and low computing power. Security is the new differentiator for embedded and IoT devices. At the on-chip level, several security features enhance the protection of a system by implementing access control to critical resources, by tamper and fault detection, by side-channel protection, and by protection against reverse engineering and IP theft. The thesis targets the design of on-chip system by implementing a methodology that ensures safety and security by design. This methodology is enabled by a framework developed to extend system capabilities so as to control the concurrent effects of security threats on the system behavior focusing on hardware level protection. We present the hardware architecture Framework, that combines Translation and Allocation Memory Management Unit (TAMMU) utilized in heterogeneous SoCs that support full virtualization integrated with a hardware protection architecture (MSU). These hardware enhancements focus on isolating physical memory compartments by applying access rules; thus, we allow dynamic security policies to be enforced at the hardware for protection against untrustworthy hardware or software components. On the other hand, Networks-on-Chip manage the traffic injection rate mainly by employing complex techniques; either back-pressure based low-control mechanisms or rate-control of traffic load (i.e. traffic shaping). This work proposes such a Traffic Shaper Module that supports both monitoring and traffic control at the on-chip network interface or the memory controller. The advantage of this Traffic Shaper Module is that proposed security framework provides guaranteed memory bandwidth to the critical applications by limiting traffic of non-critical tasks. The system is developed in the Xilinx ZYNQ7000 System-on-Chip while the measurements were captured on a Zed-board development board. By enabling the Traffic Shaper in our architecture, we achieved ne-grain bandwidth control with negligible overhead, while providing bandwidth of only 0.5-5 percent less than the theoretical specified bandwidth The proposed TAMMU architecture offers unique innovative features supporting multiple concurrently active virtual machine instances (VMs) with zero-latency world-context switching and enabling address translation services for up to a thousand virtual domains while serving multiple devices. At the same the proposed design allows for serving multiple address translation requests in parallel and per domain Translation Look-aside Buffer (TLB) invalidation. Proposed architecture is innovative in relation to the state of the art as it combines enabling address translation services with the capability that the proposed security framework provides guaranteed memory bandwidth and memory protection. The combination of these two complex features is not supported in previous systems. We prove that despite the increased need for hardware, our design manages to keep resource utilization at least at the same level as other known technologies implemented in modern systems. Significant differentiation, favorable to our architecture, is also achieved in performance compared to the state of the art. The need for comparisons with alternative architectures made it necessary to integrate our system into the Xilinx XC5VLX110T FPGA platform as well. The thesis is organized as follows. An overview of state of the art is given in Introduction section. The techniques that our framework include and its features are described in Section 2, followed by full system overview in Section 3. In Section 4, the testing of Framework and the performance and resource requirements are discussed. In Section 5, comparison with the State of the Art presented. A healthcare example is given in Section 6. Finally, Section 7 concludes the thesis.

The increasing complexity and size of modern Cyber-Physical Systems (CPS) has led to a sharp decline in productivity among CPS designers. Requirements on safety aggravate this problem further, both by being difficult to ensure and due to their high importance to the public. Tools, or rather efforts to facilitate the automation of development processes, are a central ingredient in many of the proposed innovations to mitigate this problem. Even though the safety-related implications of introducing automation in development processes have not been extensively studied, it is known that automation has already had a large impact on operational systems. If tools are to play a part in mitigating the increase in safety-critical CPS complexity, then their actual impact on CPS development, and thereby the safety of the corresponding end products, must be sufficiently understood. An survey of relevant research fields, such as system safety, software engineering and tool integration, is provided to facilitate the discussion on safety-related implications of tool usage. Based on the identification of industrial safety standards as an important source of information and considering that the risks posed by separate tools have been given considerable attention in the transportation domain, several high-profile safety standards in this domain have been surveyed. According to the surveyed standards, automation should primarily be evaluated on its reliable execution of separate process steps independent of human operators. Automation that only supports the actions of operators during CPS development is viewed as relatively inconsequential. A conceptual model and a reference model have been created based on the surveyed research fields. The former defines the entities and relationships most relevant to safety-related risks associated with tool usage. The latter describes aspects of tool integration and how these relate to each other. By combining these models, a risk analysis could be performed and properties of tool chains which need to be ensured to mitigate risk identified. Ten such safety-related characteristics of tool chains are described. These safety-related characteristics provide a systematic way to narrow down what to look for with regard to tool usage and risk. The hypothesis that a large set of factors related to tool usage may introduce risk could thus be tested through an empirical study, which identified safety-related weaknesses in support environments tied both to high and low levels of automation. The conclusion is that a broader perspective, which includes more factors related to tool usage than those considered by the surveyed standards, will be needed. Three possible reasons to disregard such a broad perspective have been refuted, namely requirements on development processes enforced by the domain of CPS itself, certain characteristics of safety-critical CPS and the possibility to place trust in a proven, manual development process. After finding no strong reason to keep a narrow perspective on tool usage, arguments are put forward as to why the future evolution of support environments may actually increase the importance of such a broad perspective. Suggestions for how to update the mental models of the surveyed safety standards, and other standards like them, are put forward based on this identified need for a broader perspective.<br>Den ökande komplexiteten och storleken på Cyber-Fysiska System (CPS) har lett till att produktiviteten i utvecklingen av CPS har minskat kraftigt. Krav på att CPS ska vara säkra att använda förvärrar problemet ytterligare, då dessa ofta är svåra att säkerställa och samtidigt av stor vikt för samhället. Mjukvaruverktyg, eller egentligen alla insatser för att automatisera utvecklingen av CPS, är en central komponent i många innovationer menade att lösa detta problem. Även om forskningen endast delvis studerat säkerhetsrelaterade konsekvenser av att automatisera produktutveckling, så är det känt att automation har haft en kraftig (och subtil) inverkan på operationella system. Om verktyg ska lösa problemet med en ökande komplexitet hos säkerhetskritiska CPS, så måste verktygens påverkan på produktutveckling, och i förlängningen på det säkra användandet av slutprodukterna, vara känd. Den här boken ger en översikt av forskningsfronten gällande säkerhetsrelaterade konsekvenser av verktygsanvändning. Denna kommer från en litteraturstudie i områdena systemsäkerhet, mjukvaruutveckling och verktygsintegration. Industriella säkerhetsstandarder identifieras som en viktig informationskälla. Då riskerna med användandet av enskilda verktyg har undersökts i stor utsträckning hos producenter av produkter relaterade till transport, studeras flera välkända säkerhetsstandarder från denna domän. Enligt de utvalda standarderna bör automation primärt utvärderas utifrån dess förmåga att självständigt utföra enskilda processteg på ett robust sätt. Automation som stödjer operatörers egna handlingar ses som tämligen oviktig. En konceptuell modell och en referensmodell har utvecklats baserat på litteraturstudien. Den förstnämnda definierar vilka entiteter och relationer som är av vikt för säkerhetsrelaterade konsekvenser av verktygsanvändning. Den sistnämnda beskriver olika aspekter av verktygsintegration och hur dessa relaterar till varandra. Genom att kombinera modellerna och utföra en riskanalys har egenskaper hos verktygskedjor som måste säkerställas för att undvika risk identifierats. Tio sådana säkerhetsrelaterade egenskaper beskrivs. Dessa säkerhetsrelaterade egenskaper möjliggör ett systematiskt sätt att begränsa vad som måste beaktas under studier av risker relaterade till verktygsanvändning. Hypotesen att ett stort antal faktorer relaterade till verktygsanvändning innebär risk kunde därför testas i en empirisk studie. Denna studie identifierade säkerhetsrelaterade svagheter i utvecklingsmiljöer knutna både till höga och låga nivåer av automation. Slutsatsen är att ett brett perspektiv, som inkluderar fler faktorer än de som beaktas av de utvalda standarderna, kommer att behövas i framtiden. Tre möjliga orsaker till att ett bredare perspektiv ändå skulle vara irrelevant analyseras, nämligen egenskaper specifika för CPS-domänen, egenskaper hos säkerhetskritiska CPS och möjligheten att lita på en beprövad, manuell process. Slutsatsen blir att ett bredare perspektiv är motiverat, och att den framtida utvecklingen av utvecklingsmiljöer för CPS sannolikt kommer att öka denna betydelse. Baserat på detta breda perspektiv läggs förslag fram för hur de mentala modellerna som bärs fram av de utvalda säkerhetstandarderna (och andra standarder som dem) kan utvecklas.<br><p>QC 20141001</p>

Depuis plusieurs années, nous assistons à une convergence entre les systèmes cyber-physiques (CPS) et l’Internet des Objets (IoT). Les CPS intègrent les systèmes embarqués avec leur environnement physique et humain en assurant une communication entre différents capteurs et actionneurs. L’IoT vise le réseau et les protocoles de communication entre les objets connectés. Cette convergence offre des perspectives d’applications diverses allant des véhicules connectés aux réseaux électriques intelligents ainsi qu’aux usines du futur. Le but de cette thèse est d’assurer et garantir la sûreté de fonctionnement des systèmes CPS-IoT. Pour ceci, nous avons considéré un cas d’étude spécifique tout au long de la thèse qui est les drones. Dans un premier temps, on s’est focalisé sur les différentes méthodes d’analyse de sûreté de fonctionnement qui sont déjà existantes. Ces méthodes ont fait leurs preuves pour la conception et la réalisation des systèmes embarqués. Tout au long de ce process, on a essayé de répondre à la question suivante: est-ce que ces méthodes existantes sont adéquates pour réaliser les analyses de sûreté de fonctionnement nécessaires pour les CPS-IoT? On a conclu la nécessité de nouvelles approches pour analyser la sûreté de fonctionnement des systèmes CPS-IoT du fait de la complexité significative de ces systèmes. Dans un second temps, on a proposé une méthodologie pour l’analyse prédictive de la résilience des CPS-IoT. La résilience est définie comme étant la capacité d’un système à tolérer les pannes, à continuer à fournir le service demandé tout en considérant les différentes contraintes internes et externes au système. On a différencié deux types différents de résilience qui sont la résilience endogène et exogène. La résilience endogène est la capacité inhérente du système à détecter et à traiter les défauts internes et les attaques malveillantes. La résilience exogène est la capacité permanente du système à maintenir un fonctionnement sûr dans son environnement ambiant. La dernière partie de notre travail a consisté à investiguer l’impact de l’intelligence artificielle sur la sûreté de fonctionnement des CPS-IoT. Plus spécifiquement, on s’est intéressé à comment serait-il possible d’utiliser l’intelligence artificielle pour accroître la sûreté des drones lors de la phase de planification de chemin. Les résultats obtenus ont été comparés avec les algorithmes de planification existants<br>For several years, we have been witnessing a convergence between cyber-physical systems (CPS) and the Internet of Things (IoT). CPS integrate embedded systems with their physical and human environment by ensuring communication between different sensors and actuators. The IoT targets the network and communication protocols between connected objects. This convergence offers prospects for various applications ranging from connected vehicles to smart grids and the factories of the future. The aim of this thesis is to ensure and guarantee the operational safety of CPS-IoT systems. For this, we have considered a specific case study throughout the thesis which is UAVs. Initially, we focused on the different methods of analysis of operational safety that already exist. These methods have proved their worth for the design and implementation of on-board systems. Throughout this process, we tried to answer the following question: are these existing methods adequate to perform the necessary safety analyses for CPS-IoT? It was concluded that new approaches to analyse the safety of operation of CPS-IoT systems are needed due to the significant complexity of these systems. As a second step, a methodology for predictive analysis of the resilience of CPS-IoTs was proposed. Resilience is defined as being the ability of a system to tolerate failures, to continue to provide the requested service while considering the various internal and external constraints of the system. Two different types of resilience have been differentiated: endogenous and exogenous resilience. Endogenous resilience is the inherent ability of the system to detect and deal with internal faults and malicious attacks. Exogenous resilience is the ongoing ability of the system to maintain safe operation in its surrounding environment. The last part of our work was to investigate the impact of artificial intelligence on the safe operation of CPS-IoTs. More specifically, we looked at how artificial intelligence could be used to enhance UAV safety in the path planning phase. The results obtained were compared with existing planning algorithms

Cyber-physical systems (CPS) integrate sensing, computing, communication and actuation capabilities to monitor and control operations in the physical environment. A key requirement of such systems is the need to provide predictable real-time performance: the timing correctness of the system should be analyzable at design time with a quantitative metric and guaranteed at runtime with high assurance. This requirement of predictability is particularly important for safety-critical domains such as automobiles, aerospace, defense, manufacturing and medical devices. The work in this dissertation focuses on the challenges arising from the use of modern multi-core platforms in CPS. Even as of today, multi-core platforms are rarely used in safety-critical applications primarily due to the temporal interference caused by contention on various resources shared among processor cores, such as caches, memory buses, and I/O devices. Such interference is hard to predict and can significantly increase task execution time, e.g., up to 12 commodity quad-core platforms. To address the problem of ensuring timing predictability on multi-core platforms, we develop novel analytical and systems techniques in this dissertation. Our proposed techniques theoretically bound temporal interference that tasks may suffer from when accessing shared resources. Our techniques also involve software primitives and algorithms for real-time operating systems and hypervisors, which significantly reduce the degree of the temporal interference. Specifically, we tackle the issues of cache and memory contention, locking and synchronization, interrupt handling, and access control for computational accelerators such as general-purpose graphics processing units (GPGPUs), all of which are crucial to achieving predictable real-time performance on a modern multi-core platform. Our solutions are readily applicable to commodity multi-core platforms, and can be used not only for developing new systems but also migrating existing applications from single-core to multi-core platforms.

Les Systèmes Cyber Physiques (CPS) intègrent des composants programmables afin de contrôler un processus physique. Ils sont désormais largement répandus dans différentes industries comme l’énergie, l’aéronautique, l’automobile ou l’industrie chimique. Parmi les différents CPS existants, les systèmes SCADA (Supervisory Control And Data Acquisition) permettent le contrôle et la supervision des installations industrielles critiques. Leur dysfonctionnement peut engendrer des impacts néfastes sur l’installation et son environnement.Les systèmes SCADA ont d’abord été isolés et basés sur des composants et standards propriétaires. Afin de faciliter la supervision du processus industriel et réduire les coûts, ils intègrent de plus en plus les technologies de communication et de l’information (TIC). Ceci les rend plus complexes et les expose à des cyber-attaques qui exploitent les vulnérabilités existantes des TIC. Ces attaques peuvent modifier le fonctionnement du système et nuire à sa sûreté.On associe dans la suite la sûreté aux risques de nature accidentelle provenant du système, et la sécurité aux risques d’origine malveillante et en particulier les cyber-attaques. Dans ce contexte où les infrastructures industrielles sont contrôlées par les nouveaux systèmes SCADA, les risques et les exigences liés à la sûreté et à la sécurité convergent et peuvent avoir des interactions mutuelles. Une analyse de risque qui couvre à la fois la sûreté et la sécurité est indispensable pour l’identification de ces interactions ce qui conditionne l’optimalité de la gestion de risque.Dans cette thèse, on donne d’abord un état de l’art complet des approches qui traitent la sûreté et la sécurité des systèmes industriels et on souligne leur carences par rapport aux quatre critères suivants qu’on juge nécessaires pour une bonne approche basée sur les modèles : formelle, automatique, qualitative et quantitative, et robuste (i.e. intègre facilement dans le modèle des variations d’hypothèses sur le système).On propose ensuite une nouvelle approche orientée modèle d’analyse conjointe de la sûreté et de la sécurité : S-cube (SCADA Safety and Security modeling), qui satisfait les critères ci-dessus. Elle permet une modélisation formelle des CPS et génère l’analyse de risque qualitative et quantitative associée. Grâce à une modélisation graphique de l’architecture du système, S-cube permet de prendre en compte différentes hypothèses et de générer automatiquement les scenarios de risque liés à la sûreté et à la sécurité qui amènent à un évènement indésirable donné, avec une estimation de leurs probabilités.L’approche S-cube est basée sur une base de connaissance (BDC) qui décrit les composants typiques des architectures industrielles incluant les systèmes d’information, le contrôle et la supervision, et l’instrumentation. Cette BDC a été conçue sur la base d’une taxonomie d’attaques et modes de défaillances et un mécanisme de raisonnement hiérarchique. Elle a été mise en œuvre à l’aide du langage de modélisation Figaro et ses outils associés. Afin de construire le modèle du système, l’utilisateur saisit graphiquement l’architecture physique et fonctionnelle (logiciels et flux de données) du système. L’association entre la BDC et ce modèle produit un modèle d’états dynamiques : une chaîne de Markov à temps continu. Pour limiter l’explosion combinatoire, cette chaîne n’est pas construite mais peut être explorée de deux façons : recherche de séquences amenant à un évènement indésirable ou simulation de Monte Carlo, ce qui génère des résultats qualitatifs et quantitatifs.On illustre enfin l’approche S-cube sur un cas d’étude réaliste : un système de stockage d’énergie par pompage, et on montre sa capacité à générer une analyse holistique couvrant les risques liés à la sûreté et à la sécurité. Les résultats sont ensuite analysés afin d’identifier les interactions potentielles entre sûreté et sécurité et de donner des recommandations<br>Cyber physical systems (CPS) denote systems that embed programmable components in order to control a physical process or infrastructure. CPS are henceforth widely used in different industries like energy, aeronautics, automotive, medical or chemical industry. Among the variety of existing CPS stand SCADA (Supervisory Control And Data Acquisition) systems that offer the necessary means to control and supervise critical infrastructures. Their failure or malfunction can engender adverse consequences on the system and its environment.SCADA systems used to be isolated and based on simple components and proprietary standards. They are nowadays increasingly integrating information and communication technologies (ICT) in order to facilitate supervision and control of the industrial process and to reduce exploitation costs. This trend induces more complexity in SCADA systems and exposes them to cyber-attacks that exploit vulnerabilities already existent in the ICT components. Such attacks can reach some critical components within the system and alter its functioning causing safety harms.We associate throughout this dissertation safety with accidental risks originating from the system and security with malicious risks with a focus on cyber-attacks. In this context of industrial systems supervised by new SCADA systems, safety and security requirements and risks converge and can have mutual interactions. A joint risk analysis covering both safety and security aspects would be necessary to identify these interactions and optimize the risk management.In this thesis, we give first a comprehensive survey of existing approaches considering both safety and security issues for industrial systems, and highlight their shortcomings according to the four following criteria that we believe essential for a good model-based approach: formal, automatic, qualitative and quantitative and robust (i.e. easily integrates changes on system into the model).Next, we propose a new model-based approach for a safety and security joint risk analysis: S-cube (SCADA Safety and Security modeling), that satisfies all the above criteria. The S-cube approach enables to formally model CPS and yields the associated qualitative and quantitative risk analysis. Thanks to graphical modeling, S-cube enables to input the system architecture and to easily consider different hypothesis about it. It enables next to automatically generate safety and security risk scenarios likely to happen on this architecture and that lead to a given undesirable event, with an estimation of their probabilities.The S-cube approach is based on a knowledge base that describes the typical components of industrial architectures encompassing information, process control and instrumentation levels. This knowledge base has been built upon a taxonomy of attacks and failure modes and a hierarchical top-down reasoning mechanism. It has been implemented using the Figaro modeling language and the associated tools. In order to build the model of a system, the user only has to describe graphically the physical and functional (in terms of software and data flows) architectures of the system. The association of the knowledge base and the system architecture produces a dynamic state based model: a Continuous Time Markov Chain. Because of the combinatorial explosion of the states, this CTMC cannot be exhaustively built, but it can be explored in two ways: by a search of sequences leading to an undesirable event, or by Monte Carlo simulation. This yields both qualitative and quantitative results.We finally illustrate the S-cube approach on a realistic case study: a pumped storage hydroelectric plant, in order to show its ability to yield a holistic analysis encompassing safety and security risks on such a system. We investigate the results obtained in order to identify potential safety and security interactions and give recommendations

Functional safety is a significant concern in today's networked cyber-physical systems such as connected machines, autonomous vehicles, and intelligent environments. Simulation is a well-known methodology for the assessment of functional safety. Simulation models of networked cyber-physical systems are very heterogeneous relying on digital hardware, analog hardware, and network domains. Current functional safety assessment is mainly focused on digital hardware failures while minor attention is devoted to analog hardware and not at all to the interconnecting network. In this work we believe that in networked cyber-physical systems, the dependability must be verified not only for the nodes in isolation but also by taking into account their interaction through the communication channel. For this reason, this work proposes a holistic methodology for simulation-based safety assessment in which safety mechanisms are tested in a simulation environment reproducing the high-level behavior of digital hardware, analog hardware, and network communication. The methodology relies on three main automatic processes: 1) abstraction of analog models to transform them into system-level descriptions, 2) synthesis of network infrastructures to combine multiple cyber-physical systems, and 3) multi-domain fault injection in digital, analog, and network. Ultimately, the flow produces a homogeneous optimized description written in C++ for fast and reliable simulation which can have many applications. The focus of this thesis is performing extensive fault simulation and evaluating different functional safety metrics, \eg, fault and diagnostic coverage of all the safety mechanisms.