Extracting interdependent requirements and resolving conflicted requirements of safety and security for industrial control systems

Abstract

Industrial control systems are safety-critical systems. However, security attacks aiming at industrial control systems are rising tremendously in recent years. As a result, not only safety but also security should be considered in industrial control systems. To protect industrial control systems from failing due to intentional attacks from outside of the system and internal faults, safety and security must be considered comprehensively for the two following reasons: Firstly, it is security attacks from outside of the system that weaken inside equipment, which then leads to safety issues. This means that safety and security are related. Secondly, safety and security are two different areas with their own focuses. When trying to achieve their separate goals in the same industrial control system, safety requirements and security requirements may be conflicted. Therefore it is necessary to study the relationship between safety and security and consider them comprehensively. In this paper, we focus on requirement analysis phase. The relationships between safety and security requirements are analyzed and classified. An integrated requirement analysis method is proposed to extract interdependent safety and security requirements and resolve conflicted safety and security requirements. Finally, two examples are given to show how to use the proposed method.