A Simulation-Based System-Theoretic Process Analysis for the Computational Risk Assessment of Cyber-Physical Systems

The complexity of Cyber-Physical Systems (CPSs) challenges traditional risk assessment methods. To cope with this, in this work we develop a framework of Computational Risk Assessment (CRA) that couples System Theoretic Process Analysis (STPA), a qualitative hazard analysis method, with a modular simulation skeleton of the CPS that yields a low-resolution model when nominal operation and low-consequence accident scenarios are to be analyzed, whereas high-fidelity models are used when high-consequence accident scenarios (i.e., those leading to the most severe losses) are of concern. We show the application of the framework on a CPS that consists of a Hydrogen (H2)-fueled train and its cyber control systems.