  Risk assessment of cyber-physical systems, such as power plants, connected
devices and IT-infrastructures has always been challenging: safety (i.e.
absence of unintentional failures) and security (i.e. no disruptions due to
attackers) are conditions that must be guaranteed. One of the traditional tools
used to help considering these problems is attack trees, a tree-based formalism
inspired by fault trees, a well-known formalism used in safety engineering. In
this paper we define and implement the translation of attack-fault trees (AFTs)
to a new extension of timed automata, called parametric weighted timed
automata. This allows us to parametrize constants such as time and discrete
costs in an AFT and then, using the model-checker IMITATOR, to compute the set
of parameter values such that a successful attack is possible. Using the
different sets of parameter values computed, different attack and fault
scenarios can be deduced depending on the budget, time or computation power of
the attacker, providing helpful data to select the most efficient
counter-measure.
