Tamara Oueidat
email: tamara.oueidat@grenoble-inp.fr

Jean-Marie Flaus
email: jean-marie.flaus@grenoble-inp.fr

François Massé
email: francois.masse@ineris.fr

A new way to generate automatically the attacks scenarios and combine them with safety risks

Keywords: Cybersecurity, Attack scenarios, Risk analysis, Safety, Industrial systems, meta-models

Industrial systems have undergone a transformation with the introduction of connected systems and digital technology into their control systems, making them open to new cybersecurity threats that affect the safety of the system with the accidental situations. Therefore, analysing these new threats becomes crucial during risk analysis. A significant number of risk analysis approaches have been proposed to treat independently the safety and cybersecurity issues. There is a strong interest in developing risk analysis approaches that combine safety and cybersecurity, particularly in the critical process industry, which poses a significant risk to local populations and the environment. The goal of this article is to present a new developed risk analysis approach that aims to generate the possible attacks scenarios that can occur in industrial systems systematically in new models, and generate these scenarios automatically using a computerized code to simplify the risk analysis process; especially for users who are not experts in the domain of cybersecurity.

Introduction

In industrial systems, safety and cybersecurity are two different concepts that refer to different types of risks. In terms of risk analysis, they differ, but they also have similarities and interdependencies [START_REF] Piètre-Cambacédès | Modeling Safety and Security Interdependencies with BDMP (Boolean Logic Driven Markov Processes)[END_REF]. Traditional industrial systems relied on mechanical and electrotechnical devices, closed systems, and human resources, and they focus in risk analysis solely on the safety issues. In recent years, industrial systems have increasingly integrated digital and communication technologies into their automated control systems, such as the internet connectivity and the remote access to control systems [START_REF] Flaus | Cybersécurité Des Systèmes Industriels[END_REF], the convergence between the Information Technology (IT) and the Operational Technology (OT), and so on. This digitization makes industrial systems more vulnerable to cyberattacks and exposes them to new cybersecurity threats that could affect the system safety. Many security incidents affecting the industrial systems, such as NotPeya, TRITON, and others [START_REF] Hemsley | History of Industrial Control System Cyber Incidents[END_REF], have been observed around the world.

Cybersecurity has become a significant issue for critical industrial systems, and it should be treated as part of the risk analysis process. Thus, industrial systems should be more conscious of cybersecurity and raise awareness about the risks related to cybersecurity. For risk analysis, a wide variety of approaches have been proposed, the majority of them evaluate the risks associated to safety and cybersecurity independently, despite the similar outcomes consequences. HAZOP [START_REF] Wei | HAZOP-Based Security Analysis for Embedded Systems: Case Study of Open Source Immobilizer Protocol Stack[END_REF], FMEA (Schmittner et al. 2014), Bow-Tie [START_REF] Ferdous | Handling and Updating Uncertain Information in Bow-Tie Analysis[END_REF], PHA [START_REF] Mohr | Preliminary Hazard Analysis[END_REF] are some risk analysis approaches for safety, and Attack Tree [START_REF] Fovino | Through the Description of Attacks: A Multidimensional View[END_REF], EBIOS (Flaus 2019), CORAS (Lund, Solhaug, andStølen 2010) are some risk analysis approaches cybersecurity. In recent years, it has been recognized as vital to joint safety and cybersecurity together, and a large number of safety and cybersecurity risk analysis approaches have been proposed. In section 2 of the related work, several of these developed approaches are shown. Each of these approaches has limits in terms of the system modelling, the generation of attack scenarios, and the risk evaluation. The purpose of this paper is to present a new model-based risk analysis approach that provides a new way to automatically generate the attack scenarios that may exist on a case study when using the proposed approach, and then integrate them with safety risks in the same Bow-Tie. Section 3 outlines the overall concept of our approach, as well as the steps for automatically generating the attack scenarios. Section 4 summarizes and concludes this article with future work.

Related work

Since the relevance of merging safety and cybersecurity in risk analysis for critical industrial systems has grown, a shift has occurred by developing risk analysis approaches that include processes that address both safety and cybersecurity concerns. There are several approaches that aim to extend traditional safety risk analysis approaches to include cybersecurity risks, such as FMVEA (adaptation of FMEA) (Schmittner, Ma, and Smith 2014), Cyber HAZOP [START_REF] Wei | HAZOP-Based Security Analysis for Embedded Systems: Case Study of Open Source Immobilizer Protocol Stack[END_REF], SECFT (adaptation CFT) [START_REF] Steiner | Qualitative and Quantitative Analysis of CFTs Taking Security Causes into Account[END_REF], or to extend cybersecurity risk analysis approaches to include safety risks, such as the extension of TVRA [START_REF] Reichenbach | A Pragmatic Approach on Combined Safety and Security Risk Analysis[END_REF]. Other approaches are attempting to merge existing safety and cybersecurity approaches, such as SAHARA [START_REF] Macher | SAHARA: A Security-Aware Hazard and Risk Analysis Method[END_REF], ATBT [START_REF] Abdo | A New Approach That Considers Cyber Security within Industrial Risk Analysis Using a Cyber Bow-Tie Analysis[END_REF], and others. Other approaches were created from scratch to incorporate safety and cybersecurity concerns in the same analysis, such as S-cube [START_REF] Kriaa | A Model Based Approach for SCADA Safety and Security Joint Modelling: S-Cube[END_REF], CHASSIS [START_REF] Schmittner | A Case Study of Fmvea and Chassis as Safety and Security Co-Analysis Method for Automotive Cyber-Physical Systems[END_REF], Integrating security in BDMP (Piètre-Cambacédès and Bouissou 2010). Other approaches have been offered and based on the STPA process, which treats accidents and losses as a dynamic control problem, with an accident occurring as a result of a behaviour fault on the control, not as a consequence of a failure [START_REF] Young | Systems Thinking for Safety and Security[END_REF]. Examples of some approaches in this category: STPA-SafeSec [START_REF] Friedberg | STPA-SafeSec: Safety and Security Analysis for Cyber-Physical Systems[END_REF], STPA and STRIDE (de [START_REF] Souza | Extending STPA with STRIDE to Identify Cybersecurity Loss Scenarios[END_REF], Combination of STPA-Sec with FMVEA [START_REF] Temple | Systems-Theoretic Likelihood and Severity Analysis for Safety and Security Co-Engineering[END_REF].

Despite the existence of various limits, such as in the system modelling which represents an important step before starting the risk analysis, the technique to define the attack scenarios in a no formal and systematic way, the amount of complexity, and detail when using the approach, each developed risk analysis approach has advantages and is good to implement. In this paper, we propose a new modelbased risk analysis approaches that considers the links between safety and cybersecurity during the risk analysis process, with the main goals of covering the limits of the existing approaches and making the steps of defining the attack scenarios easier and simpler to apply with a sufficient level of detail by taking into account the level of cybersecurity expertise of users. The following section illustrates our proposed approach, which includes the contribution of the automatic generation of attack scenarios.

The proposed risk analysis approach

In this section, our new proposed risk analysis approach is provided, it tries to generate the attacks and integrate them with the safety risks, and it simplifies the risk analysis process phases. The following are main steps of our approach:

• The construction of a model that explains the industrial installation.

• The proposition of a guide to help defining and searching for possible vulnerabilities.

• The proposition of new meta-models for defining the attack scenarios.

• The automatic generation of cyberattacks.

• The combination of the generated attacks with the safety risks in the same meta-model.

We will focus in this article on the steps for generating the attack scenarios in meta-models and generating them automatically for a case study. To carry out these steps, some data from the industrial installation is required, such as the components of the system architecture and their attributes (physical access, internet connection, remote access, removable media, email reception, software), which can reveal important vulnerabilities in the industrial system and are gathered from the system mapping and cartography; The list of vulnerabilities generated from a check-list and guide for the vulnerabilities that may be found on industrial systems, these data of vulnerabilities are gathered from the organisational policies and security barriers that are used and applied on an industrial system. The data gathered aids in the generation of the attack scenarios. In the next section, the principle of the proposed risk analysis approach is provided. Then, there is the way to generate the attack scenarios in metamodels, as well as how to do it automatically.

Principle of the proposed approach

The risk analysis approach is based on a Knowledge Base KB, which contains the defined generic list of vulnerabilities as well as the generic attack scenarios developed after by meta-models. The generic data and the meta-models of the KB, along with the system architecture (components and attributes), provide the inputs for automatically generating the attack scenarios, which are considered the output of the approach.

Figure 1 depicts the principle of the approach. The processing of an algorithm using data produced from the meta-models of attack scenarios and the other inputs leads in the automatic generation of the existing attack scenarios on a case study. Therefore, the contribution here is the automatic generation of attack scenarios with the generation of the data in the KB. In the following section, the way to generate the different attack scenarios that can exist on an industrial system is discussed, along with the automatic generation of these scenarios.

Generation of attack scenarios in meta-models

To execute a cyberattack, the attacker must go through one or more steps to achieve its goal. A starting point for a cyberattack is the attack surface exiting on the component or any level of an Industrial Control System. Based on the attributes of the components, five attack surfaces are established, and they can be sources of vulnerability leading to the execution of cyberattacks. • Email reception: a component that receives emails from outside the industry can be used to carry out cyberattacks via phishing emails.

• Remote access: if a component can be accessed remotely, it can become a target for cyberattacks, if the access is unprotected and unregulated.

• Internet connection: if a component is connected to the internet, it can become a target for cyberattacks if the connection is insecure and unregulated.

• Unsecured implemented software can be used to launch cyberattacks.

The possible attack scenarios are generated into meta-models; each meta-model contains the existing attack surface on each zone of the Industrial Control System (ICS) level, as well as the different steps to conduct an attack through this surface. We work on the three levels of ICS listed below: Field level (zone of physical components), Control level (two zones: PLC zone and station zones), and Supervision level (zone of SCADA system and zone of computer stations). We decompose the ICS levels into zones since at the same level, each zone can have different attack surfaces with different levels of vulnerabilities. The output of this part is the catalog of cyberattack scenarios that can be experienced on any industrial site. This meta-model is depicted in Figure 2. • One or more security events may occur during the execution of an attack. The security event can occur as a result of the occurrence of one or more security sub-events linked by the gates OR/AND, or it can occur as an initiating event of an attack or as a complimentary event.

• The security sub-event in this meta-model is a combination of the vulnerability and the technical step required to exploit the vulnerability.

The possible attacks scenarios for each attack surface and each ICS level zone are generated using this meta-model. In order to cover as many scenarios as possible, our research was built on the MITRE ATTACK framework (ATT&CK 2020). Figure 3 depicts an example of an attack scenario on the zone of physical components from the field level through the surface of physical access. Figure 4 depicts another attack scenario via the surface or receiving email on the station's zone of control level. To execute the attack of disconnecting a physical component through physical access (figure 3), an attacker must first get an unauthorized physical access through one of the following security sub-events:

• The attacker can exploit a vulnerability that exists on the access to physical components locals, the access can be without badges or keys without any technical step required.

• The attacker can exploit the vulnerability during an unsupervised external visitor's visit, and he can gain unauthorized access without any technical steps.

• The internal staff who are not well formalised about cybersecurity and its risks can be a significant source of vulnerability for gaining unauthorized access without requiring any technical steps.

Figure 4 shows how the attacker can change the configuration or the functionality of a PLC by sending an email to the appropriate station. The attacker sends an email with malicious content without taking any technical steps in the first step, by exploiting these two possible vulnerabilities: • There is no anti-spam software installed on the station that can prevent these types of emails from being received.

• The received emails to the configuration station are not filtered.

When a station receives a phishing email, an untrained employee in cybersecurity has access the content of the email (virus, malicious websites, etc.). After gaining access to the content, an attacker can steal the authentication data and use it to get an unauthorized digital access to the station, or the attacker can install a malware on the station and use a vulnerability in the anti-virus software implemented to prevent the malware from being executed. The algorithm of automatically generating the attack scenarios is provided in the following section.

Algorithm for the automatic generation of attack scenarios

When using the proposed approach to a case study, the major goal of the automatic generation of attack scenarios is to make the step of searching for the possible attack scenarios easier, especially for users who are not experts in the field of cybersecurity. This generation enables a simple application of the analysis process with a sufficient level of detail for the attack scenarios while limiting the complexity and time cost of the risk analysis. To carry out this step, some input data (from the KB) is required in order to run an algorithm and obtain the potential attack scenarios as outputs. There are two categories of inputs to consider:

• &The data of meta-models from the generated attack scenarios from the previous step, which is fixed data and identical across all cases studies. These data comprise the different zones of ICS levels, the generated list of vulnerabilities, the different attack surfaces, all the sequences and schemas of security events and sub-events, and all the relationships between them in order to carry out the attack.

• The second type of data is that which the user must enter in while using the risk analysis approach. The user must fill in the policies that are implemented at each zone of ICS level with their levels of applicability, as well as the attack surface that exists at each zone of ICS levels, depending on the case study.

These two types of input data are converted into data interchange format files, which are then used in a developed code to automatically generate the existing attack scenarios as output data in the same format as the input data.

Until this phase of the approach, the undesirable events that can occur on an industrial site are listed with their accidental situations representing the safety risks from a traditional risk analysis approach, and the list of possible attacks that can occur is formed. In the rest of the approach, these two types of risks that lead to the same physical undesirable event are merged in a single Bow-Tie, called Cyber Bow-Tie, the likelihood of occurrence of the combined risks is evaluated, and lastly, the combined risks are treated by proposing new safety and cybersecurity measures in order to minimise the criticality of the unacceptable combined risk.

Example and results

This section includes an example to demonstrate the steps of the proposed risk analysis approach. The example shows a case study of a polymerization system. The field level of this system is composed of different sensors, valves for running a chemical reaction, and they are physically accessible. These components are controlled by a PLC at the control level that can be accessed remotely from outside the industry and is configured on a configuration station at the control level. This station is physically accessible, has remote access from outside, and is implemented by software such as an operating system and an anti-virus. The field and control levels are supervised by a SCADA system that containing a server with a database, and a supervision station. These components can be physically accessed. Furthermore, at the supervision level, many computer stations are connected to the internet, can be accessed remotely, and they receive emails from outside the industry and are implemented by a variety of software.

In this case study, a Bow-Tie is used to depicts the different scenarios of safety risks that can result in the occurrence of a critical undesirable event, such as the toxic release into the atmosphere. In addition to the safety risks, cybersecurity issues must be examined for this case study. The components are correctly modelled with their attributes into tables, and the generated list of vulnerabilities is validated for the existing ones. For the step of searching the possible attack scenarios, we define for each zone of ICS level the existing attack surfaces before executing the automatic generation.

• Physical components zone (field level): physical access.

• PLC zone (control level): physical access, remote access.

• Stations zone (control level): physical access, remote access, software.

• Supervision zone (supervision level): physical access.

• Computer stations zones (supervision level): physical access, remote access, internet connection, email reception, software.

The developed algorithm uses the data from the defined attack surfaces, as well as the data from the generated meta-models of attack scenarios, to define the possible attack scenarios on each zone. The configuration station, for example, is not connected to the internet, thus there are no attacks possibilities on this zone via the internet connection. The output is all the sequences of security events for each zone and each attack surface in this case study, as well as all of the attacks that can occur as a result of these sequences of security events, as well all of the combinations between the vulnerabilities and technical steps of the security sub-events for each security event at each zone and attack surface.

Conclusion and future work

The need of incorporating of safety and cybersecurity into risk analysis for critical industrial systems grew. These industries have been subject to new cybersecurity threats as a result of the integration of new technologies into their control systems, which can harm the safety of their systems. Therefore, in addition to the safety issues, industries should raise awareness about the risks associated with cybersecurity. Several authors proposed and developed approaches for including safety and cybersecurity into risk analysis. However, to identify and analyse the critical attack scenarios from the perspective of safety for people and the environment, a risk analysis strategy based on the best characteristics and analysis process picked from the existing approaches [START_REF] Oueidat | A Review of Combined Safety and Security Risk Analysis Approaches: Application and Classification[END_REF] is needed.

In this article, our proposed model-based risk analysis approach is provided. It focuses on merging safety and cybersecurity risks analysis in a clear and straightforward manner, with as many attack scenarios as possible. Its process for generating the list of vulnerabilities and the attack scenarios differs from that of other existing approaches. The attack scenarios are automatically generated based on the KB as inputs, which includes the meta-model of attacks scenarios as well as some data collected from the industrial installation. We discussed in this article the processing for generating the attack scenarios in meta-models, as well as how to generate them automatically. The remaining steps represent the integration of safety and cybersecurity risk into a single bow-Tie, the evaluation of the likelihood of the combined risks, as well as their evaluation. The objective of introducing a new risk analysis approach is to simplify the steps of the risk analysis process, thus we will enhance future research about the integration of the likelihood evaluation of each attack scenario in the same algorithm of attack scenarios generation.

Fig. 1 .

 1 Fig. 1.The principle of the proposed risk analysis approach

Fig. 2 .

 2 Fig. 2.The meta-model representing the sequence of an attack scenario

Fig. 3 .

 3 Fig. 3.The attack scenarios on the field level through a physical access

Fig. 4 .

 4 Fig. 4. The attack scenarios on the control level through the email reception


Emmanuel Plot
email: france.emmanuel.plot@ineris.fr

Maria Chiara Leva
email: mariachiara.leva@tudublin.ie

Ludovic Moulin
email: france.ludovic.moulin@ineris.fr

Philippe Decamps
email: .philippe.decamps@developpement-durable.gouv.fr

Frederic Baudequin
email: .frederic.baudequin@interactive.fr

The Development of a holistic IT platform for major risk assessment and management: the MIRA tool

Keywords: complexity, cognitive bias, risk assessment, risk management, dialogue, digitization

There are natural human cognitive biases that affect many aspects of our activities, including major risk management. Some of these have a common characteristic, namely the reification process related to our tendency to selectively seek or interpret information in a way that confirms our representations of reality, and which can lead to forgetting that our representations are in some way abstractions, or hypotheses, and as such, must be continually questioned, analysed and checked against reality. The moment we forget that the correspondence between our representations and reality is only a conditional truth and requires constant verification, is the moment when most human and organizational errors in major risk management can occur. How to fight against this? This is the question that preoccupied us during ten years of research, starting within the European Tosca project (see Leva et al. 2019, Anzirsi et al. 2019), and that still haunts us today. This article presents the problem to be solved and the envisaged solution, based on an IT tool allowing to organize the dialogue between the risk assessment and management stakeholders. This solution has been designed with the SNOI, which is responsible for the French part of the NATO pipeline network in Central Europe.

Introduction

Language is not transparent, we must always question the words we use and our linked representations, even those that seem obvious, especially within organizations in charge of major risk management, where a managerial error is likely to have catastrophic consequences. It is not "just" a problem of interpersonal communication. It is, at a deeper level, an issue related to the construction of our thought, the way we elaborate and rationally accept our knowledge and models, in the face of complexity, in order to make effective choices, i.e. choices that are sufficiently in touch with objective reality so that our actions produce the desired results. This incessant questioning, necessary for the proper functioning of our rationality, is at the heart of our problematic: why and how to organize it? Our thesis can be summarized by the following sequence of arguments which constitutes the plan of this article:

1/ Several technical factors contribute to the complexity of risk assessment and management. 2/ This complexity is reinforced by the characteristics and limitations of our cognition.

3/ These factors of complexity can only be mastered by the development of prudent strategies based on cognitive trade-offs, integrated into scenarios for action (procedural schemes).

4/ These strategies are dependent on our beliefs, in the sense of interpretive frameworks, that work a priori.

5/ One of the mechanisms common to the functioning of these beliefs is the fact that they tend to be hidden from us, because of a tendency to selectively search for or interpret information in a way that confirms one's representation of reality and because we spontaneously reify our representations by believing that they designate things that exist as we think them, forgetting that they are constructions, abstractions, hypothesis.

6/ Digital technology opens new opportunities to solve this issue. In the literature other authors have also highlighted the steps required in the development of an expert system or a decision-making support system as part of a complex of intelligent technological management of the reliability and efficiency of oil and gas systems [START_REF] Zemenkova | Technology for developing expert modules and DSS comprehensive platform for reliability and risks monitoring in the Oil and Gas Engeneering[END_REF], and many of those steps are in common with the one followed when developing MIRA. However, in this paper we will try to describe the main step underpinning the rationale, derived from human science research [START_REF] Plot | Quelle organisation pour la maîtrise des risques industriels majeurs ? Mécanismes cognitifs et comportements humains, Paris L'Harmattan[END_REF], that ended up shaping the envisaged software solution.

The key scientific contribution of this software solution was an attempt to develop and test in practice a method and a web tool (MIRA) dedicated to the combined management and assessment of major risk, where the data from daily monitoring and periodic inspections, alongside the requirements from the regulations, can be integrated with the risk assessment. This foster the advantage of updating a risk assessment that is often static and unable to provide un up to date assessment of the situation as to support daily decisions.

Technological complexity factors

This paragraph offers a quick overview of the events that had to be monitored and managed in the holistic platform developed in this case study. The list is only indicative but non exhaustive. a) Events resulting from the physical environment: the most characteristic is the interruption of the energy supply for example during a storm. Even if a backup power supply is provided, its activation in an extremely short time (a few fractions of a second) is never certain. In any case, the passage on a secondary network modifies the values of the parameters as well as the nature of the physicochemical reactions. These rare events can be a factor of complexity. b) The sudden and accidental failure of a part of the installation or of a mechanism. Its essential characteristic is that it is not recoverable. As a general rule, safety devices are provided for this circumstance and aim to put all or part of the installations out of service: this is the emergency stop. When a pipe suddenly opens under the effect of internal pressure, the automatic safety devices are activated, provided that the state of the installation allows it. An emergency shutdown may concern a part of the installations. However, the whole process is disturbed. c) Control system faults: their main characteristic is that they are not immediately visible. A sensor can indicate an erroneous position of a valve: operators can act on the displayed information and elaborate actions that are relevant from the point of view of the erroneous information presented but not relevant for the safety of the process. This is a problem of instrumentation reliability, which is the cause of many disasters. Anticipating this problem with cross-checking systems makes the daily activity more complex. d) Interfaces can generate quantity and quality problems in the feedback, including control directionality problems, feedback delays, and response delays... which require operators to work on a relatively sophisticated representation of the process.

e) Fluctuations in the manufacturing process on the side of the incoming products or the industrial process. These fluctuations are signaled by alarms or pre-alarms indicating that a given parameter is outside the tolerated limits; nevertheless, their signaling leaves unanswered the question of their origin and the factors that cause them. The origin may be in another area than the one reported. f) Interference between tasks: conflicting activities (the team may be busy with other tasks when an incident requires the availability of each team member), or, on the contrary, areas left unattended and to a dilution of associated responsibilities, all of which are conducive to the genesis of the unexpected. g) The hierarchical structure of an organization, which can lead to uncontrolled decision-making processes.

The information flow may be too slow, or may not provide the necessary information to the relevant managers, etc. h) The time pressure which is defined by the time available for the operator to make his decision and act on the system by obtaining a response in accordance with his objectives (the pressure includes the response time of the system). Many slow processes are characterized by fast transients and action windows. Hesitation or neglect on the part of the operator reduces the time available to act, and by simple consequence, mechanically increases the time pressure on the decision to be taken. i) The degree of reversibility of actions. Reversibility describes the possibility for the actor to cancel an action on the system. This reversibility is a guarantee for safety (the error is without consequence if it is seen). It allows testable simplifications of the representation. However, it is never possible to obtain a total reversibility in processes in constant evolution. j) The under-specification of the objectives to be achieved. As a result, the actors cannot clearly imagine their objectives, the types of knowledge they need to have to be successful, the level of performance they want to achieve.

Cognitive properties that reinforce this complexity

Operators facilitate the implementation of processes. They are generally a factor of efficiency and performance, insofar as they manage to implement strategies that fill in the gaps resulting from the unthinking of technical and organizational systems.

So, as a major element of the system, they must be given special attention. The articulation of human activities and facilities is a problem in itself that cannot be omitted. From this point of view, human factors must be added to the purely technical considerations, and we can say that they constitute an additional level of complexity. Thus, our list of complexity factors is growing for instance with human errors mechanisms. See also problems such as the feeling of difficulty, defined as an emerging feeling, during the execution of an action, of the risk of losing control of the situation. See also cognitive operations that the actor must put into play to guarantee the best validity for his representation throughout the execution of the work without risking saturating his cognitive system [START_REF] Amalberti | La conduite de systèmes à risques[END_REF].

Beyond these factors, the important point is to recognize that the problem of complexity is necessarily linked to the management of major risks. The real is only simple within the framework of abstractions that man constructs to facilitate his action. The real is always complex, when it has to been managed with a high level of reliability.

Let us take a banal example. The control of walking is apparently simple. However, we sometimes fall, because the ground is slippery, because we did not see a stone, because we were pushed, etc. We accept these losses of control in our daily lives. We accept these losses of control to the extent that further control of walking would be more costly than beneficial. But we no longer accept them when these losses of control can put our life or health in danger, as is the case in the mountains. The control of the same action is different according to the level of success desired. To ensure total success, we must take into account the finer points of reality, everything that can prevent success.

Experience shows that this "everything" is never totally predictable, if only because reality is much richer than what our understanding can grasp. Therefore, in order not to fall, prudent mountaineers make great efforts to pay attention and advance roped up. This is the principle of safety barriers, which presupposes that despite all the precautions taken, control of an activity is never assured and that several independent means of avoiding the consequences of its failure must be provided.

Strategies of prudence to counteract this complexity

Faced with the complexity of reality, we must recognize the limits of our knowledge, we must know that our assumptions and decision can only be considered provisionally true. We must accept that we can only regulate systems through cycles of trial and error. And when these errors can lead to catastrophic consequences, deemed unacceptable, we must ensure that their probability is extremely low.

This approach is a source of efficiency and reliability. It is the approach of prudence, which consists in judging the errors to be acceptable.

In this perspective, the fundamental problem is not that of complexity or errors, but that of the strategy allowing to master reality in spite of it, with an acceptable risk taking. The principle of the solution consists in constructing in advance a minimal representation of the situation to be mastered, which provides a maximum of comprehension, anticipation and guidance capacities (a representation of effective and safe scenarios/possible solutions), and in carrying out the action by seeking to remain within the envisaged scenarios so as not to find oneself in situations not envisaged. The principle of the solution is therefore to give oneself the means to guide the process and not to be guided by it [START_REF] Amalberti | La conduite de systèmes à risques[END_REF]. The generic solution consists in progressively structuring the knowledge in a form compatible with its subsequent highly automated use. This learning allows the passage from the state of rules or declarative schemes to the state of procedural schemes that the operator will be able to activate and then unfold with a minimum of attentional control. Only the practice of the profession allows this almost infinite transformation.

Actors create room for manoeuvre to ensure that they will be able to solve the problems encountered in the course of the action. The quality of this strategy, the quality of the cognitive compromise, is based on defences in depth that make it possible to control that the accepted risk does not degenerate into a loss of control and above all to accept the risk in the first place.

The adjustment of the cognitive compromise is established on the basis of confidence. Prudence consists in defining measures according to what we judge to be known (the reliability that we attribute to our knowledge), and in accepting the risks of an error in this judgment. There is no prudence in those who do not recognize their limitations.

The adjustment of the cognitive compromise is also established according to other criteria such as workload (feeling of overload), stress (feeling of loss of control over the immediate or future situation) or fatigue (emergence of the feeling that intellectual performance is less effective than it could be in an optimal situation).

The emergence of these feelings is uncontrollable by the subject but will seriously modulate the adjustment of the cognitive compromise. These strategic elements underlying prudence are the subject of numerous studies in cognitive psychology.

Dependence of these strategies on our beliefs

These strategies are dependent on a priori interpretive frameworks that have been the subject of sociological studies. These include the "Simmel effects" or "Simmel model" widely analysed by [START_REF] Boudon | Raison, bonnes raisons[END_REF]. We consider here a sociology very much focused on epistemological questions and, conversely, an epistemology concerned with the social conditions of production mechanisms and sorting of knowledge.

The central idea is that our beliefs can be dubious or false because within a perfectly valid argumentation, there slip a priori or implicit propositions that the subject treats as self-evident, and that, for this reason, he perceives in a meta-conscious way, and that these implicit a priori take the form of logical frameworks that calibrate the other propositions.

A parallel could be drawn with the Kantian categories of a priori. It seems that this "Simmel model" can also be compared to schema theory which provides a cognitive model in psychotherapy. Beck, for example, proposed a model as early as 1967, based on the idea that schemas represent personal and automatic interpretations of reality that process information unconsciously and influence individual coping strategies. Many authors have focused on analysing these mechanisms. We can cite, also, for example, the works of [START_REF] Morel | Les Décisions absurdes[END_REF][START_REF] Morel | Les Décisions absurdes, tome 3. L'enfer des règles. Les pièges relationnels[END_REF]), Bronner (2007[START_REF] Pinker | Rationality: What It Is, Why It Seems Scarce, Why It Matters[END_REF], or even Pinker (2022).

The reification process as a common failure mode

A common thread in these analyses is our tendency to miss these implicit facts and to be mistaken about truth. Basically, this difficulty is a preoccupation from the earliest philosophical texts to the more contemporary one. As far as we are concerned, it is with Auguste Comte that we have found the simplest and most enlightening analyses of the problem and especially of the principle of the solution to be considered (Comte, 1842).

The cornerstone idea is that starting from observation the observer may immediately and spontaneously form abstractions. We only observe what we can abstract. And conversely, we can only abstract correctly by observing. There is therefore no leap between experience and its conceptualization. We understand then that any abstraction, tends to be reduced to an observation, that is to say to the enunciation of a fact, more or less specific, particular, or general.

This expresses the horizon of the search for true propositions, knowing that the starting point is the hypothesis which is characterized precisely by a freedom with regard to the existing knowledge/ observation, and that there always seems to remain a kind of gap, of hollow, of falsity, between clear representations and observed facts. It is that reason must try to bend to observation at every moment of its constitution, so that the principles it employs should try to be as real facts, only more general and more abstract than those they must link, and it is always from their direct or indirect conformity with the observed phenomena that their objective effectiveness results exclusively. This imperative of submission to what is observed provides the means of distinguishing between justified and unjustified propositions. In this approach a theory is superior when it allows to foresee the phenomena, discovering their modifiability and the way to modify them, it is relatively to its effectiveness that the value of a theory is defined.

If we must confine our research to the domain of the observable, the less the proposals are based on accurate and objective observations, the less they are justified. …knowing that the quality of our abstractions is in the narrow dependence of our cultural heritage, and thus, evolves in time, progresses. Thus, it is not so much the complexity factors, or the "classical" cognitive bias that constitute our starting points, but rather those implicit frameworks of validity of our truths that are not questioned when we forget (it is the process of reification) that our representations are abstractions of abstractions that must submit to observation, and that the observed facts are from the outset an encounter of a subjectivity with the truth of the world, and thus that Truth is made of Our truths. Let us note in passing the very enlightening reading of the phenomenon of reification, proposed by Bergson and his numerous successors. For Bergson, it is a mechanism proper to the functioning of our intelligence which spatializes in order to think a reality whose framework is duration, which plays as well in our daily life as in sciences.

In this perspective, the fundamental error is to forget that representations, like those proposed by risk assessors or risk managers, are as fictions, of course useful fictions but always partially disconnected from reality, and that the proper of these abstractions is to freeze and to reduce, for the needs of the analysis and the action, a complex reality which exceeds what we can seize alone.

Only objectivism will pretend to substitute this abstract vision to reality. Or, better yet, only an overly bureaucratic or a too legalistic approach will make this substitution. This reification attitude is concluded by the substitution of the idea to the real and opens the field to postures where the document presenting a facility will be held as truer than the facility itself! However, not falling into the trap of objectivism is only possible if cognitive strategies incorporate the need to provide and collectively process quality incidental feedback.

Alone, an individual will necessarily succumb to objectivism. In this perspective, the organization of dialogues, the continuous confrontation of points of view, on the robustness of major risk control models would be the key to their performance.

This approach leads us at the same time to trust our representations (and therefore to accept the risks), and to distrust our representations in order to enter into a continuous process of improving our knowledge, with methods adapted to the nature of the problems, through the necessary dialogues with the stakeholders.

Digital technology opens new opportunities

Why is it so important when managing major risks? Because when we deal with major risks, we must consolidate the models without being able to rely on a trial and error process up to accidents, since by definition they are major and therefore unacceptable. It is mandatory to monitor the acceptability of models and to update them based on an incidental feedback.

It should be noted that our problem is centered on knowledge management. In this area, everyone knows that digital technology offers revolutionary opportunities. Starting in 2014, within the European project Tosca, we have done research to develop a knowledge management IT tool to support together risk assessment and risk management. We call it MIRA (Integrated Monitoring of Updated major Risks -Monitoring Intégré des Risques majeurs Actualisés).

The MIRA project is to assist in the management of the acceptability and updating of major risk control models, by fighting the risk of reification.

MIRA is a web platform dedicated to technological risk assessment and management, for resilience option selection, and for decision support & monitoring. Today, MIRA offers 5 basic modules: Risk assessment, Document management, Question/ answer and rules, Data management, Monitoring.

These modules offers the possibility to decompose and recompose models in order to have both an overall view and partial views down to the smallest elements on which they rely, to compare the analyses between them, to change scale when it is possible, to control the coherence within the models, to control the correspondence of the elements of the model (equipment, substances, tasks, ...) with the reality of the installations and the practices, thus to give a maximum of intelligibility to the multiple experts who will participate in this work. The objective is to multiply the points of view on the models and the elements of feedback, in order to optimize the possibilities of answers to this imperative of submission to what is observed, to rely on the truths of the stakeholders to progress towards a more robust modeling, until the dialogues dry up because a common operational picture seems to have been deemed acceptable by all. This is also why MIRA goes so far as to monitor the criticality of the risks (and of all the items allowing its calculation and periodic recalculation). It numerically integrates thousands of pages of risk studies, operational procedures and recording into a database logic. For it is always a question of reexamining the models without losing sight of what is really important and what is less important: by giving oneself the means to prioritize the problems. In this case, the whole process of doubt, regret and curiosity, to use the emotions that can be put forward to encourage this positive dynamic [START_REF] Houdé | L'intelligence humaine n'est pas un algorithme[END_REF], must not lose sight of the fact that the final issue is the overall level of risk acceptability. Is it obvious? Without a doubt. But it is clear that current risk management approaches, practices and tools do not address this issue. To our knowledge, no IT solution has this objective, so they generally focus on the communication aspects around the bow ties for example, but without the concern to re-interrogate the models by going as far as recalculating the risks from the feedback. Similarly, government inspectors will tend to rely on probabilistic analyses to identify safety barriers, take them out of context, and prescribe obligations of means (rather than obligations of objectives) requiring operators to achieve 100% success when the risk assessment has estimated a level of confidence, i.e., designed an acceptable possibility of failure.

The key here would be to keep the connection between risk assessment and risk management so that there is a way to update the estimated statuses for the equipment in the risk assessment and guide the choices made to manage priorities.

Any break at this level between risk assessment and risk management seems inevitably to ruin the construction of a positive dynamic of dialogues around a common operational picture.

To give a maximum of intelligibility to the stakeholders, by taking into account the points of view of each one, in order to build a dynamic of dialogues around the acceptability of the models, by keeping in the heart of the risk management the principles and the methods of the risks assessment... this is the challenge of the MIRA project, this is where we hope to take advantage of the new possibilities offered by digitization. A lot of progress has been made in this perspective, notably the development of adapted web based tool. However, much remains to be done, in particular through the multiplication of industrial case studies.

An example of application: MIRA

The current application developed was for a case study with Service National des Oléoducs Interalliés (SNOI) to develop a system at three levels: Level 1/ A risk assessment IT solution able to support decisions regarding risk management and provide the rationale to justify SNOI choices also if questioned by the regulator and its own management. This rationale informed the very foundation of the way the system was designed and realized. Above all SNOI wanted the risk assessment to be the foundation of a live picture shared across all levels to provide transparency on the risk faced and the impact that the unavailability or the unreliability of tasks or equipment can have on the accident scenarios the SNOI is exposed to. The computer system tends to become the support tool for the drafting of risk studies. It can manage the hundreds of thousands of pages of these studies and extracting lists of measures (safety barriers) and its critical equipment or tasks linked to exclusions, estimates of hazard potentials, calculations of frequencies of initiating events, and assumptions for modeling the intensity of hazardous phenomena.

Level 2/ An IT monitoring processes to:

o Support the improvement of the risk assessment, o Demonstrate the congruence between the risk control means considered in the analyses and the resources efficiently managed on the sites, Figure 1: the pop out window in this screenshot shows the risk studies associated to an installation o Monitor that the evolution of the criticality of the hazardous phenomena remains acceptable over time. This is a system for reporting real-time updates of risk monitoring data from facility operating systems (maintenance, production, incident management system). The system manages records and monitoring data associated with critical equipment or tasks from which risk acceptability update calculations are periodically performed for an entire installation (see Figure 1). A critical asset is any equipment or key task involved in the realization of a safety measure (cf. the criteria used for the detailed barrier analysis: independence, response time, etc.) that plays a role in the risk assessment (whether it is at the level of exclusion choices, estimates of hazard potentials, calculations of frequencies of initiating events, or even at the level of assumptions for modeling the intensity of the hazardous phenomena). The system can also offer an interactive ground plan of the safety critical assets linked to the database. Once selected the item identified on the ground plan, the risk studies and safety management procedures/ document connected to the items can be displayed. In the GIS mapping other relevant items and related Isorisk curves are made accessible that can be relevant for topological risk mapping related to releases etc. The tool also offers dashboards for monitoring changes in the performance of critical items. This point is crucial as it provides a complete feedback loop between prospective risk assessments and the updated picture of actual equipment and industrial process status and how they impact the SNOI risk profile for the relevant scenarios. This link is visible and simplified in a way that it provides transparency for the outcome of unavailability of critical tasks or equipment connected with relevant safety measures. This knowledge is not available just to the risk expert or the process engineer but shared across all levels of the organizations, easy to understand also for operational personnel. In this sense it can also allow those consideration to update HAZOP and HAZID studies that would otherwise become stale picture of a status quo no longer valid (see Figure 2). Level 3/ An IT rules and proofs management system capable to include:

o All the type of requests and demands received from different inspectors (including updates to risk studies), with a classification according to how clear and easy or not to do they are to realize, o How to best address them so that recurrent similar request can be dealt in a consistent standardized way o The lists of evidence that answer daily to mandatory requests. The system allows organizing and storing the internal requirements connected to the external regulatory requirements the plant must comply with. For each internal requirements the plant can store evidence or proof that the requirements have been applied and is being followed on site. Some evidence is also to be found in the risk studies and how they are updated in the system considering the actual reliability data with status updated from the field. Each piece of evidence is also attached to the regulation they refer to. The regulations are stored in the system by uploading the official PDF and each article is translated as an item on the list of requirements. However, these requirements which can be many and varied (approx. 1300 items on the current system database) can be linked and aggregated in company guidelines/procedures (named "doctrines" in French in the system), following which the organization can safely align themselves to the regulations. They can provide a much more synthetic set of rules/ procedures for the system to safeguards the alignment with regulatory obligations.

Conclusions

There is a need for digital applications able to support the management of technical complexity factors, promoting the methodical development of conservative strategies within cognitive trade-offs that integrate in the form of action scenarios the implementation of identified safety barriers for the control of accident scenarios, despite cognitive biases that enhance complexity and/or hinder the development of these strategies.

The developed digital MIRA platform attempts to achieve this goal by supporting the organization of dialogues between stakeholders, around a database that is comprehensive of risk assessment, regulatory requirements and up to date info on monitoring and inspection data. The system needs to process information in a dynamic way to support proposals regarding the acceptable level of major risks, and explicitly lay out the basis of decisions and assumptions for each stakeholder involved.

Figure 2 :

 2 Figure 2: Interactive worksheet available in MIRA to edit and populate HAZID or HAZOP