Engineering risk management is comprised of managing operational safety risks on the one hand and managing physical security risks on the other. Although some basic management principles are obviously the same for both safety and security, some important conceptual and calculation differences exist, as is explained in this paper. For instance, safety risk is usually calculated based on the scenarios’ consequences and likelihoods, while security needs to be determined by the assessment of vulnerability, the likelihood of attack and potential consequences. Nonetheless, there are also many similarities. Conceptual models, metaphors and principles that have been elaborated in the safety domain during the past century, many of them based on major accidents and their investigation, can easily be translated to the security domain. In the present study, we will explain how physical security should be seen in relation to safety, and what models and principles, derived from safety science, can be employed to manage the security aspects associated with physical threats.

@en

Chemical facilities may be targets of deliberate acts of interference triggering major accidents (fires, explosion, toxic dispersions) in process and storage units. Standard methodologies for vulnerability assessment are based on qualitative or semi-quantitative tools, currently not tailored for this type of facilities and not accounting for the role of physical protection systems. In the present study, a quantitative approach to the probabilistic assessment of vulnerability to external attacks is presented, based on the application of a dedicated Bayesian Network (BN). BN allowed the representation of interactions among attack impact vectors and resistance of process units, which determine the final outcomes of an attack. A specific assessment of protection systems, based on experts’ elicitation of performance data, allowed providing a knowledge support to the evaluation of probabilities. The application to an industrial case study allowed the assessment of the potentialities of the approach, which may support both the evaluation of the vulnerability of a given facility, and the performance assessment of the security physical protection system in place.

@en

The propagation of fire in chemical plants – also known as fire domino effects - largely depends on the performance of add-on passive and active protection systems such as sprinkler systems, water deluge systems, emergency shut down and emergency blow down systems, fireproofing, and emergency response. Although such safety barriers are widely employed to prevent or delay the initiation or escalation of fire domino effects, their inclusion in the modeling and risk assessment of fire domino effects has hardly been taken into account. In the present study, the dynamic evolution of fire protection systems has been investigated qualitatively using event tree analysis. To quantify the temporal changes and their impact on the escalation of fire domino effects, a dynamic Bayesian network methodology has been developed. The application of the methodology has been demonstrated using an illustrative case study, considering a variety of fire scenarios, target installations, and firefighting systems.

@en

Malicious acts of interference and terroristic attacks may affect chemical facilities causing severe accidents, with potential catastrophic consequences for people, environment and asset. The lack of a consolidated practice in the risk-informed implementation of security countermeasures goes hand in hand with the existence of very few rigorous approaches to the effectiveness assessment of security systems, and in particular of Physical Protection Systems (PPS). The present study addresses the issue of quantitatively assessing the effectiveness of PPS adopted to protect chemical facilities, recognized as high-consequence loss physical assets. An extended set of quantitative expert judgment based data that take into account performance variations due to operative conditions was derived. The application of the results to the quantitative assessment of the contribution of security controls in reducing vulnerability was also addressed.@en