H Abdo

M Kaouk

J-M Flaus

F Masse

A safety/security risk analysis approach of Industrial Control Systems: A cyber bowtie -combining new version of attack tree with bowtie analysis

Keywords: Risk analysis, safety, cyber-security, bowtie analysis, Attack-Tree analysis, SCADA. 1

The introduction of connected systems and digital technology in process industries creates new cyber-security vulnerabilities that can be exploited by sophisticated threats and lead to undesirable safety accidents. Thus, identifying these vulnerabilities during risk analysis becomes an important part for effective industrial risk evaluation. However, nowadays, safety and security are analyzed separately when they should not be. This is because a security threat can lead to the same dangerous phenomenon as a safety incident. In this paper, a new method that considers safety and security together during industrial risk analysis is proposed. This approach combines bowtie analysis, commonly used for safety analysis, with a new extended version of attack tree analysis, introduced for security analysis of industrial control systems. The combined use of bowtie and attack tree provides an exhaustive representation of risk scenarios in terms of safety and security. We then propose an approach for evaluating the risk level based on two-term likelihood parts, one for safety and one for security. The application of this approach is demonstrated using the case study of a risk scenario in a chemical facility.

INTRODUCTION

Analyzing risks of industrial and complex systems such as those found in nuclear plants, chemical factories, etc., is of crucial importance given the hazards linked to these systems (explosion, dispersion, etc.) (Abdo and Flaus, 2016b). Quantifying and analyzing these major risks contributes to better decision making and ensures that risks are managed according to defined acceptance criteria [START_REF] Arunraj | Risk-based maintenance techniques and applications[END_REF].

Industrial safety risk analysis aims to evaluate undesirable risk scenarios that can lead to major accidents that affect human and the environment. Traditionally, a systematic risk analysis process is made up of three steps: (i) identification of risk scenarios, (ii) likelihood analysis, (iii) effect analysis [START_REF] Purdy | Iso 31000: 2009setting a new standard for risk management[END_REF]. Based on these steps, a level of risk will be given to each scenario to see if it is acceptable or not. If not, safety measures should be added to reduce the level of risk to an acceptable level by diminishing the likelihood or the effects. This work considers the first two steps. Identifying a risk scenario aims to explore how an undesirable hazard can be developed starting from causes and ending with the consequences. Likelihood analysis aims to estimate the likelihood of occurrence of risk scenarios. This estimate can be qualitative or quantitative depending on the available data.

Traditional industries were based on mechanical devices and closed systems [START_REF] Kriaa | A survey of approaches combining safety and security for industrial control systems[END_REF]. Only safety related risks generated from accidental component failures and human errors need to be addressed during risk analysis of these industries. However, today, industries are influenced by the development of digital technology related to instrumentation and industrial automation (IA). Supervisory Control And Data Acquisition (SCADA) systems are introduced to monitor and control equipment that deals with critical and time-sensitive materials or events. The shift from analog equipment towards technologies has a number of benefits concerning production, but it also presents challenges [START_REF] Shin | Cyber security risk evaluation of a nuclear i&c system using bayesian networks and event trees[END_REF]. This introduction of automation technology increases the degree of complexity and communication among systems. The use of Internet for connecting, remote controlling and supervising systems and facilities has generated a new type of risk causes that are related to cyber-security. These systems and facilities have become more vulnerable to external cyber attacks. These new security threats can affect the safety of systems and their surrounding environments in terms of people, property, etc. [START_REF] Johnson | Cybersafety: on the interactions between cybersecurity and the software engineering of safety-critical systems[END_REF]; [START_REF] Kornecki | Safety and security in industrial control[END_REF]).

The differences and similarities between safety and security are studied by many authors [START_REF] Kriaa | A survey of approaches combining safety and security for industrial control systems[END_REF]; [START_REF] Firesmith | Common concepts underlying safety security and survivability engineering[END_REF]). In general, safety is associated with accidental risks caused by component failures, human errors or any non-deliberate source of hazard, while security is related to deliberate risks originating from malicious attacks which can be accomplished physically (which are excluded in this study) or by cyber means. In addition, causes of accidents related to safety are internal and considered to be rare events with low frequency. Causes of security accidents can be internal or external (attacks via insider agents or outsiders) and are classified as common events.

Until today, industrial risk analysis does not take into consideration the cyber-security related risks that can affect the safety of the system and lead to major accidents. Systems are designed to be reliable and safe, rather than cyber secure. In recent years, there has been an increasing number of cyber attacks that target critical facilities (e.g., Stuxnet in 2010 and Flame in 2012). According to Dell's annual threat report (Dell, 2015), cyber attacks against SCADA systems doubled in 2014. Dell SonicWALL saw global SCADA attacks increase against its customer base from 91,676 in January 2012 to 163,228 in January 2013, and 675,186 in January 2014. Many authors have studied the potential impact of security related threats on the safety of critical facilities and highlight the importance of analyzing safety and security risks together [START_REF] Kornecki | Safety and security in industrial control[END_REF]. Thus, concerns about approaches for industrial risk analysis that consider safety and security together are a primary need.

In this paper we aim to analyze and consider the effect of cyber-security on safety risk scenarios that lead to major accidents. As a result, we propose a new global definition of industrial risk and a risk analysis methodology that covers security and safety. The proposed methodology combines Attack tree (AT) for security analysis within bowtie (BT) for safety analysis in order to provide a complete representation of a risk scenario. Then, a likelihood analysis approach with two different scales, one for security and another for safety, is introduced.

The likelihood of an event is represented in terms of couples (security, safety) in order to see if higher likelihood is related to either security or safety.

It should be noted that in this study we are interested in cyber-security breaches that can lead to major hazards that have effects on human life and the environment and not on confidentiality, integrity or availability of information.

In order to present the possibilities offered by this study, the paper is structured as follows: Section 2 introduces the concepts of safety risks, security risks and the industrial automation and control system IACS. In Section 3, we highlight the global idea behind this study.

In Section 4, we present the proposed methodology for a combined safety/security industrial risk analysis. In Section 5, we present a case study where the proposed methodology is applied for a hazard scenario in a chemical facility. Finally, section 6 draws a number of conclusions.

Preliminary

In this section, we present the definitions of safety and security related risks (Sections 2.1 and 2.2, respectively). These two definitions will be used to generate a new global definition of industrial risk that covers safety and cyber-security related risks. Section 2.3 introduces the concept and design of the industrial automation system.

Definition of risks related to safety

In general, safety related risk is defined or defined as follows [START_REF] Kaplan | On the quantitative definition of risk[END_REF]):

= { , , }; = 1, 2, ..., ;

i i i safety e e e

R S P X i N

(1) where

• sa fety R -safety related risk which is defined as a set of {};

• S e -scenario representation of the undesirable event under study (e) by identifying safety causes of e and its related consequences;

• P e -likelihood of occurrence of S e ;

• X e -severity of consequences of S e ;

• N -is the number of possible scenarios or undesirable events that can cause damages.

Definition of risks related to security

In the context of cyber-security, risk is defined in terms of likelihood and effects of a given threat exploiting a potential vulnerability [START_REF] Stouffer | Guide to industrial control systems (ics) security[END_REF]; Henrie (2013)): (2) where

• secu rity R -security related risk which is defined as a set of {};;

• tv -scenario representation of a security breach: threat or attack (t) exploits a vulnerability v;

• tv P -likelihood of t exploits v;

• tv X -severity of consequences if t exploits v;

• M -is the number of possible attacks.

Industrial Automation and Controld System -IACS

Industrial automation is the use of Industrial Control System (ICS), such as computers and information technologies for handling different processes in an industry. The use of ICS helps in increasing productivity, quality and flexibility in the manufacturing process [START_REF] Almalawi | An unsupervised anomaly-based detection approach for integrity attacks on scada systems[END_REF].

The SCADA system is one of the most important parts of IACS, which refers to an industrial computer system that monitors and controls processes and systems distributed over limited or large geographical areas [START_REF] Nicholson | Scada security in the light of cyber-warfare[END_REF]; [START_REF] Cherdantseva | A review of cyber security risk assessment methods for scada systems[END_REF]). The principal function of SCADA is acquiring the data from devices such as valves, pumps, etc. and providing control of all of these devices using a host software platform [START_REF] Li | False sequential logic attack on scada system and its physical impact analysis[END_REF];

Schneider Electric ( 2012)). The monitoring of the process is provided using a remote method of capturing data and alarm events, where instruments can be regulated and turned on and off at the right time. The SCADA system also provides more functions such as displaying graphics, alarming facilities and storing data. Malfunctions of SCADA may cause undesirable consequences ranging from financial loss to environmental damages [START_REF] Patel | Supervisory control and data acquisition remote terminal unit testbed[END_REF].

SCADA systems throughout the world supervise and control electric grids, power plants, water systems, chemical plants, pipelines, manufacturing, transportation, and other physical processes [START_REF] Weiss | Industrial control system cyber security and the critical infrastructures[END_REF]. Figure 1 shows the basic hierarchy and architecture of an IACS, which is classified into five distinct levels. SCADA operates on levels 1 and 2. The different levels of IACS are presented as follows:

• level 0 -field instruments: the lowest level of the control hierarchy which includes to sensors, pumps, actuators, etc. that are directly connected to the plant or equipment. They generate the data that will be used by the other levels to supervise and control the process;

• level 1 -control level using Programmable Logic Controller (PLC): PLC is an adapted industrial digital computer that controls the manufacturing processes. It is linked to the field instruments, and to the SCADA host software using a communication network;

• level 2 -SCADA: monitor, maintain and engineer processes and instruments;

• level 3 -MES: this level is responsible for process scheduling, material handling, maintenance, inventory, etc;

• level 4 -ERP: the top level of the industrial automation which manages the whole control or automation system. This level deals with commercial activities including production planning, customer and market analysis, orders and sales, etc.

Industrial communication networks are most prominent in IAS which represents the link that relays data from one level to the other in order to provide continuous flow of information.

This communication network can be different from one level to another.

The SCADA system represents the most sensitive and targeted part of the industrial automation in terms of cyber-security. Cyber attacks on the SCADA system are classified into three different categories: (i) hardware, (ii) software, (iii) communication network.

General idea

This section generalizes the global idea behind the methodology proposed in this paper.

This study first contributes a new global definition of industrial risk that covers safety and security. In the safety domain, risk is described as a set of undesirable events scenarios S e with their related likelihoods and impacts (see Section 2.1). In the security domain, risk is described as a set of scenarios that consist of threats exploiting vulnerabilities with the attached likelihoods and impacts (2.2). However, undesirable safety events can occur due to cyber threats after exploiting specific vulnerabilities. Thus, safety/security risk is defined in terms of a triplet as follows:

( , )

S

, where se and sa are respectively the likelihoods related to security and safety;

• ( , ) tv e X -Severity of consequences of ( , ) tv e S ;

• N -is the number of possible scenarios or undesirable events that can cause damages.

To represent and evaluate the likelihood of a risk scenario, in the domain of safety, a bowtie analysis is constructed and then we use this bowtie to calculate the likelihood. In the domain of security, the chain of a security breach is represented by a graph called attack tree.

The structures of the trees are close, here we propose a common representation by combining them as presented in Figure 2.

In both cases (safety and security), the risk is measured by a pair Likelihood/severity.

However, we realized that it is not possible to use a common qualitative scale for likelihood analysis. Indeed, if we consider an undesired event that can be generated from a component failure (safety) or a cyber attack (security), it is preferable to keep a double measure of likelihood (safety, security) rather than aggregating the two likelihood information into one. This gives a better idea on the importance of the two aspects and eventually, the use of the common model to detect an attack. Let us take the example of a door lock which is controlled via the Internet. If the IT protection mechanism is moderate reliable, and the lock is difficult to break, then the risk is moderate (it needs a mechanical attack or a cyber attack). In comparison to a purely mechanical lock that is a little less resistant, this will present the same level of risk. The two systems appear to be similar whereas only the first one presents a residual cyber risk.

Thus, the proposed methodology to analyze safety/security risks is based on three main steps:

 identifying risk scenarios: we propose a methodology that combines BT with adjusted AT to identify the safety and security related causes and consequences of the undesirables events being studied. BT analysis is one of the most popular methodologies used in probabilistic safety analysis (Abdo and Flaus, 2016a). AT is widely used to represent and analyze risk scenarios related to cyber-security. However, combining BT and AT analyses can be effectively used for an integrated safety/security assessment of critical systems. This methodology identifies and considers all safety incidents and security threats that can lead to the same undesirable event generating damages.

 likelihood evaluation: as BT and AT offer likelihood evaluation for safety and security risk scenarios, respectively, then the combined ATBT offers the same option for a safety/security risk scenario. But, as we said, sources of risk for safety and security are of different nature.

Usually the likelihood of cause events related to safety are very low in comparison to the likelihood of security related cause events. For this reason, different likelihood scales, one for safety and another for security are defined to characterize the likelihood of input events. This differentiation helps in identifying the sequences of events (minimal cut sets) that are purely related to safety, security or to both. The resulting output of different types of cut sets offers richer information for decision making and provides inputs for intrusion detection systems. In the rest of this paper we are going to prove the importance of considering safety and security together and show that purely security risk sequences should be treated first.

 severity of consequences evaluation: this step aims to quantify the loss in terms of system assets, human life and environmental damage if the undesirable event has occurred. Here, the severity of an individual scenario is considered to be the same whatever the causes are related to safety or security. This part is not considered in this paper.

The proposed approach will provide a deep, exhaustive analysis on safety/security for industrial risk scenarios in a given facility.

4.

Methodology for combined safety/security risk analysis

Introduction

In this section, we will outline the proposed methodology for a combined safety/security industrial risk analysis. As we are going to prove that the occurrence of safety related events, security related events or both together can lead to the same undesirable accident, the idea then is to combine the BT for safety analysis and the AT for security analysis in order to provide a complete modeling of a risk scenario. A risk scenario will be a combination of all expected security and safety events that can result in the undesirable event being studied. This modeling will be the first step in our methodology and it is conducted as presented in Section 4.2.

Next, we explain the second step that aims to evaluate a risk scenario in terms of likelihood as presented in Section 4.3. But, due to the difference in nature between safety and security related events, they will be characterized separately for likelihood analysis.

Figure 3 shows the framework to apply the proposed methodology.

Step-1: representation of a risk scenario

In this section, first we will present the concept of BT analysis and introduce a new extended AT as depicted in Sections 4.2.1 and 4.2.2, respectively. Then, we show how ATs can be integrated within BT for richer combined safety/security representation of a risk scenario (see Section 4.2.3).

Safety risk analysis using bowtie analysis

bowtie analysis is a very prominent method to identify and analyze the likelihood of risk [START_REF] Ferdous | Handling and updating uncertain information in bow-tie analysis[END_REF]. It presents a combination between fault tree analysis (FTA) and event tree analysis (ETA). FTA and ETA respectively describe the relationships between the undesirable event, its causes and its consequences for a systematic representation of hazard. These relationships between trees' nodes are represented using the logical AND/OR gates. BT uses different types of nodes to model a risk scenario. Figure 4 presents a schematic diagram of the bowtie analysis, the definition of each is detailed in Table 1.

Security risk analysis using a new extended Attack Tree

The "Attack Tree" technique as initially presented by Schneier ( 1998) is a graph that describes the sequence of steps in order to perform an attack. It represents an attack against a system in a tree structure [START_REF] Fovino | Through the description of attacks: A multidimensional view[END_REF]. The root (main event) of the tree is the goal of an attack. This root is connected to intermediate and starting (leaf nodes) events in order to represent the different ways to achieve the attack.

Traditional AT presents some limitations to be used for risk analysis. Showing just the steps that an attacker or a team of attackers follow to achieve a particular goal is not enough to understand the system's weaknesses. On the other hand, traditional AT does not present all the information needed to evaluate the likelihood of a successful attack on the target system. Thus, mapping information on the target system such as vulnerabilities in addition to attack steps is essential for an effective security risk analysis using AT.

In this study, we will propose an extended version of attack tree with new modeling in order to characterize a security risk scenario. This extended version allows the consideration of significant information such as the target system vulnerabilities to suit the security risk analysis perspective. The AT's leaf nodes (security input events) are represented by a combination of attack events and vulnerabilities. This representation help the decision makers understanding the system's vulnerabilities (or weaknesses) and the different types of attacks that can be contacted in order to provide the right countermeasures.

As in BT, the AND/OR gates are used to link the tree's events and define the relationship between them. Table 2 presents the term, shape and definition of each event used in the proposed AT.

The goal of this new AT is to model how attackers can exploit system vulnerabilities in order to cause damage. Figure 5 shows in a schematic way the reality behind how attackers target a system by exploiting its vulnerabilities. Here, attackers should run three different attacks and exploit three different vulnerabilities in order to achieve their goal. This attack can be modeled by the proposed AT as shown in Figure 6. Figure 6 shows the breach layers to attain the attack goal. This concept of layers would help propose the right countermeasure in the right place.

It should be noted that different attack events may be needed to exploit a specific vulnerability and vice versa. In these cases, the forms of the basic security events are presented in Figure 7. If we take the WannaCry ransomware attack as an example, the attack event is sending an unsolicited email that contains a link to exploit two different vulnerabilities: (1) the computer runs Windows operating system that is a not updated and ( 2) the unawareness of the user (if he/she clicks on the link). The security event will be as presented in Figure 8.

Combined ATBT analysis

This step aims to combine AT and BT analyses for a combined safety/security industrial risk analysis. The goal of this combination is to provide a complete representation of risk scenarios by plotting on the same scheme safety and security events that can lead to the same undesirable events. Additionally, integrating ATs within BT analysis can help in understanding how attackers can exploit systems' weaknesses in order to cause damages besides non-deliberate incidents.

This step is conducted as follows:

1. construct BT for the chosen undesirable event being analyzed;

2. for each safety event in BT, identify if there are security incidents that can lead to the occurrence of this event. If yes, construct the AT and attach its goal to the corresponding event (see Figure 9). This means that this event can occur due to accidental (safety) or deliberate (security) incidents.

Finally, a cyber-security BT (ATBT) is obtained for the undesirable event being studied.

Step-2: likelihood evaluation

This section proposes an approach for conducting a qualitative likelihood analysis of a safety/security risk scenario. This likelihood analysis methodology is made up of three main steps: (i) determining the minimal cut sets to understand the structural weaknesses of a system, (ii) characterizing likelihoods of input events using a two-levels representation and (iii) quantify the likelihood of each MC to prioritize the system's weaknesses (see Sections 4. It should be noted that we are required to characterize likelihood of safety and security events separately because they are intrinsically different and the control in terms of safety or security barriers should be managed independently of the two safety and security aspects.

Determining minimal cut sets

Finding out the MCs represents the first step of likelihood evaluation in our approach. An MC is the smallest combination of input events which causes the occurrence of the undesirable event. MCs present the different ways in which component failures or events alone or in combination with others make the occurrence of the top event (minimal cut sets with one or several components or events). In this study, the MCs are obtained using rules of boolean algebra [START_REF] Yuanhui | Safety system engineering[END_REF]. Each MC set is a combinations of AND gates containing a set of basic inputs necessary and sufficient to cause the top event (see [START_REF] Grossel | Guidelines for chemical process quantitative risk analysis: ; by center for chemical process safety; american institute of chemical engineers[END_REF], appendix D for more details).

We separate between three types of minimal cuts:

• purely related to security: all events of the MC are due to deliberate attacks;

• purely related to safety: the MC does not contain any security related event;

• related to a mixture of both security and safety: accidental and deliberate causes exist in the MC.

The importance of this differentiation between types of MCs is to discover the system's weaknesses where a pure security MC represents a weak point due to the high likelihood of occurrence of security causes. This reasoning will be detailed and demonstrated in the rest of this paper.

Characterizing likelihoods of occurrence of input events

In safety, the likelihood of occurrence is the probability (expected frequency) or possibility of something happening. But when we talk about security, the likelihood of occurrence is the probability that a given threat is capable of exploiting a vulnerability (or set of vulnerabilities).

Likelihood analysis can be qualitative or quantitative depending on the type of available data. This data is either quantitative derived from historical incident or qualitative based on experts' elicitations. Because of the difficulties in estimating quantitative likelihood of occurrence of an attack or an accidental cause, a qualitative scale is used. The advantage of the qualitative methodology is its simplicity of applying and understanding by the relevant personnel.

As we presented in the beginning of this section, there are different concepts to define likelihood related to safety and security. Due to the deviation in the likelihood translation, high likelihood in safety is different than high likelihood in security regarding the number of observed safety and security incidents (we see cyber attacks on critical facilities every day, while safety incidents are rare). Two different scales L s : security and L f : safety of respectively five and six levels are proposed. The first level of each scale represents an undefined value (likelihood equals zero) in order to specify if an event is purely related to safety or security. Thus, each event is characterized by couples (L s , L f ).

Based on this likelihood representation in terms of couples, we can differ between three different types of events presented as follows:

• events that are purely related to safety with likelihood (N/A, L f ) for each event;

• events that are purely related to cyber-security with likelihood (L s , N/A) for each event.

If the event is a security cause (basic event in terms of two parts), L s will depend on the vulnerability level and the technical difficulties of conducting the attack as we will detail in Section 4.3.2.2;

• events (intermediate events) related to both safety and security with likelihood (L s , L f ) for each event.

Characterizing likelihood for safety risk events

Likelihood characterization here aims to determine the likelihood of occurrences of input events (BEs and Es in BT) and the likelihood of failures of risk barriers according to a specific scale.

The same scale used by INERIS for safety analysis is used in this study [START_REF] Ineris | Agrégation semi-quantitative des probabilits dans les études de dangers des installations classées -omega probabilités[END_REF] as presented in Table 3.

Characterizing likelihood for security risk events

In the context of a security risk analysis, the likelihood of occurrence depends on the capability that a given threat (or set of threats) exploiting a potential vulnerability (or set of vulnerabilities).

Thus, the likelihood is a function of the difficulty of performing a needed attack to exploit a vulnerability, and the level of vulnerability depending on the existing counter measures. In this article, two different criteria are considered to determine the likelihood of a security initial event presented as follow:

• vulnerability level: given to a vulnerability in the ATBT to represent how easy or hard exploiting this vulnerability depending on the existing countermeasures. Table 10( 4. From Table 4, we can note that likelihood levels of security events are different from those of safety events (Table 3).

Calculating the likelihoods of MCs

This step aims to prioritize the system weaknesses by calculating the likelihood of each MC in order to help decision makers propose the right countermeasure where MCs with highest likelihood should be treated first.

Calculating the likelihood of an MC only needs the AND gate to be solved. AND gate signifies that the output event occurs if all its input events have occurred. Since qualitative scales are used for safety and security likelihood characterization, the min rule is used to solve the AND gate. Suppose an AND gate with n input events EV i , = 1,..., in , the output likelihood is calculated as presented in Eq 4 (INERIS, 2015). Finally, for each MC, the two determined likelihoods for safety and security should be taken together to provide one meaningful likelihood to be used for prioritizing MCs and for risk evaluation using the likelihood-consequence risk matrix (which is not discussed in this paper).

  11 ( ) = [ ( )] = [ ( )], [ ( )] = ( [ ( ), ..., (
L A N D m in L E V m in L E V m in L E V m in L E V L E V m in L E V L E V (4)
Table 5 presents the overall scale regarding the proposed safety and security scales. This overall scale defines five different qualitative expressions from low (L) to very high (VH).

It should be noted that this overall-likelihood can not replace the double part likelihoods Figure 11 presents an example on how to calculate the likelihood of an MC. The MC in Figure 11 presents four basic events, two are related to safety (BE -1 and BE2) and the other two are security related (SBE -1 and SBE -2). Based on the proposed approach, experts are asked to characterize the likelihood of safety basic events, and (i) difficulty of attacks and (ii) exploitability of vulnerabilities for security basic events. From (i) and (ii), the likelihood security basic events are determined based on Table 10 (For example, SBE -1 is of level 4 since the vulnerability level is E and the needed attacker skills are T). The dashed rectangle beside each event in the figure presents its likelihood. These likelihood are then propagated through the MC.

The likelihood of events SE-1 and E-1 are calculated based on Eq 4.

( 1) = ( ( 1), ( 2)

) = ( [ ( 1), ( 2)], [ ( 1), ( 2
)]) = ( [ / , / ], [ , ]) = ( / , )        secu rity secu rity sa fety sa fety L E m in L B E L B E m in L B E L B E m in L B E L B E m in N A N A m in A C N A C
, where 5. This approach will be illustrated in the next section and applied to an overheating scenario in a chemical reactor.

5.

Case study

Description

This case study illustrates the implementation of the proposed approach, which can be applied in any industrial context. The case study concerns an industrial site of a propylene oxide polymerisation reactor [START_REF] Abdo | A mixed fuzzy probabilistic approach for risk assessment of dynamic systems[END_REF]. The reactor runs a high exothermic chemical reaction at high pressure. It is located in a manufacturing site located south of a small town.

Risks associated with the operation of the reactor are of high consequences.

In a systematic representation of the reactor, a production system, a cooling system and a power supply are interacting in order to perform the operation under normal conditions (regulated temperature and pressure). Components of these systems (valves, pumps, etc.) are controlled by PLCs and supervised by a SCADA system. The information collected by the SCADA system is accessible by all the site managers from their offices using wireless remote control. The manager of the utility can control the facility using its tablet or smart phone via

Internet. Controlling the process via Internet would allow the manager to handle the situation from where he/she is before it is too late, rather than waking up at midnight racing to the plant to handle the situation. Figure 12 shows the architecture of the system under study.

The reactor is used in batch mode to run a chemical reaction in order to produce a product C from two reactives A and B. The temperature of the reaction is regulated with industrial water. At the end of the reaction, after the mixture A, B is completely transformed. The output C is transferred toward another unit in the facility by opening the valve XV33021. This process is controlled by PLC1.

The cooling system E33040 receives cold industrial water as input which is used to cool down the content of reactor R33030 using a double jacket. The temperature of the cooling system and the water flow rate are measured by the sensor TI33061 and TI33062, respectively.

The data collected by these two sensors is sent to PLC2 which regulates the water flow rate by controlling P1, P2, CV33063 and XYSV33027. Under normal conditions, the pressure in the reactor is less than six bars when the temperature is controlled under 120 °C. An automated safety valve PSV33009 opens in the case of over-pressure to limit the pressure to 10 bars. After PSV33009 opened, the exhausted gases are cleaned by scrubber.

Application

In this case study, the most likely undesirable scenario with the highest consequences due to overheating/overpressure is considered for risk analysis. This scenario can be generated after the occurrence of deliberate attacks or accidental errors. Overheating occurs if the temperature and pressure exceed the threshold.

The two first steps for risk analysis (risk identification and likelihood evaluation) using the proposed methodology are applied on the overheating scenario as depicted in Sections 5.2.1 and 5.2.2, respectively.

Step-1: Constructing ATBT for safety/security analysis

This step contains two sub-steps as presented in the proposed methodology:

1. constructing the BT for safety analysis: Figure 13 presents the BT for the undesirable event under study. The undesirable main event is an overheating and increase in pressure inside the reactor. This event occurs after an abnormal increasing of the temperature and pressure which is due to:

(a) an error in the cooling system: this event can be generated from accidental failures if the valve XYSV33027 breaks down (BE-1), pumps P1 or P2 breakdown (BE-2 or BE-3), the valve XYSV33063 breaks down (BE-4), or failure in the power supply (BE-5). It can also be initiated by deliberate attacks on the control system (as detailed in the next paragraph:

constructing ATs);

(b) over loading: an excessive loading of the reactor due to a human error (BE-6);

(c) agitation system breakdown: if the power supply or the motor of the system breaks down (BE-7 or BE-8).

However, this rise in pressure is limited by an automated safety valve. If this does not accomplish its purpose due to mechanical failure (BE-9) or cyber-attack (see next paragraph), it would result in the explosion of the reactor. Thus, nine safety related basic events are investigated as causes of the overheating in the reactor.

2. constructing ATs for security analysis: two events in the BT of Figure 13 can occur due to security breaches. The first event is the failure of the automated safety valve due to an attack on the hardware (SBE-19 in Figure 13: exploiting the control surveillance vulnerability by running a Doorknob rattling attack). The second is by sabotaging the cooling system after gaining unauthorized access to the SCADA system. SCADA system can be exploited by attacking the computer software or the communication network as shown in Figure 14 and detailed below:

• attacking the communication network: this can be achieved by sending a malicious email to steal access information from an authorized target (employees inside the facility) to exploit the no existence of email surveillance (exploit confidentiality), see SBE-18 in displays to the operator that the system is under normal conditions.

5.2.2.

Step-2: Likelihood evaluation 1. determining minimal cut sets: The ATBT shown in Figure 13 yields to 61 MCs. All minimal combinations of basic events that result in the occurrence of the main event are identified. Figure 18 shows an example of the MC number 59. The MC in Figure 18 is related to mixture safety/security because safety and security basic events (respectively BE-9 and SBE-17 in the Figure ) should occur together to cause the occurrence of the undesirable event. These MCs are divided into 27 that are purely related to security, 7 that are purely related to safety and 27 that are related to mixture safety/security.

2. characterizing likelihood of occurrence of input events: Experts in the field are asked to characterize likelihoods of safety and security basic events. The characterized likelihoods in terms of couple ( , )

secu rity sa fety LL are drawn beside the basic events in the ATBT (see figures).

3. calculating likelihood of MCs: safety/security likelihood of each MC is calculated using Eq 4 as shown in Table 6. Then the overall likelihood of each MC is determined based on Table 5. As an example, Figure 18 presents calculating the likelihood of MC number 59. MC number 59 contains two basic events BE-9 and SBE-17 with likelihoods equal to (N/A, D) and ( 4,

N/A) (derived based on Table 10(c))
, respectively. After propagating these likelihoods, the likelihood of the explosion event is equal to (4, D) which is of level L.

Discussion and improvement

As shown in Table 6, the MCs ranked high (H) and (VH) are purely due to cyber-security.

This reveals the importance of considering security risks during safety risk analysis. However, the presence of a safety event in an MC will lead to less likelihood of occurrence. We can clearly see that between MC-25 and MC-59 where their attached likelihoods are equal to VH and L respectively, MC-59 is of less likelihood because it contains the accidental event BE-9.

To show the importance of analyzing safety and security together, a burst disk is added which represents a mechanical component (no security breaches are related) as improvement for the process. The re-determination of MCs shows that there is no MC that is related to pure security. Table 7 shows the re-determined MCs with their re-estimated likelihoods. The introduced improvement diminishes the likelihoods into the lowest level. Thus, the presence of a mechanical failure (safety event) in a cut set will insure the prevention of malicious attacks and vice versa. For these reason, safety and security being treated together will lead to a better risk analysis and effective decision making.

The methodology in this paper focuses on introducing cyber-security related threats within industrial risk analysis. Beside the advantages this methodology presents, it hides some limits:

• the step of characterizing likelihood for security related events (Section 4.3.2.2) could be improved. Many other criteria could be taken into account to evaluate the likelihood of security related events: connectivity of systems, control of internal and external stakeholders, technology and communication protocols used, organization set up to monitor and patch vulnerabilities, etc.;

• the approach presented for likelihood analysis is qualitative. The advantage of this qualitative approach is its simplicity of applying and understanding by the relevant personnel.

But, this qualitative approach is subjective and heavily dependent on the experience of experts who are performing the analysis and it can be influenced by personal idiosyncrasies.

Consequently, it can lead to inaccurate and imprecise risk predictions. Therefore, moving towards a quantitative approach by using statistical data for likelihood analysis is a focus of interest for future work;

• in general, each dangerous phenomenon is analyzed a part in terms of likelihood/severity. Nevertheless, in case of security, it can be imagined that several scenarios can occur at the same time. An attacker could try to cause several phenomena at the same time to maximize the effects. For example, if there are several tanks of dangerous materials, in traditional risk analysis, the fire of each tank is assessed separately. But, if there are several simultaneous fires, the severity would be greater and the the intervention to reduce accidents would be more difficult.

These limits will be considered for future work.

Conclusion

The use of technology in critical facilities exposes systems' safety to security related threats. These threats are due the use of Internet, standardized protocols and electronic components for connectivity and remote controls.

Nowadays, existing approaches for industrial risk analysis ignore cyber-security. On the other hand, cyber-security analysis ignore the benefits of non-digital systems in decreasing the likelihood of security scenarios. In light of security threats, there is an urgent need for complete and effective safety risk analysis. That is why this paper proposes an approach that integrates ATs with BT analysis for a combined safety and security industrial risk analysis. Bowtie analysis is used for analyzing safety accidents. A new concept of Attack Tree is introduced to consider potential malicious attacks that can affect the system's safety. The steps of combining AT within BT is presented and the process for likelihood evaluation is explained.

There is complexity in quantifying likelihoods of attacks and a lack of consistency in the likelihood of occurrence between deliberate and accidental causes of risk. For these reasons, two different qualitative likelihood scales one for safety and another for security are proposed for representing the likelihood of basic events related to safety and security. The different likelihood scales lead to three different types of events sequences (MCs). A qualitative mathematical rule is used to calculate the likelihoods of MCs.

The outputs of the approach show important results in terms of representation of risk scenarios as well as in likelihood quantification. MCs due to purely safety, security or both can be separately extracted. This separation between MCs helps understand the origins of risk and provide the right control measures.

The application of the proposed approach on an undesirable scenario in a chemical reactor shows that the highly likelihood MCs are purely related to security. The added improvement diminishes the unacceptable likelihood to an acceptable level. The results show that the moves from purely security MCs to mix safety/security MCs is the safest risk treatment.

In the future, this work will be extended by proposing a more robust likelihood evaluation technique. Quantitative data, if available, will be used for more accurate analysis. In (1, E) VL

  a) shows the three different levels proposed to evaluate this criterion. Level 1(E) means that the vulnerability is easy to be exploited (for example, a password that should be a number of four digit represents an easy vulnerability). Vulnerabilities of level 2 (M) or 3 (H) are harder to be exploited due to the presence of security measures. If we take the same example, a password that should be a number of eight digit would be of level 2. While an eight digit password that should contains lower and upper case letters in addition to numbers would be of level 3;• technical difficulty of conducting an attack: given to an attack event to show the needed level of expertise or difficulty to conduct the attack. Table 10(b) presents the levels of difficulty of an attack inspired from[START_REF] Byres | The use of attack trees in assessing vulnerabilities in scada systems[END_REF]. Four levels { , , , } T M D VD are used to describe the difficulty of executing an attack. (T) is the easiest to conduct where normal computer skills are required (for example, running a Denial Of Service Attack). (M) demands some programming and security skills (running an SQL injection). (D) needs a hacking expert (man in the middle attack). (VD) is the hardest where a team of competent hackers are needed to conduct the attack (implementing a sophisticated warm).These two criteria should then be combined in order to provide a likelihood for the security initial (or basic) events. The difficulty of the attack is combined with the vulnerability levels as presented in Table 10(c). Four different security likelihood levels in addition to the N/A level are proposed to represent the combination. The definition of each security likelihood level is presented in Table

  for decision-making and in choosing the right countermeasure, because decision makers should know if the high likelihood is related to safety, security or to both.

C

  which is of level Moderate (M) based on Table

Figure 14 .

 14 Figure 14. Or, exploiting the weakness of the encryption algorithm (integrity of information) used for communication between the SCADA and the control level. Different attacks can be performed to exploit integrity: message spoofing, replay attack or man in the middle attack

  addition, uncertainty due to imprecision, vagueness and the lack of consensus (if multiple sources of data are used) will be considered. laboratory, Grenoble Alpes University, France. His research concerns cyber security of control systems.Jean-Marie FLAUS has more than 20 years of experience in industrial engineering, computer engineering and safety/security risk analysis. He is a professor at G-SCOP laboratory, Grenoble Alpes University, France.François MASSE is a reliability and functional safety engineer at the French National Institute for Industrial Environment and Risks (INERIS). He is currently managing a project on cyber security in critical facilities run by the French ministry.

Figure 1 :Figure 2 :Figure 3 :

 123 Figure 1: Components and architecture of IAS Figure 2: Global definition of risk Figure 3: Framework of the proposed approach for safety/security risk analysis Figure 4: Structure of a "bowtie" diagram Figure 5: How attackers exploit system vulnerabilities in order to cause damages Figure 6: Example of the structure of the proposed attack tree Figure 7: The different form of a security basic event Figure 8: Modeling WannaCry ransomware attck using the proposed AT Figure 9: Example of how we attach an AT to its corresponding event in BT Figure 10: Characterizing the likelihood of security basic events Figure 11: Example of how calculating the likelihood of an MC Figure 12: The chemical reactor with its SCADA system structure Figure 13: Combined AT-BT of the scenario under study

Figure 14 : 3 :

 143 Figure 14: AT for the goal: gain unauthorized access to SCADA Figure 15: The top objective of Stuxnet Figure 16: Attack tree of the "spreading of Stuxnet" Figure 17: Attack tree of "Stuxnet self installation" Figure 18: Calculating the likelihood of MC number 59 Table 1: Abbreviations, significations and definitions of elements listed in the bowtie diagram Shape Signification Definition Basic event (BE) Direct cause of a physical integrity Event (E) Physical integrity caused by the occurrence of basic events Undesirable event (UE) The unwanted event such as a loss of containment, etc. Secondary event (SE) Characterizes the source term of an accident, such as ignition Dangerous phenomenon (DP) Physical phenomenon that can cause major accidents, explosion, dispersion, fire Risk barrier Measures taken place to reduce the likelihood of undesirable event and the effects of accidents Logical gates Describe the relationships between eventsTable 2: Description of events used for representing an attack scenario shape Signification Definition

Table 4 :

 4 Qualitative scale to characterize the likelihood of input security events

	Qualitative scale	Security Level	Designation

Table 5 :

 5 Analysis scale -Overall likelihood

	Likelihood levels		Likelihood of safety events
	E	D	C	B	A	N/A

Table 6 :

 6 The identified MCs for the scenario under study

		MCS	Likelihood Level		MCS	Likelihood Level
	1	SBE-1(V1,	(1, N/A)	L	32	BE-6, BE-9	(N/A, D)	L
		A-1.1);
		SBE-2(V-2.1,
		A-2); SBE-4;
		SBE-5;
		SBE-6;
		SBE-7;
		SBE-11;
		SBE-12;
		SBE-13;
		SBE-19

Acknowledgments

This work is based on research supported and funded by the French National Institute for Industrial Environment and Risks (INERIS).

Houssein ABDO holds a master's degree in computer security and risk management. He is currently a PhD student at G-SCOP laboratory, Grenoble Alpes University, France. His research focus is safety, security and uncertainty analysis in industrial risk management of critical facilities.

Mohamad


Montaha Yassine

Laura Fuster

Marie-Hélène Dévier

Emmanuel Geneste

Patrick Pardon

Axelle Grélard

Erick Dufourc

Mohamad Al Iskandarani

Selim Aït-Aïssa

Jeanne Garric

Hélène Budzinski

Patrick Mazellier

Aurélien S Trivella
email: aurelien.trivella@u-bordeaux.fr

Photodegradation of novel oral anticoagulants under sunlight irradiation in aqueous matrices

Keywords: photolysis, solar light irradiation, surface water, apixaban, dabigatran, rivaroxaban

Kinetics of photodegradation of novel oral anticoagulants dabigatran, rivaroxaban, and apixaban were studied under simulated solar light irradiation in purified, mineral, and river waters. Dabigatran and rivaroxaban underwent direct photolysis with polychromatic quantum yields of 2.2x10 -4 and 4.4x10 -2 , respectively. The direct photodegradation of apixaban was not observed after 19 hours of irradiation. Kinetics of degradation of rivaroxaban was not impacted by the nature of the aqueous matrix while photosensitization from nitrate ions was observed for dabigatran and apixaban dissolved in a mineral water. The photosensitized reactions were limited in the tested river water (Isle River, Périgueux, France) certainly due to the hydroxyl radical scavenging effect of the dissolved organic matter. The study of photoproduct structures allowed to identify two compounds for dabigatran. One of them is the 4-aminobenzamidine while the second one is a cyclisation product. In the case of rivaroxaban, as studied by very high field NMR, only one photoproduct was observed i.e. a photoisomer.

Finally, seven photoproducts were clearly identified from the degradation of apixaban under simulated solar light.

Introduction

Until recently, oral anticoagulants were synonyms of vitamin K antagonists (VKAs) such as warfarin. These medicines are used for venous thromboembolism, stroke, atrial fibrillation treatment, and most generally in medicinal conditions that require chronic anticoagulation [START_REF] Hanslik | The use of vitamin K in patients on anticoagulant therapy: a practical guide[END_REF]. VKAs may not be appropriate for many patients especially due to the necessity of dietary precautions and frequent laboratory monitoring [START_REF] El-Helou | Adverse drug events associated with vitamin K antagonists: factors of therapeutic imbalance[END_REF]. In fact, if warfarin concentration is too low the anticoagulation effect does not act efficiently; a too high concentration causes excessive bleeding. In this context, novel oral anticoagulants (NOACs) were developed [START_REF] Spyropoulos | Brave new world: the current and future use of novel anticoagulants[END_REF][START_REF] Beyer-Westendorf | Safety of switching from vitamin K antagonists to dabigatran or rivaroxaban in daily care--results from the Dresden NOAC registry[END_REF]. The U.S.

Food and Drug Administration (F.D.A.) recently approved the use of three new active ingredients, namely dabigatran etexilate (2010), rivaroxaban (2011), and apixaban (2012) [START_REF] Wanat | Novel oral anticoagulants: a review of new agents[END_REF]. Dabigatran etexilate is a prodrug that is converted to dabigatran and acts as a direct thrombin inhibitor [START_REF] Khoo | Insights from the dabigatran versus warfarin in patients with atrial fibrillation (RE-LY) trial[END_REF]. Rivaroxaban and apixaban are direct factor Xa inhibitors that do not require cofactors for activity [START_REF] Gulseth | Rivaroxaban: an oral direct inhibitor of factor Xa[END_REF][START_REF] Frost | Apixaban, an oral, direct factor Xa inhibitor: single dose safety, pharmacokinetics, pharmacodynamics and food effect in healthy subjects[END_REF].

These three compounds are also increasingly used in Europe. In particular, these NOACs currently represent 30% of ingested anticoagulants in France with an increase in their consumption by a factor of 10 between the second trimester 2012 and the third trimester 2013 [START_REF] Ansm | Evolution des ventes des anticoagulants oraux en France de janvier 2008 à septembre 2013[END_REF]. The main limitation for their use was the absence of antidote. In 2015, the F.D.A. approved the idarucizumab as dabigatran antidote while rivaroxaban and apixaban antidote (andexanet alpha) is about to be validated (Pollack et al., 2015;[START_REF] Siegal | Andexanet Alfa for the Reversal of Factor Xa Inhibitor Activity[END_REF]. Thus, their prescriptions are expected to continue to rise in the near future.

To our knowledge, information reported in the literature about the occurrence of NOACs in the aquatic compartment, their fates, and their toxicity, as well as their degradation products are very scarce [START_REF] Kasad | Photolytic-Thermal Degradation Study And Method Development Of Rivaroxaban By RP-HPLC[END_REF][START_REF] Ramisetti | Development and validation of a stability indicating LC-PDA-MS/MS method for separation, identification and characterization of process related and stress degradation products of rivaroxaban[END_REF][START_REF] Secrétan | A comprehensive study of apixaban's degradation pathways under stress conditions using liquid chromatography coupled to multistage mass spectrometry[END_REF]2015;[START_REF] Swain | Liquid Chromatographic Method Development for Forced Degradation Products M A N U S C R I P T A C C E P T E D ACCEPTED MANUSCRIPT 23 of Dabigatran Etexilate: Characterisation and In Silico Toxicity Evaluation[END_REF][START_REF] Tantawy | Stability-indicating spectrophotometric methods for determination of the anticoagulant drug apixaban in the presence of its hydrolytic degradation product[END_REF][START_REF] Wingert | Characterization of three main degradation products from novel oral anticoagulant rivaroxaban under stress conditions by UPLC-Q-TOF-MS/MS[END_REF]. This is especially worring since human

M A N U S C R I P T A C C E P T E D

metabolism studies have shown that NOACs are eliminated in urines as unchanged forms at levels between 27 and 85% of the delivered dose (eVidal, 2017). In fact, organic pollutants are known to undergo degradation processes in environmental waters which must be taken into consideration. Photolysis can be one of the major ways of degradation for pharmaceutical compounds absorbing solar light as well as for those degraded by photosensitization [START_REF] Szabo | Phototransformation of ibuprofen and ketoprofen in aqueous solutions[END_REF][START_REF] Zuo | Determination of estrogenic steroids and microbial and photochemical degradation of 17 α-ethinylestradiol (EE2) in lake surface water, a case study[END_REF][START_REF] Carlson | Direct UV photolysis of selected pharmaceuticals, personal care products and endocrine disruptors in aqueous solution[END_REF]Zhang et al., 2016;[START_REF] Chen | Role of humic substances in the photodegradation of naproxen under simulated sunlight[END_REF].

This study has for objective to bring information on the environmental fate of NOACs. In particular, direct and indirect photolysis of NOACs was studied in different aqueous matrices.

Results on molar absorption coefficients, rate constants and polychromatic quantum yields of photodegradation are discussed. Rate constants were obtained from simulated solar light irradiation in purified, mineral, and river waters to evaluate the effect of ions and dissolved organic matter naturally present in surface waters. Finally, the elucidation of structures of photoproducts was performed using LC-HRMS, and 700 and 800 MHz NMR spectrometers. CAS 211914-51-1, 99%), rivaroxaban (AKSci, CAS 366789-02-8, 98%), and apixaban (APIChem Technology, CAS 503612-47-3, 99%), as well as 4-aminobenzamidine dihydrochloride (≥ 99.0%), methanol (CHROMASOLV®, ≥ 99.9%), and sodium bicarbonate salt (≥ 99.5%) were purchased from Sigma-Aldrich (Saint-Quentin Fallavier, France). Sodium nitrate salt (analytical reagent grade) was provided by Fisher Chemical. All chemicals were used as received. Purified water was produced using a Milli-Q® Direct-Q® 5 system (Millipore, resistivity 18.2 MΩ.cm). Mineral water (Volvic) contains 7.2 and 74.0 mg.L -1 of nitrate and hydrogen carbonate ions, respectively. River water was collected from the Isle River (Périgueux, France). This surface water contained 7.7 and 140-200 mg.L -1 of nitrate and hydrogen carbonate ions, respectively. Before use, the river water was filtered on a 0.45 µm hydrophilic PVDF Durapore® membrane (Millipore). Stock solutions of NOACs were prepared in purified water at concentrations of 5.0x10 -5 , 1.0x10 -5 , and 3.0x10 -6 mol.L -1 for dabigatran, rivaroxaban, and apixaban, respectively. During the preparation, volumetric flasks were covered with aluminum foils and solutions were left under magnetic stirring during one week. Then, stock solutions were stored in amber glass bottles at room temperature until use to prevent photodegradation and solubility problems, respectively. The stability of the three compounds was checked.

UV-Visible spectroscopy.

UV-Visible absorption spectra were recorded on a UV-1800 spectrophotometer (Shimadzu, Japan). A 1-nm resolution and a "medium" scan rate were used to record the reference spectrum and spectra in the range 200-400 nm (NOACs do not absorb visible light) using either 1 or 5 cm quartz cells (QS, Hellma Analytics).

M A N U S C R I P T A C C E P T E D ACCEPTED MANUSCRIPT

6 Molar absorption coefficients of dabigatran and rivaroxaban in purified water were calculated from the absorbance of five solutions with concentrations included in the range 10 -6 -10 -5 mol.L -1 . Due to the particularly low solubility of apixaban in water, a stock solution was prepared in methanol at a concentration of 9.6x10 -6 mol.L -1 . Then, this stock solution was used to prepare five solutions at concentrations between 1.0x10 -6 and 4.8x10 -6 mol.L -1 by adding purified water (i.e. the maximal proportion of methanol was of 50%).

The solar light emission spectrum at the Earth surface was recorded using a USB2000+ radiometer coupled to an optical fiber (Ocean Optics, Florida, USA).

Irradiation experiments.

Solar radiations at the Earth surface were simulated using a SUNTEST CPS apparatus from Atlas Material Testing Solutions (Illinois, USA). The irradiance was set to 250 W.m -². In the case of kinetic studies, purified, mineral, and river waters were spiked with the stock solutions prepared in purified water to obtain final concentrations of 3.5x10 -7 , 3.5x10 -7 , and 4.5x10 -7 mol.L -1 for dabigatran, rivaroxaban, and apixaban, respectively. For the elucidation of photoproduct structures, non-irradiated and irradiated stock solutions were analyzed without pre-treatment.

Before irradiation, samples were placed into 12 mL transparent glass tubes (optical pathlength: 1.5 cm) and were sealed to avoid water evaporation. NOACs were irradiated in purified water alone and doped with nitrate and bicarbonate ions (same concentrations as in mineral water), in mineral water, and in river water. For each aqueous matrix, two tubes were filled with 10 mL of solution and one of them was wrapped in an aluminum foil for dark control. To obtain kinetic data, aliquots of each sample were collected before irradiation and after scheduled irradiation time. For each kinetics, at least five samplings were performed and the analysis was repeated in triplicate. The maximum irradiation time was of 10 hours for dabigatran, 4 hours for rivaroxaban, and 19 hours for apixaban. To calculate the

M A N U S C R I P T A C C E P T E D ACCEPTED MANUSCRIPT 7
polychromatic quantum yields of photodegradation, photon fluence rates were measured with a one nanometer interval in the range 290-350 nm using a USB2000+ radiometer coupled to an optical fiber (Ocean Optics, Florida, USA).

2.4. HPLC and LC-QToF-MS analyses. For kinetics studies, HPLC analyses were carried out using an Agilent 1100 series chromatograph (Agilent Technologies) equipped with a variable wavelength detector [START_REF] Zuo | High-Performance Liquid Chromatography (HPLC): Principles, Procedures and Practices[END_REF]. For dabigatran and rivaroxaban, the column was a Nucleosil® C 18 Nautilus, 250 mm x 4.6 mm, with a particle size of 5 µm (Macherey-Nagel) while for apixaban the column was a Nucleodur® 100-5 C 18 ec, 250 mm x 4.6 mm, with a particle size of 5 µm (Macherey-Nagel). Solvent A was methanol and solvent B purified water. Analyses were carried out in isocratic mode with a ratio of 60:40 (A:B, v/v) for rivaroxaban and apixaban, and a ratio of 30:70 (A:B, v/v) for dabigatran. The UV detection was performed at 303, 248, and 277 nm for dabigatran, rivaroxaban, and apixaban, respectively.

UV absorption spectra of photoproducts were recorded with an HPLC Spectra System P1000 coupled with a diode array detector model UV6000LP (Thermo Separation® Products). For each NOAC, elution conditions described above were used. With the goal to check the elution of all the products formed after irradiation, other analyses were performed in gradient mode.

The gradient elution started with 10% of A and reached 100% in 25 minutes linearly. Then, it was kept stable during 5 minutes. No new photoproducts were observed compared to isocratic mode analyses.

LC-HRMS analyses were carried out using an Agilent 1290 HPLC system coupled to an Agilent 6540 QToF mass spectrometer (Agilent Technologies, Inc., Santa Clara, CA, USA) equipped with an Agilent Jet Stream electrospray ionization source (ESI). The chromatographic separation of the parent compound and of its photoproducts was performed

M A N U S C R I P T A C C E P T E D ACCEPTED MANUSCRIPT 8
on a Kinetex C 18 column (100 x 2.1 mm, 1.7 µm; Phenomenex®, Agilent Technologies, Les Ulis, France ) regulated at 40°C. Gradient LC elution was performed at a flow rate of 0.3 mL.min -1 using 0.1% formic acid in purified water as mobile phase A and 0.1% formic acid in acetonitrile as mobile phase B. The gradient started with 10% of B and was linearly increased to 35% in 13 minutes. The fraction B was then immediately increased and held at 100% for 1 min, before returning to the starting conditions for 3 min. Sample injection volume was set at 5 µL. Non-irradiated and irradiated stock solutions in purified water were analyzed without pre-treatment.

After elution, the analytes were detected using the QToF operating in positive ion mode (ESI+) with the following parameters: capillary voltage, 3000 V; nebulizer pressure, 40 psig;

ln ቀ [] బ [] ቁ = k ௬ ⋅ t eq. (1)
where [C] 0 and [C] t are the organic contaminant concentrations (mol.L -1 ) respectively before irradiation and at the instant t, k poly is the apparent first-order rate constant under polychromatic irradiation (s -1 ), and t is the irradiation time (s).

In this framework, the rate of photolysis of C is given by equation 2:

ݒሺܥሻ = k ௬ ⋅ [C] ௧ = ∑ ܫ ,ఒ ⋅ ሺ1 -݁ ିଶ.ଷଷ⋅ ഊ ሻ ⋅ ߶ ఒ ఒ ఒ భ eq. (2)
where ܫ ,ఒ is the photon fluence rate of the irradiation source (E.L -1 .s -1 ), ܣ ఒ is the absorbance of C and ߶ ఒ is the quantum yield of photolysis of C (mol.E -1 ) at the λ i wavelength. λ 1 -λ n is the overlapping wavelength range between the UV-Vis absorptions of the organic contaminant and the emission spectrum of the radiation source.

In environmental conditions, the absorbance of C is generally low (A < 0.02, hyper dilute medium). Based on this hypothesis, the expression of polychromatic quantum yield of photolysis (߶ ௬ , mol.E -1 ) of C is given by equation 3:

ϕ ௬ = ଶ.ଷଷ⋅⋅ ⋅ ∑ ଵ ఌ ഊ ⋅ூ బ,ഊ ఒ ఒ భ eq. (3)
where ݈ is the sample's optical pathlength (cm) and ߝ ఒ is the molar absorption coefficient (L.mol -1 .cm -1 ) at the λ i wavelength. 2.6. Nuclear magnetic resonance spectroscopy. LC-QToF-MS analyses were not enough to identify the structure of the rivaroxaban photoproduct due to the same fragmentation pattern (see supplementary materials). The main limitation for NMR analyses was the low solubility of rivaroxaban in water and thus the low concentration of its degradation product. In order to concentrate both compounds, a solution of rivaroxaban was prepared in methanol at an initial concentration of 52.9 mg.L -1 and was irradiated with a SUNTEST CPS+ (250 W.m -²) during 8 hours. A volume of 8 mL of this solution was evaporated and the residue dissolved in 500 µL of methanol-d 3 (Eurisotop, France) for NMR experiments. The photochemical reactivity of rivaroxaban was the same in purified water and in methanol. A second sample of pure rivaroxaban (few mg of powder were dissolved in methanol-d 3 ) was prepared. ). In the case of rivaroxaban, the spectrum recorded in the aqueous medium shows a maximum at 248 nm (ε = 23 820 L.mol -1 .cm -1 ). Moreover, a shoulder was observed at 273 nm (ε = 14 930 L.mol -1 .cm -1 ). UV absorptions of apixaban have been studied in a mixture of methanol and water due to the very low solubility of the drug into the aqueous solvent. A maximum of absorption is observed at 278 nm (ε = 14 320 L.mol -1 .cm -1 ). This maximum was found at the same wavelength in pure methanol (9.6x10 -6 mol.L -1 ) and in pure water (3.0x10 -6 mol.L -1 ). The calculated molar absorption coefficient in pure methanol was of 14 700 L.mol - 1 .cm -1 .

Please insert Fig. 1.

The three novel oral anticoagulants (NOACs) absorb photons above 300 nm. Therefore, they absorb the solar light reaching the Earth surface and they can undergo direct photolysis (Fig. 1). The study of this abiotic degradation pathway is of main concern from the environmental point of view. Moreover, the role of ions and dissolved organic matter (DOM) naturally present in surface waters is also discussed further. 1. In each case, NOACs photolysis followed apparent first-order kinetics. From dark control samples no thermal degradation and no hydrolysis were observed at the same time as the irradiation experiments.

Rate constants and quantum

Kinetics of photodegradation of dabigatran was dependent on the nature of the aqueous matrix. The calculated half-life was of 19.9 hours in deionized water and decreased by a factor of 2.7 to reach 7.4 hours in the mineral water. Afterwards, dabigatran was irradiated in purified water spiked with nitrate ions at a concentration of 7.2 mg.L -1 i.e., the same concentration occurring in mineral water. The obtained half-life was of 6.8 hours, which is almost the same value as that obtained in mineral water. In river water (nitrate ions concentration: 7.7 mg.L -1 ), 50% of dabigatran was degraded in 24.1 hours; therefore, in this aqueous medium the degradation induced by light is less efficient by a factor 3.3 compared to the mineral water.

For rivaroxaban, kinetics of photodegradation were not significantly dependent on the nature of the aqueous matrix. In fact, half-lives of 2.3, 2.1, and 2.2 hours were obtained in purified, mineral, and river waters, respectively. Photolysis of rivaroxaban in purified water spiked with nitrate ions led to a half-life of 2.0 hours.

The behavior of apixaban under simulated solar light irradiation is a function of the aqueous medium. In purified water no degradation of the drug was observed after 19 hours of irradiation. At the opposite, in mineral water, a degradation was observed with a calculated half-life of 23.6 hours. This half-life decreased by a factor of 2.3 (10.4 hours) when apixaban was irradiated in purified water in the presence of nitrate ions. When both nitrate and hydrogen carbonate (74.0 mg.L -1 ) ions were present in the medium, the half-life increased to 26.9 hours. In the river water, 50% of degradation would be reached after 96.3 hours, clearly showing a lowering of the photodegradation efficiency.

Please insert Table 1.

M A N U S C R I P T A C C E P T E D ACCEPTED MANUSCRIPT 13

From these results, we can state that among the three NOACs, dabigatran and rivaroxaban are subject to direct photolysis under simulated sunlight irradiation, i.e., degradation occurs in purified water. At the opposite, direct photodegradation of apixaban is not significant. In addition to direct photolysis, photosensitized reactions are clearly observed for dabigatran and apixaban. Ions naturally present in the mineral water can be at the origin of this processes.

The photosensitizing potential of nitrate ions was particularly reviewed by [START_REF] Mack | Photochemistry of nitrite and nitrate in aqueous solution: a rewiev[END_REF]. These ions absorb solar light and then react with water to produce highly reactive hydroxyl radicals [START_REF] Zuo | Simultaneous determination of nitriteand nitrate in dew, rain, snow and lake water samples by ion-pair high-performance liquid chromatography[END_REF][START_REF] Chen | Direct and indirect photodegradation of estriol in the presence of humic acid, nitrate and iron complexes in water solutions[END_REF]. The photodegradation kinetics of dabigatran is accelerated in mineral water and in purified water spiked with nitrate ions. Both aqueous media led to a half-life close to 7.0 hours. We can thus conclude that the ion mainly responsible for the acceleration of dabigatran photodegradation was NO 3 -. In the case of apixaban, circumstances are slightly different. Nitrate ions are also proved to accelerate the drug photolysis but this result is not sufficient to explain the obtained half-life in mineral water. In fact, 50% of degradation would be reached after 23.6 and 10.4 hours in mineral water and deionized water spiked with NO 3 -, respectively. Addition of hydrogen carbonate ions to water spiked with nitrate ions induced an increase of the half-life by a factor of 2.6 (t 1/2 = 26.9 h). Hydrogen carbonate ions are among the most widespread anions in environmental waters and they are known to act as scavengers of hydroxyl radicals [START_REF] Nakatani | Determination of photoformation rates and scavenging rate constants of hydroxyl radicals in natural waters using an automatic light irradiation and injection system[END_REF][START_REF] Espinoza | The effect of nitrate, Fe(III) and bicarbonate on the degradation of bisphenol A by simulated solar UV-irradiation[END_REF]. Therefore, in our case the increase of apixaban half-life is mainly due to the reaction of HCO 3 -ions with hydroxyl radicals produced by nitrate ions under simulated sunlight irradiation. Finally, rivaroxaban photolysis seems not to be significantly impacted by ions present in the mineral water. This result can be explained by the very fast direct phototransformation of rivaroxaban. As a consequence, indirect photochemistry is unable to affect the phototransformation rate significantly.

M A N U S C R I P T A C C E P T E D ACCEPTED MANUSCRIPT 14

In the river water, the concentration of nitrate ions (7.7 mg.L -1 ) is close to that measured in mineral water (7.2 mg.L -1 ). The concentration of hydrogen carbonate ions is included between 200 and 140 mg.L -1 , i.e., at least twice as high as in mineral water. Thus, the HCO 3 -ions scavenging effect is expected to be more efficient in river water than in mineral water. In surface waters, the ions effects are added to those of DOM that can act as photosensitizer, as screen through competitive light absorption, as inhibitor of triplet-sensitized transformation by reducing partially oxidized intermediates to the starting compounds, and as radical scavenger [START_REF] Walse | Role of Dissolved Organic Matter, Nitrate, and Bicarbonate in the Photolysis of Aqueous Fipronil[END_REF][START_REF] Wenk | Effect of Dissolved Organic Matter on the Transformation of Contaminants Induced by Excited Triplet States and the Hydroxyl Radical[END_REF][START_REF] Chen | Direct and indirect photodegradation of estriol in the presence of humic acid, nitrate and iron complexes in water solutions[END_REF][START_REF] Liang | Impact of dissolved organic matter on the photolysis of the ionizable antibiotic norfloxacin[END_REF]Zhang et al., 2016). In the case of dabigatran, the half-life in river water increases by a factor of 3.3 in comparison with the mineral water. This increase cannot be assigned only to the scavenging effect of HCO 3 -ions. In fact, the comparison of results in mineral water and in purified water spiked with NO 3 -ions shows no clear effect of HCO 3 -ions on the rate constants for photolysis of dabigatran (Table 1). In the same way, apixaban half-life increases by a factor of 4.1. Thus, the increase of half-lives of dabigatran and apixaban cannot be explained only by the concentration increase of HCO 3 -ions in the river water but by the effect of DOM.

Results obtained with rivaroxaban help to understand its role. In fact, rivaroxaban phototransformation is apparently not impacted by the presence of DOM. Thus, no significant screen effect is observed from DOM (see SF1 of supplementary materials). This result leads to the conclusion that the observed slowing down of the degradation of dabigatran and apixaban in river water is mainly due to a scavenging of hydroxyl radicals. The effect of DOM is emphasized with apixaban, for which the degradation occurs only by means of photosensitization.

Finally, the efficiency of NOACs direct photolysis was evaluated from polychromatic quantum yields of photodegradation. Values of 2.2x10 -4 and 4.4x10 -2 mol.E -1 were calculated for dabigatran and rivaroxaban, respectively. Dabigatran absorbs sunlight to a higher extent

M A N U S C R I P T A C C E P T E D ACCEPTED MANUSCRIPT
than rivaroxaban (Fig. 1), which partially offset the strong difference in the photolysis quantum yields. In the case of apixaban, no quantum yield for photolysis was determined due to the absence of degradation after 19 hours of simulated sunlight irradiation.

Structures of NOACs photoproducts.

For each NOAC, non-irradiated and irradiated solutions were analyzed by means of LC-QToF-MS. Three products (D1, D2, and D3) were observed for dabigatran and one product (R1) for rivaroxaban, both irradiated in purified water. For apixaban, seven products (A1 to A7) were observed in mineral water. Results are gathered in Table 2.

In the case of dabigatran, among the three photoproducts observed two of them were associated to the drug photodegradation (Fig. 2). These compounds have m/z of 136.0874 (D1, C 7 H 10 N 3 ) and 323.1145 (D2, C 17 H 15 N 4 O 3 ). D1 fragmentation spectrum displays m/z at 119 (-17) associated to the loss of a NH 3 group located on the amidine part, and at 92 (-27) associated to the loss of the C=NH fragment (see SF4 of supplementary materials).

Please insert Table 2.

D1 was identified as the 4-aminobenzamidine (4-AB). This hypothesis was confirmed from LC-UV (Fig. 3a) and LC-QToF (see SF4 of supplementary materials) analyses of the standard. 4-AB is known to act as inhibitor of trypsin, an enzyme involved in the digestion of proteins [START_REF] Safarik | Determination of selected xenobiotics with ferrofluid-modified trypsin[END_REF]. D2 structure is formed from the other moiety of dabigatran for which an intramolecular cyclization and a demethylation occurred (Fig. 2). Only one fragment (m/z = 251) is clearly observed for D2. This fragment is associated to a decarboxylation and a CO elimination. The UV spectrum of D2 is displayed in Fig. 3a.

Please insert Fig. 2.

M A N U S C R I P T A C C E P T E D ACCEPTED MANUSCRIPT

Finally, a last photoproduct (D3) with a m/z of 279.1248 (C 16 H 15 N 4 O) was observed. This compound is not directly formed from dabigatran but from D2. In fact, D2 and D3 have a m/z difference of 44 (CO 2 group) and produce the same fragment at m/z = 251. Therefore, we can assume that D3 is formed from the photo-decarboxylation of D2.

Please insert Fig. 3.

Rivaroxaban degradation induced by simulated solar light irradiation in purified water produces only one main photoproduct with molecular ion at m/z 436.0732 (named R1) in ESI+ mode (Table 2). R1 has the same m/z as rivaroxaban, i.e. a photoisomerization occurred.

The UV absorption spectrum of R1 displays one band at 245 nm while that of rivaroxaban presents a maximum at 248 nm with a shoulder at 273 nm (Fig. 3b). The substituted thiophene moiety is responsible for the maximum of absorption around 245 nm [START_REF] Boig | Ultraviolet Absorption Spectra in the Thiophene Series. Halogen and Nitro Derivatives[END_REF]; this part of the parent compound is unchanged in R1. This result is supported by the presence of a fragment at m/z 145 assigned to the substituted thiophene ring and observed on both spectra of isomers (see SF8 of supplementary materials).

Please insert Fig. 4.

Processes of photoisomerization involving an intramolecular cyclisation as photo-Fries [START_REF] Sandner | Mechanistic Studies of the Photo-Fries Reaction[END_REF]) and Norrish type II reaction [START_REF] Norrish | Photo-decomposition of Aldehydes and Ketones[END_REF] were considered. The two processes lead to structures in which the substituted thiophene ring is unchanged as validated using high field NMR. Indeed, 1 H and 13 C NMR spectra show the same splitting patterns for both compounds (see SF9 and SF10 of supplementary materials). The SOFAST-HMQC 1 H-15 N 2D map undoubtedly shows the presence of a NH group in the R1 structure

M A N U S C R I P T A C C E P T E D ACCEPTED MANUSCRIPT
(Fig. 4a) and the TOCSY sequence clearly exhibits two correlation pathways between NH proton (8.93 and 8.75 for R and R1 structures, respectively) and protons at 3.74 (J3), 4.92 (J4), and 4.24/3.95 (J5) ppm for R, 4.24/3.95 (J5) ppm for R and 3.74/3.84 ppm (J3), 4.96 (J4), and 4.00/4.26 (J5) ppm for R1 (Fig. 4b). On this basis, the proposed structure for R1 is presented in Fig. 5.

Please insert Fig. 5.

The simulated sunlight irradiation of apixaban in mineral water results in the clear observation of seven photoproducts (Table 2). Assuming that LC-MS/MS structure responses are the same for each compound, four degradation products can be considered as major (A3, A5, A6, and A7). Their structures are presented in Fig. 6. Structures of minor photoproducts have also been determined (A1, A2, and A4; see SS2, SS3, and SS5 of supplementary materials). Results in river water show that dissolved organic matter slows down the degradation of dabigatran probably related to its action as a scavenger of hydroxyl radicals. Two photoproducts are formed, i.e. the 4-aminobenzamidine and a cyclization product. Apixaban is degraded only by photosensitization which is induced by nitrate ions. At the opposite, hydrogen carbonate ions partially block the degradation of apixaban. This effect is also observed in the presence of dissolved organic matter. Seven photoproducts were clearly identified under simulated solar light irradiation of apixaban.

Please insert

Following these results, it will be important to evaluate the ecotoxicological impact of NOACs photoproducts. Compounds of potential concern are especially the isomer of rivaroxaban and the 4-aminobenzamidine, which is a known inhibitor of trypsin and could be at the origin of toxic effects.

Highlights

Dabigatran undergoes direct and indirect photolysis, t 1/2 is of 24h in river water. Direct photolysis is predominant for rivaroxaban, t 1/2 is of 2.2h in river water. Argatroban is mainly photodegraded by photosensitization. Structures of main photoproducts have been identified.

  The novel oral anticoagulants (NOACs) dabigatran (APIChem Technology,

  drying gas, 8 L/min; gas temperature, 300 °C; sheath gas flow, 11 L/min; sheath gas temperature, 400 C; nozzle voltage, 0 V; fragmentor voltage, 190 V. LC-MS accurate mass spectra were recorded across the range m/z 70 -1000 at 2 GHz. The data recorded were processed with MassHunter Qualitative software (version B.06.00, Agilent Technologies, Santa Clara, CA, USA). Accurate mass measurements of each peak from the extracted ion chromatograms were obtained by means of a calibrant solution delivered by an external quaternary pump, allowing system to continuously correct for any mass drift by using the reference mass ion HP-921 [hexakis-(1H,1H,3H-tetrafluoropropoxy)-phosphazine] at m/z 922.0098. Stability of mass accuracy was checked before, and if values went above 0.2 ppm error, then the instrument was recalibrated. The instrument was operated in single MS with full spectra (1 spectrum/s) and in MS/MS (2 spectra/s) using an isolation width set at medium (m/z ∼ 4), and collision energies of 10, 20, and 40 eV. A standard solution containing 36 compounds was injected before the samples to check the retention time of compounds and the instrumental sensitivity.

  photon, an organic contaminant (C) can be degraded and one or several photoproducts (P) are

  1D and 2D NMR spectra of non-irradiated and irradiated rivaroxaban were recorded at room temperature on Bruker Avance III HD SB 700 MHz and 800 MHz spectrometers. The 700 MHz spectrometer was equipped with a 5 mm 1H-13C/15N/D TXI probe with Z-gradients operating at 176.07 MHz and 700.15 MHz for 13 C and 1 H, respectively. The 800 MHz spectrometer was equipped with a 5 mm 1H-13C/15N/D TCI cryoprobe with Z-gradients operating at 81,08 MHz, 201.21 MHz and 800.23 MHz for 15 N, 13 C and 1 H, respectively. In order to assign the 2 structures, the following experiments were performed: 1D-1 H and 1D-13 C experiments and, HSQC 1 H-13 C, HMBC 1 H-13 C, COSY, TOCSY, NOESY, and SOFAST-HMQC 1 H-15 N, two-dimensional experiments. Data treatment was accomplished using the TopSpin Bruker software. absorption spectra. UV absorption spectra of dabigatran, rivaroxaban, and apixaban, are presented in Fig.1. Dabigatran dissolved in deionized water displays two maxima located at 302 nm (ε 302 = 24 180 L.mol -1 .cm -1 ) and 220 nm (ε 220 = 40 940 L.mol -1 .cm - 1

  yields of photolysis. Dabigatran, rivaroxaban, and apixaban were irradiated under simulated solar light in unspiked and spiked purified water with nitrate (NO 3 -) and hydrogen carbonate (HCO 3 -) ions, in mineral and in river waters.Calculated rate constants, coefficients of determination, half-lives (t 1/2 ), and polychromatic photolysis are compiled in Table

  show that photolysis can be one of the main ways of degradation for NOACs present in surface waters. Rivaroxaban degradation is not significantly impacted by the nature of the aqueous matrix. This compound seems only to undergo direct photolysis leading to a photoisomerization. The structure of the photoisomer has been clearly identified from NMR spectra. Dabigatran is photolyzed by direct and indirect routes. Nitrate ions are mainly responsible for the acceleration of dabigatran degradation.

Fig. 1 .

 1 Figures

Fig. 2 .Fig. 3 .

 23 Fig. 2. Photodegradation of dabigatran under simulated solar light irradiation in purified

Fig. 4 .Fig. 5 .Fig. 6 .

 456 Fig. 4. Selected expansions of 2D NMR spectra of rivaroxaban (R) and of its photoisomer (R1) in MeOH-d 3 : (a) SOFAST-HMQC 1 H-15 N and (b) TOCSY NMR spectra.

Table 2

 2 LC-MS/MS (ESI+) analyses of NOACs and of their photoproducts. RT: retention time.

	NOAC	Name	m/z	Proposed chemical	∆(m/z)	Fragments
			(RT in min)	formula	(ppm)	(relative intensity in %)
	Dabigatran	D	472.2116 (2.2)	C 25 H 26 N 7 O 3	-4.02	-
		D1	136.0874 (1.0)	C 7 H 10 N 3	0.73	119 (100), 92 (17)
		D2	323.1145 (2.3)	C 17 H 15 N 4 O 3	-0.31	251 (100)
		D3	279.1248 (3.2)	C 16 H 15 N 4 O	-0.72	251 (100)
	Rivaroxaban	R	436.0739 (11.3)	C 19 H 19 ClN 3 O 5 S	-1.15	-
		R1	436.0732 (8.2)	C 19 H 19 ClN 3 O 5 S	0.46	436 (73), 231 (63), 145 (100)
	Apixaban	A	460.2012 (11.7)	C 25 H 26 N 5 O 4	-5.87	-
		A1	191.1186 (1.5)	C 11 H 15 N 2 O	-1.05	191 (100), 147 (16), 107 (13)
		A2	287.1146 (5.3)	C 14 H 15 N 4 O 3	-0.70	270 (100), 242 (9)
		A3	354.1581 (5.5)	C 18 H 20 N 5 O 3	-4.24	337 (100)
		A4	476.1939 (8.0)	C 25 H 26 N 5 O 5	-1.05	459 (100), 241 (13), 199 (74)
		A5	476.1939 (8.5)	C 25 H 26 N 5 O 5	-1.05	459 (100), 361 (11), 241 (18),
						200 (13), 199 (70)
		A6	446.1818 (8.8)	C 24 H 24 N 5 O 4	2.24	430 (23), 429 (83), 282 (13),
						227 (15), 186 (13), 185 (100),
						171 (12), 93 (11)
		A7	458.1820 (12.3)	C 25 H 24 N 5 O 4	1.75	458 (42), 441 (100), 385 (64),
						342 (10), 277 (15), 199 (36)

2 National Council of Scientific Research (NCSR), Lebanese Atomic Energy Commission (LAEC), Laboratory of Analysis of Organic Pollutants (LAOP), B. P. 11-8281, Riad El Solh -1107 2260 -Beirut, Lebanon 3 Institute of Chemistry and Biology of Membranes and Nano-objects, CBMN UMR 5248, CNRS University of Bordeaux, Bordeaux National Institute of Technology, Allée Geoffroy St Hilaire, Pessac, France 4 INERIS, Unité d'écotoxicologie in vitro et in vivo (ECOT), Verneuil-en-Halatte, France

ACKNOWLEDGEMENTS

This work was supported by the French national program EC2CO-Ecodyn (PATNACOT).

Financial support from the TGIR-RMN-THC Fr3050 CNRS for conducting the research is gratefully acknowledged. The authors also would to thank the multidisciplinary Seine Aval scientific program (CRAPPSE project), sponsored by the GIP Seine-Aval (http://seineaval.crihan.fr/web/). This study has been carried out in the frame of the Investments for the

 Table 1Apparent first-order rate constants (k, min -1 ), coefficients of determination (R²), half-lives (t 1/2 , h), and polychromatic quantum yields of photolysis (φ, mol.E -1 ) obtained from Suntest irradiation of NOACs in aqueous matrices. ND: not degraded. Error bar on first-order rate constants: ±10%.