Marsot, J N De Galvez

EZID: A new approach to hazard identification during the design process by analysing energy transfers

Introduction

In 2014, out of the 621 111 work accidents declared in France, about 5% were related to machines [START_REF]CNAMTS -Direction des risques professionnels, Tableaux de synthèse des statistiques nationales de la sinistralité 2014 de la branche AT-MP du régime général[END_REF]. Regarding these accidents in particular and occupational health and safety in general, design is a source of prevention whose advantages no longer need demonstrating [START_REF] Main | Safer by design: Reducing hazards through better designs[END_REF]. This approach is called "integrated prevention" and is schematized in figure 1. It is codified by European directive 2006/42/EC, known as the "Machinery directive" [3], and in the associated standards. The prevention strategy recommended in these texts focuses on the a priori evaluation of risks; it gives the machine designer the objective of obtaining the lowest possible risk level according to the state of the art. Figure 1. Simplified description of the integrated prevention process However, except for some items of catalogue machinery for which specific standards exist (known as type "C") and that incorporate this risk assessment, the designers of special machines and the integrators of specific equipment in production lines are limited to relying on transversal standards (types "A" and "B"), especially standard NF EN ISO 12100 [START_REF]NF EN ISO 12100 -Safety of machinery, General principles for design[END_REF] relating to general design principles.

It is also important to recall that in France "special machinery" (i.e. machine designed specifically to answer the needs of a client) is mostly designed and manufactured by small or medium sized enterprises [START_REF]Caractéristiques comptables, financières et d'emploi des unités légales en 2013[END_REF]. The designers belonging to these SMEs (project managers, engineers and technicians of engineering offices) are not specialised in "prevention" and have no formal resources or tools adapted for performing a priori risk assessments. Therefore, on the one hand they are limited to the risk families closest to their field of experience (for example, mechanical), while on the other hand, they carry out this assessment more often at the end of the project, once all the technical solutions have been defined. Furthermore, the data required for risk assessments (severity of harm, frequency and/or exposure, probability of occurrence, possibility of avoidance) are not directly linked to the design data, thereby widening the gap between design and safety. Occupational health and safety requirements are thus treated as constraints of adaptation and correction rather than as design requirements [START_REF] Fadier | Safety design: Towards a new philosophy[END_REF].

To solve this issue, a method called EZID (Energy analysis for systematic haZard Identification during Design) is proposed in this article to assist the designers of special manufacturing machinery to identify hazards in order to help them perform risk analysis early in the design process. This approach is intended to define the link between design parameters with those used in risk assessment methods: severity of harm and probability of its occurrence [START_REF]NF EN ISO 12100 -Safety of machinery, General principles for design[END_REF].

To be considered efficient, this method must have the following four characteristics. It must be:

 generic to allow its use independently of the different types of risk, the different design approaches followed and the sectors of activity of the enterprises concerned;  inductive, by being based on design parameters (causes) to ascertain hazards (effects);  dynamic and traceable, in order to observe and analyse the evolution of the system's characteristics and the configuration of its components during the different design stages;  integrated and/or compatible with current design tools and methods to ensure interoperability. It must also be monitored and instrumented with indicators of potential risks in order to quantify and use the data.

The first section provides a literature review of the design and integrated prevention processes. The hypothesis underlying EZID is then presented, followed by the presentation of the model used to ensure its practical implementation. Next, a theoretical presentation of the different steps and elements of EZID is given followed by its application to a real industrial case and the results obtained. The article concludes with a discussion on the current status of EZID and its perspectives.

2. Literature review 2.1. On the design process

The multiplicity of domains (industrial machines, tools, consumer products, building etc.) and objectives (cost, schedule, quality, performance, safety, etc.), has led to the development of many design methods. However, they share several similarities [START_REF] Boujut | Intermediary objects as a means to foster co-operation in engineering design[END_REF]: they all proceed by dividing the design process into phases. They use similar methods and design tools that generate intermediate design objects. These objects allow the designer to represent the system from the earliest stages of the design process and they serve as milestones for design activities and guarantee the maturity of design parameters [START_REF] Boujut | Intermediary objects as a means to foster co-operation in engineering design[END_REF][START_REF] Godot | Methodology to develop a geometric modeling process according to collaborative constraints[END_REF][START_REF] Scaravetti | Structuring of embodiment design problem based on the product lifecycle[END_REF]. Their processing allows making decisions regarding the following phases in the development of a product. X. Godot [START_REF] Godot | Methodology to develop a geometric modeling process according to collaborative constraints[END_REF] also established that the activity within each design phase could be summarised by the five following generic tasks: creation, dimensioning, representation, optimisation /evaluation and validation Therefore, proposing an approach that can be used by all machine designers requires that the intermediary objects [START_REF] Boujut | Intermediary objects as a means to foster co-operation in engineering design[END_REF] and design parameters are based on generic design tasks (cf. Fig. 2).

Figure 2. The position of EZID approach in the generic tasks of the design process

On integrated prevention

There is a wide range of works related to integrated prevention in the literature. Among them, it is possible to find studies about risk assessment during the design of nuclear plants [START_REF] Schroer | An event classification schema for evaluating site risk in a multi-unit nuclear power plant probabilistic risk assessment[END_REF], comparison between integrated prevention and add-on safety in offshore platforms [START_REF] Kjellén | Safety in the design of offshore platforms: Integrated safety versus safety as an add-on characteristic[END_REF] or proposition of inherently safer design concept for process plants development [START_REF] Rusli | Evaluating hazard conflicts using inherently safer design concept[END_REF]. Research works dealing with the integration of risk prevention in machinery design mainly focus on three areas: its links with the design process, risk assessment and risk reduction. All these works present limits regarding the objective of helping designers identify hazards.

Based on a state of the art realized by Sadeghi et al. [START_REF] Sadeghi | Design for Human Safety in Manufacturing System: A Review of Applications of Design Theories and Methodologies (DTM) and Design Tools and Techniques (DTT)[END_REF], works related to links with the design process mostly propose methods, tools and technics which rely on participatory project reviews [START_REF] Fadier | Safety design: Towards a new philosophy[END_REF][START_REF] Hale | Safety rules: procedural freedom or action constraint?[END_REF][START_REF] Rausand | Product safety -Principles and practices in a life cycle perspective[END_REF]. In this case hazard identification is based on cooperation between the different actors during these project reviews. For example, the work of Jouffroy et al. [START_REF] Jouffroy | An approach to integrate safety at the design stage of numerically controlled woodworking machines[END_REF] presented the application of the distributed design theory for safety design to a machine tool in the context of concurrent engineering. Several actors with several points of views (functional, manufacturing, structural, user, human and safety) were involved in the experiment and they communicated using written messages (around 150 were exchanged in order to follow the entire design process). The final solution was directly based on the competencies of the actors who used natural language. No structured language or formal process was applied in this machine tool design process.

Therefore this type of approach does not guide the designer in decision-making when they work autonomously [START_REF] Hale | Safe by design: where are we now?[END_REF]. Furthermore, as these project reviews needs numerical mock-ups or physical prototypes, hazard identification can only be initiated belatedly [START_REF] Kjellén | Safety in the design of offshore platforms: Integrated safety versus safety as an add-on characteristic[END_REF].

Studies on the risk reduction process mostly propose methods or tools that manage [START_REF] Janssens | A decision model to allocate protective safety barriers and mitigate domino effects[END_REF], analyse [START_REF] Vijayan | Degradation of fluorescent high-visibility colors used in safety garments for the Australian railway industry[END_REF] or assess [START_REF] Cocca | Video surveillance systems to enhance occupational safety: A case study[END_REF] preventive measures. These articles help designers to compare and choose the safety measures to be integrated in their design. However, since they are linked to the risk reduction process that occurs after the risk evaluation, they are not related to hazard identification.

Works on risk assessment are mainly focused on estimation and evaluation steps, i.e. the determination of an index used to classify potential risks. The methods proposed differ by the number of parameters used to define severity and exposure, the number of levels used to evaluate these parameters, and how they are combined: matrix, graph, numerical equation, abacus, and chart [START_REF] Lamy | -09 Estimation des risques machines -Recensement des méthodes et subjectivités des paramètres de l'estimation[END_REF]. Moreover, these methods are mainly specific to one type of hazard, for example mechanical [START_REF] Hu | An adaptive online safety assessment method for mechanical system with pre-warning function[END_REF] or ergonomic [START_REF] Lyon | Improving Ergo IQ: A Practical Risk Assessment Model[END_REF]. Consequently, they do not provide an answer to the issue presented here, which concerns the first step of the risk assessment process, i.e. the identification of all types of hazard.

Analysis of the literature leads to the identification of 4 approaches which, a priori, provide an answer to our problem and satisfy the criteria expected (generic, inductive, dynamic and integrated):

-The Factor of Risk (FRis) proposed by Coulibaly et al. [START_REF] Coulibaly | Maintainability and safety indicators at design stage for mechanical products[END_REF] indicates whether a risk is present or not in a machine. This factor combines three Boolean parameters: Ph represents the existence of a hazard, Zo the existence of a hazardous area, and HIn the intervention of a worker in the hazardous area. However, this paper does not give solutions for the identification of these parameters, in particular Ph, i.e. whether or not a hazard exists in the machinery; -Performance Analysis Agent (PAG) [START_REF] Shahrokhi | A framework to develop an analysis agent for evaluating human performance in manufacturing systems[END_REF] is a multi-agent system that represents a worker and their environment through agents linked to modelling (morphological, biomechanical, kinematic, physiological and psychological) and analysis (human factor, risks, economic and industrial performance) integrated in a numerical mannequin. The input parameters of PAG are directly linked to design, but as this is based on CAD tools and numerical mock-ups, it cannot be used at the beginning of the design process.; -IRAD (Innovative Risk Assessment Design) [START_REF] Ghemraoui | Design method for systematic safety integration[END_REF] is a method for simultaneously developing technical and safety functions. By completing the requirement specifications with safety functions, it allows the designer to take technical and safety aspects into consideration at the same time. Then, the designer uses it throughout the design process to verify that each safety function is treated. This method focuses more on the risk reduction phases and does not give solutions for hazard identification. -The work situation model MOSTRA [START_REF] Hasan | Integrating safety into the design process: elements and concepts relative to the working situation[END_REF] (in french: MOdèle de Situation de TRAvail) facilitates the simultaneous consideration of multi-viewpoint data based on the concept of risk. Although it defines every link between the concepts that construct a work situation, this model does not provide direct links between design parameters and risk evaluation parameters. As in the previous approach, MOSTRA does not give solutions for hazard identification.

Consequently, we conclude that none of these works completely answers the problem exposed in section I. However, certain of them agree on the fact that hazardous phenomena are linked to energy [START_REF] Ghemraoui | Design method for systematic safety integration[END_REF][START_REF] Haddon | Energy damage and the 10 countermeasures strategies[END_REF][START_REF] Kjellén | Prevention of accidents through experience feedback[END_REF].

The severity of harm is clearly linked to the severity of injuries or damage to health, and to the extent of harm. These parameters are directly related to the level of energy exchanged during the interactions between the machinery and the operator. Thus it is possible to connect the design parameters characterizing these energies to those used for hazard evaluation, in particular the "severity of harm" parameter (cf. Fig. 3). On the contrary, the probability of occurrence is linked only to the organization within which the machine takes part. Thus hazard identification can be reduced to the identification of energy sources and flows. This can be done throughout the design process since designers progressively characterize these sources and flows during it. The designer can then be informed at the earliest phase of design and thus provide appropriate prevention measures. Once all the energies of the machine have been defined, it is possible to identify all the types of hazard linked to it.

We therefore expanded our bibliographic research to the models used during design for analysing energy sources and flows during product design. Different models can be used for this type of representation [START_REF] Paynter | Analysis and Design of Engineering Systems[END_REF][START_REF] David | Structured Analysis and Design Technique[END_REF][START_REF] Horrein | Représentation-Simulation de Générateurs Thermoélectrique au travers de la Représentation Energétique Macroscopique[END_REF][START_REF] Mario | Der Einsatz von Sankey-Diagrammen im Stoffstrommanagement[END_REF][START_REF] Sysml™ | SysML v1.4 Specification[END_REF]. We chose to use the Functional-Structural Model (FSMo) [START_REF] Constant | Contribution à la spécification d'un modèle fonctionnel de produits pour la conception intégrée de systèmes mécaniques[END_REF][START_REF] Roucoules | Une approche au juste nécessaire de l'intégration métier, en conception vers des solutions alternatives innovantes[END_REF]. Initially developed to analyse the different kinds of energy flows in an existing complex system, this model has been completed to follow the design process of a mechatronic product from its initial structure. It also takes into account energy dissipations and the worker, and has already been the subject of computerisation. This model is based on four elements (cf. Fig. 4):

 frontiers that delimit a manufacturing system, a subsystem or a component in relation to its external environment;  functional surfaces that designate the interfaces through which a production system, subsystem or component exchanges energy with its environment. They are crossed by one energy flow and are characterized by energy parameters (effort, current, power, temperature, speed, etc.) and other design parameters (dimensions, shape, type of material, roughness, etc.);  links that associate two functional surfaces that do not belong to the same component. They therefore characterize the interfaces that can be separated into three types: conductive (C), semi-conductive (SC) or insulating (I);  internal links that associate two functional surfaces belonging to the same component. They can also be conductive, semi conductive or insulating. As FSMo also allows modelling the worker with the same elements, it provides a global and uniform view of the different energy flows within a man/machine system.

Based on this model, we proposed a method for identifying hazards throughout the design process: we have given it the acronym EZID for "Energy analysis for systematic haZard Identification during Design".

3. The EZID method 3.1. Description

As mentioned in section 1, the aim of this work is to help the designer to identify the hazards defined in the NF EN ISO 12100 standard [START_REF]NF EN ISO 12100 -Safety of machinery, General principles for design[END_REF], namely mechanical, electrical, thermal, vibration, noise, radiation, material/substance and ergonomic (limited to physical load in this article). There are also hazards associated with the environment in which the machine is used and the combination of hazard groups, though these are based on the previous eight groups.

The different elements that compose the method are presented (model, data and processes) for the designer that will use it. The method is based on FSMo to which we added reference data and processes to identify hazards (cf. Fig. 5). Note that the sole objective of this method is to identify potential hazards without covering the risk estimation/evaluation steps of the risk analysis that are already covered by numerous methods, as indicated above. In the FSMo, functional surfaces are crossed by one energy flow and designate the interfaces through which a component has links to the other system elements, including the workers. Then, the identification of relevant hazards (identified as being present at, or associated with, the machine) linked to these energy flows becomes systematic by identifying all the functional surfaces.

These energies can be parts of the machine (e.g., electric motor, pneumatic cylinder, heating resistor), or generated by the worker (manual tasks) or also due to potential energies (e.g., gravity). These energies could also be wanted (specified by the designer) or unwanted (e.g., thermal energy related to friction, noise or vibrations generated by the movement of mechanical parts, mechanical energy (impact) linked to an unwanted movement of the operator) and occur during every step of the machine lifecycle. Consequently, two functional surfaces can be systematically defined for each component. The first one is linked to the potential energy due its mass: a mechanical hazard due to loss of stability (falling or tilting). The second corresponds to the energy necessarily provided by the operator to handle this component during the assembly or dismantling phase or also due to unintended contact and the risk of injury from sharp edges, for example.

To be used from the earliest design steps, it is necessary to explain how the FSMo should be modelled. At the beginning of the design process, the only available intermediate object is the client needs defined in the specifications document. In it, the client details at least the machine interactors (ex.: raw materials, trash, workers, energy sources, etc.), their exchanges (ex.: actions, energy flows, data exchange, etc.), and also some limitations for the machine characteristics (ex.: volume, mass, dimensions, etc.). Based on these data, the FSMo can represent the machine as a whole with a unique frontier since no information detail its components. In addition of this machine frontier, it is possible to represent all the interactors with separated frontiers and their exchanges with the machine and the other interactors. Based on the other intermediate objects (ex.: structural and kinematic architectures, CAD models, etc.) generated during the following steps of the design process, the user of EZID will be able to detail the component of the machine, if needed until its elementary parts. In consequence, the FSMo will evolve to details the previous machine frontier into multiples ones that will represent each component/part of the machine with their functional surfaces.

Then, after the functional surfaces of the FSMo have been identified, their parameters are analysed by other steps of EZID using reference parameters and different levels of processing in order to specify:

-the types of hazard (mechanical, electrical, chemical, ergonomic, etc.); -the nature of damage: for example, crushing, cutting, severing, dragging for mechanical hazards; -the hazards which may be considered significant (a hazard identified as relevant and which requires specific action by the designer to eliminate or reduce the risk according to the risk assessment), that is to say those which are sure to require specific actions from the designer.

To perform an exhaustive hazard identification, it is necessary to build an FSMo of the machine for each energy architecture representing the different working situations and/or lifecycle steps.

Step 2: Hazard type identification

This first level of processing allows associating the energy parameters of a functional surface to a type of hazard. This association is supported by the generalized variables of the Bond Graph model [START_REF] Roucoules | Une approche au juste nécessaire de l'intégration métier, en conception vers des solutions alternatives innovantes[END_REF].

By using the concept of generalized variables, it is possible to split energy parameters into two categories: generalized effort (ge) and generalized currents (gc). They design the energy source and the energy flow, respectively. By extension, generalized power (gp) can be defined through the following relation: gp=f(ge, gc). Table 1 contains the variables provided in the Bond graph theory. For some hazard types, the relationship with these generalized variables is obvious (e.g., mechanical energy/ mechanical hazard, electrical energy/electrical hazard).

For others, the generalized variables found in the literature are not those usually used by designers. For example, this is the case for chemical energy for which the generalized variables defined in the literature are chemical potential (ge) and molar flow (gc). These parameters are not usually used by or accessible to designers. In other cases we did not find generalized variables in the literature. For example, this was the case for vibratory, electromagnetic, ionizing, biochemical and biomechanical energies.

To overcome these difficulties, we decided to complete these generalized variables with parameters used to assess the severity of the corresponding hazard (for example, we distinguish the biomechanical energy provided voluntarily by the worker to the machine from the mechanical energy by using the generalised variables effort and speed, in order to identify ergonomic hazards). These extended generalized parameters are summarised in table 2. For some risks, hazard identification is based on the detection of technical solutions. For example, standard ISO 11688 [START_REF]Standard, NF S[END_REF] identifies pressure pulses, turbulences, impacts, etc. as noise hazard sources. It is therefore necessary to include this kind of element in the reference data. Also, during the design process, a designer can also specify energy source solutions without specifying the associated parameters: for example, an electrical motor is linked to a mechanical energy and to an electrical energy. Table 3 contains examples of technological solutions that provide energies and their corresponding hazards. To conclude this step, by analysing the FSMo, the designer can identify all the relevant hazards present in the machine they designed, by identifying the functional surfaces and comparing the energy parameters (or technical solutions) with the reference data.

However, this identification of relevant hazards is not enough. Indeed, the designer needs to know about the significant hazards, that is to say, the hazards they must prevent. This additional identification requires clarifying the nature of the risk in order to check whether or not it comprises legal threshold values. If there are none, then the relevant hazard may indeed be qualified as significant. If there is one, it must be compared to the parameters characterizing the functional surface (or a combination of them) to determine this classification. This is presented in the following section.

Step 3: Identification of damage and significant hazards

It is first necessary to identify the damage linked to a hazard. Damage describes the consequences of a hazard for the worker. Of course, a type of hazard can injure a worker in different ways. For example, for the same mechanical energy, an element can lead to a risk of shock or cutting, depending on its shape (blunt or sharp edge).

To identify this damage, this process uses the energy parameters simultaneously with the other design parameters defined and which characterize functional surfaces. These other design parameters are called complementary parameters later in this paper.

We identified three main families of complementary parameters:

 Position parameters: they localize elements in the machine and include the position of the static elements, their accessibility and the trajectory of dynamic elements;  Geometric parameters: they describe dimensions, shapes, surface states, etc.;  Intrinsic parameters: they represent the specific characteristics of the elements such as their material properties and the features of the technological solutions.

By using the root-cause analysis [START_REF] Wilson | Root Cause Analysis: A Tool for Total Quality Management[END_REF] for each type of damage related to a given hazard, it is possible to define the complementary parameters of the corresponding energy parameters. The results are trees which defined logical rules of association that allowed the user of EZID to identify damages directly from the existence of selected design parameters (cf. Fig. 6). At present, the combinations suggested use only generic design parameters and "AND" and "OR" logical gates. This way, they can be used on any kind of machinery, confirming the generic aspect of the approach.

Thus, when a functional surface is created and its energy type is defined, the designer must check a list of the complementary parameters linked to this type of energy to identify the damage. As the project progresses, these complementary parameters may or may not be filled-in by the designer. As soon as a combination of these parameters is detected, the information of the potential damage is given to the designer. They can then choose or adapt a preventive solution for the specific damage.

Figure 6. Examples of logical rules (trees) to create drawing-in damage After this step, it is mandatory to check whether or not legal threshold values exist for the hazards or damage identified.

Some hazards or damage have threshold values to distinguish harmful energies from harmless ones. These values exist in the directives or safety standards and are recorded in the reference data of EZID (e.g., maximum handling weight is defined in [START_REF]Standard, NF X35-106, NF EN 1005[END_REF], contact temperature in [START_REF] Standard | NF X[END_REF], etc.)

If the energy parameter value of a functional surface exceeds the threshold value, the hazard is considered significant. This is also the case if no threshold value exists. Then the designer must eliminate or reduce this hazard by modifying their project, as described in the next section.

If the energy parameter value is below the threshold, the hazard is confirmed as relevant. No specific action from the designer is required.

In the case where there is not enough data to perform this classification, the hazard is considered as "relevantunknown". Therefore, it is relevant but it can become significant depending on future design decisions.

The end of the EZID method occurs when feedback is supplied to the designer on the number and the source of hazards (functional surfaces), their types, their damage and which of them must be considered as significant. Therefore, the designer is alerted of the presence of these hazards as far upstream in the process as possible and throughout the remaining steps. Then they must estimate and evaluate the risks by using the different methods found in the literature. Finally, they must choose preventive measures according to the risk evaluation.

The designer's actions

According to the risk reduction process, the designer has two different possibilities: eliminate or reduce the risk by implementing inherently safe design measures or using guards or protective devices.

In the first case, this translates in the FSMo by the removal of the functional surface (corresponding to the hazard eliminated) or by the modification of the level of energy under the threshold level.

In the second case, the designer can specify "insulating links" to eliminate the transfer of energy between the targeted functional surface and the worker. If these "insulated links" are "energized" (mobile guards or laser system for example), the designer must integrate them in the FSMo in order to verify that they do not introduce new significant hazards.

When the operator is a source of energy (manual task), we create a new type of link that we call "adapted conductive link" (cf. Fig. 7). Of course, in order to prevent hazards generated by neglecting ergonomic principles, it is necessary to adapt the level of effort required for the operator according to human performance standards [START_REF]Standard, NF EN 1005 -Safety of machinery -Human physical performance[END_REF]. By conducting all these steps in a systematic process, the designer can identify every hazard in the machine selected at any moment of the design process. By using EZID, they can receive information on the kind of hazard, whether significant or not, Figure 7.

Transformation of a conductive link into an adapted conductive link

To verify its usability, EZID was applied to an industrial case. The next section presents the details of the experiment and the results obtained.

Industrial experiment 4.1. Industrial case

In order to check the relevance of EZID, it was applied a posteriori to the design project of an industrial supply line (cf. Fig. 8). This work was carried out by a design office dedicated to manufacturing machine design (Lormac Automation). The aim of this equipment to be incorporated in a production line is to transfer and control products. The operators have to place the product on the conveyor belt. The machine is composed of conveyors, actuators, a robotic arm and a vision system (camera + controlled light) for product control. We obtained from the designer all the intermediary objects generated or used during this project (requirement specifications, 3D CAD models, monitoring reports, subsystem datasheets). In order to apply EZID under the same conditions as if it had been applied during the design of the system, the first task consisted in positioning them chronologically in the conceptual, architectural and detailed design phases. Then the EZID method was applied manually by using the design data available at each moment. It was necessary to select the lifecycle step and the working situation since they directly influenced the energy architecture.

For the sake of readability, all FSMo are represented in a simplified way. The letter in the main functional surfaces indicates the kind of energy (B: biomechanical energy, M: mechanical energy, P: potential energy of gravity, E: electrical energy, R: radiative energy). Also, two empty functional surfaces appear on every frontier (except for the worker) to represent the mechanical energies linked to their shapes (Ms) and masses (Mm), as explained in section 3.1.1.

EZID application during the conceptual design stage 4.2.1. Functional Structural modelling

The documents attributed to this phase specified the functional requirements from the customer in particular, the products concerned by the supply line and the main input energy capabilities (230-400 V / 50-60 Hz). The general operating principles were also described.

The products are packaged in two ways: loose in bags or boxes and organized in boxes. When the parts are loose, the bags or boxes must be opened manually by the operator and the parts placed loose on a conveyor. For the organized boxed products, the operator simply needs to manually open the box and put it on the conveyor. The non-conforming parts and the empty boxes are automatically directed towards the operator to be removed manually.

For the FSMo, the supply line is considered as a whole in interaction with the external elements: products, electric source, and the worker (cf. Fig. 9).

Figure 9. FSMo of the supply line for the conceptual design stage (for the usage lifecycle step)

Hazard type identification

Hazards are identified by the nature of the energies of the functional surfaces present in the FSMo. Although the parts and boxes do not physically belong to the machine and the designer does not design them, they are included in the machinery operation process. Therefore, all their functional surfaces must be analysed according to the EZID method.

There are 124 functional surfaces in this FSMo and thus 124 potential relevant hazards. The hazards identified are mainly related to the mechanical energy linked to the parts' shapes, their mass and their interactions with the machinery and/or the worker. Moreover, since it is specified that the main energy source of the system is electrical and that the supply of the parts is manual, electric source of the machine and the worker's actions also appear in the FSMo. Consequently, it is possible at this design stage, only with the data contained in the specifications document, to identify mechanical, electric and ergonomic hazards (cf. table 4).

Identification of damage and significant hazards

Since there are mechanical hazards, it is possible to identify some of the damage they generate.

Only the parts and packages are well-known at this point and they all have blunt geometries. Therefore, using a logic tree similar to that illustrated in figure 5, only impacts and crushing damage are possible due to the unwanted energy provided by the worker and the falling of these items to the ground, respectively. Thus, for the 93 mechanical hazards identified, all of them can generate impacts and the 29 linked to weight can also cause crushing damage. Since mechanical hazards do not have threshold values, they are all automatically considered significant.

Regarding the ergonomic hazards, although the mass of the packs is less than 25 kg, it is not yet possible to define the posture of the operator or the frequency of actions. Thus they must be considered as unknown at this point. The electric hazards due to the electric energy flow linked to the system (230V-400V / 50-60 Hz) must be considered as significant since the values are over the 25V threshold [START_REF] Standard | NF EN 60204 -Safety of machinery -Electrical equipment of machines[END_REF].

Action by the designer

It is mandatory for the designer to choose a preventive solution for every significant hazard, namely, mechanical and electrical hazards since they are significant. The ergonomic hazards are unknown at this stage but can become significant in the future. Thus it is not mandatory to select a preventive solution now but it is recommended to anticipate one.

The only preventive measure declared in the requirement specifications concerns conformity with ergonomic standards. This is represented on the FSMo by "adapted conductive links" between the worker and all the parts and boxes (cf. Fig. 9). However, none appear clearly for the mechanical and electrical ones. In fact, no effective preventive measures can be selected since the hazards identified are mainly linked to the external elements of the machinery. Furthermore, no structure is described by the designer, making it impossible to prevent any hazard linked to the machinery.

EZID application during the architectural design stage 4.3.1. Model

To illustrate the following design phases, we focus on the supply of loose parts during use.

Hazard type identification

The number of functional surfaces describing the machine increases considerably in this design stage. This is because the machine is described as an assembly of subsystems and each of them has its own functional surfaces. Moreover, details on the dissipations of the internal links appear, creating new types of energy flows that do not contribute to the functioning of the machine. These are the reasons why there are 264 functional surfaces in this FSMo and thus 264 potential relevant hazards (cf. Fig. 10).

Mechanical hazard (M) is still the primary type of hazard in the machine, since the mechanical process is that detailed most in the intermediary elements. However, by detailing the machinery, the number of electric hazards (E) also increases because there is more than one subsystem requiring an electric source (conveyor, actuator, camera+light). The dissipation linked to the conveyors and the actuator generates thermal, noise and vibration hazards. A radiation hazard (R) appears because of the camera -controlled light system and the light received on the parts. The ergonomic hazards (B) are the same except that no interaction is required between the worker and the machine defined here.

Figure 10. FSMo of the supply line for loose part management in the architectural design (to simplify the figure, the link with the structure (the blank functional surfaces) is not represented).

As said before, we focus on the reasons for the technical solutions for supplying loose parts. These parts circulate via a belt conveyor and a metal gutter. The reason here (impact between metallic parts) is recognized as generating noises [START_REF]Standard, NF S[END_REF] and recorded in the reference data (cf. table 2), Thus, EZID can identify the noise hazard linked to the technical solutions for supplying loose parts. Likewise for the technical solutions for recovering empty boxes or non-conforming parts: parts falling from conveyor 5 to the trash box. These two links are highlighted in figure 10.

Consequently, there are 200 mechanical, 8 electric, 29 ergonomic, 8 thermal, 7 vibration, 10 acoustic and 2 radiation hazards during the use of the machine with both loose and organized parts.

It is important to note that a link exists between the hazards identified at the conceptual and architectural design stages. For example, the two shapes and mass functional surfaces of the "supply lines" in fig. 9 are divided into as many surfaces on each sub-system (motor, conveyor, etc.) in fig. 10. Likewise for the main mechanical and electric energy flows. The ergonomic hazards remain the same.

Identification of damage and significant hazards

At this design stage, there are more data on the position and certain intrinsic parameters of the machine elements. For example, the conveyors have a gripping surface to move the parts. Thus, using logic trees similar to that illustrated in figure 5, the hazards linked to the kinetic energies created by the conveyors can generate drawingin damage. In addition, the area between consecutive conveyors can also create dragging damage when they have opposing movements directed toward the area. All the conveyors generate dragging and crushing damage as they can bustle the worker and they are positioned near other parts. Also, the areas under conveyors 4 and 5 are also subject to crushing damage. Table 5 summarises the results obtained by EZID at this stage. Once again, all the mechanical hazards are significant. The noise and vibration hazard must be considered as unknown since the only data available are their existences. The irradiation of the light of the vision system is similar to natural white light. Therefore, the radiation hazard linked to it is relevant.

Action by the designer

For this stage too, it is mandatory for the designer to choose a preventive solution for the mechanical and electrical hazards since they are significant. The electrical, thermal, vibration, noise and ergonomic hazards are unknown at this stage but can become significant in the future. Thus, it is not mandatory to select a preventive solution now but it is recommended to anticipate one. The radiation hazards are only relevant so they do not need preventive measures.

The data obtained show that some mechanical parts protect the user from several mechanical dragging hazards. Also, the conveyors that interact with the user are in an ergonomic position. Since we are still at the architectural design stage, the electrical, thermal, vibration, noise and ergonomic hazards are not yet prevented. The data on the preventive measures chosen by the designer for these hazards belong to the detailed design stage.

At this stage, with EZID, it is possible to identify the noise hazards linked to the technical solutions for supplying loose parts and the recovery of empty boxes or non-conforming parts. In the real project, this hazard was identified only at the final reception and changes were requested by the end-user. During the previous two design stages, we saw the evolution of the FSMo from a unique frontier (supply line) to multiple frontiers corresponding to subsystems. For the detailed design stage, this breakdown continues to the detailed parts of each subsystem. To illustrate this, we focus on the conveyor subsystem (cf. Fig. 11).

Fig. 11. FSMo of the loose part conveyor system in the detailed design

We do not develop every component in full since it is not necessary in certain cases. For example, if we take the electric motor of the conveyor, we can create an FSMo with its stator, rotor, gear and structure as represented in Figure 12. However, this is not common practice for machine designers. Generally, this is a standard purchased component and is certified for the whole subsystem. Continuing from the results obtained with EZID for the architectural design stage, the number of functional surfaces increases since new frontiers appear. However, the type of energy and, logically, their related types of hazard remain the same since no changes have been made to the technical solutions. Rather than an increase in the number of mechanical hazards, there are more electric hazards because each conveyor contains 3 elements that use electricity as energy. Also, the two proximity detectors of the conveyor emit light radiation, thus adding radiation hazards to the results. There is no change in the number of hazards with the increase of conveyor details.

Consequently, 470 functional surfaces are detected for the usage lifecycle at the detailed design stage: 380 mechanical, 20 electric, 29 ergonomic, 8 thermal, 10 linked to noise, 7 linked to vibration and 16 linked to radiation (cf. table 6).

Identification of damage and significant hazards

Using logic tree processes similar to that illustrated in figure 5, it is possible to deduce that the electric motor can cause cutting hazards due to its shape (solid + sharp edge) and impact hazards (solid + blunt edge) due to the kinetic energy provided by the worker and dragging hazards (solid + surface state and/or proximity) linked to the kinetic energy provided by the electric motor. All the data on the relevant hazards are obtained by following the same pattern for the other machine parts.

Table 6 contains the damage and significant hazard identification results for the detailed design stage. Once again, the mechanical hazards are all considered significant. The electrical hazards linked to the motor/actuator/camera-light electric sources are still considered significant since they exceed the value of preventive extra-low voltage. Since no values are available on noises linked to parts falling on the metal gutter and the trash box-skate, their hazards must still be considered as unknown. Ergonomic hazards still require data on worker posture and the frequency of actions to be considered significant. Finally, by studying the characteristics of the energy sources, we note that thermal, vibration, remaining noises, radiation and electrical hazards linked to detectors have energy levels below the legal threshold levels. Consequently, they cannot be considered significant. Preventive measures for mechanical hazards are selected at this stage. All the areas between consecutive conveyors are protected with a metal sheet to avoid dragging damage. All the elements are in theory well assembled with various solutions so there is no longer any risk caused by falling machine elements. The majority of the elements integrated in the supply line are commercial solutions and therefore satisfy safety standards. Consequently, mechanical hazards linked to the shape of elements are mainly prevented because the designers have incorporated chamfers and fillet radiuses to avoid angular shapes and points. The significant electric hazards are also prevented because of the safety measures employed by commercial solutions.

Not all the ergonomic and unknown noise hazards caused and the rest of the mechanical hazards linked to the movement of the elements such as the actuator are prevented according to the data of the last CAD model. Other intermediate objects must therefore be checked to ascertain whether the risk reduction process is complete.

Results

The designer relies on their experience to prevent most of the hazards during the different design stages. Most of the preventive measures integrated in the prototype concern the addition of safety guards, the correct fastening of the different elements and the transformation of angular shapes into blunt ones. Intrinsic prevention achieved through changing technologies or the organisation of parts was not considered.

For example, ergonomic hazards were not prevented in the stages observed. The designer did not modify the way the worker will interact with the machine. In addition, the initial solution of using the worker as a power supply for different actions was not reconsidered or adapted in the stages observed for any lifecycle step (e.g., use, assembly, setting, maintenance, disassembly).

Similarly, the noise hazard generated by parts falling on the metal gutter was prevented only when testing the prototype machine. The designer added a coating on the metallic gutter as a solution for absorbing the impact of the parts.

Finally, three electrical motors still impeded the worker's movements. Consequently, the worker could provide unwanted kinetic energy to the motor and injure themselves, especially during training or peak working times. Therefore it is necessary to increase the designer's awareness of all the hazards linked to every kind of energy.

Table 7 shows the final results of EZID applied to the prototype.

Discussion and conclusion

As stated in the "Machinery" directive, it is mandatory for designers to perform a risk analysis during the design process. However, although hazard identification is the central step of this analysis, there are no methods or tools dedicated to hazard identification and intended to help the designers of special machines. Therefore, they tend to focus on identifying the hazard closest to their field of experience and perform the whole risk analysis at the end of the design process. This leads to reducing the range of possible preventive solutions due to cost and schedule constraints.

The aim of the EZID method presented in this article is to solve hazard identification problems by proposing a structured approach based on intermediary objects and associated design parameters. Based on the hypothesis that hazards are linked to the presence of energy, it is possible to systematically identify hazards by analysing the energy properties of a machine and organizing them as relevant, unknown and significant. Performing an exhaustive hazard identification requires applying EZID to every step of any kind of machine lifecycle. EZID checks the four required characteristics defined in the introduction:

 generic because every kind of hazard can be identified, every machine can be studied and EZID is independent of the type of design process elements used by the designer;  inductive because it uses design parameters (causes) to ascertain hazards (effects);  dynamic and traceable because the FSMo evolves as a function of the design parameters defined and is not generated for each application;  integrated and/or compatible with current design tools and methods because it is based on a design model (FSMo). EZID is currently adapted as an easy to use software application.

EZID method allows designers to complete the risk assessment process (estimation and evaluation steps) by supplying information on all significant hazards. Thus they are able to select the appropriate preventive solution.

The relevance of EZID for systematic hazards identification from the early stages of the design process is verified by its application on the data linked to the real design project of an assembly line supply subsystem. It validates the interest to analyse the energy flows to identify the different kinds of hazards. It also confirms that this identification can be done since the first steps of the design process, based on the intermediate objects generated (ex.: ergonomic hazards linked to the actions of the operator are identified based on the specifications document). The dynamic aspect is also verified with the persistence of untreated hazards during the entire design process and the identification of new hazards caused by the progressive definition of other components properties (ex.: position, material, etc.). The application of EZID on an industrial case finally validates its capability to identify hazards for other lifecycle steps of the machine. Therefore, EZID is capable of systematic hazard identification as it analyses all the energy configurations linked to the different lifecycle steps and operating mode of a given machine throughout the design process.

However, EZID have some limits for which we have perspectives:

 First, the threshold values currently used do not considered the exposition criteria. A first perspective is to add risk assessment and evaluation elements to EZID to propose a method that covers the entire risk appreciation process. In the same idea, we are currently working on the integration of life expectancy parameters in the functional surfaces, as it was done with the complementary parameters used in the logical rules, to identify hazards linked to the failure of the machine components.  Also, EZID can only identify hazards directly linked to functional surfaces. A second perspective is to allow the method to identify hazard combinations that involve at least two hazards to create a different kind of hazard, such as electric hazard (spark) and chemical hazard (dust) that can create thermal hazard (explosion).  Another limit is that the FSMo is only able to model energy flows. Since some other flows can contribute to the system safety, such as information flows, a third perspective is to add to the FSMo new elements, or to use the internal block diagram with modelling operators and rules, to extend the range of the hazard identification.  Finally, the modelling step needs a lot of time to be done manually (several days in this paper case).

The last perspective is to develop a prototype software application to drive the EZID method: construction of a functional-structural model, automatization of the different processes, capitalization of reference data, etc. This software will include different resources to allow its users to complete or adapt the reference data (e.g., generalized parameters, damage, logical rules) if necessary. Implanting EZID inside CAD softwares represents the final goal. Since CAD models can manage rules and circumstantial alerts based on the design data [START_REF] González-Lluch | A survey on 3D CAD model quality assurance and testing tools[END_REF], it is not unrealistic to imagine a real time feedback to the designer about hazards based on the processing of EZID as it was done in [START_REF] Shahrokhi | A framework to develop an analysis agent for evaluating human performance in manufacturing systems[END_REF].

To conclude, it is important to remember that the sole goal of the EZID method is to help designers identify hazards using a structured framework. It complements designers' tools and processes but does not replace project safety reviews or the other safety related designs we presented. It is solely a method for assisting designers in their work.

Figure 3 .

 3 Figure 3. Links between design parameters and those used for risk assessment

Figure 4 .

 4 Figure 4. Functional-structural model

Figure 5 .

 5 Figure 5. Global view of the EZID method 3.1.1. Step 1: Modelling the machine being designed

  Type of energy Generalized effort (ge) Generalized current (gc) Kinetic (mechanical) Force (N) Linear velocity (m.s-1) Torque (N.m) Angular velocity (rad.s-1) Pressure potential (mechanical) Pressure (Pa) Volumetric flow (m^3.s-1Entropic flow (W.K -1 ) Electromagnetic (radiation) Electric field (V.m -1 ) and magnetic field (T) Electric flow (V⋅m) and magnetic flow (Wb) Chemical Chemical potential (J.mol -1 ) Mole flow (mol.s -1 )

Figure 8 .

 8 Figure 8. 3D CAD model of the supply line

4. 4 .

 4 Application of EZID during the detailed design stage 4.4.1. Model

Fig. 12 .

 12 Fig. 12. Drawing of the conveyor electric motor (left) and its FSMo (right) 4.4.2. Identification of hazard types

Table 1 :

 1 Generalized variables[START_REF] Borutzky | Bond graph methodology: development and analysis of multidisciplinary dynamic system models[END_REF]

Table 2 .

 2 Extended generalized variables[START_REF]NF EN ISO 12100 -Safety of machinery, General principles for design[END_REF][START_REF] Standard | NF C13-200 -Installations électriques à haute tension[END_REF][START_REF]Standard, NF EN ISO 5349 -Measurement and evaluation of human exposure to hand-transmitted vibration[END_REF][START_REF] Standard | NF EN 50505:2006 -Basic Standard For The Evaluation Of Human Exposure To Electromagnetic Fields From Equipment For Resistance Welding And Allied Processes[END_REF][START_REF] Standard | NF X[END_REF][START_REF]Standard, NF X35-106, NF EN 1005[END_REF][44][START_REF] Standard | 2008 photobiological safety of lamps and lamp systems[END_REF]

	Hazards	Type of energy		Generalized effort (ge)	Generalized current (gc)
					Force (N)	Linear velocity (m.s-1)
		Kinetic (mechanical)		Torque (N.m)	Angular velocity (rad.s-1)
	Mechanical hazards	Potential of pressure (mechanical) Potential elastic (mechanical)	Pressure (Pa) Elastic strain (Pa)	Volumetric flow (m^3.s-1) Elastic deflection (m)
		Potential (mechanical)	of	gravity	Mass (kg)	Height (m)
		Potential magnetic (mechanical) Magnetic field (T)	Electromagnetic flow (Wb)
	Vibration hazards	Vibratory (mechanical)		Acceleration (m.s -2 )	Body area affected, exposure time (s)
	Noise hazards	Acoustic (mechanical)		Acoustic pressure (dB)	Acoustic flow (m3/s)
	Electrical hazards	Electric			Electric tension (V)	Current (A)
	Thermal hazards	Thermal			Temperature (K)	Entropic flow (W.K -1 )
		Artificial (radiation)	optical	radiation	Wavelength (m), irradiance (W.m -2 ), radiant exposure (J.m -2 ) and radiance (W.m -2 .sr -1 )	Body area affected, surface (m²), exposure time (s)
	Radiation hazards	Laser (radiation)		Laser class
		Electromagnetic (radiation)	Electric field (V.m -1 ) and magnetic field (T)	Electric flow (V⋅m) and magnetic flow (Wb)
		Ionizing			Dose-per-unit intake (Sv.Bq -1 )	Body area affected
					Chemical potential (J.mol -1 )	Mole flow (mol.s -1 )
	Material/substance hazards	Chemical/biological		Level of danger + concentration (chemical)
					Dangerous biological pathogens, class of toxicity and allergenicity
					(biological)
	Ergonomic hazards	Biomechanical		Effort (N)	Speed (m.s -1 )

Table 3 .

 3 Energy source solutions and their associated potential hazards

	Examples of generic technical solutions	Potential hazards associated
		Mechanical (output shaft)
		Electrical (power supply)
	Electrical Motor	Vibration (structure fixing)
		Acoustic (friction between parts)
		Thermal
	Electrical resistance or oven	Electrical (power supply)
		Thermal

Table 4 .

 4 Results of the hazard identification during the conceptual design stage (for the usage lifecycle step)

	Hazards	Relevant	Unknown	Significant	Damages
	Mechanical	0	0	93	Impact, crushing
	Electrical	0	0	1	/
	Ergonomic	0	30	0	/
	Thermal	0	0	0	/
	Noise	0	0	0	/
	Vibration	0	0	0	/
	Radiation	0	0	0	/
	Chemical	0	0	0	/

Table 5 .

 5 Results of hazard identification during the architectural design stage (for the usage lifecycle step)

	Hazards	Relevant	Unknown	Significant	Damage
	Mechanical	0	0	200	Impact, crushing, drawing-in
	Electrical	0	0	8	/
	Ergonomic	0	29	0	/
	Thermal	0	8	0	/
	Noise	0	10	0	/

Table 6 .

 6 Results of hazard identification during the detailed design stage (for the usage lifecycle)

	Hazards	Relevant	Unknown	Significant	Damage
	Mechanical	0	0	380	Impact, crushing, drawing-in, cutting
	Electric	12	0	8	/
	Ergonomic	0	29	0	/
	Thermal	8	0	0	/
	Noise	8	2	0	/
	Vibration	7	0	0	/

Table 7 .

 7 Final results of EZID

	Hazards	Relevant	Unknown	Significant	Damages
	Mechanical	377	0	3	Impact, crushing, drawing-in, cutting
	Electric	20	0	0	/
	Ergonomic	0	29	0	/
	Thermal	8	0	0	/
	Noise	8	2	0	/
	Vibration	7	0	0	/
	Radiation	16	0	0	/
	Chemical	0	0	0	/

Acknowledgments

We would like to thank Lormac Automation, based in Tucquegnieux (France), for allowing us to observe the design process of a supply line, providing large amounts of data and answering our questions. This enabled us to validate the EZID method on a real project.

This work was performed in the framework of the joint INRS -ENSAM/ LCFC laboratory (safety design of work situations).


Tu Ngo

Vera Georgescu

Anne Laurent

Thérèse Libourel

Grégoire Mercier

Mining Spatial Gradual Patterns: Application to Measurement of Potentially Avoidable Hospitalizations

Keywords: Data Mining, Gradual Patterns, Spatial Maps, Cartography Visualization, Potentially Avoidable Hospitalizations

Gradual patterns aim at automatically extracting covariations between variables of data sets in the form of "the more/the less" such as "the more experience, the higher salary". This data mining method has been applied more and more in finding knowledge recently. However, gradual patterns are still not applicable on spatial data while such information have strong presence in many application domains. For instance, in our work we consider the issue of potentially avoidable hospitalizations. Their determinants have been studied to improve the quality, efficiency, and equity of health care delivery. Although the statistical methods such as regression method can find the associations between the increased potentially avoidable hospitalizations with its determinants such as lower density of ambulatory care nurses, there is still a challenge to identify how the geographical areas follow or not the tendencies. Therefore, in this paper, we propose to extend gradual patterns to the management of spatial data. Our work is twofold. First we propose a methodology for extracting gradual patterns at several hierarchical levels. In addition, we introduce a methodology for visualizing this knowledge. For this purpose, we rely on spatial maps for allowing decision makers to easily notice how the areas follow or not the gradual patterns. Our work is applied to the measure of the potentially avoidable hospitalizations to prove its interest.

Introduction

Problem Statement

It is often estimated that over 90% of the information integrate spatial information. In many cases, this important component has not yet been taken into account for specific designs and implementations. However, such spatial information are currently taking more and more importance with the emergence of Internet of Things and popular applications integrating spatial information (e.g., Google maps).

In this context, it is important to analyze the information at several levels of granularity with upscaling and downscaling features. Public policies are especially targeted in such analyses as actions can be taken at different levels of administrative entities (cities, regions, states,...). In our context, we focus on potentially avoidable hospitalizations. We aim at extracting gradual patterns so as to analyze the co-variations of descriptors and highlight some actionable features. Gradual patterns are of the form the more/less A 1 ,..., the more/less A n . Such co-variations can not easily be aggregated through spatial levels of granularity and some knowledge that could be relevant at some level could be called into question at some other level. Thus, we aim at helping decision makers to navigate through the most relevant features and levels of granularity.

In this paper, we introduce a generic method for extracting and analyzing gradual patterns from spatial data at several levels of granularity. Our method is based on the extraction of gradual patterns. One key point is then to deal with aggregation from one level to the upper level.

This method is applied to a real case for analyzing potentially avoidable hospitalization that are both societal and financial issues in public policies.

Use Case

The use case we are working on is meant at helping decision makers from the public health system. Typically, in France, the public health decision makers can have an impact on the determinants related to health care such as the density of physicians, nurses, or the density of hospital beds, but they have no influence on socio-economic determinants such as poverty and education. Potentially avoidable hospitalizations (PAH) are hospital episodes that could have been avoided if patients had received timely and effective primary care. Avoiding these admissions by improving access to primary care could result in a substantial decrease in costs and could enhance patients' quality of life [START_REF] Mercier | Geographic variation in potentially avoidable hospitalizations in France[END_REF]. The main objective for avoiding these hospitalizations is to enhance the health care services where and when it is feasible by working on actionable features.

In this work, we consider two levels of granularity: geographic code and department levels where the patients live. This geographic code level corresponds roughly to the postal code level (n = 5,590) while the department level is similar to the county level in the United States (n = 96). It should be noted that French overseas territories were excluded because most data is lacking.

In addition, this research is conducted on the datasets with the age-and sexstandardized rates of PAH. The standardization for the rates of PAH is necessary to allow for an unbiased comparison between spatial elements [START_REF] Nelson | Reporting healthcare data: Understanding rates and adjustments[END_REF]. The datasets are provided by the Ministry of Health data that is the national hospital discharge database (fr. Programme de Médicalisation des Systèmes d'Information PMSI). It includes data from all French hospitals, whether public or private, and for all payers. Discharge data are obtained at the patients' residence geographic code level. The reliability and validity of the PMSI are high for various acute and chronic conditions, especially since 2007 [START_REF] Goldberg | Epidemiological studies based on medical and administrative databases : a potential strength in France[END_REF]. This research has been approved by the National Committee on Information Technology and Civil Liberties (Reference number CNIL/DE-2014-134)

The PAH potential determinants including the rates of ambulatory care nurses (per 1,000 people), the rates of general practitioners, the rates of specialist physicians, the annual median patient incomes, percentage of education level beyond high school, the mortality ratios, and the rates of acute care hospital beds had been collected from French Ministry of Health and from the National Institute for Statistics and Economic Studies (INSEE).

This research is the next step of one of the previous finding [START_REF] Mercier | Geographic variation in potentially avoidable hospitalizations in France[END_REF] of a French national project on PAH funded by the French Ministry of Health. That previous research has found the associations between the standardized rates of PAH with higher mortality ratio, lower density of ambulatory care nurses, lower median income, and lower education levels and other effects [START_REF] Mercier | Geographic variation in potentially avoidable hospitalizations in France[END_REF].

Those findings are useful for policy makers. However, that research does not help answer which areas to increase the rate of the nurses, for instance, in order to reduce the numbers of PAH. Hence, another research should be conducted for the answers and it is the main aim of this research.

Approach Proposal

The approach proposed in this paper is an extension of [START_REF] Aryadinata | Mining epidemiological dengue fever data from Brazil: a gradual pattern based geographical information system[END_REF]. It considers the extraction of gradual patterns at several spatial granularity levels that are then compared and plotted on spatial maps. The rest of this paper details this approach. We first detail the methodology proposed, described here as a workflow integrating the use of a spatial database and spatial maps. We also discuss how to deal with the extraction and study of gradual patterns at several granularity levels.

The approach we introduce here is generic. Although it has been tested and assessed on real data from French public health, it can be used on any data containing spatial information and which attribute domains are partially ordered so as to allow gradual patterns to be extracted, as recalled below with the basic concepts associated to gradual patterns.

Related Works

Around Gradual Patterns

Gradual patterns consider tendencies in terms of correlation of the attribute variations [START_REF] Laurent | GRAANK: Exploiting rank correlations for extracting gradual itemsets[END_REF]. A gradual pattern is in the form of "the more/the less A 1 , ..., the more/the less A n " such as "the more experience, the higher salary" or "the older a subject, the less his memory".

A gradual item is defined as a pair (i,v) in which i is an attribute of the given dataset and v is variation with v ∈ {↑,↓} in which ↑ stands for increasing variation and ↓ stands for decreasing variation. A gradual pattern is a set of gradual items denoted by {(i 1 ,v 1 ),...,(i n ,v n )}.

For example, given that we have a dataset with three attributes: A, B, and C as shown in table 1, (A,↓) is a gradual item and {(A,↓), (C,↑)} is a gradual pattern. Support of Gradual Patterns. The support value of a gradual pattern indicates to which extent it is true in a given dataset. There are several ways to compute such a value [START_REF] Laurent | GRAANK: Exploiting rank correlations for extracting gradual itemsets[END_REF][START_REF] Di-Jorio | Mining frequent gradual itemsets from large databases[END_REF]. In this paper, we consider the approach based on precedence graphs. A precedence graph is considered for one given gradual pattern and represents the partial order of the objects from the database through paths. For instance, when considering the data from Table 1 and the gradual pattern {(A,↓), (C,↑)}, then Obj 3 ≺ Obj 2 as 2 > 1 and 10 < 13.

The support value of a gradual pattern is given by the maximum length of all paths from the precedence graph over the total number of objects. Returning back to the example precedence graph (Fig. 1), the value of maxLength is 3 and there are 5 objects. Hence, we have:

Support({(A,↓), (C,↑)})= 3 5 = 0.6
A gradual pattern is said to be frequent if its support is higher than a given support threshold.

Gradual Patterns and Spatial Information. Gradual patterns have been applied in various application domains, as biology, psychology, etc. They have also been studied in the framework of spatial information [START_REF] Aryadinata | Mining epidemiological dengue fever data from Brazil: a gradual pattern based geographical information system[END_REF] which proposes a method to visualize on spatial maps the information about to which extent a geographical object (e.g., a city) participates in each gradual pattern. On the other hand, each gradual pattern can be represented by a precedence graph that indicates which paths a spatial object belongs to. For example, on the precedence graph (Fig. 1 Definition. The item support value of an object is the max length of all the paths the object is on.

Back to the example above, the item support value of [Obj 2] is 3 because the lengths of all the paths [Obj 2] is on are {3,2} as mentioned above.

On the other side, since our approach is applied on several hierarchical levels of the spatial objects, there are insider-level objects and container-level objects (in our case, they are geographic codes and department codes respectively).

Definition. The follow-gradual pattern (or Follow-GP) insiders of a container-level object (denoted container) are the insider-level objects (denoted insiders) in the container having GP item support values that are not smaller than a user-defined threshold.

Later in this paper, we will present a use case of this definition when we discuss about aggregation maps. Spatial Maps. Spatial maps are powerful to highlight information related to locations [START_REF] Magnuson | Data visualization: A guide to visual storytelling for libraries[END_REF]. There are several types of spatial maps such as choropleth and symbol maps [START_REF] Magnuson | Data visualization: A guide to visual storytelling for libraries[END_REF][START_REF] Zhang | Design and implementation of decision-making support system for thematic map cartography. The international archives of the photogrammetry, remote sensing and spatial information science[END_REF]. However, in the scope of this paper, introduce choropleth maps. Choropleth maps use colors to represent the data associated with an area by filling the shape of that area with different colors. The data could be categorical or numerical. With categorical data, choropleth maps (categorized maps in QGIS) use a different color for each category. When there are only two categories, these maps can be called binary maps as the two categories could be converted into binary values (0 and 1). With numerical data, choropleth maps (graduated maps in QGIS) use color progression for the different ranges of data with the principle that the darker colors the higher values of data. In this study, we use these choropleth maps (with QGIS) for the knowledge visualization.

Multiple-level Analysis of Spatial Information

Statistics. Statistical methods have been developed and applied widely in data analysis in many domains such as health sciences [START_REF] Auget | Advances in statistical methods for the health sciences: Applications to cancer and AIDS studies, genome sequence analysis, and survival analysis (statistics for industry and technology)[END_REF][START_REF] Ott | An introduction to statistical methods and data analysis[END_REF]. In our previous work [START_REF] Mercier | Geographic variation in potentially avoidable hospitalizations in France[END_REF], a multilevel mixed model (regression model with two hierarchical levels) was used to assess disparities in PAH in France in 2012 and analyze their determinants. The result of the research has indicated that the increased PAH were associated with higher mortality, lower density of acute care beds and ambulatory care nurses, lower median income, and lower education levels. It also suggests that primary care organizations play a role in geographic disparities in PAH [START_REF] Mercier | Geographic variation in potentially avoidable hospitalizations in France[END_REF]. However, this statistical method did not take into account the spatial information.

SOLAP. While On-Line Analytical Processing (OLAP) technologies allow fast, easy, and interactive exploration and analysis of data without any expert assistance [START_REF] Rivest | SOLAP technology: Merging business intelligence with geospatial technology for interactive spatio-temporal exploration and analysis of data[END_REF][START_REF] Mchugh | Towards a SOLAP-based public participation GIS[END_REF], they are not optimized to spatial data. On the other hand, Geographic Information Systems (GIS) are powerful tools for detailed spatial data analysis, but they are not meant to support analytical needs which mostly require summarized information, aggregated data, trends analysis, spatio-temporal comparisons, interactive exploration of data, geographic knowledge discovery in large amounts of data, etc. [START_REF] Bernier | Easier surveillance of climaterelated health vulnerabilities through a Web-based spatial OLAP application[END_REF]. The solution of combining the strengths of GIS and the strengths of OLAP tools gives birth to Spatial OLAP (SOLAP) technologies [START_REF] Rivest | SOLAP technology: Merging business intelligence with geospatial technology for interactive spatio-temporal exploration and analysis of data[END_REF]. Like OLAP, these decision making technologies allow easier and faster navigation of geo-spatial databases relying on several levels of information granularity, cross-tabulated data, explicit spacetime integration and more tightly integrated modes of visualization [START_REF] Mchugh | Towards a SOLAP-based public participation GIS[END_REF]. As SOLAP technologies are very promising, they have been applied in many domains such as surveillance of climate-related health vulnerabilities [START_REF] Bernier | Easier surveillance of climaterelated health vulnerabilities through a Web-based spatial OLAP application[END_REF] or public debate [START_REF] Mchugh | Towards a SOLAP-based public participation GIS[END_REF]. Related to our work, SOLAP technologies could be an interesting extension to our project.

Extracting Spatial Gradual Patterns

As mentioned in the Introduction section, our goal is to extract associations between potential determinants and spatial objects and to visualize the results with spatial maps to help decision makers to navigate through hierarchical levels.

Considering our use case, we aim in particular at retrieving the potential determinants impacting the rates of PAH by extracting gradual patterns from different levels of spatial information (geographic codes and department codes). The patterns are then plotted on spatial maps as a reference for the decision makers. In this paper, we present our approach to achieve that goal.

Process Flow

Our implementation approach includes several steps that are described in the process flow in the figure ?? and detailed below.

Step 1: Find gradual patterns at several granularity levels. At this first step of the process the gradual patterns are extracted at all granularity levels (geographic code and department levels in our use case). Given a support threshold, the output of this step is a list of frequent gradual patterns for every level with their support values.

Step 2: Select gradual patterns for mining. At this step, experts help select some gradual patterns from the output of the first step. A gradual pattern is selected based on both its relevance and the inclusion of actionable variables and its high gradual pattern support value.

Step 3: For every selected gradual pattern, find item support values of spatial objects. At this third step, for every selected gradual pattern, the item support value is computed of every element from every granularity level (e.g., every geographic code and every department code).

Step 4: Find number of follow-GP insiders for every containerlevel element. This step is only processed at the insider-level. In this step, for every selected gradual pattern, a threshold is defined for the item support values. In addition, a join table contains an insider (e.g., geographic code) is in which container (e.g., department). The output of this step is a dataset with the number of follow-GP insiders for every container. This output is used to update the shape file1 at the container-level.

Step 5: Update findings into the shape files at all levels. At this step, all the findings found on the previous step for all granularity levels will be updated into the corresponding shape files (geographic codes and departments for our use case). The findings include the item support values of the spatial objects and number of follow-GP insiders for container-level objects.

Step 6: Visualize the findings with the shape files by GIS software. In this step, any GIS software such as QGIS can be used to visualize the findings on spatial maps with the shape files.

Use Case

As mentioned in the Introduction section, we have applied this approach to our real datasets that have two hierarchical levels: geographic codes (n=5,590) and department codes (n=96). In this section, we present the obtained results. For this purpose, an R package has been developed.

At the geographic code level, the following PAH potential determinants are available:

-Rates of general practitioners per 1,000 people (denoted as Generalists) -Annual median incomes (denoted as Median income) -Percentage of education level beyond high school (denoted as Education) -Rates of ambulatory care nurses per 1,000 people (denoted as Nurses) -The rates of ambulatory care specialists per 1,000 people is also available, but there are many geographic codes in which there are no specialists, hence we did not include it when we search for the gradual patterns.

At department code level, besides the potential determinants we have at geographic code level, we also have the data of the followings:

-Standard mortality ratio (denoted as Mortality ratio) -Number of acute care hospital beds per 1,000 people (denoted as Beds) -Percentage of CMU-c recipients2 (denoted as CMUc recipients)

Select Gradual Patterns for Mining. The Find Gradual Patterns step has generated the list of gradual patterns with their support values. From that list, the experts have selected the following gradual patterns for mining based on their high support values and their relevance to the purpose of the project.

At the geographic code level:

-{(Median income,↓), (PAH,↑)} (denoted as INC in Fig. 7 and Fig. 8) -{(Education,↓), (PAH,↑)} (denoted as EDU in Fig. 7 and Fig. 8) -{(Nurses,↓), (PAH,↑)} (denoted as NUR in Fig. 7 and Fig. 8) At the department level:

-{(Nurses,↓), (PAH,↑)} -{(Mortality ratio,↑), (PAH,↑)} -{(Generalists,↓), (PAH,↑)} -{(Specialists,↓), (PAH,↑)} -{(Education,↓), (PAH,↑)}
Find Item Support Values. In this step, at each hierarchical level, for every selected gradual pattern, we need to find the item support value of every spatial element. For the purpose of demonstration, in this paper, we only present the item support values of the gradual pattern {(Nurses,↓), (PAH,↑)}. For the purpose of visualization, we divided these values into 5 groups for each level, at both the geographic code (Fig. 2) and department code (Fig. 3) levels.

4 Dealing with Spatial Maps and Hierarchies

Navigating through Hierarchical Levels

In this section, we present how hierarchies can be dealt with in the context of spatial data and gradual patterns. In our approach, we take advantages of the current GIS software (QGIS in our case) to navigate through hierarchical levels. In particular, we use choropleth maps to plot the gradual patterns at each level as layers (as in QGIS). The navigation bar of the GIS software allows us to easily switch among the maps (rolling up or down between the hierarchical

Use Case

In our work, we implemented two aggregation values. The first one is to show percentage of geographic codes inside a department following a selected gradual pattern. The second one is to display the best gradual patterns in each department. The best gradual pattern is simply defined is the gradual pattern whose number of follow-GP is the biggest compared with the other gradual patterns.

As we have mentioned, for every selected gradual pattern, we need to find the number of follow-GP geographic codes for every department. In order to do that, thresholds are needed. In our case, the experts have selected the following thresholds (Table 2). After setting the threshold for each gradual pattern, the number of follow-GP geographic codes of every department can be obtained as shown in the same template (Table 3).

Finding Visualization on Spatial Maps

As mentioned in the process flow (Fig. ??), in order to visualize the findings above, we need to import them into the corresponding shape files at the hierarchical levels. This step can be conducted by SQL commands on database management system (DBMS) with spatial extension (postgresql and postgis in our case).

Graduated Maps for Item Support Values. These maps (Fig. 4 and Fig. 5) facilitate the decision makers to find out how an area (geographic code and department) follows a selected gradual pattern through its item support value, the higher item support value the better it follows the gradual pattern. The first type is to display the percentage of geographic codes inside department codes following a selected gradual patterns (Fig. 6).

The second aggregation map is the best gradual pattern map (Fig. 7). For example, on the map above (Fig. 7), EDU&INC indicates that the departments have the have the same numbers of follow-GP geographic codes for {(Education,↓), (PAH,↑)} and {(Median income,↓), (PAH,↑)} Multiple-Gradual-Pattern Maps. This type of spatial maps (Fig. 8) is to display multiple gradual patterns on a same map. This type of maps could be useful for the decision makers as they can analyze the association between many different determinants on the spatial objects. In particular, in our case, the decision makers want to see which gradual patterns the geographic codes follow.

Conclusions

In this paper, we have presented an approach of using gradual pattern method to not only find the correlation of the attribute variations as the regression method does but also to mine geographical data and to identify how an object participates in the associations between attribute variations through the gradual pattern item support values of spatial elements. The visualization of the spatial areas is crucial.

In our work, we have applied our method to study which areas participate in the association between primary care and PAH. This work is of high interest to national-and regional-level health authorities. Indeed, the latter might focus their efforts and investments on these areas in order to maximize the efficiency at the health system level. This paper describes the method of using spatial maps with shape files and GIS software as tools for the decision making people. In particular, this paper gives some ideas of visualizing the gradual pattern support values of the geographic codes and the departments the on the spatial maps. These maps might be the useful references for decision makers at the French Ministry of Health when they want to reduce the numbers of PAH in France.

Further work includes the integration of these proposals in the context of Spatial OLAP systems in order to provide end-users with integrated fluid solutions for navigating through the spatial data and hierarchies with such complex measures (gradual patterns).

Fig. 1 .

 1 Fig. 1. Precedence graph for the gradual pattern {(A,↓), (C,↑)} with the example dataset.

  ), [Obj 2] are on two paths: The first one is [Obj 4] → [Obj 1] → [Obj 2] and the other one is [Obj 3] → [Obj 2]. The lengths of these paths are 3 and 2 respectively.

Fig. 2 .Fig. 3 .

 23 Fig. 2. Item support values of {(Nurses,↓), (PAH,↑)} at geographic code level Fig. 3. Item support values of {(Nurses,↓), (PAH,↑)} at department code level

Fig. 4 .Fig. 5 .

 45 Fig. 4. Graduated map for item support values of {(Nurses,↓), (PAH,↑)} at geographic code level Fig. 5. Graduated map for item support values of {(Nurses,↓), (PAH,↑)} at department code level

Fig. 6 .Fig. 7 .

 67 Fig. 6. Percentage of geographic codes inside department codes following {(Nurses,↓), (PAH,↑)} Fig. 7. Best gradual patterns at each department code

Fig. 8 .

 8 Fig. 8. Multiple-gradual-pattern map at geographic code level

Table 1 .

 1 An example dataset

	Objects	A	B	C
	Obj 1	4	6	12
	Obj 2	1	9	13
	Obj 3	2	10	10
	Obj 4	5	8	11
	Obj 5	3	7	14

Table 2 .

 2 Thresholds for the numbers of follow-GP insiders

	#	Gradual pattern	Threshold
	1	{(Median income,↓), (PAH,↑)}	165
	2	{(Education,↓), (PAH,↑)}	161
	3	{(Nurses,↓), (PAH,↑)}	153

Table 3 .

 3 Number of follow-GP geographic codes of department with gradual pattern {(Nurses,↓), (PAH,↑)}

	#	Department code	Number of follow-GP
	1	01	6
	2	13	25
	3	02	10
	...	...	...

Popular geo-spatial vector data format for geographic information system (GIS) software

In France, CMU-c recipients are people who are given special rights for a free complementary health care complementary insurance.

Acknowledgements

We would like to thank University of Science and Technology of Hanoi (USTH) and the DIM department from the CHU of Montpellier for funding this work.


Andréa Cynthia Santos

Christophe Duhamel

Christian Prins

Tactical optimization strategies to adapt urban transport networks

come

Introduction

According to the Global Health Observatory (GHO), more than half of the total population lived in urban areas in 2010. This proportion is expected to reach 60% by 2030 and 70% by 2050. The increasing concentration of population and the unplanned extension of urban areas raise several challenges, among which the management of the urban network infrastructures.

Decision Making System

An optimization framework core has been developed to deal with a class of tactical optimization problems [2], where two objectives are optimized independently:

Results

The methods were tested on Manhattan graphs (grid structure) instances, as well as on real instances from the Clermont-Ferrand and Troyes cities, France. The first results are presented in [3].

Figure 2 illustrates the relation between the convergence and the tradeoff between the solutions quality and the running time, using a mediumsized instance for the Clermont-Ferrand city, France.

Conclusions

The proposed framework is able to solve the core problem of setting directions and evaluating the global impact on an urban network for the goals (i) and (ii). We are currently extending it:

• To manage the global congestion

• To quickly provide good traffic redirections when some streets are blocked due to maintenance, natural perils (freezing rain, hail storm, flood, fire, etc), road accidents, manifestations (fairs, etc.), …

Main references

The

  TOAST project (Tactical OptimizAtion Strategies to adapt urban Transportation networks) aims at investigating a new set of emerging tactical optimization problem [1]. It consists in setting directions on each street to improve the global transport system. This research has been funded in 2013 by the DRRT (Délégation Régionale à la Recherche et à la Technologie, Champagne-Ardennes region, France).

  drivers from entering critical areas such as city centers or touristic points. The ongoing work will include the computation of the global congestion and address several other settings (such as lanes) to deal with promising applications. The optimization core can be embedded in a support decision systems as shown in Figure 1. The core TOAST encloses sophisticated heuristics and metaheuristics such as Iterated Local Search (ILS) and Relaxed ILS (RILS), Evolutionary Local Search (ELS) and Relaxed ESL (RELS), Variable Neighborhood Search (VNS) and Intelligent VNS (IVNS), applied to produce high quality results for different networks structures.

Figure 3 Figure 1 :Figure 3 :

 313 Figure3shows a typical output from our solver for the center of Troyes, France.

Figure 2 :

 2 Figure 2: Convergence and time-quality trade-off.

  1. R. Z. Farahani, E. Miandoabchi, W. Y. Szeto, and H. Rashidi. A review of urban transportation network design problems. European Journal of Operational Research, vol. 29 (2), 281-302, 2013. 2. R. E. Burkard, K. Faldbacher, B. Klinz, and G. J. Woeginger. Minimumcost strong network orientation problems: classification, complexity and algorithms. Networks, vol. 33 (1), 57-70, 1999. 3. A. C. Santos, C. Duhamel, C. Prins. Heuristics for setting directions in urban networks. In proceedings of the X Metaheuristics International Conference, Singapore, 298-300, 2013.