Guy Marlair
email: guy.marlair@ineris.fr

Amandine Lecocq

Arnaud Bordes

Paul Christensen

Benjamin Truchot

Key Learnings from Recent Lithium-ion Battery Incidents that have Impacted e-mobility and Energy Storage Fast Growing Market

Learning lessons from accidents has always been very instructive for developing inherently safer technologies and processes. This paper aims to show that lithium-ion rechargeable battery (LIB) technology is no exception, as the penetration of these devices into society has been accompanied by a number of significant fires and explosions. The relatively small incidents involving LIBs arose from their application in an ever wider and more varied range of portable electronic products in the mid 2000's, leading to, for example, repeated recalls of laptop computers. Later it became apparent that failures could and would occur in the full value chain of LIBs, starting from the manufacturing of cells up to end-of life issues and recycling. The true nature of the risks and hazards of LIBs has only started to become apparent with larger batteries, for example those associated with e-mobility (electric vehicles) and grid-scale battery energy storage systems, and hence this paper focusses on the lessons to be learnt from incidents involving these systems.

Introduction

Lithium-ion batteries (LIBs) were first put on the market by Sony in 1990 and have since become the dominant power system in many consumer products including laptops, smartphones and portable power tools. Concerns over climate change have opened up larger scale applications for these devices since c.a. the late 2000s, in terms of e-mobility and lithium-ion battery energy storage systems (LiBESS) to support national electricity grids and store energy from renewable energy generators. Battery electric vehicles (BEVs) are intended to progressively replace ICE vehicles, whilst LiBESS may store GWh's of energy and are already competing in terms of performance and cost with, for example, Sodium-Sulfur (Na-S) high temperature batteries. The rapid and, since the late 2000's, major expansion of LiBs, particularly into applications utilising 10s to 1000s of kWh rather than 10s of Wh, demands a new paradigm in terms of the risk profile of these devices. The risk of Thermal Runway (TR), with the attendant hazards of toxic gas, fire and explosion, is new in battery technology, resulting from: (1) the replacement of an aqueous electrolyte by a flammable organic one and (2) the requirement to operate the battery in very narrow thermal and electrochemical windows, combined with (3) very high energy densities. Thermal runaway has replaced the easier-to-manage risk of hydrogen release during the charging of secondary batteries making use of aqueous electrolytes such as lead acid or Ni/Cd cells. A very significant body of research has focussed on elucidating the processes that lead to TR following abuse (crush, penetration, heating, overcharge), but the chemical reactions that actually trigger TR, and even the definition of TR, remain controversial. However, only a limited research effort [START_REF] Sun | A Review of Battery Fires in Electric Vehicles[END_REF] has been focused on learning from actual fires and explosions involving LIBs, despite the significant, and often exaggerated, publicity such incidents attract. Past experience of other emerging technologies dictates that early monitoring and reporting of incidents and near misses may help to identify critical issues with respect to safety management and save time and money in developing appropriate risk management [START_REF] Rivière | Learnings of the root factors of incidents potentially impacting the biofuel supply chains from some 100 significant cases[END_REF].

Therefore, this paper aims at presenting and discussing scientific sound knowledge acquired from incidents having so far been reported with LIBs and related applications, with a focus on yet non mature but fast developing markets such as e-mobility and BESS applications.

Historical learnings achieved from early use on LIBs based on incident records of consumer products.

As a matter of fact, according to LIB technology design, managing short-circuiting remains a complex issue since multiple types of internal shorts have to be taken into considerations (Figure 1) and internal shorts are not easily detectable. Basically, two major issues were identified from the significant recalls of consumer products incorporating LIBs prompted by fires and explosions of, for example, mobile phones and laptops:

• The presence of non-intentionally added substances (NIASs) during manufacture could lead to catastrophic internal short circuit at any time following manufacture, for example via perforation of the thin polyolefin separator. Examples of NIAS include airborne particles in manufacturing areas.

•

Poor design/manufacturing also led to internal short circuit: for example, inappropriate LIB current collector mountings. Defects such as these caused the recall of the Nexus and Samsung Galaxy Note 7 smartphones. It is generally reported in the literature and in battery safety conferences that field failures due to manufacturing defects are of the order of 1 cell out of one to ten million (fault rate rated 10 -7 to 10 -6 for 18650 cylindrical cells only), as the cells are assembled in clean rooms. The semiconductor industry still experiences defects in semiconductor wafers due to airborne contamination despite production taking place in advanced cleanrooms (see: https://www.cassindustries.com/lithium-ion-battery-safety-failure-causes/ ). Despite the very low manufacturing failure rate in LiB manufacture, and insurance quality systems mandated by the Transportation of Dangerous Goods Model Regulation (United-Nations, 2019) for the transport of LIB cells and batteries under UN3480, it must be anticipated that field failures will still happen due to billions of such cells being placed on the global market.

Another key message that has to be kept in mind is that virtually all applications of LIBs in consumer products have experienced field failures leading to the venting of flammable and toxic gases, with or without fires due to thermal runaway: there have been regular media reports of incidents involving laptops, phones and smartphones, e-cigarettes, power tools, hoverboards, e-bikes and e-golf caddies). More recently e-scooters have been subject of alarming media reports. Given that LIBs have penetrated all levels in society, it is not surprising that insurances companies are presenting alarming statistics about recurrent fire events that are originating from careless managements of LIB and LIB-powered systems or related chargers (Sim, 2021): for example, the fatal fire in New York City due to the charging of nine e-bike batteries (King 2021).

Field failures lessons from last decade e-mobility development

overall field failure driven lessons

Many countries all over the world have e-mobility strategies to produce vehicles of all sorts from light e-mobility vehicles (LMV) including escooters and ebikes, to hybrid or full battery electric vehicles (HEVs, BEVs): the latter are now sold in significant quantities by nearly all car makers. Fleets of e-buses are also fast emerging in many large urban areas. Battery safety appears to be significantly lower on the agenda than range limitation ("range anxiety") and increasingly rapid charging, it is clearly important for the successful expansion of the EV market [START_REF] Bordes | A holistic contribution to fast innovation in electric vehicles: An overview of the DEMOBASE research project[END_REF] to understand why EVs are catching fire. With the increase of power and size of EV's battery making use of LIB technology, as noticed by [START_REF] Christensen | Risk Management over the life cycle of lithium-ion batteries in electric vehicles[END_REF], it is important to consider the LIB hazards over the complete life cycle of EVs, and to understand that the corresponding threats, also clearly revealed by EV incidents, may encompass risks to health, fire risks and risk to the natural ecosystem.

According to the survey performed on EV field incidents in this work, the main lessons learnt are as follows:

-Nearly all EV models (if not all) put on the market and powered with LIB have experienced (albeit infrequent) battery safety issues, often leading to fires.

-Safety considerations have led to stringent regulatory requirements (e.g.: R100 for vehicle homologation) and appropriate standards developed by IEC Committees TC21 and SC21A (see for instance IEC 62660 series and IEC 62660-3 in particular). However, the fervent quest for ever improved performance at static (if not reduced) costs makes ensuring that safety is adequately addressed ever more challenging, as reflected in the numerous recalls of EVs in the last two years following EV fires (Hyundai Kona, Chevy Bolt…).

-As illustrated by the details of > 60 Tesla vehicle fires listed in an open access database (www.tesla-fire.com), field failures can happen in any state of the vehicle life cycle (during cruise, at the garage or car park, during charging, after maintenance, at car store etc.).

-Incidents have no single root cause, hence fires may occur as a result of a crash, inappropriate repair, inadequate battery integration, shortcomings in design or operation of the Battery Thermal Management System (BTMS)) or in the Battery Management System (BMS) hardware or software. Water or liquid refrigerant cooling might progressively be preferred to air cooling in future more powerful EV for better BTMS [START_REF] Edmonson | Thermal Management for Electric Vehicles 2020-2030[END_REF] for reason of better cooling efficiency -Metallic lithium plating on the anode due to overcharging, fast charging and charging at low temperature has been identified as potential critical safety issues, as well as the formation of dendrites [START_REF] Bordes | A holistic contribution to fast innovation in electric vehicles: An overview of the DEMOBASE research project[END_REF] -Multiple charging points for EVs or e-buses in narrow and or confined spaces proved to be critical, as shown recently by destruction of e-buses and three bus depots in Germany or in China (Nedelea 2021) -Fire-fighting an EV fire is not an easy task and need significant training of the fire-brigades and appropriate safety information from the EV car manufacturer -Re-ignition of EVs after the first emergency response is quite frequent and may occur hours, days or even weeks later -After a collision involving an EV, precautions need to be taken whatever action is taken subsequently (repair or recycling) as the integrity of the battery integrity may have been compromised and hence delayed ignition is possible.

Emerging statistical data from field failures leading to EV fires

Although no robust figures are yet made available in terms of EV fire statistics [START_REF] Ahrens | Vehicle Fires[END_REF], there is no clear evidence that EV fire events occur more frequently than Internal Combustion Engine (ICE) cars, despite the impressions that may be obtained from sensational media reporting of EV fires and controversial claims (e.g. by the London Fire Brigade, reporting a failure rate of 0.1% for EVs, more than double that of ICE vehicles: [START_REF] Garret | Vehicle fire data suggests higher incident rate for EVs[END_REF]:figures possibly biased due to the limited number of fire records considered).

A database recording Chinese EV fires [START_REF] He | Experimental and computational study of self-heating ignition and calorimetry of Lithium-ion batteries during storage[END_REF] which covers the years 2018 to 2020, appears to show that EV fires occur more often in summer, which could possibly be linked to inappropriate sizing of the BTMS ( Figure 2).

More recently, on the information collated on a publicly accessible online database www.teslafire.com (Unknown, 2021) and regularly updated, regarding fires involving Tesla Model 3, S and X vehicles, strongly suggests that the root cause of the fires involving these vehicles is crashes, see table 1. This observation is also consistent with statistics regarding vehicle fires in general [START_REF] Ahrens | Vehicle Fires[END_REF]. Fast charging only accounts for some 5% of overall fire records. However, apparent 'spontaneous ignition' accounts globally for nearly 30% which might have to be related to manufacturing defects or contaminants, potentially reflecting design or manufacturing issues that are not specific to Tesla Models. This conclusion is given added weight by the recent multiple recalls of EVs by several car manufacturers.

Field failure regarding stationary applications (BESS)

The fast development of stationary application for storing renewable energy with BESS is the most recent market targeted and largely dominated by lithium-ion battery manufacturers and energy storage providers for domestic and industrial applications, including services to the grid. Originally dominated by lead acid (mostly UPS systems) and for application over the MW range by sodium-sulfur systems (the latter being developed and marketed by NGK from Japan) it is interesting to note that Li-ion technology had the opportunity to enter this market following a major fire that abruptly stopped the domination of Na-S batteries (NGK Insulators, 2011). Stationary applications, although at that time rather more expensive was considered safer option, until a series of incidents. However, the rapid market development of BESS (mostly in containerized modular systems) has led to a series of major fires and explosions across the world from 2012, with most occurring from 2017. For example: Belgium (Drogenbos, 2017), Australia (Brisbane 2020, Geelong 2021), United-Kingdom (Liverpool, 2019), France (Perles-et-Castelet, 2020), USA (Surprise, AZ, 2019, La Salle, IL 2021), China (Beijing, 2021), Germany (Neuhardenberg, 2021), and chiefly in South Korea, where a series of fires struck some 25 BESS, mostly in coastal and mountainous areas and in years 2017 to 2019.

Common lessons from well investigated fires outside South Korea

To date there are some 45 reported case studies of BESS (EPRI, 2021) that have experienced significant field failures, mostly leading to major fires and explosions with significant property loss. These have provided important lessons and have highlighted critical gaps in safety. Some of the underpinning field failures are summarised in table 2, highlighting the wide range of configurations in terms of capacity, application, age and status: as can be seen from table 2, critical situations may arise whatever the capacity, at any stage of the life cycle of the unit from construction to long term use, outdoor and indoor and any type of hosting site. The key information may be summarized as follows:

-Dealing with a BESS incident is a difficult and potentially risky operation for fire and rescue services: rendering the fire under control may take hours (Liverpool 2020, Korean fires 2017-2020) if not days (Australia Victoria 2020), and there is the explosion risk due to the vapour cloud vented by cells in cascading thermal runaway (Surprise 2019, Liverpool, 2020; Brisbane 2020) -No chemistry, not even less reactive LFP li-ion chemistry, is exempt from thermal runaway -Installing battery systems in on-top and side-by-side configurations, and in upper storeys of buildings should be avoided (Perles-de-Castelet, 2020; Moorabool 2021; Brisbane,2020) -Remote operation, of such systems require well designed and resilient command and control and ICT systems (Liverpool, 2020) -Detection and fire protection systems need to be optimised: so far no clean suppression (gaseous) agent has proven effective for controlling or stopping TR in containerized BESS -The energy storage electrochemical subsystem may be not be the root cause of a fire event: BTMS and other key parts of a BESS may also be involved (for example, a (Goolagong, 2021) as evidenced by BESS of hybrid ships [START_REF] Mrozik | Environmental Impacts, pollution sources and pathways of spent lithium-ion batteries[END_REF] and the SK fires -A fail-safe approach with multi-layer protection barriers should be the future strategy, not just relying on the use of safer materials in the hope of negating the TR hazard

Major learning as reported by the official investigation teams put in place by Korean government

From the 23 (out of the 30 BESS fires in Korea) that were officially investigated under a mandate from the local authorities, the conclusions were essentially:

-A particular battery chemistry, specific application, manufacturer (although LG Chem technology has been the focus of significant concern because of the Korean BESS fires as well as EV and domestic battery system recalls) or specific capacity in terms of energy or power could be singled out for serious concern re safety.

-14 out of the 23 incidents investigated occurred during the waiting state after full charge of the system, 6 took place during charge or discharge process and 6 occurred during construction or commissioning -Globally, 4 categories of root reasons were evidenced, namely: i) insufficient protection against electrical shocks and short circuit, ii) underscored rating of criticality of local environmental conditions of BESS operations (e.g.: maritime and or mountainous geographical locations), iii) negligence/complacency in the implementation phase of the system and iv) inadequate command/control efficiency for the protection of the system. Multiple actions were taken in response of these statements (MOTI, 2019), including the rapid development of safety standards, stakeholder training and the limitation of effective maximum charge in BESS as compared to nominal capacity. This latter measure was justified by the fact that most of incidents involved BESS that were fully charged in stand-by mode, waiting for power demand, which had led the authorities to request a maximum charge rated to 80% to 90% of nominal unit capacity.

Conclusions

In this paper, incidents that have paved the fast-growing and tremendously innovative markets of li-ion technology were reviewed with a focus on e-mobility and stationary applications, showing that developing fitfor-purpose energy storage systems for these markets keeps really challenging in terms of safety management.

It may be anticipated that in the context of ever reducing price market demand, emergence of LIB secondary life market and other circular economy driven aspects and eger demand for more powerful systems (e.g.: more energy-dense batteries), intrinsic safety of future LIBS will not progress significantly. Therefore, sustainable and safe further development on LIB applications in the future shall rely on a variety of initiatives such as i) better education of all stakeholders including all end-users, ii) an improved set of standards and certification schemes, iii) maintenance of financial support to energy storage safety-focused research, iv) and an overall control of efficiencies of all measures implemented from implementation and maintenance of consolidated battery failure databases allowing reliable exploitation in terms of safety performance statistics.

Figure 1 :

 1 Figure 1: (left) Scheme of the various short-circuit (SC) potential configurations in LIB; (right): Related criticality of outcomes according to SC configurations. Al-An: aluminium current collector vs. anode material; and An-Ca: anode material vs. cathode material; symbols used: -for high risk, o for medium risk, + for low risk (after Volck et al, 2016).

Figure 2 :

 2 Figure2: fluctuation of reported EV fires in China, after data reported at the 2 nd China International Electric Vehicle Safety Technology Innovation Conference, 2020[START_REF] He | Experimental and computational study of self-heating ignition and calorimetry of Lithium-ion batteries during storage[END_REF]

Table 1 :

 1

	Post-crash or due to overturn	35	56.5
	Spontaneous ignition at rest	11	17,7
	Spontaneous ignition on the road	6	9.7
	Normal or fast charging	4	6.5
	Impact from projectile laid on the road	3	4.8
	Unknown circumstance	3	4.8

distribution of Tesla model fires known records as a function of reported root causes (multiple EV fires in stores or car carrier excluded)

Fire root cause or circumstance # EV fires (-) Proportion of EV fires (%)

Table 2

 2

		: a selection of reported BESS fires (adapted from EPRI battery failure database, 2021, and Mrozik et
	al 2021)
		Location	Capacity	Application installation	Event	System	status
				(MWh-MW)			date	age (y)
	US,	CA	Moss	1,200-300	Solar Integr.	Power Plant	09-4-2021	0.8
	Landing			(SI)
	Australia,		450-300	Grid Stability	Rural	07-30-2021	0	Construction/
	Moorabool			(GS)				commissioning
	Germany		5-5	SI/ frequency	Indoor/	07-18-2021	5
	Neuhardenberg		reg. (FR)	hangar
	China, Beijing	25-?	SI+ other	Mall	04-16-2021		Construction/
					services				commissioning
	France Perles-de-	0.5-0.5	Local	substation	12-1-2020	0	testing
	Castelet, Arège		demand mgt
	UK, Liverpool		10-20	FR	substation	09-15-2020	1.5
	US AZ, Surprise	2-2	Volt Reg, PQ,		04-19-2019	2
					SI
	SK,N.Geyongsang,	3.7-?	SI	Mountains	05-04-2019	2.2	Charged,
	Chilgok							inactive
	Australia, Brisbane		SI	Indoor,	03-17-2020	6.7
						elevated floor
	Belgium,		6(1;5)-4(1)	Test Center	Gas power	11-11-2017	0
	Drogenbos				plant


Nicolas Tillier

Christophe Bolvin

Agnès Vallée
email: agnes.vallee@ineris.fr

The Periodical Review of Safety Report in France for Upper-tier Seveso Establishments

The Seveso III Directive, adopted by the European authorities in 2012, has updated the European regulation on industrial risks and on the prevention of industrial accidents. Among the prescriptions, there is the periodical review of the safety report for upper-tier establishments at least every five years (Article 10-5). In France, this prescription has been transposed in national regulation by the obligation, for operators of these establishments, to write a "review notice" five years after the last safety report has been submitted and accepted by the Competent Authority. This notice must study 11 points to determine if the facilities are still in adequation with their environment and if new technologies or new safety measures may be implemented to improve risk management. Following this notice and depending on its conclusion two options are available. In case of strong changes / modifications (of the facilities, environment, regulation), a revision / new version of the safety report has to be submitted to the Competent Authority. The second option, in case of no major modification and if the conclusions of the existing safety report are still valid, is to update this existing safety report. Contrarily to this last option, the revision of the safety report implies that the French authorities will process it and new prescriptions may be added to the establishment. This paper describes the requirements and contents (the 11 points) of a French review notice of the safety report for an upper-tier Seveso establishment, and its advantages / drawbacks compared to the automatic revision of the safety report every five years.

Introduction

In the European Union, the industrial risks policy is guided by the Seveso Directive. Its last version (called Seveso III) has been adopted in 2012. Its application field is wide, and among all the prescriptions, there is the obligation, for the most hazardous facilities (upper-tier establishments), to write a safety report. This report must identify and characterize the risks involved by the facilities and the risk management policy and safety measures that the operator has implemented. As the regulation or the facilities evolve, this safety report must be reviewed at least every five years (Article 10-5) or after modifications of the facilities (Article 11). In France, there were a total of 1 365 establishments subject to the provisions of the Seveso III Directive in 2020, of which 725 were upper-tier establishments, for which the review of the safety report is compulsory.

The context of major hazard prevention for Seveso upper-tier establishments in France

In France, safety reports are required for more than 28 000 establishments since 1976, as all establishments needing an Environmental Authorization required it, which is a wider scope than only Seveso establishments.

The beginning of safety reports and the impact of the AZF accident

Before 2003, the risk assessment used in safety report was based on the worst-case scenario. It was a deterministic approach. The Toulouse disaster in 2001, which caused 31 fatalities, over 3,000 injuries and damages estimated at €3 billion, has led to a new French land-use planning approach. Following this disaster, the French legislation was strengthened, particularly on the siting of hazardous facilities, new urban developments in their vicinity and the flow of information between operators, relevant authorities and the local community. The Technological Risk Prevention Plan (PPRT in French, standing for "Plan de Prévention des Risques Technologiques") is one of the flag-ship measures of the law of July 30, 2003. The aim of the PPRT is to protect people by acting on the existing urbanization and also by controlling the future land-use planning in the vicinity of the existing upper-tier Seveso establishments. The law of July 30, 2003 has introduced the use of probabilities and frequencies into the French legislation and regulations regarding industrial risks. The risk analysis, at the heart of the safety report, has now to take into account the probability of occurrence, along with the kinetic, the gravity of the potential accidents. Then, combined with the gravity of potential accidents, the probability allows to assess the acceptability of an industrial establishment in its environment and the demonstration of risk control.

The structure of a safety report in France

The French safety report is based on a risk analysis and an assessment of major accident in terms of probabilities, intensities and gravities. The global structure of safety report is described here:

• The safety report is a key element, as its results are directly used for decision making. The French government has developed a risk matrix for assessing the societal acceptability of the risks generated by a Seveso establishment. The input data are the probabilities of major accidents and the number of people exposed to their consequences. The matrix (see figure above) defines three levels of accidental risk:

• Acceptable (in white on the matrix): the risk is acceptable, • Unacceptable (in red): the risk is too important, additional safety measures must be implemented, • ALARP (As Low As Reasonably Practicable, in yellow): the risk has to be reduced in order to become "as low as reasonably practicable".

In order to help operators to do their safety report, some guidance documents have been produced: • A guideline describing the "General principles for the elaboration of safety reports" has been issued in 2006. This guideline has been integrated in the circular of May 2010. It reviews all the elements that should be featured in a safety report. This circular makes also available other guidelines regarding for instance the human factor, the assessment of the gravity of an accident, BLEVE and UVCE in LPG units, etc.

•

The French National Institute of Industrial Environment and Risks (Ineris) has published many scientific documents about the new risk assessment methodology. They are useful tools for both inspectors and operators, and particularly the Omega 9 guidebook.

The periodical review of safety reports in France

In France, until 2017, the process of the periodical review of the safety report was "traditional": the industrial operator had to revise the report. In February 2017, the French Competent Authority (CA) has published a new procedure (Notification of February 8, 2017) that modify the process, and requires that the operators looked at elements that aren't seen in the safety report, and forced them to ask themselves some questions that they weren't obliged to ask before. This new process is the obligation to write a "review notice" that asks to look at 11 points. The elements brought in response to these 11 points must lead the operator to see if its establishment is still in adequation with its environment and if new risk management measures may be implemented to reduce the risk level. Depending on the conclusion, the safety report has to be lightly updated or revise it (at least partly) because one of its conclusions has evolved. Once written, the review notice is sent to the CA, which will process it (along with the revised safety report, if applicable).

The 11 points to look at in the review notice

The notification published by the CA in February 2017 has listed 11 points that must be looked in the review notice. They are the following: 1. Evolutions of professional standards in terms of good practices in safety, 2. New available technologies of safety measures, 3. Technical and scientific evolutions regarding substances and dangerous phenomena, 4. New regulation and new prescriptions taken by the Competent Authority since the last safety report, 5. Non-compliance or gaps noticed during inspection by the Competent authority or following internal inspections, and measures taken following these inspections, 6. Observations make during the periodic inspections of equipment under the Industrial Facilities Modernization Plan regulation 7. Modifications of the facilities that could impact scenarios studied in the safety report, 8. Failure of safety measures, feedback on accident and incident that have occurred on the facilities, the industrial group and sector, 9. Feedback on emergency plan activation and exercises, 10. Evolution of the environment and stakes around the facilities, 11. Need for a new risk analysis. These points are developed in the next paragraphs.

Evolutions of professional standards in terms of good practices in safety and their application

Most companies are members of professional associations, regrouping actors of a field of expertise, at a regional, national or international level. Some of these associations developed guidebooks or professional standards that regroup the best practices in diverse domains, including safety and risks. For instance, France Chimie, the French association of chemical industry, is regularly publishing technical documents regarding methods to control equipment or presenting methods to take flooding risks or domino effects into account on a facility. These documents enable industrial operators to be aware of the best practices in terms of safety in their field of expertise. This point aims to detail the relevant international standards applied by the operator.

New available technologies of safety measures

This second point is one of the most important of the notice. The facilities operator has to look at its safety measures to check if they still are adapted and if more effective ones can be set up to replace them or to be added to them. The safety measures targeted are the one valorized in the risk estimation (in terms of probability and Severity). Indeed, some technologies can evolve a lot in five years, and new sensors or new automatic safety measures for instance may be available with better characteristics: a better reliability, a shorter response time, a better resistance in a specific environment (severe weather, acid environment), etc.

Not only the operator must look at these technologies, but it also needs to rank them in a list and hierarchize them considering their impact in terms of reduction of the probability of occurrence or severity of dangerous phenomena and their ratio cost / improvement in terms of safety. It must then explain which measure(s) it will set up in its facilities and when. This ranking is a new requirement, implemented in 2020 in a regulatory package concerning industrial risks taken in response to the Lubrizol accident in Rouen in 2019. Furthermore, the CA has precised that no public guidance will be published to help the operators. Indeed, the CA want each operator to brainstorm, to make this exercise to be aware of which solutions exists in term of safety measures adapted to its facilities.

Technical and scientific evolutions regarding substances and dangerous phenomena

As in five years the knowledge of the substances and their hazard may evolve, the notice asks the operator to check if new knowledge has appeared since the last safety report. This knowledge may be their properties of hazard (flash point, boiling point, etc.), the toxic thresholds to study or even the models used to determine the intensity and the distance reached by their effects.

New regulation and new prescriptions taken by the CA since the last safety report

Prescriptions regarding Seveso facilities can be of two different levels: national (France), and specific to the establishment. Indeed, in France, ministerial decrees concerning activities or products list minimal requirements and prescriptions for this activity. On top of these decrees, the Competent authority delivers decrees specific to each establishment, with prescription that can be harsher or lighter (exemptions of some particular prescriptions) for the facilities, depending on their particularities. If new prescriptions regarding accidental risks have been taken since the last safety report, they may have an impact on the facilities (reduction of authorized storage capacity, new safety measures to set up, etc.) and on the scenarios of danger, which, by the way, need to be checked and if needed reevaluate in terms of probability and intensity.

Non-compliance or gaps noticed during inspection by the Competent Authority or following internal inspections and measures taken following these inspections

The CA must inspect an upper-tier Seveso establishment at least once a year, on various subjects. Each inspection results in an inspection report. If non-compliances of the prescriptions have been identified, the operator must take measures in response and eventually write an answer to the observations of the Authority. This point of the review notice is the opportunity to resume all observations and non-compliances since the last safety report and the actions taken by the operator in response. If some of these have an impact on the scenarios of danger, they must be taken into account in the safety report.

PMII

This acronym stands for the Industrial Facilities Modernization Plan ("Plan de Modernisation des Installations Industrielles" in French). This plan synthetize the policy related to the controls of aging of various equipment on industrial facilities. At this point of the review notice, the operator looks at the controls it had to do regarding the aging of its facilities on the last five years, and identifies the problems or non-conformities constated and replacements or work that have been done following these controls.

Modifications of the facilities that could impact scenarios studied in the safety report

This point is, with the point 2, one of the most important of the notice. As industrial facilities often evolve, it is the place to summarize all modifications that have happened since the last safety report. Indeed, for a major modification, a new safety report is required by the regulation, but a minor one only require the operator to inform the CA. In five years, a lot of minor modifications could have happened, and their addition could have major implications. Even if the changes do not modify the potential major accident and the conclusion of the safety report, this synthesis is useful for the update of the descriptive part of the safety report, but if they have an impact, the study of the scenarios of danger must be reevaluate, whether it raises or reduces the risk level.

Failure of safety measures, feedback on accident and incident that have occurred on the facilities, the industrial group and sector

The safety measures of an industrial facility are regularly solicited, whether for tests or in real situations. This point of the review notice is the opportunity for the operator to make an appraisal of the number of failures of safety measures (if any) regarding the number of solicitations. This allowed both the operator and the CA to see if the safety measures implemented really are efficient and reliable or if they need to be changed. On this point, a study of the accidentology, both internal (establishment / group) and external (databases, medias, professional associations, etc.) is also asked, in order to see if scenario that haven't been identified in the risk analysis of the safety report have occurred in similar facilities. If that is the case, the risk analysis of the safety report needs to be updated, as for the detailed risk study of the new scenarios identified.

Feedback on emergency plan activation and exercises

In France, upper-tier Seveso establishments have to test their internal emergency plan at least once a year with an exercise. Regarding external emergency plan, describing the emergency response of the State services, the frequency of exercises is once every three years. Following each exercise, a feedback is done, recapitulating procedures and equipment that worked as expected but also what didn't work and need to be improved. Improvements take following such exercises could impact the scenarios studied in the safety report (to reduce the risk level).

Evolution of the environment and stakes around the facilities

The evolution of the environment of the facilities must be studied for two reasons. The first one is as the environment seen as an aggressor of the facilities. Indeed, if a new industrial establishment has settled nearby, it may be source of domino effects impacting the facilities. So, they could create new scenarios or modify existing ones by increasing their probability of occurrence. The second aspect of the environment's evolution to look at is as stakes that may be impacted by the scenarios of danger. If new housing, companies, or establishments open to the public have been built within the distance of impact, or if the number of vehicles on the ways of communications has changed, the severity of some dangerous phenomena, that is to say the number of people impacted, may have increased.

Need for a new risk analysis

Thanks to all the elements of the previous points ( §4.1 to 4.10), this step is the moment to ask if the facilities need a new risk analysis. As a good practice, Ineris considers that the risk analysis needs to be updated at every review of the safety report (at least every five years). The best option being to update the risk analysis continuously at each change on the facilities.

Decomposition products in case of fire

Another adding of the post-Lubrizol regulation, the review notice following 2021 needs to include the list of the decomposition products that can be found in the smoke in case of a fire on the facilities. This is now required in order to help emergency services to determine the worst-case toxicity of the smoke for the emergency responders, the population and the eventual composition of the ash deposit.

The conclusion of the review notice and its follow-ups

The elements brought in response to these 11 points must lead the operator to answer these three questions:

• Are safety measures effective? Did new ones need to be implemented to decrease the risk level? • Are the conclusions of the safety report still valid?

•

Is the establishment still in adequation with its environment? If the answer to these three questions are "Yes", in this case, the operator only has to update the safety report to include the slight evolutions. If at least one answer is "No", a new version of the safety report (a revised safety report) has to be written and then processed by the CA. Following a new safety report, new prescriptions may be added to the establishment.

Comparison of the review notice process and the automatic revision of the safety report

The comparison is made on the two following items: the scope of the periodical review and the workload for both operators and the CA. A brief synthesis on the limits of such a periodical review is also give in §6.3.

Scope of the periodical review

As shown in the previous chapters, the review notice must look at various points, some of them not being developed in a French safety report, as the history of inspections (internal ones or by the CA) or the emergency plan exercises for instance. So, with the review notice, these items are studied by the operator and interpreted in terms of impact on the risk management on the facilities. This is a progress compared to the automaticity of a revision of a safety report, as these points matter in industrial safety.

Work charge for the operator and the CA

If the modifications of the facilities, the environment or the regulation are slight or inexistent, the procedure of the review notice is lighter than revise a safety report. Indeed, the notice being shorter than a full safety report (a few dozen pages instead of a few hundred), the operator who must make this document can save some time (even if an update of the safety report may be done, which implied some more work, even to a lesser extent than a revision of the safety report). As the SHE services of industrial establishments often are overloaded, it can be valuable. On the same way, the CA will have to process shorter document and so, will also save time. Still, the CA may (or must) inspect the facilities to check what is said in the review notice. On the contrary, if the changes may impact the conclusions of the safety report, the operator has to make a new safety report in addition to the review notice, which is more time-consuming for him. Regarding the CA, it will have the two documents to process, but as the review notice is an explanation of the evolution of the safety report, it could not require a lot more time to process both documents. As a reminder, the CA can still require the operator to revise its safety report at any time, and in particular if it disagrees with the conclusions of the review notice.

Limits of the periodical review

The periodical review, whether as a review notice or as a systematic revision of the safety report has its limits. Indeed, Ineris identified two main limits:

• There is no explicit legal obligation for upper-tier Seveso establishment operators to update its risk analysis, e.g. to take back the tables (or bow ties depending on the method used) and look at each event, each cause and safety measure and ask if they still are possible and if new ones need to be studied. It may take a lot of time to do it for the whole establishment with a relevant work group, but , according to Ineris, it is not a waste of time, and it enables all the members of working group to have a precise idea of what can happened and what is the role and importance of safety equipment and procedures. As said in §4.11, Ineris recommends that the risk analysis must be constantly updated to be representative of the facilities.

•

On a wider scope than the risk analysis, the safety report must not be only an administrative document but an evolutive document at the center of the risk management of the facilities, and so need to be operational (can be used for inspections, the emergency plan, the monitoring of safety measures, etc) and up to date. A review every five years can be a good solution as a summary of evolutions, but a constant work to keep the safety report up to date would be more adapted.

Conclusion

Since the Notification of February 8, 2017 delivered by the French Competent Authority on industrial risks, the periodical review of safety report for upper-tier Seveso establishments, as required by the Seveso III Directive, is made by writing a "review notice" rather than an automatic update or revision of the safety report. This review notice must study 11 points, among which the evolution of the facilities, the environment, the regulatory prescriptions or the feedback on accidents, exercises and inspections. This review notice is a progress because some of these points may not have been studied before, and depending on the conclusion of the notice, the safety report need to be updated (light changes) or revised (heavy changes, and then processed by the competent authority). However, it is still strongly recommended to update the risk analysis and the bow ties in the context of the periodical review process.

  Description of the studied facilities, identification of the hazard potentials and accidentology study, • Risk analysis, • Detailed risks study: o Modeling of the dangerous phenomena and evaluation of the safety distances, o Evaluation of the severity of the effects (i.e. the number of people impacted), o Evaluation of the probability of occurrence of the dangerous phenomena by the use of bow tie methodology, o Evaluation of their kinetic, • Conclusion on the acceptability (see figure below).

Figure 1 :

 1 Figure 1 : Risk matrix used in France