C Mandin

R Meininghaus

A Cicolella

Use of a sensory irritation potential index to characterize improvement indoor air quality in French schools by ventilation

Keywords: School, Ventilation, VOCs, Irritation potential index

After several cases of health problems in French schools, a methodology for health risk assessment related to indoor air quality (IAQ) was required. Based on measured concentrations in schools where acute symptoms possibly due to exposure to airborne sensory irritants were reported, an index quantifying the sensory irritation potential was built and used. This paper focuses on one classroom where the index was successively applied without any ventilation system, after the implementation of passive ventilation grids and with a mechanically controlled ventilation. The decrease of the index value was correlated with an improved IAQ perception by pupils and teachers since no complaint occurred any longer. It shows the ventilation efficiency in removing irritating volatile organic compounds (VOCs) and the validity of our IAQ irritant potential index.

INTRODUCTION

IAQ in schools is a topic that stimulates a lot of national research programs. Not only scientific attention, but also parents and school administrators' preoccupation grew in recent years. Children belong to a susceptible group of population and bad IAQ can influence learning capacities (US-EPA, 2003). It is thus necessary to assess IAQ with both building inspection and relevant air sampling in order to explain complaints typical of sick building syndrome, avoid them and in the end guarantee a healthy and comfortable indoor environment. With this aim, we used an IAQ irritant potential index.

METHODS

Location

Strong headaches, breathing difficulties, and nose bleeding were regularly reported by pupils and teachers in a French school in Autumn 2001. Approximately 300 children (9-11 years old) and 10 adults used to come four days a week. The building (one floor, 1000 m 2 ) consists of a hall, 11 classrooms and one office constructed three months before on a site without industrial history. It is located in a residential area of a small French city. At the end of a dead end street with very little traffic, the building is surrounded by houses and another school with school yard, where people, teachers and pupils did not complain about similar symptoms. There was no ventilation system at the beginning of the study.

After a careful building inspection with regard to potential chemical and biological emission sources (furniture, household products, water damage), no relevant sources were clearly identified. VOCs, aldehydes and ketones measurements were thus done.

Sampling and Analyses

Active sampling devices (Sep-pack® cartridges) were used to trap aldehydes and ketones. After sampling, the cartridges were extracted with 2 ml acetonitrile. The extracts were analysed with HPLC separation (KROMASIL CIS 150 mm-3 mm-3.5 urn) and UV detection (A = 365 nm). VOCs were trapped with active device on a sorption tube (Carbotrap®) and analysed by thermodesorption (350°C during 5 min) and GC-MS (column DB30, 30 m) or GC coupled with FID. As relative humidity (RH) may play a role in eye, nose, and airway irritation, RH and temperature were hence measured.

The samplers were limited to one classroom where symptoms were mostly described. In this unoccupied classroom, the first series of measurements took place in January 2002 (Cl in Table 1), the second after the installation of two passive ventilation grids (10x5 cm) in March 2002 (C2 in Table 1), and the last one after the implementation of mechanically controlled ventilation in May 2002 (C3 in Table 1). In this latter experiment phase, sampling was also conducted with 26 pupils and two adults in the classroom to assess the impact of human presence on results (not reported in Table 1).

Sensory Irritation Potential Index

*/

A weighted sum parameter for sensory irritation (Eqn 1) was used to evaluate IAQ. The general approach for the development of such an IAQ index has been previously used [START_REF] Ten Brinke | Development of a new volatile organic compound (VOC) exposure metrics and their relationship to "sick building syndrome[END_REF][START_REF] Meininghaus | A weighted sum parameter to simplify discussion on aldehyde exposure[END_REF][START_REF] Meininghaus | Risk assessment of sensory irritants in indoor air-a case study in a French school[END_REF] and is, therefore, only briefly described.

When assessing the risk of compounds with regard to their health effects, their concentrations are compared to toxicological reference values (TRY), which in turn, are often derived from animal studies by including safety factors. If the concentration of a target compound remains below its TRV, the risk of developing corresponding health effects is considered to be negligible. In the present study, TRV are selected or developed based on the symptoms of sensory irritation by inhalation. Since no specific IAQ guideline values exist, either existing TRV for ambient air are selected or TRV from IAQ literature are proposed (WHO, 2000; ATSDR; [START_REF] Nielsen | Toxicological based air quality guidelines for substances in indoor air[END_REF]. When no international or national guideline value is available, tentative guideline values are developed on the basis of toxicological data such as RDso, i.e. the concentration inducing a 50 % decrease in respiratory rate in mice.

When assuming additivity of sensory irritation [START_REF] Flemming | Sensory irritation to mixtures of formaldehyde, acrolein, and acetaldehyde in rats[END_REF], a weighted sum parameter (Eqn (1)) may be used to assess the summed effect of sensory irritants. Here, the concentration of a potential sensory irritant is divided by its corresponding TRV:

If S remains below 1 , it may be reasonable to assume that the risk of developing the irritant effects following inhalation of the studied mixture is not likely.

RESULTS

The main identified pollutant concentrations are reported in Table 1 . Table 2 summarizes the different S sums calculated. 100 (WHO) 5000 (RDso) 77,000 (RDs,,) 1000 (QMS) 4400 (ATSDR) 8000 (RD 5( >) 2600 (RD, 0 ) 180(RD 5 o) ' reference indicates that the approach based on RDso and described by (Nielsen et ai, 1996;[START_REF] Meininghaus | A weighted sum parameter to simplify discussion on aldehyde exposure[END_REF] is used.

DISCUSSION

Measured concentrations confirm that studied indoor air contains a mixture of pollutants without particularly high indoor levels. No specific pollutant can be proposed as responsible for irritation symptoms. Each of these chemical compounds is present in a typical range of indoor concentrations considering comparable data from recent literature [START_REF] Gonzalez-Flesca | Pilot study of personal indoor and outdoor exposure to benzene, formaldehyde and acetaldehyde[END_REF][START_REF] Ulrich | Indoor air concentrations of aldehydes-a field study using DNPH diffusive sampling[END_REF][START_REF] Meininghaus | Indoor and outdoor aldehyde concentrations in a medium-sized French town[END_REF]Smedge, 2001). Moreover, each of them, considered separately, is below its TRV for acute sensory irritation effect following inhalation. However, when looking at the mixture of studied compounds, different results are obtained since the risk of developing sensory irritation is not negligible when no ventilation system is present. As soon as ventilation was installed, complaints disappeared slowly and S fell below 1. IAQ is clearly improved with passive ventilation grids, and even better with mechanically controlled ventilation. Ventilation systems as a solution to improve IAQ were installed since no alternative aiming at reducing the responsible pollutant emissions could be suggested (new furniture, new flooring material, end of one product use).

One of the limits of the proposed index is that the sampling strategy is based on the assumption that measured concentrations are representative of levels to which all individuals are exposed at all times in the classroom, which is not necessarily the case.

CONCLUSION

The health risk assessment of airborne irritants detected in the school indoor air using the sensory irritation potential index allows us to appreciate global IAQ when no specific pollution can be identified. The evolution of S index shows that the index might be reliable to estimate IAQ irritant potential, and that ventilation is a good way to improve IAQ when sources cannot clearly be identified and immediately removed.

The index should be refined with measurement and characterization of the irritating potential of other pollutants, for example, particles, fibres, microbiological pollutants, reactive compounds.

Table 1

 1 Indoor air concentrations (|ug/nr ) measured in the same unoccupied classroom

		Cl (without C2 (passive C3	Toxicological
		ventilation) ventilation)	(mechanical reference value
				ventilation)	(ug/m 3 )
	Formaldehyde	50.3	35.8	16.6
	Acetaldehyde	28.4	16.2	37.8
	Acetone	656	57.1	26.3
	Toluene	93.6	38.6	34
	Xylenes	1 015	326	97
	Ethylbenzene	195	85	26
	Butyl acetate	198	35.7	10
	2-Ethylhexanol	124	43	21

Table 2

 2 Sensory irritation potential index S in 3 ventilation configurations Without ventilation Passive ventilation Mechanical ventilation

	S index	2.05	0.78	0.32

"Corresponding author. E-mail: corinne.mandin@ineris.fr

ACKNOWLEDGEMENTS

We thank E. Burgei from the Health Services Department for providing helpful advice and M. Fleho from Bussy-Saint-Georges Technical Services for his collaboration.


G Marlair
email: guv.marlair@ineris.fr

A Tewarson

EFFECTS OF THE GENERIC NATURE OF POLYMERS ON THEIR FIRE BEHAVIOR

Keywords: flammability, fire properties, ignition, combustion, and fire propagation

Fire behavior of four aliphatic and two aromatic C, H, O, N, S, and Cl atom containing polymers has been examined. Experiments were performed in three ASTM E 2058 Fire Propagation Apparatuses. The differences in the ignition behavior of polymers were found to be mainly due to differences in the ignition temperature. Chemical effects appear to contribute about 25 % towards the ignition resistance of the polymers. For thermoplastics, formation of polymer melt and its burning as a pool fire was found to increase the fire intensity by factors of two to four. The combustion efficiency and generation efficiency of CO 2 were found to decrease and the generation efficiencies of CO and smoke were found to increase by changes in the generic nature of the polymers (aliphatic to aromatic to halogenated). About four times as much carbon atoms in the polymers converted to smoke than converted to CO. Large-scale fire propagation behavior of polymers was characterized by a Fire Propagation Index (FPI). The FPI values of melting type thermoplastics (showing rapid-fire propagation behavior) were high, whereas they were low for the engineered charring type and halogenated polymers (showing either slow or decelerating fire propagation behavior).

INTRODUCTION

Polymers are macromolecular organic materials manufactured by the modification of natural products or by synthesis from suitable intermediates. The number of basic polymers is large, the list is growing, and variations and modifications to these basic polymers, and co-polymers are quite large. Almost all the polymers consist of hydrogen, oxygen, nitrogen, sulfur, chlorine, fluorine, and silicone atoms bonded alone or in combination with other atoms to the polymer backbone of carbon atoms with different types of chemical bonding. Polymers can be predominantly crystalline, amorphous or a combination of both the natures. In predominantly crystalline polymers, chains are packed together more efficiently and tightly than in the amorphous polymers [START_REF]Physical Properties of Polymers Handbook[END_REF]. Polymers with higher crystallinity have higher thermal stability than amorphous polymers. All these differences are reflected in wide variations in the fire behavior of polymers.

In our study, we have attempted to examine the differences in the fire behavior of polymers because of variations in their generic nature and physical and chemical properties. Four aliphatic and two aromatic polymers with H, O, N, S, and Cl atoms bonded to the polymer backbone of C atoms were examined. Independent experiments were performed in the three ASTM E 2058 Fire Propagation Apparatuses [START_REF] Astm E | [END_REF], one at INERIS, one at FM Global Research (FMR) and one at FM Approvals.

EXPERIMENTAL POLYMERS USED IN THE STUDY

The following polymers were examined as sheets from original resins, without any additives, except those used for processing: 1. The data indicate that the resins are relatively pure with negligible amounts of impurities or additives. Additional information on the polymer samples, data analysis and experimental facilities are described in Ref [START_REF] Marlair | Interflam'01-Ninth International Fire Science and Engineering Conference[END_REF]. For the analysis of experimental results, these data along with the literature data listed in Table 2 were used. samples expanded when exposed to external heat flux due to charring. Ignition experiments were performed under quiescent normal airflow condition with a small pilot flame close to the surface. The entire sample surface was exposed to external heat flux in the range of 10 to 60 kW/m 2 . Combustion experiments were performed under co-normal airflow rate of 158-mm/s (volumetric flow rate of 2.9 x 10 irrVs) with entire surface exposed to 50 kW/m 2 of external heat flux. The fire propagation experiments were performed in 40 % oxygen concentration in the co-air-oxygen mixture flowing at a rate of 158-mm/s (volumetric flow rate of 2.9 x 10 nr/s). Only the 120-mm bottom part of the sample was exposed to 50 kW/m 2 of external heat flux in the presence of a pilot flame in the fire propagation experiments.

In the ignition experiments, ignition-time was measured as a function of the external heat flux. In the combustion and fire propagation experiments, measurements were made for the release rates ofpolymers vapors, heat, and products.

IGNITION

In the experiments, ignition-time, defined as the appearance of a sustained flame, was measured visually by a stopwatch. The measured ignition-time at each flux from the three laboratories varied between 3 to 15 % of the average value for the non-charring and nonexpanding POM, PMMA, and nylon and between 4 to 31% of the average value for the charring and expanding PC, PSF, and PVC. The variations were higher at lower heat fluxes than for heat fluxes > 30 kW/m 2 , where the variations were only between 3 to 10% of the average value for all the polymers, a range used to obtain the ignition properties of the polymers.

The ignition-time and external heat flux relationship shown in Fig. 2 for POM is very similar for all the polymers and has been analyzed using the following well known relationship for thermally thick conditions [10]:

The term (T i g -T a )ykpc is defined as the Thermal Response Parameter (TRP) of the polymer [START_REF] Tewarson | [END_REF]. q cr is the minimum heat flux at or below there is no sustained ignition, which is about 10 kW/m 2 in Fig. 2. The TRP value is derived from the inverse of the slope in the range of që> 30 kW/m 2 . q j ! r and TRP values derived in this fashion are listed in Table 3.

The TRP values from the three laboratories vary between 6 to 11% of the average value. There is no variation in the q j ! r values. The values are lower for the aliphatic polymers compared to the aromatic and aliphatic halogenated polymers.

Data in Table 3 and for many polymers listed in the literature [START_REF]Physical Properties of Polymers Handbook[END_REF][START_REF] Domininghaus | Plastics for Engineers-Materials, Properties, Applications[END_REF][START_REF] Abu-Isa | Thermal Properties of Automotive Polymers I. Thermal Gravimetric Analysis and Differential Scanning Calorimetry of Selected Parts from a Dodge Caravan[END_REF][START_REF] Abu-Isa | Thermal Properties of Automotive Polymers II. Thermal Conductivity of Parts Selected from a Dodge Caravan[END_REF][START_REF]Handbook of Plastics and Elastomers[END_REF] show that the ykpc component of TRP is approximately constant with an average value of 0.72 ± 19 %. The differences in the TRP values in Table 3 thus are mainly due to the differences in the T ig values. This is supported by the estimated 1 y kpc values also listed in Table 3, which are very similar to the calculated -yjkpc values. The T ig values of polymers depend on the chemical bond dissociation energies and generic nature of the polymer vapor in addition to thermal effects [START_REF] Tewarson | Chapter 12 in Polymers and the Environment-A Handbook[END_REF][START_REF] Tewarson | Fire Safety Science, Proceedings of the Sixth International Symposium[END_REF]. For ordinary polymers, T ig « vaporization (T v ) or decomposition temperature (T d ), which supports the influence of the bond dissociation energy on the ignition behavior [START_REF] Tewarson | Chapter 12 in Polymers and the Environment-A Handbook[END_REF][START_REF] Tewarson | Fire Safety Science, Proceedings of the Sixth International Symposium[END_REF]. For high temperature and highly halogenated advanced engineered polymers, T ig » T v /T d suggesting the influence of both bond dissociation energy as well as of the generic nature of the polymer vapors [START_REF] Tewarson | Chapter 12 in Polymers and the Environment-A Handbook[END_REF][START_REF] Tewarson | Fire Safety Science, Proceedings of the Sixth International Symposium[END_REF]. It is estimated that chemical factors contribute to some 25 % in the TRP value [START_REF] Tewarson | Chapter 12 in Polymers and the Environment-A Handbook[END_REF]. It is, therefore, necessary to account for factors such as energies associated with chemical bonds and chemical nature of the vapors in addition tothermal effects to describe the ignition behavior ofpolymers.

The -v/kpc values of polymers were estimated from the expression:

,0.25.

TRP/[{(q cr ) 3x364} -293],

where it is assumed that heat losses are mainly due to surface reradiation, polymer surface acts as a black body and the ambient temperature is 20 °C.

COMBUSTION

In the experiments, release rates of polymer vapors, heat, and fire products were determined 2 . In the experiments at 50 kW/m 2 , the 10-mm thick melting type polymers (POM, PMMA, and nylon) burned as liquid pool fires, whereas the 10-mm thick charring type polymers (PVC, PC, and PSF) burned as solid polymers. Thus, the data for POM, PMMA, and nylon are for the combustion of polymer melts whereas the data for PVC, PC, and PSF are for the combustion of solid polymers. The polymer vapors, heat and product release rate profiles and steady state (maximum) values from the three laboratories were in excellent agreement, such as shown by the data in Fig. 3 for the heat release profiles for POM and by the steady state data in Table 4

3 ' 4 .
For heat release rate from the Oxygen Consumption and Carbon Dioxide Generation Calorimetries, net heat of complete combustion per unit mass of oxygen consumed and CO and CO 2 generated were obtained from the data in Table 1.

Combustion efficiency (%) is defined as the ratio of the chemical (actual) heat of combustion to the net heat of complete combustion or the combustion experiments at q= 50 kW/m , the release rates of polymer vapors, heat, and products can be expressed as:

m"=(q>qï-C)/AH g (2)
Qch =(AH ch /AH g )(q;' +q; -q n ) = %(AH T /AH g )(q +q f -q rr ) (

; T ;;; ;+q;-q; r )

In the combustion experiments, flames were completely lifted off the surface due to high release rate of polymer vapors. Under this condition, q f value can be assumed negligibly small and m values can be predicted from 4 for the three charring type polymers (PVC, PC, and PSF) is similar to the predicted range. The measured range for m values for melting type polymers (POM, PMMA, and nylon), however, is significantly higher than the predicted range for the solid polymers, but similar to that for the generic similar liquids. For example, the predicted m values are 50, 55, 93 x 10" kg/m-s for methanol, hexadecane, and butanol respectively at 50 kW/m 2 [START_REF] Tewarson | Flammability Properties of Engine Compartment Fluids Part I. Combustion Properties of Fluids Containing Carbon, Hydrogen, and Oxygen[END_REF].

AH
The measured range of m values for the melting type polymers (POM, PMMA, and nylon) are similar to the predicted m" range at 50 kW/m 2 for generically similar liquids. These observations suggest that formation, flow, and burning of polymer melt as liquid pool fires are critical stages in fires in thermoplastics (thickness <10-mm for që > 50 kW/m 2 ). The importance ofthese behaviors was also found critical in large-scale fires of 3 to 5-mm thick polymer parts ofaminivan [13]. 4 Generation efficiency (fj ) of a product is defined as the ratio of the yield of the product to its maximum possible stoichiometric yield based on its elemental composition [8]. For example for the calculation of the maximum possible stoichiometric yield of CO, it is assumed that in the combustion all the carbon atoms in the polymer are completely converted to only CO. l sm-Combustion Efficiency and Generation Efficiency of Products Data in Table 4 and Figs. 4 and5 indicate that % « f c o2 > that these two parameters are inversely proportional to fcoand f sm and that there is a linear relationship between fcoand f sm . The data also show that % and fCo2 decrease and fCo and f sm increase as the generic nature of the polymers changes from aliphatic to aromatic to halogenated. About four times as much carbon atoms are converted to smoke compared to the conversion to CO. Molecular weight of the monomer appears to have a stronger effect on In the experiments release rates of heat and products during upward fire propagation and initial and final weight of the sample were measured. Fire propagation was very rapid for POM and PMMA, but was slow for PVC, PC, and PSF. Fire propagation experiments could be not be performed for nylon 6,6 due to rapid melting. The heat and product release rate profiles during fire propagation, from the three laboratories, were in excellent agreement, as shown in Fig. 6 for PMMA.

For examining the upward fire propagation behavior of polymers, theoretical expression for the flame spread velocity [START_REF] Quintiere | [END_REF][START_REF] Feraandez-Pello | [END_REF] was utilized. With an assumption that the forward heat transfer from the leading edge of the flame is proportional to (Q/w) n , flame spread theories [START_REF] Feraandez-Pello | [END_REF] suggest the following expression for the upward fire propagation velocity: v 1 ' 2 x (Q r /w) n /(T ig -T a )(kpc D )"p; Based on the correlation between small-scale and large-scale upward fire propagation experiments, Eq 5 is modified as follows [START_REF] Tewarson | Twenty-Second Symposium (International) on Combustion[END_REF][START_REF] Tewarson | [END_REF]: Based on the visual observations in small-scale and largescale fire propagation experiments, the following behaviors have been observed [START_REF] Tewarson | [END_REF][START_REF] Tewarson | Chapter 12 in Polymers and the Environment-A Handbook[END_REF][START_REF] Tewarson | Twenty-Second Symposium (International) on Combustion[END_REF][START_REF] Tewarson | [END_REF]: 1) For FPI < 6: flames are close to extinction conditions and fire propagation is limited to the ignition zone (area where surface is exposed to external heat flux in the presence of a pilot flame); 2) For 6 < FPI< 10: fire propagation is decelerating and stops short of the sample length; 3) For 10<FPI< 20: there is fire propagation beyond the ignition zone; 4) For FPI > 20: fire propagation beyond the ignition zone is very rapid.

Excellent correlation has been found between the FPI values from the smallscale and large-scale tests [START_REF] Tewarson | [END_REF][START_REF] Tewarson | Chapter 12 in Polymers and the Environment-A Handbook[END_REF][START_REF] Tewarson | [END_REF]. The FPI concept thus has been adopted for the acceptance of polymers in the clean rooms of the semi-conductor industry by FM Approvals and Underwriters Laboratories (UL) [START_REF]FM Approvals Test Standard[END_REF][START_REF] Ul | Standard Test Method for Determining the Combustibility Characteristics of Plastics Used in Semiconductor Tool Construction[END_REF], and for electrical cables and conveyor belts by FM Approvals [START_REF]Specification Standard for Cable Fire Propagation. Class 3972[END_REF][START_REF]Approval Standard, Class 1 Conveyor Belting, Class No. 4998[END_REF]. Thus, we have also used the FPI concept in this study to describe the fire propagation behaviors of the selected polymers.

Since there is an excellent agreement between the three laboratories for the heat release rate profiles and TRP values, FPI values from the three laboratories also show excellent agreement as indicated in Fig. 7.

The FPI value of PMMA [START_REF] Orloff | Sixteenth Symposium (International) on Combustion[END_REF] suggest rapid propagation that is confirmed by the data from the large-scale parallel tests [START_REF] Tewarson | Chapter 12 in Polymers and the Environment-A Handbook[END_REF][START_REF] Tewarson | [END_REF] and many large-scale vertical wall fires [START_REF] Orloff | Fifteenth Symposium (International) on Combustion[END_REF][START_REF] Orloff | Sixteenth Symposium (International) on Combustion[END_REF][START_REF] Quintiere | [END_REF]. The FPI value for POM is 13 for which fire propagation was observed to be rapid. For char forming polymers (PC and PSF) and halogenated polymer (PVC), the

The FPI values were in the range of 6.9 to 8.4, for which fire propagation was observed to be either slow or decelerating. Thus, all the factors that influence the variations in the ignition and combustion behaviors of polymers are also responsible for the differences in the fire propagation behavior. SUMMARY 1) Under similar experimental conditions, differences in the ignition, combustion, and fire propagation behaviors of polymers are found to be influenced by the generic nature and molecular weight of the monomer; 2) Ignition temperature appears to be the main factor affecting differences in the ignition behavior of polymers. The ykpc values are weakly dependent on the generic nature of the polymers. About 25 % of the ignition resistance is due to differences in the generic nature of the polymers; 3) The combustion efficiency and generation efficiency of CO 2 decrease and the generation efficiencies of CO and smoke increase as the generic nature of polymers changes from aliphatic to aromatic to halogenated. The combustion efficiency and generation efficiencies of products are closely related. A direct linear relationship is found between the generation efficiencies of CO and smoke, whereas an inverse nonlinear relationship is found between the generation efficiency of CO 2 and that of CO and smoke; 4) About four times of the carbon atoms in the polymer are converted to smoke than to CO; 5) Generation rate of vapors for polymers that burn as solids is well predicted from the heat of gasification and surface reradiation loss at high external heat flux values where flame heat flux is negligibly small. The generation rate of vapors for polymers that burn as liquid pool fires however is under-predicted, suggesting that heat of gasification values for liquids rather than that of solid polymers need to be used. 6) Large-scale fire propagation behavior of polymers is well characterized by a Fire Propagation Index (FPI). Melting type ordinary thermoplastics have high FPI values and have been observed to have rapid-fire propagation. The FPI values for the engineered charring type and halogenated polymers are low and have been observed to have either slow or decelerating fire propagation beyond the ignition zone.

Figure 2 .

 2 Figure 2. Ignition-time versus external heat flux (Eq. 1) from the ignition data for POM measured in the ASTM E 2058 apparatuses. FMR: FM Global Research.

Figure 3 .

 3 Figure 3. Heat release rate in the combustion of POM in normal air at 50 kW/m apparatuses. in the ASTM E 2058 kg/m 2 -s for qe = 50 kW/m 2 . The measured range of m ' values in Table4for the three charring type polymers (PVC, PC, and PSF) is similar to the predicted range. The measured range for m values for melting type polymers (POM, PMMA, and nylon), however, is significantly higher than the predicted range for the solid polymers, but similar to that for the generic similar liquids. For example, the predicted m values are 50, 55, 93 x 10" kg/m-s for methanol, hexadecane, and butanol respectively at 50 kW/m 2[START_REF] Tewarson | Flammability Properties of Engine Compartment Fluids Part I. Combustion Properties of Fluids Containing Carbon, Hydrogen, and Oxygen[END_REF].The measured range of m values for the melting type polymers (POM, PMMA, and nylon) are similar to the predicted m" range at 50 kW/m 2 for generically similar liquids. These observations suggest that formation, flow, and burning of polymer melt as liquid pool fires are critical stages in fires in thermoplastics (thickness <10-mm for që > 50 kW/m 2 ). The importance ofthese behaviors was also found critical in large-scale fires of 3 to 5-mm thick polymer parts ofaminivan[START_REF] Ohlemiller | Burning Behavior of Selected Automotive Parts from a Minivan[END_REF].

2 Figure 4 .\

 24 Figure 4. Generation efficiencies of CO and smoke versus CO 2 efficiency for the well-ventilated combustion of polymers.

v 1 /=Figure 6 .

 16 Figure 6. Heat release rate profile for the upward fire propagation at 40 % oxygen concentration for PMMA. TRP, from the ignition experiments are used in Eq. 7 to calculate the FPI values.Based on the visual observations in small-scale and largescale fire propagation experiments, the following behaviors have been observed[START_REF] Tewarson | [END_REF][START_REF] Tewarson | Chapter 12 in Polymers and the Environment-A Handbook[END_REF][START_REF] Tewarson | Twenty-Second Symposium (International) on Combustion[END_REF][START_REF] Tewarson | [END_REF]: 1) For FPI < 6: flames are close to extinction conditions and fire propagation is limited to the ignition zone (area where surface is exposed to external heat flux in the presence of a pilot flame); 2) For 6 < FPI< 10: fire propagation is decelerating and stops short of the sample length; 3) For 10<FPI< 20: there is fire propagation beyond the ignition zone; 4) For FPI > 20: fire propagation beyond the ignition zone is very rapid.Excellent correlation has been found between the FPI values from the smallscale and large-scale tests[START_REF] Tewarson | [END_REF][START_REF] Tewarson | Chapter 12 in Polymers and the Environment-A Handbook[END_REF][START_REF] Tewarson | [END_REF]. The FPI concept thus has been adopted for the acceptance of polymers in the clean rooms of the semi-conductor industry by FM Approvals and Underwriters Laboratories (UL)[START_REF]FM Approvals Test Standard[END_REF][START_REF] Ul | Standard Test Method for Determining the Combustibility Characteristics of Plastics Used in Semiconductor Tool Construction[END_REF], and for electrical cables and conveyor belts by FM Approvals[START_REF]Specification Standard for Cable Fire Propagation. Class 3972[END_REF][START_REF]Approval Standard, Class 1 Conveyor Belting, Class No. 4998[END_REF]. Thus, we have also used the FPI concept in this study to describe the fire propagation behaviors of the selected polymers.Since there is an excellent agreement between the three laboratories for the heat release rate profiles and TRP values, FPI values from the three laboratories also show excellent agreement as indicated in Fig.7.The FPI value of PMMA[START_REF] Orloff | Sixteenth Symposium (International) on Combustion[END_REF] suggest rapid propagation that is confirmed by the data from the large-scale parallel tests[START_REF] Tewarson | Chapter 12 in Polymers and the Environment-A Handbook[END_REF][START_REF] Tewarson | [END_REF] and many large-scale vertical wall fires[START_REF] Orloff | Fifteenth Symposium (International) on Combustion[END_REF][START_REF] Orloff | Sixteenth Symposium (International) on Combustion[END_REF][START_REF] Quintiere | [END_REF]. The FPI value for POM is 13 for which fire propagation was observed to be rapid. For char forming polymers (PC and PSF) and halogenated polymer (PVC), theThe FPI values were in the range of 6.9 to 8.4, for which fire propagation was observed to be either slow or decelerating. Thus, all the factors that influence the

Figure 7 .

 7 Figure 7. Fire Propagation Indices for Polymers.

  1. Polyoxymethylene, POM (aliphatic: C, H, O atoms, M mono : 29 g/mole, melting type); 2. Poly(methylmethacrylate), PMMA (aliphatic: C, H, O atoms; M mono : 100 g/mole, melting type); 3. Nylon 6,6 (aliphatic: C, H, O, N atoms; M mono : 226 g/mole, melting type); 4. Poly(vinylchloride), PVC, rigid (aliphatic: C, H, Cl atoms; M mono : 62 g/mole, charring type), 5. Polycarbonate, PC (aromatic: C, H, O atoms; M mono : 238 g/mole, charring type); 6. Polysulfone, PSF (aromatic: C, H, O, S atoms; M mono : 442 g/mole, charring type). The measured elemental composition and net heat of complete combustion are listed in Table

Table 1 : Measured Elemental Composition and Net Heat of Complete Combustion of Polymers

 1

	Polymer	C	Elemental Composition (% Weight) H O N S	Cl	AH T MJ/kg
	POM	41.40	6.91	51.40	0.15	<0.04	<0.02	15.7
	PMMA	60.10	8.56	32.14	<0.1	<0.04	<0.02	24.8
	Nylon 6,6	61.86	10.25	17.82	11.98	<0.02	<0.02	29.2
	PVC (rigid)	38.90	4.77	4.33	<0.1	0.36	49.00	19.3
	PC	75.70	5.50	18.40	<0.1	<0.04	<0.02	29.9
	PSF	72.90	4.82	14.39	<0.1	8.2	0.02	30.4

Table 2 : Thermophysical Properties of Polymers from the Literature"

 2

	Polymers	kxlO 3 (kW/m-K)	p x 1(T 3 (kg/m 3 )	c (kJ/kg-K)	AH ch /AH g (MJ/MJ)
	POM	0.28	1.42	1.46	6
	PMMA	0.18	1.19	1.47	17
	Nylon 6,6	0.23	1.14	1.70	12
	PVC (rigid)	0.25	1.38	1.41	2
	PC	0.21	1.20	1.17	7
	PSF	0.28	1.24	1.30	5
	a: data are taken from Refs. 1,4,5,6,7, 8 and 9.

2058 Apparatus at fora11 the samPles ' because some of the INERIS F21

Table 3 . Ignition Properties of Polymers

 3

	Polymer	Lab	TRP (kW-s 1/2 /m 2 )	t ? Qcr (kW/m 2 )	(kpc) 1/2 (kw-s 1/2 /m 2 -K) From Table 2 Estimated
		INERIS	238			0.67
	POM (aliphatic C,H,O atoms)	FMR-1 FMR-2	286 294	10	0.76	0.81 0.83
		Average	204 ±11%		Average	0.77
	PMMA (aliphatic C,H,O atoms)	INERIS FMR-1 FMR-2 Average	200 196 217 204 ±6%	10	0.56 Average	0.56 0.55 0.61 0.58
	Nylon 6,6	INERIS	263			0.62
	(aliphatic C,H,O,N	FMR-1 FMR-2	244 278	15	0.67	0.58 0.66
	atoms)	Average	262 ±6%		Average	0.62
	PC (aromatic C,H,O atoms)	INERIS FMR-1 Average	323 313 318	25	0.54 Average	0.62 0.60 0.61
		INERIS	333			0.60
	PSF (aromatic C,H,O,S atoms)	FMR-1 FMR-2	357 313	30	0.67	0.64 0.56
		Average	334 ± 7%		Average	0.60
		INERIS	333			0.79
	PVC (aliphatic C,H,C1 atoms)	FMR-1 FMR-2	357 385	15	0.70	0.85 0.91
		Average	358 ± 7%		Average	0.85

Table 4 . Release rates of Polymer Vapors and Heat, Heat of Combustion and Yields of Products in the Combustion of Polymers

 4

	1/2

ACKNOWLEDGEMENTS

The financial support provided for this work (as part of the evaluation of the INERIS FPA) by the French Ministry for Land Use Planning and the Environment is gratefully acknowledged by one of us (GM).

NOMENCLATURE


E Plot

J C Le-Coze

An integrated Approach to Organise Major Risks Control in Hazardous Chemical Establishments

In the field of risk prevention, research is often divided or partial. Research workachieved or in progress -focuses on topics like technical risk assessment, organisation management or human factor: ergonomics, sociology, etc. But little work is dedicated to an integration of all these disciplines into a same methodology.

It is yet obvious that an effective control of major accident risks depends on the ability of an organisation to consider and integrate every aspect of prevention. A separate control of either human factor, or safety technical barriers, or safety management is of course necessary, but does not guarantee a sufficient prevention level on its own. Effective prevention requires the control of every means available.

From this statement, INERIS has started developing an original integrated method to control major accident risks of hazardous establishments under the scope ofSevesoII directive. The method is currently tested with voluntary French SEVESO II establishments.

Introduction

In January 2002, the European commission released the following statistics: the probability of an accident is 3 x 10" y"1 in industrial installations under the SEVESO II directive. It means concretely that for approximately 300 hundred installations, there is an accident per year. In most of the cases, accidents are described as having a close human or organisational components into it. Indeed, in May 1998, the MARS database, in charge of collecting major hazard within the European community indicates that the human contribution represents 64% of root causes of the declared accidents. These causes can be divided among operational errors or organisational issues. These cover different origins: inappropriate or non existing procedures (13%), bad design of interface (12%), lack of analysis or bad knowledge of the product in use (10%), error due to bad contractors management (10%), device failure following a maintenance operation (9%). These data clearly indicate the weight of human and organisational factors for the major hazard control.

The major accident analysis like the researches done on Bhopal, Flixborough already pointed out these factors, and this has been again recently emphasised after the AZF chemical installation that exploded, in Toulouse, France, in September 2001. The official commission concluded that, among many other propositions, the defence in depth concept could be applied to chemical plants and that the human factors and the organisation were key elements of this principle.

Today industrialists et authorities need methodologies and new tools, integrating the human factors, the organisational issues as well as the technical aspects in order to identify the major hazard risks, to design and improve sociotechnical systems they have in charge, assess their performance and learn from incident and accidents.

2. Meeting the requirements of regulations and facilitate the application of the law

Linking technical risk analysis and organisational features for the compliance

The first objective of that project is to suggest a method that meets the legal requirements of the so called European SEVESO n directive, translated in the French system through the "arrêté du 10 mai 2000", concerning the installation that have the potential for major hazards. That document requires the industrialists to implement a safety management system, depending on threshold of dangerous chemical products. The safety management system must contain several items: This method describes the activities required for major hazard prevention. It is believed that such a representation can facilitate the design, the implementation and the assessment of a safety management system that will meet the SEVESO II criteria.

The way these activities are combined is shown in the next figure (Figure 1).

There are 3 levels:

1. The starting point is the risk analysis activity. It identifies and assesses the major hazard scenario to be controlled.

Along with the identification of the major hazard scenarios, there are the related functions that ensure their prevention and mitigation, they could be described therefore as criticalfor safety, and therefore be identified as barriers. These critical functions can be met by critical technical devices (like an automatic shut down valve) or by critical activities (like the action of an operator who pushes a button).

2.

The device chosen for the critical functions are specified by technical requirements that describe their specifications. The critical activities depend as well on technical requirements. "Technical" because the actors in charge of ensuring the fulfilment of the critical activities always make use of methods and tools, like the procedures describing the way operations should be carried out, like the action of pushing a button, and these are, in that sense, considered as depending on technical requirements. The pushing button and the method here are seen as a technical assistance for the activity of the actor. These technical requirements rely on the ability of the organisation to properly buy, install, implement, operate, and maintain them. This ability is seen as the activity of technical requirement management.

Along with the technical requirements, there is the ability of the organisation to provide appropriate means for the co-ordination and the competence for the critical activity. The co-ordination is defined as the distribution of role and responsibilities, the communication and the decision making process at the level of the activity. The competence is described as the knowledge and knowhow, and the behaviour (related to safety culture and risk sensibility). In an organisational perspective, the co-ordination and competence are seen as risk and performance factors. They both rely on the organisational means, as distinguished on the figure from technical requirement and technical requirement management.

The second level is under the dependence of what has been defined as the support activities. These indeed provide all the necessary inputs for ensuring appropriate level of co-ordination, and of competence as well as for ensuring the activity of technical requirement management. It implies the definition of role and responsibilities, the training, the document and information management.

3.

The last level contains the learning from experience, the monitoring, the auditing and reviewing activities. These are seen as the overall management activities. At the left bottom of the figure there is the management of change activity. This is a crucial activity as the change can affect the initial risk analysis, and imply new barriers implementation like new activities or devices.

The Level 2 and 3 ensure the continuous improvement of the safety management system.

Such a method couldn't be complete, as it describes a really complex system, and it is acknowledged that some points are missing:

• The support activities ensure for themselves, for the management of change and for the overall management activity, the organisational means; •

The overall management activity ensure the continuous improvement for themselves, for the support activities and for management of change activity; •

The overall management activity and management of change use technical assistance that needs to be managed, by technical requirement management.

For implementation purposes, the first level is described through the use of matrixes.

The first matrix divides the critical (safety) function into the chosen activities or/and devices. The second one introduces the technical requirements, as described earlier, associated with the activities and devices selected. The third one can for example put together the critical activities along with the organisational means required to fulfil the activity. These three examples (tables I, II, IE) illustrate this. The following picture (figure 2) represents an example included in the figure 1.

Identification and evaluation of major hazards :

• Remarks: First, this method is not based on health and safety approaches that consist in analysing risks at the level of the operator. The method starts with the risk analysis made in a major hazard perspective, namely based on combined risk analyses approaches like HAZOP for Hazard operability study, and PRA for preliminary risk assessment for example. Secondly, it is based on a process approach that consists in decomposing the activities of the organisation. A process is seen as a system of activity that transform inputs into outputs using resources and constraints. The final outputs are hence in our case, the critical functions defined by the risk analysis.

One of the objectives of this method was to provide a structured way of implementing a safety management system, for the compliance with the SEVESC H requirement. This table (table IV) shows how the method fits in the SEVESO requirements.

Different uses

Actually the MIRIAM model can be applied for three different uses:

• It provides a guide for the implementation of a safety management system by visualising the combination of activities that are required to build the system.

From the risk analysis defining the critical functions decomposed in critical activities (including technical assistance) and critical devices.

Integrating the human behaviour

Why integrating human behaviour?

The research works on organisational reliability describe that the core issue is the complexity of the sociotechnical systems, that must be controlled. What is complexity? There is a wide range of definitions, it is possible to simplify by saying that a system is complex because there are unpredicted events or even unpredictable events. These unpredicted events are significant events for safety as there is no designed alternative built to take into account the unpredicted event. This is a problem for safety as their treatment needs to be ensured, especially in hazardous installations.

The factors influencing the presence of unpredicted events are numerous. They are linked to the features of socio technical systems.

The consequence of this is that compliance with safety management system is a first requirement, but because of these unpredictable events generated by the complexity of the systems, more is needed. It is argued here, for this precise reason, that compliance doesn't always guarantee effectiveness.

How integrating human behaviour?

The unpredictable events lead to the following findings.

First, automation requires the human intervention for these unpredicted situations, so that the automation can't be seen as the solution for safety. It could be said in that sense that the human activity allows to make work technical systems that do not work always as intended, and therefore that shouldn't be completely automated.

Secondly, the procedures do not cover all the situations that can arise. It must be acknowledged that working instructions won't be exhaustive, as the context and problems widely vary due, for example, to unpredicted events described here.

The unpredictability of events puts the supervision in a difficult situation, as everything can't be written. All situations can't be described and the supervision is therefore not able to foresee exactly what will be done by the operator. Everything can't therefore be centralised, and a sort of decentralisation is necessary. It implies that in order to find the solutions to the various situations that can be encountered due to unpredicted events, the autonomy of the actors is necessary.

It doesn't mean that the work is considered as being free from planning and monitoring, this remains an important feature of the will to make as rational as possible the way an organisation works. However it is stated that in a complex environment like an organisation in a chemical plant, the supervisors can't control all situations.

The level of safety is based on the co-operative behaviour of the actors who create the necessary synergy to treat and combine information, mental representations, and skills ... for managing this complexity and react accordingly to unpredicted events. A temptation and mistake would consist in trying to rationalise and structure the work through a theoretical frame that would be too general, how much precise it could be. More over, it would be wrong, in such a context to think that every organisational problem comes from the personnel attitude.

This necessary autonomy is implicitly acknowledged by industrialists when in very prescriptive companies, the actors have still a freedom margin and more over, have been asked to use their autonomy to adapt to situations that procedures can't describe.

The actors who play a role in safety must comply with procedures but must apply them cleverly. This type of autonomy raises however the question of how to, somehow, "control" it for safety purposes.

The solution consists in implementing performance factors, tailored to the human behaviour (which is free by definition). The method suggests to read each critical activity of a safety management system as described in the following figure (figure 4):

This figure intends helping to frame the autonomy that is implied by the safety.

The entering point is the strategy that can explain the behaviour of the actor. A strategy is namely that an actor is able to find some solutions to the problems he encountered, the result of this being its behaviour. The strategy means that humans are free and is therefore opposed to the idea of a "programme". Thus, their behaviours must be understood through the solutions they found for solving their problems (the sources of this strategic approach is found in sociology and especially in the works of J. Baechler, "Nature et Histoire", 2000, PUF). This is a fundamental point. Thinking about actors not as "programmed" or "determined" is important. It implies that what is required is to look for the factors which influence their behaviour, but without pretending that it is possible to predict them, it is an inductive approach. Such a way of looking at the organisation leads to find solutions of constraints and resources which defines these unwritten rules of the game of the organisation. If they create appropriate safety practices (represented on the right of the figure), they are described as performance factors, and if they lead to unsafe practices they are called risk factors.

A ctors ' o wnership process

The first part is therefore to qualify the part 1 of the figure. It corresponds to a safety action identification along with the strategy that led to the safety action. The safety action is appraised according to the level of compliance with the critical activity (as defined in figure 1) but as well with the level of safety margin (autonomy) that is required for the unpredicted events that can arise.

The performance and risk factors are represented on the left of the figure 4, in the part 2. However, given the freedom of the actors, it is impossible to predict which are the risk and performance factors. Consequently, the identification of these factors, and thus the organisational solutions, must go back from the observed practices (good or bad with the safety action description) to the influencing factors, through the understanding of the strategy of the actor (from part 1 to part 2) It is impossible to find the factors (the rules of the game defined by the resources and constraints) without looking first at the strategies developed by the actors that define the safety action.

Consequently, the method suggests three tools made of check list and methodological guidance for, in a first step:

•

Identifying the safety practices;

• Analysing the actors strategies that could explain the practices.

and in a second step:

• Identifying the risk and performance factors that influence these strategies.

A global assessment would therefore consist in applying this type of analyse of human behaviour to the three levels of the model (figure 1 and 2), from the risk analysis activity, through the critical functions to the support activity and overall management activity. IT should give a better understanding of how well the system works.

This could be illustrated by the following representation (figure 5), as a help to visualise what the method intends to do.

Figure 5. the human behaviour analysis for all activities of the safety management system.

Example

An example, which is summarised, is exposed here.

This example is extracted from a real situation where operators are in charge of the control of chemical reactions. In that activity the main risk is the runaway reaction.

• First step: safety actions and rules associated with the strategies:

The rules in that organisation are:

Rule 1: Strict respect of procedures. Everything is written in the documents that describe the safety related activities. This documents can be procedures, but checklist too, that allows to strictly follow how to proceed. The enquiry shows that all this is well classified and that traceability of this activity is ensured. The company invested time and resources to achieve such a result. As the operational manager noted: "the safety principle of safety here is based on the existence of procedures and checklists. If these are followed, there is problem".

Rule 2: Four monitoring levels of compliance with procedures. The rule 1 is assured by a monitoring of the operations in real time. This first type of control is allowed by the presence of a second person who checks what an operator does. That's the case for the chemical loading phase, where the quantities manipulated have to be precise.

The second type of control is ensured by the traceability provided by the checklist filled through tthe first monitoring, and checked by the team leader (first supervisor). The operational manager (or second supervisor) reads them too, and that's the third type of monitoring. Finally, there are process parameters, which are used for the monitoring of the reaction, like temperature, pressure. The monitoring of products storage level against criteria defined by the quantity that should be used for the reaction, if there is a low quantity of product remaining at a certain point, it is probably that they used too much of these Rule 3 : The operational manager is the only one able to decide the solutions to bring to problems that were not planned in the procedures. The decisions are centralised. The operators must validate the action that does not comply with the checklist, exepted in emergency situation. The team leaders must validate their decisions with the operational manager before modifying the written practices.

Rule 4 : These three first rules do not cover every single situations, even if they seem appropriate enough for everyone. The real activity is not totally covered by the three rules described, and the operators find solution in such cases. This fourth rule gives the operators the right to organise their work. This situation is seen as a normal due to the necessity of the real activity. But obviously, some actors use this in a way that does not follow the "spirit" of the written rules, but still comply with the traceability requirement of the written rules (a good example here is the act of filling the checklist without actually doing it in real). Everybody knows this, though they don't like talking about it (especially the managers).

What can be said from his enquiry is that there is a good compliance in respect with safety needs and requirements:

1.

Procedures are articulated according to risk analyses; 2.

Procedures are applied.

But, the safety margin could be considered as insufficient because:

3.

Procedures do not describe all the decisions / actions necessary to comply entirely with safety requirements; 4.

Controls can easily fail or be enforced; 5.

The operational manager must be warned on time, be given the right information, be available when necessary, and competent at any time (no redundancy)... 6.

Team leaders and operators are not given the competence neither the right technical means to make their own careful decisions and then arrangements.

•

Second step: identifying the risk and performance factors

The first part describing the rules leads to put in light the following performance and risk factors:

Factors linked to co-ordination :

1. Range of production limited can be controlled by only "one brain"; 2.

Hall of production easy to walk across, next to operational manager's office; 3.

Lack of a real structure of responsibilities, lack of official acknowledged delegations, culture of intrusion into the delegations; 4.

Very little communication between production unit and other directions of the establishment; 5.

No place or structure dedicated to dialogue nor exchange of information and opinion.

Factors linked to competence :

6.

Operators' competence is adapted to the detail of procedures; 7.

Operators and team leaders lack of knowledge and information on the substances used onsite, the dangerous runaway reactions and the existing safety barriers chosen to assure safety (agitator in reactor...); 8.

Lack of competence for the operational manager about the way to organise and control the actors' autonomy; 9.

Lack of a safety culture : everyone seems satisfied with a situation not very careful.

Factors linked to hardware interface : 10. Procedures and control means are totally operational (use of specific checklists for each batch reaction) ; 11. Methods and procedures don't help operators make their own analysis of the situation and know their autonomy of decision.

The identification of these factors suggests some improvement proposals:

• Developing the competence of team leaders and operators through:

1.

The explanation of the decisions of operational manager (namely the definition of daily production planning) ; 2.

Asking each operator to communicate two near misses per week. The most critical events should be tackled within the following month; 3.

The contribution of each actor alternatively to a risk analysis; 4.

Asking each actor to propose two ways of improvement per month ... They should be considered the same way as near-misses; 5.

Setting up a training programme with exercises about employed substances, accidents scenarios and safety barriers implemented; 6.

The communication on safety, the necessary autonomy of the actors and the limit of this autonomy; 7.

Re-placing to other functions the actors who are not able to develop enough their competence.

• Decentralising the decision-making and develop new kind of procedures through:

8.

The evaluation of the actors on defined results instead of the strict respect of procedures (new kind of controls) ; 9.

Weekly «mini collective risk analysis» to account for all possible change in production, etc... 10. The development of new kind of procedures : operational procedures defining the limits of operators' autonomy, etc...

Conclusion

The aim of such a method is to be integrative, and to embrace several layers of analysis required by the multi dimensional origins of the accident, from the technical failure, to the human behaviour and the organisational context.

From a technical approach with the risk analysis of the technical installation to the organisational side of the assessment with the models developed here, this theoretical work carried out has proved so far to be efficient when it came to apply it on real cases.

The next step is to develop further and enhance the validity and usefulness of the method for various users. This will be done through the testing of the method and through the opportunity of comparing the approach with other safety management models.

Figure 2 .

 2 Figure 2. Application of the method to a critical activity.

Figure 4 :

 4 Figure 4: A human behaviour analysis approach.

Table I :

 I Critical functions/activity or device.

	Critical functions	Function 1	Function 2
	Activity or devices
	Activity 1	X	X
	Activity 2	X
	Device 1		X
	Device 2	X

Table II :

 II Technical requirements/technical assistance or device.

	Technical requirements technical assistance or devices	specification	Time for response	Backup when emergency situation
	Technical assistance 1
	Device 1
	Device 2

Table III :

 III Critical functions/activity or device.

	Critical functions Activity or devices	Procedure	Training
	Activity 1	Who, what, when, where, how and checking points	Compliance with training specification
	Activity 2	Who, what, when, where, how and checking points	Compliance with training specification

Table IV :

 IV Comparison method/SEVESO II requirements.

	INERIS method	SEVESO H requirements
	Riskanalysis activity	Identification and evaluation of major hazards
	Critical functions (all life cycles)
		Control of process and operation
	Management of technical requirements	Planning for emergencies
	(buying, designing, maintenance)
	Support activities	Organisation and personnel
	Overall management activities Overall management activities	Learning from experience Monitoring performance Audit and review
	Management of change activity	Management of change

  The technical requirements and organisational means both specify what are the specification of these. The technical requirements rely on the activity of technical requirement management. All these are ensured by appropriate support activities and by the overall activities management. • It defines the activities linked with the risk analysis that need to be checked through a external or internal audit. • It provides a frame for learning from experience, as it describes what are the activities that must be implemented to ensure the risk control, from a risk analysis focused on major hazard prevention. Indeed, once the accidental scenario has been described, it is possible to search for what activities have been inappropriate. In order to do so, it is possible to follow the modelling and see what went wrong. A basic first representation is proposed (figure 3)

	c 7 "-. 71 Identified scenano?	Management of. change activity inappropriate?	Risk analysis activity ; inappropriate '• • (scenario
			identification)? i
	Critical activities/devices failure?		Management of technical requirements lent of ments '^a nd /^ N, >
			and organisational
			means inappropriate?
	Risk analysis activity
	inappropriate(design in the		Support and overall _
	defence in depth principle)?		management activities
			inappropriate?
	YES
	NO

Figure 3. Learning from experience application of the method.


David Hourtolou

INERIS Olivier Salvi

ARAMIS PROJECT Accidental Risk Assessment Methodology for Industries in the Framework of SEVESOII Directive

This paper presents the ARAMIS project accepted for funding in the 5 th Framework Programme of the European Commission, which started on January 2002.

The ARAMIS project aims at developing a new risk assessment methodology which allows to evaluate the risk level of an industrial plant by taking into account prevention measures against major accidents and the vulnerability of its environment. The methodology will support the harmonised implementation of the SEVESO II Directive.

The project is built to result in the composition of an integrated risk index based on the definition of Reference Scenarios and combining the evaluation of: 1. Scenario consequence severity 2. Safety management effectiveness affecting the probability of occurrence of major accidents 3. Environment vulnerability. The methodology will be validated with case studies. Efforts are given to disseminate the methodology to decision-makers in charge of the control of major accident hazards. Thus the project development will be continuously monitored by a review team gathering risk experts from industry and EU competent authorities in order to ensure the widest acceptance of the approach.

Introduction

The ARAMIS project was submitted for funding in the 5 th Framework Programme of the European Commission in February 2001 under the programme "Environment and Sustainable Development", in the chapter untitled "The fight against major natural and technological hazards" of the Work Programme. This 3-years project started in January 2002.

The ARAMIS methodology builds further on methods studied in the 4 th Framework Programme such as in the ASSURANCE 3 project, a benchmark exercise on the uncertainties in risk analysis, and developed in the I-RISK project, which provides a a Assessment of the Uncertainties in Risk ANalysis of Chemical Establishments, n° ENV4970627. b Development of an integrated technical and management risk control and monitoring methodology for managing and quantifying on-site and off-site risks, n° ENV4960243. methodology for in-depth judgement of safety management requirements for the design, operation and maintenance of major hazards plants.

The development of ARAMIS is justified by the need of the elaboration of a methodology giving consistent rules for the identification of scenarios that take into account mitigation devices and some aspects of safety management, and being recognised by risk experts from Competent Authorities and Industry.

Beside, there is an need to establish a method that is capable to assess the risk level of an installation by integrating the preventive measures implemented by the operators. Such a method is a prerequisite in order to reach the goals of the SEVESO n Directive, that are to improve the prevention linked in particular with the safety management. So, the ARAMIS methodology propose to characterise the risk level with an integrated risk index composed with independent parameters related to the consequence severity evaluation of scenarios, the prevention management effectiveness and the environment vulnerability estimation describing the sensitivity of the potential targets located in the vicinity of the SEVESO n establishments.

The application of this method will result in a more consistent and harmonised risk evaluation and safety management strategy in all European Countries.

The paper starts with the presentation of the context of the major-accident hazards control and prevention in the EU. Then, the objectives of the project and the work contents are described in details. Finally, the expected impacts of such a methodology are addressed.

Context of major-accident hazards control and prevention

The 1999 annual report from the European Environment Agency [START_REF]Environment in the European Union at the turn ofthe century[END_REF] indicates that the trend in accidents shows that many of the often seemingly simple 'lessons learned' from accidents have not yet been sufficiently implemented in industry's standards. There is no doubt that disasters will continue to occur throughout the EU. Some of these will be due to technology, some to the forces of nature. Inevitably there will be loss of life and environmental damage. However, hazards can be managed to reduce risks. The problem of low-probability, high-consequence events is likely to remain a key issue in terms of risk management.

The most significant EU Directive to help protect people and the environment from major accident hazards is the SEVESO n Directive. This Directive applies to those industries that use significant amounts of hazardous substances. Their operators must demonstrate that they apply a policy for the prevention of major accidents using appropriate measures related to both "hardware" and "software" aspects, such as safety management systems. This is likely to reduce risk levels, not only from highprobability, low-consequence accidents, but also from low-probability, highconsequence events, although these are by nature difficult to address.

In the SEVESO n Directive, the objectives in terms of risk management are very clear, but the remaining question is: How to reach them? For example, there is no harmonised definition of the scenarios that have to be considered for risk assessment. Typically, the chosen scenarios (BLEVE, total loss of containment, fire in the largest tank, explosion of the largest mass of explosive, etc.) can be different according to the specific risk analysts and according to the deterministic or risk-based approach of the country applying the Directive. This situation is confirmed by the results of the EC project ASSURANCE, in which 6 European organisations perform a benchmark exercise for the risk analysis of a specific plant. The partners use various hazard analysis techniques and arrive at quite different conclusions with respect to the scenarios that are relevant for the safety assessment. Moreover, sometimes, according to reference [START_REF] Cassidy | Special issue: The SEVESO II Directive (96/82/EC) on the control of major accident hazards involving dangerous substances[END_REF], land-use planning constraints urge the operators to consider reduction of the safety distances. Then, it may be proposed to choose 'realistic' scenarios by taking account of the effectiveness of mitigation devices. In fact, because of the lack of rules for identifying scenarios including safety measure effectiveness, the expert's job is tricky and often involves large subjective elements.

Not only risk assessment experts, but also decision-makers are confronted with a variety of approaches to assess and manage industrial risk. The difference of cultures in the Member States results in a multiplicity of methods for the evaluation of major accident hazards [START_REF] Kirchsteiger | Special Issue on International Trends in Major Accidents and Activities by the European Commission towards Accident Prevention[END_REF]. This fact makes the comparison of risk studies performed by different analysts a difficult task and has significantly hampered the widespread use of risk assessment for decision making purposes. At the recent EC-JRC International Workshop on Promotion of Technical Harmonisation on Risk-Based Decision Making, held in Italy in May 2000 [START_REF]Promotion of technical harmonization on risk-based decision-making[END_REF], most participants agreed that comparative risk assessment along harmonised procedures would significantly help the decision understanding. A harmonised risk assessment methodology would thus ensure that risk-based decision making provides the necessary transparency and strikes the right balance between scientific understanding and precaution.

To propose a harmonised methodology for risk assessment is difficult. However, some aspects of the different approaches can be put in common such as scenario identification, severity evaluation and the integration of the effectiveness of the safety management that affects the major accident probability of occurrence. Because of these reasons there is a real need to establish common rules to identify scenarios integrating the prevention management achieved by the operator and to propose a harmonised method for their evaluation [5].

Objectives

The objective of the ARAMIS project is to create a new integrated risk assessment methodology by combining the strong points from the different methods currently used in risk assessment in European Countries.

The methodology will be used as a supportive tool to promote safety in the process industry. In particular, it will contribute to speed-up the harmonised implementation of the Council Directive 96/82/EC of 9 December 1996 on the control of majoraccident hazards involving dangerous substances known as SEVESO ÏÏ Directive. Accordingly, this tool should be flexible enough to take into account the different national cultures in industrial risk assessment like deterministic or risk-based approaches, so that the new methodology could become a recommended tool used by risk experts and endorsed by the risk decision-makers in the whole EU.

In technical terms, ARAMIS project aims at:

1.

Establishing a methodology for accident scenarios identification taking into account the prevention process carried out by the operators of SEVESO establishments, and endorsed by the Competent Authorities and the decisionmakers in charge of risk control; 2.

Composing an integrated risk index which takes into account:

• Consequence severity evaluation of scenarios; • Prevention management effectiveness (preventative, protective and mitigation measures) on initiating and aggravating events, thereby reducing the probability of occurrence of major accidents; • Environment vulnerability estimation.

Project work description

Introduction

The objective of ARAMIS is to develop a risk assessment methodology to evaluate the risk level of establishments by taking into account the prevention measures implemented by the operators and the vulnerability of its environment.

The project work plan is built to result in the characterisation of the risk level which is based on the determination of Reference Accident Scenarios and integrates :

• Effects severity evaluation of scenarios; • Prevention management effectiveness; • Environment vulnerability estimation.

The end-users of the methodology are both the industrial companies and the Competent Authorities in charge of the application of the SEVESO n Directive. Thus, the valorisation and dissemination plan start at the beginning of the project with large exchanges with the end-users partners in the consortium and in a Review Team.

Project description

This paragraph describes the three main phases of the project which are :

1. Development of the methodology; 2.

Finalising and testing the methodology; 3.

Valorisation and dissemination plan.

Development of the methodology

The development of the methodology starts with the identification of reference scenarios, that are evaluated. Then the prevention management effectiveness and the environment vulnerability of the establishment are characterised. All these results are integrated to assess the risk level of a given establishment. The various phases of the methodology are described in details hereunder.

Scenarios identification

The objective of this phase is to propose a methodology for the identification of Accident Scenarios.

For industrial installations, the Major Accident Hazards will be first identified with an algorithm based on the labelling of the substances (Directive 67/548/EEC) and the conditions of their use (pressure, temperature, flow, etc.). Then, the Reference Accident Scenarios will be determined from the Major Accident Hazards and from the review of accidents which occurred on similar units. The Reference Accident Scenarios will take into account the current practices (state of the art) mentioned in the legal requirements with regard to design, operation and control, and mitigation. Therefore, the Reference Accident Scenarios will use results from the work on the prevention management effectiveness as described in Figure 1.

Reference Accident Scenarios define realistic scenarios, considering an installation operated today. They will be used to evaluate the effects (severity) of the major accident and describe the hazard potential.

V

Evaluation of effects severity of scenarios

The objective of this task is to define a severity index S depending only on physical parameters and characterising the possible effects of scenarios. It is intended to study the physical characteristics of the phenomena involved in accidents (dispersion, explosion, fire), and to take them into account to evaluate the severity of the scenarios. The parameters to be considered are:

•

The effect area A concerned with the phenomenon, for instance, a disc in case of an explosion, the projection of a plume for gas dispersion; •

The phenomenon kinetics K: rapid for explosions, slower for dispersion and fires; •

The capability of intervention / to mitigate the disaster: possible for fire and gas dispersion, but possible only at the design step for explosion; •

The potential of domino effects D: fragment emission, interlocking of delayed phenomena.

A severity index S is therefore a function of parameters only associated with physical phenomena. All scenarios identified can then be evaluated and ranked with this severity index according to the calculation of S 0 for the Major Accident Hazards and S re f for the Reference Accident Scenarios.

Prevention management effectiveness

The objective of this task is to define an index M characterising the prevention management effectiveness.

Because technical and organisational factors are key issues to prevent major accident, this task consists in developing a methodology to evaluate the management effectiveness. Safety management applied in a Major Accident Prevention Policy leads to define actions to manage technical, human and organisational factors.

The operational goal of safety management is to strengthen the barriers and lines of defence against accidents (safety equipment or human operation). Safety management contains a large number of responsibilities, tasks and functions that are difficult to disentangle. A way of discriminating different levels in safety management is as follows:

• Policy: The implicit or explicit statement of a company's intentions with respect to plant safety, the objectives and goals for safety management and the way safety is prioritised and incorporated in the company's daily management; The evaluation methodology will be built on the use of several research approaches:

• Analysis of the effectiveness of safety devices providing physical safety barriers and lines of defence according to their characteristics (nature, availability, reliability, maintainability, testability...)-This analysis follow the principle of the norms ffiC 61508 and draft IEC 61511 (Functional safety: safety instrumented systems for the process sector) and lead to general methods to improve safety barriers and some results will be used for the scenario identification. Safety management affects the probability of occurrence of the scenarios. Therefore the objective of this work will be:

• To assess the effectiveness of various forms and aspects of safety management in preventing accidents.

•

To develop reliable indicators that are a good measure of the effectiveness of a plant safety management. This information will be used to define a multidimensional index Mcharacterising the prevention management effectiveness.

Environment vulnerability estimation

This phase aim at defining an index Vcharacterising the spatial vulnerability of the environment of an hazardous establishment by characterising potential targets (population, natural and man-made environment) and to estimate their sensitivity.

To reach this objective, the area of interest in the vicinity of a plant will be divided into meshes : the potential targets belonging to each class (population, natural and man-made environment) will be identified and localised with the support of Geographic Information Systems (GIS). The sensitivity of the targets (workers of the plant, residents, surface and underground waters, public buildings...) will be characterised and ranked, using a multi-criteria ranking method (SAATY), determining a scale of vulnerability levels. Vulnerability maps will be obtained by calculating and combining the vulnerability of all the targets falling in the same mesh.

Finalising and testing the methodology Characterisation of the Risk Level RL

The severity index S can be combined with the management effectiveness index M and the vulnerability index K to define a risk level RL index of an installation in its environment (See Figure 2). The objective of this phase is to study the relation between S, M and Vto characterise the risk level. It will be studied whether the risk level should remain characterised by the 3 indexes or whether the 3 indexes could be aggregated to form a multidimensional index.

The ARAMIS method enables ranking the hazards only in terms of severity with the calculation of the severity index S for each scenario. Then the scenarios identified in several units are comparable. It also enables taking into account the efforts (preventive measures) made by the company with the estimation of the prevention management effectiveness M

The result also makes it possible to compare the risk level between two or more units of an industrial group to define the priorities for the investment for safety.

Case studies

To validate and to improve the ARAMIS methodology, case studies will be carried out with the collaboration of Companies and Competent Authorities in several SEVESO establishments in Europe. For the selection of the test sites, it will be assured that countries with a consequence-based and probabilistic approaches are represented. After this exercise, the definition of the indexes will be modulated to improve applicability and validity of the procedure.

ARAMIS METHODOLOGY

Valorisation and dissemination

In the valorisation and dissemination plan, efforts will be made to transfer the methodology to risk assessors and decision-makers, who are the end-users of the methodology.

Industrial end-users are represented in the consortium through an association of European industrial companies. It will help the consortium to relay information about the project and its progress, to find plants for case studies and to disseminate the methodology at the end of the project.

For dissemination, a web site was built (http://aramis.jrc.it) aiming at promoting the project and disseminating the public results. An electronic newsletter will also be released by the project management on the web site, after the progress meetings.

Moreover, a intermediate workshop is set to provide the end-users with some partial results of the project and to collect comments to improve the relevancy of the further work. And a final workshop is also planned at the end of the project to disseminate the main results to all relevant stakeholders. The two workshops will be open to thirdparties not involved in the consortium and workshop proceedings will be issued and made available on the web-site. Besides, in connection with the workshops, to ensure the widest possible dissemination of the results during the project, the participants will publish papers in scientific international journals and conferences.

Consortium description and involvement

The consortium consists of ten organisations involved in the risk analysis of major accidents. They are presented in Table I.

INERIS, the co-ordinator of the project, has an international expertise in the field of major accident prevention. It works as technical support for the national Competent Authority in charge of the application of the SEVESO II Directive. INERIS will lead with the steering committee the aggregation of the works for the risk level index composition and validation. INERIS will also provide support for valorisation and dissemination and for the Parallel Review. EC-JRC-IPSC and especially MAHB has a recognised international expertise in the field of major accident prevention. It has animated EU Working Groups dealing with the application of the SEVESO I and ÏÏ Directives and is also experienced in the development and use of accident databases and GIS tools at European level. MAHB acts as leader of the activities related to valorisation and dissemination of the results as well as leader of the parallel Review Team.

FPMs-MRRC has a great experience in the application of the SEVESO II Directive, and already developed methodologies on the choice of accident scenarios to study domino effects. It acts as the leader of work on Scenario Identification. In addition, the MRRC also brings its experience about domino effects and accident consequences modelling in the Severity Evaluation. The "Pôle Cindyniques" of ARMINES has built a methodology to formalise the development of accidents as a series of "particles of experience" which are collected and documented from the analysis of reports, debriefing sessions and interviews. Using this methodology, it will contribute to the scenario identification and the work related to the prevention management effectiveness.

The SITE department of ARMINES has a long experience in environmental system management characterisation. It will mainly focus on the prevention management effectiveness and environment vulnerability characterisation.

The LGEI of ARMINES has competencies in using both multi-criteria ranking methods (SAATY) and GIS. It has developed a methodology based on these two aspects for studying risks in transportation of hazardous substances., and will contribute to provide a methodology to rank the vulnerability of targets (human, environmental, equipment) in the vicinity of plants to obtain a vulnerability cartography used to characterise the spatial vulnerability. RISOE is experienced with drawing up and evaluating safety reports for hazardous installations. It has special experience with applying function-oriented modelling to analyse the effectiveness of the organisation of safety procedures and using questionnaire techniques for assessment of safety culture. RISOE will be leader of the work on the Prevention management effectiveness.

UROM is experienced in methodologies and software tools, including GIS systems, to carry out risk analysis and area risk studies. Its activities will be mainly devoted to the development of the methodology for characterising the potential targets and their vulnerability. It will prepare a software tool for determining the environmental vulnerability index basing on GIS information.

Due to its experience, on one hand in fire and explosion, and, on the other hand in safety management and risk assessment, CMI will carry out research respectively for work related to the Severity evaluation and the Management effectiveness by analysing the implementation of management standards and guidelines.

Bringing its expertise in safety management modelling and risk assessment, TUD will carry out a major effort in the ARAMIS research project in work on Prevention management effectiveness with expertjudgement and audit tools developed at TUD. IChemE-EPSC will participate in the dissemination of the results to the industrial companies which are members or associates of the EPSC. It is important to notice that a lot of EPSC members are end-users of the ARAMIS methodology. In the project, EPSC will circulate to the members information related to the project and its results, and care about the Review Team participation.

In addition to the consortium, a Review Team is indeed built up. It has an essential role for the dissemination of the results through decision-makers involved in the control of major accidents. The Review Team has a role in the management and will comment on the applicability and usefulness of the results achieved. The involvement in the methodology development of risk experts both from the Competent Authorities and industrial companies will ensure that the methodology will be known and recognised at a European level.

6.

Contribution to the implementation of the SEVESO Directive

The project supports the European Research Area concerning the improvement of the knowledge, encouragement of the Science-Industry dialogue and harmonisation in decision-making process related to hazardous establishments.

The ARAMIS method will indeed be proposed as a recommended and harmonised tool used by risk experts and recognised by the risk decision-makers in the EU.

Harmonising industrial risk assessments in Europe would significantly contribute to the European Commission's overall efforts to establish harmonised policies following the SEVESO ÏÏ Directive. Such a harmonised risk assessment procedure would be of significant interest for both Competent Authorities and Industry: .

• It would constitute a risk evaluation and comparison tool for industrial sites, which integrates the strengths of probabilistic and deterministic approaches;

• The procedure would enable definition of progress plans within the framework of a safety management system; • It would enable to moderate the selection of scenarios by taking into account realistic data and preventive measures; • It will enable the evaluation and consideration of plant-specific safety devices and safety management effectiveness, as required in the Safety Reports.

The partnership in the consortium and in the Review Team ensures that the ARAMIS project will contribute on a very practical level to the EC research objectives built to support the further development and consistent implementation of European policies.

7.

Figure 1 .

 1 Figure 1. Scenarios identification procedure.

Figure 2 .

 2 Figure 2. ARAMIS methodology representation.

  CERTEC) has a recognised expertise in the evaluation of the accident consequences for SEVESO plants (dispersion, explosion, fire modelling). UPC will develop research on the Severity Evaluation as task leader.

Table I :

 I Description of partner organisation.

	Organisation name
	1. Institut National de l'Environnement Industriel et des
	Risques Accidental Risk Division
	2. European Commission -Joint Research Centre -Institute for
	thé Protection and Security of the Citizen -Major Accident
	Hazard Bureau
	3. Faculté Polytechnique de Mons
	Major Risk Research Center
	4. Universitat Politecnica de Catalunya
	Centre for Studies on Technological Risk (CERTEC)
	5. Association pour la Recherche et le Développement des
	Méthodes et Processus Industriels -ARMINES
	6. Ris0 National Laboratory
	System Analysis Department
	7. Université di Roma
	Dipartimento Ingegneria Chimica
	8. Central Mining Institute
	Safety Management and Technical Hazards
	9. Delft University of Technology
	Safety Science Group
	10. Institution of Chemical Engineers European Process Safety
	Centre

Acknowledgement

The ideas presented in this publication have been elaborated in the frame of the EU project ARAMIS "Accidental Risk Assessment Methodology for Industries", contract no EVG1-CT-2001-00036, co-ordinated by INERIS (F) and including EC -JRC -IPSC -MAHB (I), Faculté Polytechnique de Mons -Major Risk Research Centre (B), Universitat Politecnica de Catalunya -CERTEC (SP), ARMINES (F),. Ris0 National Laboratory (DK), Universita di Roma -Dipartimento Ingegneria Chimica (I), CMI -Safety Management and Technical Hazards (PL), Delft University of Technology -Safety Science Group (NL), European Process Safety Centre (UK), Ecole des Mines de Paris -Pôle Cindyniques (F), Ecole des Mines de Saint Etienne -SITE (F), Ecole des Mines d'Alès -LGEI (F). The programme is organised within the Energy, Environment and Sustainable Development Programme in the 5 th Framework Programme for Science Research and Technological Development" ofthe European Commission". 8.