Agnès Vallée
email: agnes.vallee@ineris.fr

Christophe Duval

Flooding of Industrial Facilities -Vulnerability Reduction in Practice

International databases such as OFDA / CRED show that floods accounted for more than half of disasters registered for the 1990-2001 period. With consequences of climate change largely unpredictable at local level, future statistics are not likely to show any improvement. As human activities historically developed in river areas and floodplains, industrial facilities are structurally exposed to flooding. Past events witnessed industrial vulnerability to flooding, including direct impact on structure, loss of safety measures, loss of utilities, business interruption, etc. In response of such natural-technological interaction, mitigation efforts have taken two main directions: land-use planning in flood-prone areas and vulnerability reduction in flood-prone facilities. This paper focuses on the former issue and presents a methodology for the mitigation of flood impacts on industrial facilities.

Introduction

Even if the accidents caused by flooding form a statistically marginal group in terms of events (see chemical accidents databases analysis made by [START_REF] Cozzani | Industrial accidents triggered by flood events: Analysis of past accidents[END_REF], and when compared to other more frequent major accidents (technical problems, human errors), it is clear that human, material and environmental consequences of these accidents can be significant and should not be neglected. When flooded, industrial facilities present direct (damage to buildings, tanks, pipes, storage of raw materials and finished products, pumps, electrical, thermal and mechanical equipments) and indirect (business interruption, temporary unemployment, rising of insurance premium) consequences. As shown by the analysis of past accidents, the damages may cause major accidents within industrial plants. These include release of hazardous material, soil or water pollutions by hazardous substances for the environment, fires, explosions, dispersion of toxic clouds. It is therefore necessary that industrial plants managers improve their understanding of potential impact of flooding on their facility, and analyse major accidents or release of hazardous materials that may be caused by such a natural event in order to prevent them. Therefore INERIS (French Institute for Industrial Environment and Risks) proposes a methodology for the integration of flood hazard in industrial safety assessment, presented in the following paragraph. Then a suggestion of possible safety barriers against flood is made. However will be discuss the experience gained after implementation of this method to an industrial site.

Methodology for integration of flood hazard in industrial safety assessment

The methodology for the integration of flood hazard in risk-reduction process for industrial plants, proposed by INERIS, follows a sequence in 3 steps, as detailed below:

• Step 1: Characterization of flood hazard, • Step 2: Preliminary risk analysis, • Step 3: Detailed risk analysis.

Step 1 : Characterization of flood hazard

This first step aims at determining whether the studied plant is located in a floodable area or not. If it is the case, data are needed to better understand the flooding, such as type of flooding (direct overflow of rivers, overflow indirectly by rise of water table in aquifer, excess runoff, dike failure, tsunami), water height, flow velocity, speed of water level rising, flooding duration, return period of flood. This work could rely, for example, on documents and/or flood hazard maps (see Figure 1

Step 2 : Preliminary risk analysis

Based on information gathered in step 1, the topography of the industrial plant, and the location of buildings and facilities within plant perimeter, areas which could be affected by flooding are identified. Maps of flooded areas in the plant, for different water heights, can be drawn (see Figure 2 In the potentially flooded areas, we can identify facilities and equipments that could cause major technological accidents.

Selecting items vulnerable to flooding is based on analysis of:

• Lessons learned from floods that have already occurred on the studied plant or on similar industrial facilities,

• Hazardous properties of substances and preparations / mixtures contained in the facilities and equipments (use of Material Safety Data Sheets), with a particular attention drawn on the chemical products which emit flammable or toxic gases in contact with water, • Consequences induced by the loss of utilities, • The behaviour of structures under action of water (flotation, overturning, impact of a floating object). For these selected equipments, the flood hazard should be considered as a common cause of failure for both the equipment and its associated safety devices. A systematic risk analysis (Hazard Analysis, Hazard Identification -Hazid, for example) is performed for each equipment. The accidental sequences leading to dangerous phenomena (fire, explosion, toxic cloud dispersion, pollution) are detailed, and existing safety barriers are highlighted. See Table 1 below for an example of the type of accident sequence derived from the risk analysis process. Different dangerous phenomena, identified for each vulnerable equipment, are likely to occur simultaneously in case of flooding ("Initial event") which could be a common cause of "Critical events". The resulting accidental sequences are then represented graphically, as shown in Figure 3.

Initial event

Step 3 : Detailed risk analysis

The safety barriers are analysed more in details in terms of performance (efficiency, maintainability, testability). Each barrier shall be assessed also in terms of kinetics, depending on implementation time, availability of human resources, technical devices, etc. Depending of the available time before the arrival of water and resources in case of flooding, some safety barriers are also selected primarily for risk assessment and emergency plan (Figure 4). For risk assessment, the first calculation is conservative because it does not take into account the existence of safety barriers (Figure 5). This leads then to a single major accident, characterized by a probability (Pf) equal to the probability of the flooding and a total severity (S) which is the union of severities of each accident caused by the different critical events CE1, 2 and 3. The dangerous phenomena DPh1m, 2m and 3m are phenomena of maximum intensity. The second calculation takes into account the safety barriers, considering also their possible failure and consecutive major accidents that might occur. We can consider for example the case where the barriers SBL1 and SBP2 are failing, while barriers SB L 2 and SBP 3 are working normally. Therefore dangerous phenomenon DPh1 is characterised by a maximum intensity, DPh2 has limited intensity and DPh3 does not occur. The probability of occurrence of the major accident is determined by combining the probability of flooding (Pf) and the safety barriers failure probabilities (PL1, PP2, P L 2, P P3 ) (see safety barriers performance evaluation approach developed in France and presented by [START_REF] Lenoble | Introduction of frequency in France flowing the AZF accident[END_REF]

Probability

: P M A = Pf X PU X PP2 X (1 -P L 2) (1 -PP3)
The severity of the major accident is the combination of the severity of DPh1 (maximum intensity) and the severity of DPh2 (limited intensity).

The same approach can be used to identify all other possible accidents.

Pu PP2 1-PL2 1-PP3 Pf LSB1 PSB 2 LSB 2 PSB 3

Initial event Flooding

-0-DPh1m -0-CE2 ft DPh2l

Possible (and non exhaustive) measures to reduce vulnerability to flooding

An indicative list of possible measures to reduce the vulnerability of industrial facilities to flooding is proposed:

• Build walls around the critical equipments, those which are the most important for operation and safety, • Close certain openings, • Control, and if necessary, strengthen tanks attachment,

•

Move storage to areas that are not likely to be flooded,

• Move equipments, sensors, networks (electricity, gas, water, telecommunications, computer system...) above the highest past flooding water height, •

Install system to cut automatically power and gas supplies,

• Provide pathways which cannot be flooded to make intervention easier, and refuge area outside water for staff... The choice of measures may vary depending on the configuration of the plant. Design arrangements are preferable to non-permanent measures that will be implemented just in case of flood warning. The performance of safety barriers to protect against effects of flooding is highly dependent on the time available to secure industrial facilities and on the good operability of utilities (electricity, gas...), before the water arrival. However, in general, the industrialist does not have its own devices to monitor the river nearby, and must refer to information and alerts provided by authorities. The utilities networks can be cut at any time. It is hoped that the flood warning would be transmitted as soon as possible so that there is time to act.

Experience gained after implementation of the method to a French industrial site and perspectives

The INERIS method, presented in this paper, was tested in 2011 on an SEVESO low-tier industrial establishment in France. The first lessons learned are presented below. The success of the step 1 depends on the data related to flood hazard. Luckily the information was available for the experimental field. But this is not the case currently for all areas potentially affected by flooding in France. In addition, data collected from various services (local authorities, flood forecasting service) may be contradictory. France and most countries in Europe have initiated the production of flooding maps, but this work will take a long time. The choice of the flooding reference scenario can also cause problems: is the flood with a return period equivalent to 100 years (for design of buildings in France) acceptable for dangerous industrial facilities, or should we consider a more serious flooding (millennial flooding for example)? Do we have to assume that the chosen flooding reference scenario could be exceeded at any time, and rather to determine for which flood the plant will undergo major malfunctions?

If there are no measurements of the topography for the plant, the identification of areas prone to flooding could not be refined and the analysis will be considering large impacted areas. Behavior under the action of water for usual industrial structures like atmospheric tank, pressure vessels, pipes can be determined, but it is more difficult for example for equipment such as reactors, columns, sensors, valves. The action of water in case of direct overflow of river must be distinguished from the action of water in case of failure of dike/dam or tsunami, because of the shock effect that this leads to structures. Calculation models or simple assessment criteria have to be established for industry so they can determine the vulnerability of their equipment. We saw that dangerous phenomena such as fires, explosions, toxic clouds could be caused by flooding. The resulting human effects can be evaluated easily with commonly used tools. But, when hazardous substances are mixed with water, the impact on the environment (pollution of surface water, groundwater, soil) is difficult to assess. This aspect could be improved in the method. The quantification of probability and severity is difficult and long to implement, especially when many critical events (with the associated dangerous phenomena) may occur and several safety barriers that must be considered. The major accidents identification would probably need to be computerized. Users of this methodology can however make the choice to implement qualitative approach only (step 1, step 2 and step 3 but only the priorization of the safety barriers and the establishment of a flood emergency plan). INERIS guide explaining the different steps of this method (revised according to lessons learned into practice) is currently under preparation and will provide industry and legal authority with recommendations to prevent major accident in case of flooding.

Figure 1 :

 1 Figure 1: Example of flood hazard maps (Somme river -France)

Figure 2 :

 2 Figure 2: Potentially flooded areas on the industrial site

Figure 3 :

 3 Figure 3: Representation of accidental sequences causing by flooding

Figure 4 :

 4 Figure 4: Selection of safety barriers for risk assessment and flooding emergency plan

Figure 5 :

 5 Figure 5: Probability and severity assessment -Conservative calculation

Figure 6 :

 6 Figure 6: Probability and severity assessment -Example of calculation with safety barriers

Table 1 :

 1 Extract of Preliminary Risk Assessment -Storage tank containing flammable liquid

	Initiating events	Critical event	Dangerous phenomena	Safety barriers
	Ripple effect (for torrential floods) Collisions with floating objects	Significant breach in the tank	-Soil and water pollution -If ignition, fire and -Drain the tank in -Attach the bottom of the tank explosion case of flood warning


Jean-Christophe Le Coze

Michèle Dupré

Is it time, in the process industry, to question the limits of audits?

This paper argues that current safety assessment methodologies and models must be revised in order to reflect what is now known about the complexity of technological disasters. It first introduces the normal accident debate and indicates three types of issues that maintain the quarrel unsettled: the retrospective fallacy, the unanticipated consequences of technological and social actions and the difficulty to establish normative frames. Second, it argues, despite the 'normal accident' background, that there is much room for improvement in the way safety is assessed, if one considers closely, for instance, the lessons from socio-technological disasters. The Macondo well case study in 2010 (Chief Counsel Report, 2011) illustrates the complexity of the problem and the multidimensional nature of disasters. As safety assessments rely for a good part on safety management system audits (although the situation differs according to the high risk industries concerned), it is found relevant to start questioning their limits. This is what is explored in a third section, based on literature, empirical studies, official documents from high-risk companies and theory. The conclusion is that the audit rationale is not adapted to address the complexity of high-risk socio technical system and what we know from major accidents investigations. Fourth, some authors addressing the limits of current safety assessment practices are discussed, and ideas to move forward are introduced.

The 'normal accident' debate

Many major accidents in the past ten years in the process industry have been slowly challenging industry, regulators but also public's confidence about our ability to prevent them (e.g. Toulouse, 2001, Billy Berclau, 2003, Ghislenghien, 2004, Texas City, 2005, Buncefield, 2005, Macondo, 2010, Pembroke, 2011). This paper intends therefore first to provide a critical perspective to the question addressed in the conference call 'How do I know that I am not going to have a major accident tomorrow?' This question has, in the literature, almost a thirty years old history (and probably a much older one, although historical views on technological disasters are scarce, see however, Fressoz, 2012). It was indeed Perrow's contention that 'normal accidents' could occur from time to time, despite all preventive measures, due the levels of complexity and coupling of certain kind of high risk systems [START_REF] Perrow | Normal Accidents[END_REF].

His approach was very much technological, or structural, leaving not much space in his interpretation to understand the part played by actors, organisations and institutions in the genesis of technological disasters. Thus, a sociologist like [START_REF] Vaughan | The Challenger launch decision: risky technology, culture and deviance at NASA[END_REF] has been able to extend Perrow's argument, using Turner's incubation framework [START_REF] Turner | Man-made disasters. The failure of foresight[END_REF] in order to show that complex socio technical systems could fruitfully be analysed from a historical, dynamic and systemic point of view. Her study of NASA Challenger's accident has become a landmark in the fields of both social and safety sciences.

For Vaughan, individuals, organisations and their environment have to be analytically linked together in systemic manner to understand better how socio technical systems are, not only technologically, but also socially, complex (Vaughan, 1999(Vaughan, , 2005)). Complexity is of course not only a technological or structural attribute as asserted by Perrow, it is also very much a social one [START_REF] Le Coze | Are organisations too complex to be introduced in technical risk assessment and current safety auditing[END_REF]. Other authors have then also clearly stressed the limitations of Perrow's early perspective, either for questioning [START_REF] Bourrier | Le nucléaire à l'épreuve de l'organisation[END_REF], rejecting [START_REF] Hopkins | Was Three Miles Island a normal accident?[END_REF] (INERIS) (CNRS) or expending it [START_REF] Evan | Minding the machines. Preventing techonological disasters[END_REF]. For these different authors, Perrow's framework offers indeed a much too restricted analytical tool, although it has contributed to undermine the technological faith of a certain engineering community.

Despite these critics and new approaches to technological disasters, the argument whether accidents can be, or not, predicted in complex socio technical systems has remained unsolved. For example, the 'debate' of the 90's that Sagan (1993) contributed in shaping, between normal accidents and high reliability organisations, has never really settled, as [START_REF] Boin | Assessing NASA's Safety Culture: The limits and possibilities of High Reliability Theory[END_REF] recall in a critical review of the Columbia Accident Investigation Board (CAIB, 2003). It will probably never do. The diversity of high risk systems, the variety of situations and contexts but also the very often unspoken different philosophical assumptions on society, human nature and technology will keep the debate opened for ever between the pros and cons (Le Coze, 2008a). Even for the pros, some accidents seemed, after investigation, reasonably preventable (see Perrow's comments after the financial crisis, [START_REF] Perrow | The Meltdown was not an accident. In Markets on trial: sociology of the US financial crisis: Part one[END_REF], or Fukushima, Perrow, 2011). Without pretending to be exhaustive, here are, at least, three corner stone and intertwined issues of this debate.

First, there is the problem of the retrospective fallacy (or hindsight bias). This is the problem of the observer (e.g. investigator) when he/she look back with full a view and understanding of the end of the story whereas actors located at different positions in socio technical systems involved don't. This issue has been well identified and commented for a long time now from many disciplinary angles including cognitive scientists dealing with 'human error' at sharp end (Rasmussen, 1981), to sociologists [START_REF] Turner | Man-made disasters. The failure of foresight[END_REF][START_REF] Wynne | Unruly technology: Practical Rules, Impractical Discourses and Public Understanding[END_REF] and management scientists [START_REF] Starbuck | Challenger: Changing the odds until something breaks[END_REF] dealing with failure of foresight at the 'blunt' end, including engineers and executives. To understand accidents, one needs to investigate to a certain level of qualitative depth in order to be sensitised better about what was then the contexts in which actors were immersed. 'This warning is the warning of the retrospective fallacy understanding organisational failure depends on systematic research that avoids the retrospective fallacy by going beyond secondary sources and summaries, relying instead on personal expertise based on original sources that reveal all the complexity, the culture, the culture of the task environment, and the meaning of actions to insiders at the time'. [START_REF] Vaughan | The Challenger launch decision: risky technology, culture and deviance at NASA[END_REF].

Second, there is the question of the unanticipated consequences of technological and social actions, when the sheer number, nature and intensity of interactions between human and non human parts of socio technical systems lead to unexpected behaviours. As one is always located somewhere in a vast network of interacting parts, one can't pretend to have a full grasp of the entire system. This distributed nature of knowledge (and bounded rationality) makes it impossible for anyone to foresee every possible situation of interactions, moreover in a highly dynamic system where change is the norm rather than the exception. This distributed situation has been perfectly well captured by Weick regarding its implications for organisation theory 'We know most organizations function quite well even though no one knows quite what's going on' (Weick, 1979, 109). The downside of this is however, from time to time, an accident.

Third, there is the difficulty of establishing and stabilising normative frames of conduct for every situations and every actors of an entire socio technical system. Innovation, both at managerial, engineering and operational levels consists in breaking rules or established standards, consists in exploring new ways of doing when coping with complexity. It implies flexibility and creativity to adapt organisations to their environments (e.g. markets) for managers but also to produce knowledge and understanding about unruly technologies for engineers and to cope with work situations for operators. This line of thinking is both relevant for operators, engineers and managers as Rasmussen wrote few years back now 'Analogy can be drawn between the adaptive mechanisms involved in the skill attainment of individual (...) and the role of management decisionswhich may be errors in a safety point of viewin the adaptation to efficiency measures of an organisation. Errors in management and planning are intimately related to organisational attempts to adapt to the requirement of a competitive environment' (Rasmussen, 1987).

As a result of these three issues, one central problem met by anyone involved in a direct or indirect manner in safety management of high risk systems is fairly well coined by Pidgeon (1998) 'One puzzle for prediction, raised in several of the contributions, is that any of the background pre-conditions found in man-made disasters would apply to any modern organisation, successful or not. Barry Turner liked to quote the following observation from a close colleague, David Weir, who has suggested (personal communication) that 'most organisations operate in a degraded mode most of the time'!'. One absolutely can't predict the future (1), one can't pretend to have the big picture ( 2) and one must always, in real life situations, innovate beyond the established normative frames of conduct to cope with an uncertain -ill structured -world (3). One understands, how, brought together, these three issues create the background for the sustained assumption that accidents will keep on happening from time to time.

Interpreting an accident for judging whether or not it was 'normal', i.e. inevitable, is as a consequence, always a matter of judgment, considering these three examples of issues. Such a judgement is based on a mix of professional and more theoretical backgrounds, including a lot of hidden philosophical preconceptions and understanding of socio technical systems (see for example the work of Reiman, Rollenhagen, 2011 on they chose to call 'biases'). This can be a disturbing and confusing experience for an investigator when he/she oscillates between managerial, neutral or more critical viewpoints (e.g. Habermas, 1973). In any case, it seems extremely difficult to ensure that a high risk socio technical system will never suffer a major accident. So, to the question 'How do I know that I am not going to have a major accident tomorrow?' in the light of the 'normal accident' debate, one is very challenged to come up with an affirmative answer. However, this certainly does not mean that there is no room for improvement in the way safety is managed. Knowing about these features of any socio technical situation implies thinking and acting accordingly. Are current methods, tools and approaches up to the challenge of these three issues? This is an interesting part of current safety developments. In particular, one would like to see how much of what we know now about accidents is really translated into safety management practices. This brings us to the second section of the paper.

Findings of modern accident investigations

In the past twenty years, a wealth of well documented reports on major accidents has been produced in different industrial domains. What do they teach us? Let's illustrate this with the recently investigated Macondo well disaster (Chief Counsel Report, 2010). If one wants to approach this accident in a systemic manner, it is possible to distinguish five areas which will be briefly introduced here with the help of several illustrations extracted from the report (figure 1): o fourth, the organisational dimensions including also very often several organisations interacting, and (figure 5), o fifth the regulatory aspect of high risk industries (figure 6).

These five items are now briefly commented each in turn.

Deep water exploration entails drilling operations with safety issues including (among others) loss of containment of gas from the well. One scenario is a 'kick' followed by the release of gas on the platform, creating a flammable cloud at the surface. The uncertainties involved in drilling and the likelihood of a 'kick', are conditioned by interactions between the tools and the characteristics of geological formations (e.g. temperatures, pressures, nature of sediments).

The Macondo well accident is due to a loss of containment of gas.

Figure 2. Technology and hazardous situation

For preventing identified scenarios, barriers or defence in depth are designed. A BOP ( blow out preventer) is one of the key elements of this defence in depth strategy, along with the casing, shoe track cement, cement plugs.

The accident is due to the failure of the defences in depth, including the BOP (its functioning, maintenance and design). For conducting drilling, an important task consists in supervising operations from a distance, with the support of computerised technology. Along with this, more visual manual tasks are also involved on the deck of the platform (e.g. mudlogging). Retrospectively, in the light of the events, it appears that the design of human machine interfaces included issues regarding the handling of displayed information and the management of alarms. An accident is always to be explained as the result of an interaction of different types of dimensions including the ones presented above (on different investigation rationales, see Le Coze, 2008b). It requires several disciplinary backgrounds to be brought together, including engineering, ergonomics, social sciences, management and political sciences. This requirement for safety modelling was translated in Rasmussen's influential research program throughout the 90's (e.g. [START_REF] Rasmussen | Risk management in a dynamic society: a modelling problem[END_REF]. His socio technical model is a very well known representation of this program. While other authors have also provided similar frameworks to illustrate this systemic view (Moray, 1994[START_REF] Evan | Minding the machines. Preventing techonological disasters[END_REF], it is Rasmussen's model which associates very explicitly each level with several scientific disciplines (for a more detailed review of Rasmussen's legacy, see Le Coze, 2012a).

Applied to the Macondo well case study, one sees very well the relevance of Rasmussen's conceptual formulation. To investigate and understand technical issues related to the gas 'kick' scenario or to the BOP failure, one needs an engineering background relevant in this domain. Without it, one would be faced with the difficulty of generating hypothesis about what happened. However, once everything is clarified, a fairly clear story can be written for anyone without any engineering background. Understanding that gases sprung at the surface because of the pressure from the geological formation and that the BOP failed to prevent it is quite straightforward. This retrospective understanding of technology in interaction with its environment made available to anyone also contributes to the 'hindsight bias' effect.

Once hypotheses have been generated and that a specific accidental scenario is selected from a technological point of view, a second layer of investigations including decisions and actions of humans can start, including other disciplinary backgrounds. In reality, actions and decisions of humans close to the events have already been included in order to produce hypotheses for the technical side of the accident. What people heard, saw or did before, during and after main events leading to the accident are always information needed to formulate most likely hypotheses.

Exploiting human contribution from different point of views, using for example ergonomics, management and sociology comes in a second step, and with different models than engineering ones. To describe the coupling between computers, machines and humans, but also to better grasp the phenomena of interacting humans within teams and (inter/intra)organisations, one needs complementary observations and interviews than the one applied at the engineering phase of the investigation. The same applies when one wants to include aspects related to regulatory oversight. When this is performed, a very rich perspective is available, combing issues related to power plays, cultural and cognitive dimensions. One can see decision making processes where conflicts, uncertainties, hierarchy and communications aspects interact all together within time, but also budget and expertise constrains. It is only when these different dimensions are brought together that a systemic interpretation of the accident is produced (Le Coze, 2010). Another 'hindsight bias' is then possible, this time for those without cognitive, psychological and social sciences backgrounds.

What do we find in audits?

Now, one question that comes to mind immediately after this example of investigation (among others) is how much of what we know in retrospect can be found in organisations beforehand? In other words, do organisations produce a level of information for their own decision making processes that matches the quality of data that one finds afterwards in reports? Such a question was expressed, few years back, in 2004, by French control authorities after an investigation commissioned by the ministry to INERIS (this investigation and its results have been described, later on, in [START_REF] Le Coze | Accident in a French dynamite factory: an example of organisational investigation[END_REF]. This question was expressed as follows 'Why don't we perform this kind of investigation before, rather than after?'. This was an interesting question indeed.

A first answer had been framed at the time with the help of the field of complexity but also in relation to the limits of audits (Le [START_REF] Le Coze | Are organisations too complex to be introduced in technical risk assessment and current safety auditing[END_REF]. The argument was that organisations were complex systems that couldn't be thought through a deterministic and reductionist view; a certain level of methodological and theoretical plurality was advocated. It was also argued that safety management system (sms) audits1 relied on structural views of organisations and as a result were clearly unable to sensitise the complexity of socio-technico-organisational life. This is a problem because audits are one of the main safety tools for companies (of course, there exist differences between industrial sectors and from on company to another in the same sector). This statement was based on theoretical and professional experience. Let's carry on in this paper with the limits of audits and extend this line of argument. There are many ways to approach this issue.

A first one is through the literature. What is available in the literature regarding audits, and more importantly for the topic of this paper, about their limits? Has a lot been written about it? A second is the interviews and observations from empirical fieldworks. For the past few years, we have been investigating, in normal operations or in the context of incidents or accidents, many different work situations and high risk organisations, including observations and interviews with several types of actors (e.g. operator, engineers and managers). What do people from the industry say during our interviews about the limits of audits? What do we see through our observations about the way audits guide collection and interpretation of data?A third one is the data that company produce publicly about themselves, either during conferences or by other means (i.e. journals, internet). What can we infer from publicly available companies discourses regarding the exercise of auditing? A last one is theory. From a theoretical point of view, is it possible to pinpoint limits of audits that would be intrinsic to their underlying rationale? These four threads are now in turn developed.

Literature.

It is difficult to find either empirical or theoretical works dedicated to auditing, but two interesting ones are worth introducing here. In a study raising the question of the impact of audits, Chaplin and Hale (1997) analysed the implementation of ISRS (International Safety Rating System) in a company of the petrochemical industry. Although the paper had a rather positive tone about the value of audits, the conclusion was tempered with the following issues. The ISRS system is quite clearly designed for organisations which are used to working with the paperwork systems typical of bureaucracies.(...) it would be less likely to work in organisations where there needs to be constant improvisation, or where the organisation is small enough not to need to commit everything to paper' (Chaplin, Hale, 1998, 183). Thus, for these organisations in high risk contexts which need to rely on improvisation and adaptation to unforeseen events, these conclusions undermined somehow the value of the auditing approach. But, around the same time, outside the field of industrial safety, a much more critical orientation was found in Power's book (1997), a theme that he further explored 10 years later [START_REF] Power | Organized uncertainty. Designing a world of risk management[END_REF]. For this author, 'standardized elements, such as the auditable management system (…) represent the rationalizing tendencies of audit to reproduce ever more formal auditable structure, regardless of demonstrable effectiveness' or 'Images of control over pollution and derivatives ( …) get manufactured by an audit process which necessarily insulates itself from organizational complexity in order to make things auditable and to produce certificate of comfort'. (Power, 1997, 123, 140). Applied to financial, medical and environmental activities, the picture depicted by Power is then much darker and radical than the one suggested by Chaplin and Hale.

While they identify the problem of improvisation but also of bureaucracy, Power does not hesitate to criticize further the result of framing everything under auditing principles, among which the drawback of 'paperwork'. 'What audits really procure, other than working papers, is more opaque than is commonly admitted' (Power, 1997, 39). Although not grounded in the traditional high risk industries, many of Power's insights do echo with, for instance, what major accident investigations have revealed since many times. In these investigations, many organisational problems were without any doubt in the background of the disaster but never described in a systematic and systemic manner beforehand, whether publicly or within the corporation itself where actions could have been taken. These accidents do reveal again and again that 'individuals are infinitely more complex and adaptable than normalizing attempts to measure and control them; a substantive, messy rationality always reasserts itself over formal, technical rationality' (Power, 1997, 120). Although, without any doubt, major contributors of improvement in safety over the years, as asserted by Chaplin and Hale, auditing practices can also then be criticised, as Power does, for clearly oversimplifying organisational complexities and misleading organisations in the appreciation of their own limits (Starbuck and al, 2005). Although one can see the added value of auditing as asserted by Hale and Chaplin (apart from the issue of improvisation), Power's interpretation also echoes fairly well with our own fieldwork experience.

Elements from empirical fieldworks

In our empirical studies, mainly in the chemical industry, one question that we always ask to safety technicians, engineers or managers is what they think about audits. Everyone is not necessarily critical in the same ways. Nevertheless, what comes out first is that auditing has become a formal exercise, a routine. Everybody seems to know what auditors are after. After some years of experience, people know what to answer to satisfy auditors. The rationale of auditing is indeed very often based on paperwork. According to auditing principles, paperwork can demonstrate in a tangible manner that systems are in place. Auditors look for documents showing that the system is implemented. These documents are recordings of different types of activities, like the results of an inspection of a vessel in a chemical plant, or a signature on a document proving that someone with a specific expertise has been consulted. They can also be procedures describing specific steps of a task, transformed in checklists to fill.

Second aspect that comes out is, from a process safety point of view, that auditing is not directed to the right kind of problems. In many cases, auditors seem to be more interested in secondary issues rather than primary ones. Secondary issues for individuals with process safety functions are for example checking if people use pedestrians crossing in the factory or if the pedestrian crossings are visible. Although they do recognise the importance of these types of concerns for occupational safety, they regret that they come first at the expense of more technically oriented relevant enquiries (e.g. checking a barrier, e.g. a sensor, on the process), which matter directly for process safety. As one engineer put it, auditing is as good as the auditor (and this auditor can be, in consulting companies, a young and inexperienced one, which helps bringing down the costs).

If an auditor is knowledgeable in the area he/she is auditing, then the audit can have a positive outcome. If not, the audit can become a waste of time. For this reason, many prefer, when possible, cross auditing. Cross auditing consists in being audited by someone with a similar position and experience in the company. Such a person goes straight to the key issues, and can prioritise much better in the discussion between primary and secondary areas. It becomes an exchange between two experts, or professionals, rather than a formal exercise guided by procedures that are not understood with a background about real life, concrete, work contexts. They can discuss on the basis of a shared understanding of real life situations (and engineering expertise) rather than on a basis of an abstract management system view of safety.

During a research in an international group where we interviewed individuals both from sites and corporate levels, audits were found to be the principal source of data for decision making regarding safety matters (along with incident investigations and technical risk analysis). Relying on these audits was a very strong input to the group safety strategy at a corporate level, on the basis of which they elaborated indicators and tables 'ranking' sites. The difference of views between people on site and corporate individuals about the relevance of audits was therefore striking. While corporate safety managers saw audits as an effective tool for monitoring sites, safety engineers or managers on sites were challenging, along the line explained above, the quality of the approach. Thinking that corporate levels rely on these audits without considering their limits described by site people was, as a consequence, an important theme for our feedback session to the company. It triggers concern regarding the ability of audits to inform top managers and executives about real work conditions and as a consequence the ability to trigger appropriate responses by companies.

After spending several days applying an ethno-sociological type of investigation on a site of this group, our own point of view regarding these auditing practices by corporate levels was on the side of sites safety engineers and managers. Although audits were performed by a team of two to three trained people over two or three days (sometimes more), their way of questioning the organisation made them unaware of issues involving real life working conditions including organisational changes concretely affecting safety practices. The presence of a new director with a different experience and decision making practices that the previous one, the replacement of the experimented safety manager by a younger one with expertise in process engineering, the change of policy for sub contracting, training and recruiting, the problem of having to adapt procedures in some production pressures circumstances, were key issues over the past months and years transforming the profile of the site. However, none of these aspects were included in the audits. Audits expressed instead their own rationales, based on checking completion of paperwork, and approaching organisations through safety management system items, disconnected from each other (that we called the 'drawer effect'). More about the audit rationale is explored next.

Publicly made available data on high-risk organisations

In 2009, the petro-chemical group Total suffered a series of four deadly accidents in different sites, including:

1. two explosions in two different sites (3 deaths and 11 employees injured), 2. one exposition to dangerous substances (1 death) and, 3. one accident involving a truck (1 death) 2 .

The company decided as a consequence to assess widely the situation. Rather than considering this as bad luck, the corporation considered that a deeper problem might be found in the background of this dark series ('série noire' in French). The company commissioned internally what they described as a 'general safety inspection'3 . This inspection covered 13 sites of the company in France. After five months of inspection (from September 2009 to January 2010), a document was then made available in February 2010, summarising the findings of this inspection4 . This report is very interesting as it shows in a rather direct way how the company conceptualises the problems related to these accidents. We will argue that it reveals quite clearly some aspects of the rationale of audits.

One can imagine that the document does not provide all the findings, and the most critical aspects might not be revealed in this public version, but it is not so much what interests us here. Instead, it is the implicit models that the document contains about the interaction between technology, humans, systems and organisations in relation to safety that is relevant. It helps to surface some of the assumptions one finds in probably many high risk companies when it comes to interpreting socio technical issues with regard to safety. It is therefore important here to recall that this section of the paper is not critical of Total for its initiative but, on the contrary, stresses positively this strategy of transparency. This section however takes the chance to analyse the content of the report to explore some of what seems to be underlying assumptions about safety, or at least, the ones the company is openly communicating about.

In the inspection reports, many safety management system areas are addressed. These are areas where improvements are expected in the future. These are organised in 7 sections including 1. Risk analysis methods, 2. Operations, 3. Maintenance and inspection, 4. Sub contractors, 5. Management of competence, 6.Monitoring efficiency, 7. Organisation. For each section, a summary is written, followed by recommendations. The essence of the audit rationale is perfectly contained in the following quote from the introductory section of the 16 pages report 'The general safety inspection was able to observe that the operations of inspected sites rely on a robust basis, , and particularly on teams professionalism, it is however crucial to always ensure the solidity of this basis. This basis, ensuring operational mastery, is a referential comprising technical standards, organisational procedures and operating procedures that one must not depart from for fear of opening a path to failure' In this quote, there is the very idea that standards or procedures, once written down, define a global framework to comply with for ensuring safety. Moving away from this framework creates opportunity for accidents. What is interesting here is the absence of any indication about the part played by humans, apart from the mention of 'professionalism'. The picture, or metaphor, conveyed is a mechanistic one, a rigid one: there is a structure based on thorough risk analysis that once designed and if implemented, is in a position to contain the risks. In many places in the report, one can see the influence of this view. For instance 'These rules and procedures are constraining, they result from operating experience and risk analysis, complying with them is a discipline of every moment'.

One wonders why so little space is dedicated to introducing other fundamental dimensions of safety such as the ability of individuals, at many different positions within companies (e.g. operators and line managers, production and safety engineers, managers, etc), to adapt when facing novelty or unruly technology, when working conditions expected to be found to implement rules are not met or when decisions must be taken under uncertainties. One could expect to see the three types of issues described in the 'normal accident' section of this paper to be acknowledged as challenges for high risk industries. With this report, we are very far from the kind of description one finds in accident investigation reports such as the one chosen for the argument of this paper (section 2).

Of course, this is not an accident investigation report, but there are no indications about the complex interactions between humans, technology, organisations including issues of power, hierarchies, cultures but also conflicts or decision making processes over technology or strategy orientations. Companies deal with them everyday, find solutions to cope with them in order to be successful, so why not mentioning them? These phenomena are the daily life encountered by anyone in these organisations. Where are they in the report? Nowhere. Instead, it is argued that the image promoted by the report relies on a safety management system audit rationale. It is almost as if humans were excluded of the picture. Human are expected to comply with a normative framework. This reflects quite well our own empirical data (section 3.2) but also echoes Power critics ''individuals are infinitely more complex and adaptable than normalizing attempts to measure and control them; a substantive, messy rationality always reasserts itself over formal, technical rationality' (Power, 1997, 120). This can also be illustrated quite clearly from a theoretical point of view.

Theory

If one wants indeed to look into the audit rationale from a theoretical angle, another strategy consists in differentiating it from other kinds of approaches. This is what the following figure does (figure 7). It contains similar dimensions than other figures mentioned in section 2 (i.e. Ramussen, 1997[START_REF] Moray | Culture, politics and ergonomics[END_REF][START_REF] Evan | Minding the machines. Preventing techonological disasters[END_REF] but with slightly different graphic principles e.g. all domains are interacting, not separated from each other by socio-technical 'levels' or 'layers'.

Strategy in environment

(market positions, authorities, institutions, etc)

Social interactions

(power, culture(s), hierarchies, organisational structures,etc)

Processes, procedures & managerial tools

(risk analysis, learning from incidents and accidents, etc) The red circle indicates what audits target. Audits focus on processes, procedures and recordings. When doing so, they leave aside technology, interfaces, social interactions and company's relation to its environment. From a theoretical point of view, it is therefore not a surprise if audits only catch a limited aspect of socio technical complexity. Let's comment each of these points in a clockwise direction. Audits often don't establish a link with technology (1). As described in 3.2, fieldwork observations and interviews indicate that audits are somehow disconnected from technology, especially when it comes to process safety. This idea is now well established with accident investigations showing that occupational safety indicators are not reliable indicators of process safety (Baker Panel, 2007). If auditors focus on occupational safety for major hazard prevention, they miss the point. A relevant audit from a process point of view can only be performed if the technological dimension of the problem is included in the picture (e.g. a description of defence in depth principles) based on sound engineering knowledge of installations and risks.

Change

Audits are not designed to consider human machine interfaces, and more generally work situations [START_REF] Turner | Man-made disasters. The failure of foresight[END_REF]. Although human computers interactions are now a central issue in any high risk industry, audits don't investigate them. This would require observations, interviews of a different kind that audits. It is the field of cognitive engineering or cognitive ergonomics, which emerged in the eighties with the increase of automation and was developed to introduce an array of complex issues related to display of information. The need for a mix of engineering and psychological/cognitive background is necessary for assessing human machine interfaces situations. It is doubtful that audits are in a position to provide this kind of expertise when solely relying on processes, procedures and recordings.

Audits do not consider explicitly the environment of a company (or a site within a group) to understand its resources and constraints (3). One dimension of the environment is company's (or site's) top management strategy regarding interactions with regulators, adaptation to market (or group) opportunities or subcontracting options. This view of the organisation is to be balanced with the institutional (or societal) forces shaping company's opportunities, such as professions or demography, social changes or professional associations. Last, audits are not designed to include sociological understanding of organisations (4). This would rely on understanding of combined effects of organisational structure, conflicts, power plays and cultural dimensions. The kind of investigation and knowledge needed to include (3) and ( 4) depart from audit methodology consisting in following processes, procedures and recordings. Instead of relying on closed questions, an analysis of social interactions and organisation's environment necessitates opened questions and long period of time for obtaining a minimum of 'intimacy' with real life situations. Instead of considering organisations through processes and procedures, one considers organisations as a result social interactions between actors.

Summary section 3

This section started with some critical views from the literature. Power provided interesting, although certainly radical, comments about audits [START_REF] Power | The audit society. Rituals of verification[END_REF]. In his view, management system audits frame reality in a simplistic manner, relying on an excess of paperwork to demonstrate compliance with standards. While doing so, 'the abstract system tends to become the primary external auditable object, rather than the output of the organisation itself, and this adds to the obscurity of the audit as a process which provides assurance about systems element and little else (Power, 1997, 85). Although radical, this statement can be observed in reality as we have commented with our own observations. First audits can miss the point when not designed to establish links with certain specific problems (e.g. occupational versus process safety). Second, standards are inadequate to support auditors judgment of real work situations if they are not supported by relevant expertise in the area audited (hence the appeal by operational people for cross auditing). Third, safety management systems audits can miss, as we observed, key dimensions related to everyday life of companies, such as (organisational) changes ('drawer effect', i.e. studying safety management system items separately).

A similar analysis could be made of the general inspection report produced by Total in 2009. This report contains many expressions that reveal quite clearly a mechanistic or structural image or metaphor of safety management. Finally, these comments based on empirical investigations or available documents could be supported by a theoretical approach. Safety management system rationale is shaped by a process and procedural view of companies that tends to produce structural, mechanistic or rigid expectations. This frame, like any frame, influences what is selected, filtered, collected and interpreted. As such, it can be compared with other safety approaches including engineering, sociology and ergonomics. When doing so, it is clear that audits only look into organisation from one specific angle, a kind of 'tayloristic' one, denying the innovative and most needed manual, cognitive and relational adaptations of different categories of employees, from operators to line managers including process and production engineers.

How to move forward? Some existing guidance

If one accepts the idea that audits are limited, a next step is what could extend, complement or replace them? In fact, this paper is not the first one to challenge the limits of current safety approaches and to express the need to move beyond them (e.g. [START_REF] Dalzell | Is hazard management working?[END_REF][START_REF] Berman | Organisational drifta challenge for enduring safety performance[END_REF], Reiman, Oedewald, 2009). Although these authors do not always explicitly criticise audits as a starting point, they do stress the need for new perspectives or models for assessing safety, and offer some guidance. [START_REF] Dalzell | Is hazard management working?[END_REF] want thus to connect much more explicitly technological risk assessments with the operational and managerial activities of different actors of high risk systems. For this purpose, they combine Rasmussen's socio technical levels (individual, facility, managerial and corporate) with what they define as nine attributes of hazards and risk management (e.g. line responsibility, risk hazard and understanding, corporate unease, identification of critical elements and the existence of minimum standards, the definition and application of clear operating limits, etc).

Their purpose is 'moving to the next level, distilling the knowledge from the safety cases and risk assessments to optimise what we do (...) it is moving from managing the basics into these areas which are less quantifiable but can deliver significant risk reductions' (Dalzell and Hopkins, 2006, 896). After describing for different actors what would be expected from them with regards to the nine attributes, they then question one by one the current practices of the industry (more specifically, it seems, the chemical and petro-chemical industry), based on their experience. The strategy is thus first to define a normative framework, second, to compare this one with reality. Here is an illustration. The authors provide a normative statement coupling a chosen level and an attribute, e.g. the definition and application of clear operating limits at facility level. 'Boundaries should be defined within the performance standards discussed above. (...) At the facility level, the performance limits of the plant are easy to define in terms of throughput but less precise when considering the minimum manning, the maximum level of activity or occupancy and the point at which the combined deficiency of apparently unrelated critical systems, including people, becomes intolerable.' (Dalzell and Hopkins, 2006, 889) They then turn into an evaluative mode corresponding to the items normatively described earlier and come with a statement.

For our example, their view is the following one 'At the middle levels, there appears to be a much more general tendency to ask -'what do we need to do to keep going...or can we get by without ...?' At the managerial levels there seems to be a reluctance or inability to set precise limits and to say no. Instead, the opposite is appearingthe setting of stretch targets for production and return, and the encouragement always to say 'yes'' (Dalzell and Hopkins, 2006, 893). They repeat the same process throughout their paper for each item. The conclusion contains then a critical tone 'the attributes for effective hazard and risk management listed above have not been widely observed' (Dalzell and Hopkins, 2006, 896). They advise as a consequence to reduce the complexity of some of the developments in risk reduction of the past years (e.g. human factors, hazard analysis techniques, technology, hardware) and to 'hand risk management back to the line managers' (Dalzell and Hopkins, 2006, 900).

For [START_REF] Berman | Organisational drifta challenge for enduring safety performance[END_REF], there is a need to devise new models and methods to be in a position to better capture 'organisational drift'. Looking back into several accidents from medical, nuclear power and space sectors (e.g. David Besse, Toïkamura, Columbia), they identify a common pattern of organisational drift across their case studies. They remark that for the David Besse case, where 'the nuclear power plant, near Toledo, Ohio, came within 3/8'' of a loss of coolant accident that would have earned it a place Chernobyl', it 'had been rated 'INPO 1' which meant that an independent review process undertaken by industry peers had judged it to be a high-performing organisation' [START_REF] Berman | Organisational drifta challenge for enduring safety performance[END_REF]. This story has puzzled other authors involved in the nuclear industry (e.g. Perin, 2005, 15). Several assumptions could be made about this story. Some are briefly introduced here.

One is that external peers missed that particular scenario although they could have in principle. They didn't because of lack of time or 'lack' of identification of this area as safety critical at the time of the assessment 5 . Another one is that the individuals commissioned for the assessment were not qualified enough to perform it adequately. They didn't have the expertise to challenge practices of operators, engineers and managers regarding the specific issues revealed by the incident. A last mentioned here is that the background model to assess safety was inadequate to identify flaws or problems that increased the likelihood of an accident.

This last hypothesis seems to be, implicitly, what Berman and Ackroyd have chosen. They have indeed classified several approaches met in the nuclear industry into 1. Peer review, 2. Safety culture assessments, 3. External audits, 4. Learning and feedback systems, 5. Performance indicators, 6. Internal oversight departments and 7. Formal reviews. Regarding audits, they assert that 'this is frequently to general in scope'. They conclude that 'organisational drift' is invisible to all of these approaches, hence the good external assessment of David Besse nuclear power plant, just before the very serious near-miss. In front of the limits of all these approaches, their answer consists in offering a model of organisational drift combining 'major or incremental changes' with 'degradation' combined with 'oversight failure'. Designing new models for capturing organisational drifts is advocated as a solution to overcome some of the limits of current approaches.

It is a similar line of argument, but more developed and elaborated, that can be found in Reiman and Oedewald (2009). They, also, establish a list of approaches that one can find in the nuclear industry; very close to Berman and Ackroy's list (e.g. safety management system audits, safety culture evaluation, peer review, etc). One difference is that Reiman and Oedewald separate several historical periods regarding the way safety has been theorised. They consider that this list corresponds to a third era of safety, to conclude that 'a challenging issue is the evaluation of the organisation as dynamic complexity and not merely an aggregate of the above mentioned factors' (Reiman, Oedewald, 2009, 18). Their conclusion is also to move beyond current perspectives, to enter a fourth era through new models because 'in these evaluations, more emphasis is still placed on the assessment of technical systems, structures and documents' (Reiman, Oedewald, 2009, 33). Their model suggests a combination of different insights on organisations, through psychological properties and conception of the personnel, organisational structure and processes, social processes and organisational core task and the basic technology.

All these authors share the same line of reasoning. First, they identify a problem, i.e. the way safety is assessed is not appropriate; second, new models are advocated to address this problem. Some of these models have a more normative orientation [START_REF] Dalzell | Is hazard management working?[END_REF] and some other have a more descriptive one [START_REF] Berman | Organisational drifta challenge for enduring safety performance[END_REF], Reiman, Oedewald, 2007[START_REF] Reimann | Evaluating safety-critical organizationsemphasis on the nuclear industry[END_REF]. Some target situated actors at several levels of socio technical systems in order to specify what is expected from them according to different attributes [START_REF] Dalzell | Is hazard management working?[END_REF] while some target observers; whether external or internal, in a position to perform assessments of high risk organisations as a whole, by providing adequate models [START_REF] Berman | Organisational drifta challenge for enduring safety performance[END_REF], Reiman, Oedewald, 2009). More specifically, what the latter share is a sense of dynamic and systemic views to be applied to safety assessment of high risk organisations. Although, as indicated, these authors do not target audits directly, their ideas are relevant as an answer to the limits of audit.

This idea that new models should be applied to appreciate better safety from a more complex and multidimensional perspective, but still in a position to be practically implemented, is an important research theme that should bring together industry and safety scientists. The fact that many researchers have found important to develop new models is also a sign that the available ones are not satisfactory. One interpretation of the current situation is that the successful models of the past ten or twenty years in the field of safety might have started to become inadequate in relation to the findings of modern investigations and safety research. Thus, Reason (1990[START_REF] Reason | Managing the risk of organisational accidents[END_REF] or [START_REF] Rasmussen | Risk management in a dynamic society: a modelling problem[END_REF] created their hugely influential models on case studies of accident of the eighties and the nineties (e.g. Chernobyl, Challenger, Piper Alpha). They also relied on their psychological and cognitive engineering backgrounds to conceptualise these events and translate them into simple and useful models (Le Coze, 2012b). Social sciences should now also provide the inspiration for new models and approaches of industrial safety (for an extended discussion on this topic that can't be develop here, see Le Coze, 2012a, 2012c).

Conclusion

The aim of this paper was to demonstrate the relevance of questioning the limits of audits. There are several good reasons to do so, among which, recurrent technological disasters. It was argued that these practices rely on too simplistic method and models. Individuals (whether operators, engineers or managers) are not simply following procedures. Cognitive processes involved in their daily operations are highly complex and adaptive, and involves, for operators, interactions with technology, automation, computer displays and colleagues. Organisations are not mechanical machines behaving according to defined structures. They are socio-politico-cultural realities where power, conflicts, ideologies, change and hierarchies play a very important part in shaping their trajectories. Where are all these complexities in current auditing practices? Nowhere, in fact; or not explicitly. The literature, our empirical case studies, available documents and theory together reveal that these topics, although behind any accidents, are not acknowledged by companies. This might sound as a harsh judgment. But the normalisation of accidents in all industries over the past thirty years [START_REF] Virilio | L'accident original[END_REF][START_REF] Fressoz | The lessons of disasters. A historical critic of postmodern optimism[END_REF], demonstrate that something is wrong. We believe, with other (e.g. [START_REF] Power | The audit society. Rituals of verification[END_REF][START_REF] Power | Organized uncertainty. Designing a world of risk management[END_REF], that the way audits are conducted (including methods and models) is a part of this problem. The paper introduced elements to support this claim and some ideas to move forward, based on recent developments in the field of safety science.

Figure 1 .

 1 Figure 1. Macondo well disaster, five areas to consider, for simplification o first, the technological hazardous situation (figure 2), o second the technologically based defence in depth principles (figure 3), o third, the work situations of operators (including very often human machine interfaces) (figure 4),

Figure 3 .

 3 Figure 3. Barriers or defence in depth.

Figure 4 .

 4 Figure 4. Work situations and human-machine interfaces

Figure 5 .

 5 Figure 5. Intra or/and inter organisational interactions

Figure

  Figure 6. Regulatory issues

Figure 7 .

 7 Figure 7. Several approaches to safety.

In the rest of the paper, 'audits' means 'safety management system audits'.

http://www.usinenouvelle.com/article/total-l-inspection-generale-de-securite-est-bouclee.N128067

http://www.total.com/fr/groupe/actualites/actualites-820005.html&idActu=2312

http://www.total.com/MEDIAS/MEDIAS_INFOS/3186/FR/IGS_synthese.pdf

This is Perrow's view, with a strong critical, dark, flavor 'Objecting workers were disciplined and the reactor was allowed to continue functioning under very dangerous conditions. One objecting worker went directly to the Nuclear Regulatory Agency, forcing the embarrassed agency to act upon information they already had but chose to ignore. The worker was fired. When he sued the company for unlawful dismissal, the NRC sued him in turn'(Perrow, 2010, 313).


Ali Saeidi
email: ali_saeidi@uqac.ca

Olivier Deck
email: bolivier.deck@mines.inpl-nancy.fr

Marwan Al Heib
email: cmarwan.alheib@ineris.fr

Thierry Verdel
email: thierry.verdel@mines.inpl-nancy.fr

Alain Rouleau
email: ealain_rouleau@uqac.ca

Adjusting the Influence Function Method for Subsidence Prediction

Keywords: Mining subsidence, Influence function method, vertical subsidence, influence angle

The extraction of ore and minerals by underground mining may induce ground subsidence phenomena. These phenomena produce several types of ground movement like horizontal and vertical displacements, ground curvature and horizontal ground strain at the surface, and associated building damage in urban regions. The influence function is a well-known and efficient method for the prediction of these movements, but its application is restricted to mining configurations with the same influence angle around the mine. However, this angle may display different values when the mine is not horizontal or when other subsidence events already occurred near the considered mine.

In this paper a methodology and an algorithm are developed, based on the traditional influence function method in order to take into account different influence angles. This methodology is implemented in the Mathematica software and a case study is presented with data from the Lorraine iron mine field in France. Ground movements calculated with the developed methodology show a fair concordance with observed data.

Introduction

The extraction of ore and minerals by underground mining may induce ground subsidence. These phenomena produce several types of ground movement: horizontal and vertical ground displacements, ground curvature and horizontal ground strain at the surface [START_REF] Deck | Vulnerability assessment of mining subsidence hazards[END_REF]. These movements can cause damage to buildings and infrastructures on the surface, and jeopardise the safety of people. Therefore, predicting ground subsidence is very important in regions with underground mining, and several prediction methods have been developed. These methods can be classified into empirical, semi-empirical and numerical methods. The empirical and semi-empirical methods include graphical methods, profile function methods and influence function methods [START_REF] Aissaoui | Amélioration de la prévision des affaissements dans les mines à l'aide des approches empiriques[END_REF].

Numerical methods include finite element, distinct elements and finite differences methods. These methods can be very accurate when validated, but their application at a specific site and or in a certain context is highly dependent on the available data regarding the local geology, the mechanical properties of the overburden and sub-surface rock/soil. Moreover calculating a three dimensional prediction of the subsidence may require a large computational effort [START_REF] Alejano | FDM predictive methodology for subsidence due to flat and inclined coal seam mining[END_REF].

Graphical methods are derived from analysing an extensive field database collected over many years from mining subsidence in one mining area. A disadvantage of these methods is that they are developed in relation to a specific context and cannot be used with accuracy in other contexts. A well-known example has been developed by the NCB [4], which has provided several abacuses that can be used to predict subsidence for simple mine geometry (rectangular).

The profile function methods are based on mathematical functions that have been obtained by a curve fitting procedure to match the predicted profile with observed profiles [START_REF] Whittaker | Subsidences : Occurrence, Prediction, Control[END_REF]. Many profile functions are available for subsidence prediction [4].

Influence function methods (IFMs) were developed by Ren et al. 1987 [6] and are used extensively [START_REF] Whittaker | Subsidences : Occurrence, Prediction, Control[END_REF][START_REF] Sheorey | Ground subsidence observations and a modified influence function method for complete subsidence prediction[END_REF] to predict mining subsidence. They are based on the superposition principle and consider the displacements induced by a subsidence at a given point as the sum of the displacements induced by the subsidence of elementary mining units. IFM methods present several advantages compared to other methods for the three dimensional prediction of subsidence. First, these methods can be used with any type of mine geometry; empirical and semi-empirical methods are restricted to simple geometries. Secondly, these methods can be used to simultaneously assess vertical and horizontal ground movements induced by the subsidence at each point of the surface. In particular, the horizontal ground strain can be calculated everywhere and then used to assess the building damage [START_REF] Whittaker | Subsidences : Occurrence, Prediction, Control[END_REF][START_REF] Sheorey | Ground subsidence observations and a modified influence function method for complete subsidence prediction[END_REF][START_REF] Saeidi | Development of vulnerability functions in subsidence regions from empirical methods[END_REF][START_REF] Saeidi | Development of buildings vulnerability functions in subsidence regions from analytical methods[END_REF].

However, IFMs are developed with consideration of the same influence angle for all edges of a mine panel, while several influence angles are often observed in mining engineering. For example in the Lorraine iron basin the influence angle depends on the nature of the ground beyond the boundary of each edge of the mine polygon [START_REF] Saeidi | La vulnérabilité des ouvrages soumis aux aléas, mouvements de terrains : développement d'un simulateur de dommages[END_REF]. Therefore traditional IFMs cannot be used for prediction or calculation of subsidence in these regions.

This paper describes a methodology for applying the IFMs in the case of several influence angles. First, the principles of IFMs are explained, then the methodology is developed for the case of the several influence angles. A final section shows an application and final test of the methodology with a case study in the Lorraine iron basin.

Prediction of the subsidence parameters

This method is based on the superposition principle and addresses the displacements induced by a subsidence at a given point as the sum of the displacements induced by the subsidence of elementary mining units. Assuming an infinitesimal element dA (Fig. 1) at depth H to be extracted, the element will create an elementary trough at the ground surface. The deepest point of the trough is located directly above the extraction element dA, and the depth of the trough decreases with the radial distance from the deepest point. Consequently, the subsidence of a point P can be stated as a function of the radial distance between P and the trough central point.

The elementary subsidence dS z caused by an elementary surface dA at a point on the ground surface is calculated with Eq. 1.

dS = S × K (r) × dA (1)
Where S max is the maximum value of subsidence that can be observed for a critical and super critical case (i.e. for mines with a width greater than 2Htanγ), K z (r, γ) is the influence function, r is the radial distance between the surface dA and the ground surface point under consideration, and γ is the influence angle (Fig. 1). The total vertical subsidence at a given point P on the ground surface can then be estimated by integrating Eq. 1 over the mine panel surface (A) (Eq. 2).

= ∬ × (2)
An equivalent and frequent calculation of the subsidence considers a cone of influence whose apex is located at the point considered of the ground surface (Fig. 2). In this figure, we consider a point on the ground surface and calculate the effect of all elements of the mine surface contained in the cone of influence. For example, Fig. 2a shows three unit areas of the mine under the point P on the surface. The influence of the element is maximal for dA 1 , which is located in the centre of the cone under the point P, the influence of the element dA 2 is less than that of the dA 1 , and the dA 3 element has no influence at the point P [START_REF] Whittaker | Subsidences : Occurrence, Prediction, Control[END_REF]. This methodology requires discretising the surface area of the cone base into several rings and sectors (Fig. 2b andc). The calculation of the subsidence for each point P on the ground surface requires applying Eq. 1 to all of the sectors of the mine area included into the cone of influence under the point P [START_REF] Whittaker | Subsidences : Occurrence, Prediction, Control[END_REF]. A numerical software is developed to calculate subsidence parameters at any point of the ground surface (P). An application of this software to a theoretical rectangular mine is illustrated in Fig. 3 as an example. The geometrical dimensions are shown in Fig. 3a; a mine depth of 120 m and an influence angle of 35° are considered. The results of vertical subsidence are presented as isovalues (Fig. 3a) and in a profile in a X-X vertical section (Fig. 3b). Fig. 3. Illustration of results obtained by the IFMs for a rectangular mine, with a) contours of vertical subsidence; and b) subsidence profiles for vertical section in direction X-X.

= ∑ (3)

Application of IFMs in the case of several values of the influence angle

IFMs methods are usually developed while considering the same value of influence angle for all edges of the mine panel. However, influence angles may vary around a mine panel. This is the case in the French Lorraine iron-ore basin, where the influence angle depends on the nature of the ground beyond the boundary of each edges of the mine polygon. The study in this basin [START_REF] Saeidi | La vulnérabilité des ouvrages soumis aux aléas, mouvements de terrains : développement d'un simulateur de dommages[END_REF][START_REF] Heib | Paramètres d'affaissement pour la hiérarchisation des zones à risque dans le bassin ferrifère lorrain[END_REF] shows that if the adjacent ground is intact (i.e without mine workings) then the influence angle is about 10 degrees. If the adjacent ground has been excavated for mining, the influence angle is larger and varies with the method that was used for mining (Table 1). Two different methods of estimating the influence function considering different values of the influence angle are proposed in this paper.

Table 1. The values of influence angle depending on the nature of ground at the boundary of each edge.

Nature of ground beyond each edge boundary.

Intact or unexcavated area

Rooms and pillars area

Collapsed or subsided area Influence angle (°) 0-10 6-29° 23 -40°

Estimating the influence function -Method A

Method A applies a technique that assigns an influence angle value of a given point P at the ground surface (Fig. 4a) as being equal to the characteristic influence angle of the nearest edge of the polygon. Considering for example a rectangular mine polygon with four different values of influences angle (Fig. 4a), we can see that for point A of the ground surface the influence angle is γ 3 , because this point is closer to the edge of the polygon, which characteristic influence angle is γ 3 .

Similarly, for the point B, the influence angle is γ 4 (Fig. 4a).

Considering that the perpendicular line is the minimum distance between a point and a line, the line equation of each edge of polygon is calculated using Eq. 4:

Y -y 1 = y 2 -y 1 x 2 -x 1 ( X -x 1 ) (4)
with (x 1 ,y 1 ) and (x 2 ,y 2 ) the coordinates of two points of a same polygon edge.

If the line equation is written as Ax+By+C=0, the perpendicular distance of a point A with coordinates (x A ,y A ) is defined by Eq. 5 (Fig. 4b):

2 2 A A A x By C d A B ⋅ + + = + (5)
This technique gives inconsistent results as shown in Fig. 4b. The influence angle assigned to point P is γ 4 because the length of "PC" is less than the length "PD" while the consistent influence angle is more logically γ 3 . The technique is then modified as follows: each polygon edge is discretized into several small segments with characteristic mean coordinates (X i ,Y i ). Then the distance of the given point P with (X p ,Y p ) coordinates and each characteristic point with (X i ,Y i ) coordinates are calculated with Eq. 6.

d i = ( X p -X i ) 2 + (Y p -Y i ) 2 (6)
Then the minimum distance d i is determined (Eq. 7) and the influence angle related to this segment is considered as the influence angle of point P. i ( , ) if d is minimum

p i i i d γ γ γ = ∈ (7)
For example, in Fig. 4c the smallest segment among PE, PG, PH, PK, PL is PH and the influence angle assigned to the point P is γ 3 .

The influence angle related to each point of the ground surface is first calculated with this method, then the subsidence parameters could be calculated for each one of these surface points.

This method of considering different influence angles is tested with a rectangular polygon (Fig. 5). Two influence angle values are considered (20° and 35°) for the opposite edges. Other characteristics are: S max = 1.4 m, H = 120 m, the dimension is 50 m × 100 m. . Results presented in Fig. 5a are not realistic because of significant discontinuities. These are explained by a threshold effect shown in Fig. 5b, where it is observed that for two closely located points P and Q, the influence angle can be considered different (20 and 35 degrees), which is not realistic. Moreover, the R, S and T points illustrate the cases of indeterminate points as they are located equidistant between two polygon edges of the mine.

Estimating the influence function -Method B

For solving the discontinuity problem, a different method is proposed to calculate the influence function. In this case, the apex of the cone of influence is located at the mine level. The algorithm of this method is summarized in Fig. 6a. The polygon of the mine is discretized into a large number of elementary surfaces (Fig. 6b). Each elementary surface is then considered as a small polygon of mine with a constant influence angle for which it is possible to apply the IFMs. A value of the influence angle is then assigned to each elementary surface of the mine, according to the nearest edge, which allows calculatingthe displacement induced on all points of the ground surface.

The displacements induced by the rectangular mine shown in Fig. 5b (Fig. 7) have been calculated. The results appear realistic as they do not show any discontinuity. It is observed that the maximum vertical subsidence in two regions near the edges is characterized by low values of the angle of influence.

Application and validation of methodology

In France, the Lorraine region displays a very large number of old underground mines excavated using the room and pillars technique under urbanized areas. Between 1996 and 1999, five subsidence events occurred (two in the city of Auboué in 1996, two in Moutiers in 1997, and the last one in Roncourt in 1999) which caused damage to more than 500 dwellings. In this paper we consider the Roncourt case for verification and validation of our model. Isovalues of the observed vertical subsidence and a vertical section of this parameter in the direction AB are shown in Fig. 8. The polygon of the collapsed mine (collapsed area based on several measurements and tests performed by INERIS [START_REF] Fayad | Amélioration de code de calcul-Logiciel SUBSID : Application au cas des mines de fer[END_REF]) with different values of the influence angles are shown in Fig. 8b. The characteristics are specified in Table 2, where the points P i are the coordinates of the polygons, O is the opening of the mine, τ is the extraction ratio and H is the depth of the mine. The calculated values of the subsidence are shown in Fig. 8b, and can be compared with observed values in Fig. 8d. Comparing the results with measurements (Fig. 8d) is satisfactory considering the various uncertainties affecting the data and the model.

Conclusion

The influence function methods with suitable modifications can be used to predict subsidence for mine panels, even for panels with complex geometry. However these methods are developed for mine panels with a characteristic influence angle that has the same value over the entire mine workings. In a number of field cases, such as the iron mining area in Lorraine, different values of influence angle must be considered over a mine. A methodology is developed to apply IFMs over a mine site considering a variable influence angle in order to assess the ground subsidence. This methodology is implemented in the Mathematica software and a case study is presented with data of the Lorraine iron mining area in France. Ground movements calculated with the developed methodology are compared with the observational data and show a fair concordance.

Fig. 1

 1 Fig. 1 Principle of the influence function method. An infinitesimal mining element dA at depth H

Fig. 4 .

 4 Fig. 4. a)Method A for calculatng the influence angle of each point of the ground surface. b) Selecting the influence angle for each point of ground surface. c) ) Selecting the influence angle for each point of ground surface.

Fig. 5 .

 5 Fig. 5. Contours of the vertical subsidence in the case of different influence angle for a square mine and (b) Identification of problems in selecting an influence angle by the methodology of the nearest edge.

Fig. 6 .Fig. 7 .

 67 Fig. 6. Details of method B to take into account different influence angles. a) algorithm of the method, b) definition of the angle of influence of each small surface in the mine polygon, c) effect of each small mine surface on the ground surface.

Fig. 8 .

 8 Fig. 8. Comparison of observed results at the site of Roncourt with the predicted results given by the modified influence functions method.

Table 2 .

 2 Characteristics of mine polygon in Roncourt mine ([START_REF] Fayad | Amélioration de code de calcul-Logiciel SUBSID : Application au cas des mines de fer[END_REF]).

		P 1 [m]	P 2 [m]	P 3 [m]	P 4 [m]	O [m]	τ	H [m]
	Polygon 1	(434,406)	(495,601)	(327,538)	(289,418)	2,5	0,53	140
	Polygon 2	(557,537)	(572,627)	(497,607)	(468,515)	2,5	0,53	140