David Hourtolou Bruno Debray

INERIS Olivier Salvi

ARAM IS project: Achievement of the integrated methodology and discussion about its usability from the case studies carried out on real test Seveso II sites

11ntroduction

Some recent technological accidents like Enschede (2000), Toulouse (2001) or Lagos (2002) have led the public to wonder or even mistrust both the industry and the regulatory authorities in their riskinformed decisions. The communities want now to be informed and require more transparent decisionmaking processes. Risk-based decisions of course require some reliable scientific input from risk analyses. But from one risk analyst to the next, noteworthy variation exists in the results, which would affect any relevant and local decision (ASSURANCE project, 2002). That is why emerges today the need for a methodology giving consistent rules to select accident scenarios and taking into account safety management effectiveness for risk control demonstration. In the context of Seveso II directive, there is also an underlying need for a method that could reach a consensus amongst risk experts throughout Europe. ARAMIS overall objective is to build up a new Accidental Risk Assessment Methodology for Industries that combines the strengths of both deterministic and risk-based approaches. Co-funded under the 5th EC Framework Programme, this three-year project started in January 2002. A mid-term workshop was already organised in June 2003 in Maastricht and aimed at disseminating first results and collecting comments from the audience. One year later, the basic methodology is achieved and aims at becoming a supportive tool to speed up the harmonised implementation of SEVESO II Directive in Europe. This paper intends to summarise the major features of the methodology and to show how the needs of ARAMIS potential users were addressed. In a second part, the objectives of the case studies that are presently under progress will be discussed. Five main tests will be carried out on industrial plants, in countries with a consequence-based approach (France and Denmark) and a risk-based approach (Netherlands). The full test of the method in two future EU countries (Slovenia and Czech Republic) should also contribute to the dissemination process towards these countries, whose issues in terms of risk management can be slightly different from those of western-European countries.

Needs of potential ARAMIS users

The potential end users of ARAMIS are numerous but the most concerned are the industrialists, the competent authorities and the local authorities. If all of them have an interest in the same risk management process, their needs are slightly different. Industrialists need a method to identify, assess and reduce the risk. This method has to be accepted by the competent authorities. This method also has to bring useful information about the ways to reduce the risk and to manage it daily. The competent authorities need to be able to assess the safety level of the plant, particularly through the safety report. They need to know why scenarios have been kept for modelling of consequences. Both need to assess the influence of the management on the safety level. The industrialist to be able to improve its management to reduce the risk and the competent authority to assess a true risk level which takes into account this major influencing factor. About 80% of the major accidents have causes related with human and organisational factor, which is a sufficient reason to take these aspects specifically into account. The local authorities are interested in land use planning issues. They need to have a clear report about the risks or hazards their population actually faces. They also want to get information that can be used as a decision-aiding tool to define priorities or choose among alternatives. Basically, their capacity is about reducing vulnerability either by limiting the number of targets exposed to the risk or by introducing obstacles between the source and these targets. They also need to trust the industrialists and competent authorities when they propose risk or consequence-based contours from scenarios. The aim of ARAMIS was to answer all these needs. It was also to make the convergence between the deterministic approach and the probabilistic approach and to resolve some difficulties inherent to each of them. These limitations have been discussed by Christian Kirchsteiger [Kirchsteiger 99]. As far as the deterministic approach is concerned, the limit deals with the difficulty to justify the choices of the reference scenarios used for land-use planning decisions. Most of the time tie selection is not about worst-case scenarios but an implicit choice is made to eliminate those which seem too improbable. For the probabilistic approach, the difficulty resides both in producing the probability data and in interpreting the results to take appropriate decisions. ARAMIS does not completely solve these difficulties but furnishes the tools and the structure to improve decision-making. It also provides a framework for the definition of further research programs as discussed in the last paragraph.

Main features of the ARAMIS methodology

ARAMIS is divided into four major steps (figure 1). 1. Definition of the reference scenarios • identification of the major accident hazards (MAH)

• definition of safety systems • definition of the reference accident scenarios (RAS) 2. Assessment of the management efficiency 3. Risk severity mapping from the set of Reference Accident Scenarios 4. Vulnerability mapping representing the sensitivity of one plant's surrounding environment A last step involves the crossing of this information for decision making

Efficiency of safety management and s^fetyculture

Vulnerability,of ;«J Environment

Figure 1: Summary diagram of the ARAMIS methodology

identification of the major accident hazards (MAH)

MIMAH [Delvosalle 04] is the method for the identification of major accident hazards. It is based mainly on the use of bow-tie diagrams (figure 2), composed of a fault tree and an event tree. The major input of ARAMIS was to define a precise bow tie structure and to define precisely and exhaustively the list of equipment, potential critical events and their consequences. The critical events were defined to be either losses of containment for fluids or losses of physical integrity for solids. The complete list contains twelve critical events including breach, collapse, explosion, etc. From a description of the plant including the chemical substances used, produced or stored, it is possible from MIMAH to list of all the critical events susceptible to occur in the plant. Then, for each of these critical events, MIMAH allows to identify all their consequences in terms of secondary events and dangerous phenomena.

Then, MIMAH provides the user with a set of generic fault trees, which are based on the most frequently observed causes. From these generic fault trees, the user will build specific fault trees that take into account the specificity of his plant: types of process used, presence of equipment, etc. The specific fault trees are obtained mainly by the suppression of causes and consequences which are not relevant to the context without any consideration on probability at this stage. It is important to notice that both the fault and event trees are considered without safety barriers, which will be defined in the next step of the method. This has the advantage to make an explicit distinction between hazard and risk. This first step allows the identification of hazards. The next one aims at identifying the risks which result from the hazard scenarios and the failure of safety barriers.

An alternative to classical probabilistic approaches

Standard risk analysis methods propose to assess the probability of major accident and to decide from this evaluation whether the risk is acceptable or not. But, during the ARAMIS project, this calculation of the probability was shown not to be an easy task. An inventory of the probabilistic data sources was carried out. It turned out that many of the available data are not adapted for use with the tools developed in the first steps of the methodology. Others were obtained by statistical methods in limited geographical areas like the Netherlands and are therefore not extendable to the whole Europe. Only very generic frequency ranges could be obtained for the critical events' causes, which hindered the possibility to rely solely on the probability of events. However, one main objective of ARAMIS was to valorise through contextual frequency data the efforts realised by the operators both in prevention and mitigation. Generic frequencies of critical events are not suitable for that purpose and contextual frequency data is hardly available onsite. An alternative method was proposed, which focuses on generic values on safety systems and clear guidelines to lower the final frequency of identified scenarios. First, it aims at helping the user with the definition of the safety requirements applying to its plant. These requirements are defined according to the initial risk level without barriers. This means that an initial coarse calculation of the probability is made and that a consequence level is assigned to the major effects independently to any vulnerability of the surroundings. Then, the method helps the user to define the safety barriers [Debray 04] by promoting the concept of safety function and by providing different possible strategies of barrier implementation for a given safety function.

The frequencies of resulting scenarios are then evaluated from the frequency of the initiating event the probabilities of failure of the different safety barriers implemented, according to principles derived from the SEL concept (Safety Integrity Level) available in IEC 61508-61511 standards. Among the scenarios, which result from the application of the safety barriers, only the phenomena that range from 10" 6 /year to lO'Vyear (figure 2) are kept for further calculation of risk severity. These are called the Reference Accident Scenarios (RAS).

Defining the safety requirements

As it can be understood from the previous paragraph, the definition of the safety requirements is a keystone of the ARAMIS methodology. The proposed method is inspired by the IEC 61508 standard.

The idea is to guide the user in the identification of the risk reduction goal that should be associated with different scenarios (table 2). This approach has a triple interest. It helps the user improving its management of risks by defining clear targets. It helps the competent authorities checking the risk reduction for the same reasons. It provides an evaluation of the residual risks. The way it was built also reduces the stress put on the quality of probability values.

To define the safety requirements, four consequence classes were defined and associated to the major effects independently from the intensity of the considered phenomenon. For example, a fireball will always be assigned a consequence class C4 (irreversible injuries or death outside the site) whereas a jetfire could only be considered as C2 (Injuries leading to hospitalisation). The consequence classes also reflect the possibility of domino effects, hi this case, the consequence class attributed to a given phenomenon is increased potentially generated by escalation.

FREQUENCY OF THE EVENT (of the EVENT without barriers » of tri» FAULT)

1Q-l <F<10' 3 LC requirement to make the risk acceptable

Resulting probability of danger, phenomenon 10' 1 10~* 10" s «MO" 4 LC requirement to make the risk acceptable 1 a Resulting probability of danger, phenomenon 10" z 10" 2 10" 3 <10"

LC requirement to make the risk acceptable 2 1a-Resulting probability of danger, phenomenon 10" 3 10" 3 10 s <10~*

The risk graph (TEC 61508) in figure 2 sets then the levels of confidence in the barriers which should be applied to reach the safety objective, i.e. the risk reduction goal defined in the matrix, namely to make the risk residual or even negligible. This risk graph takes also into account an exposure frequency parameter -(Tj if the targets are exposed less than 10% of the time T 2 otherwise) and a parameter linked to the capacity to avoid the consequences (kinetics is long enough and emergency measures are robust enough). The frequency classes are linked to the initiating event of the scenario and ranges from P A (F<10' 4 /year) toP D (F>10" 2 /year). Once this work carried out in risk analysis, the resulting dangerous phenomena can then be ranked according to their classes of probability and consequences.

Figure 2 : Risk graph. It determines the required LCs (Levels of Confidence) to make risk acceptable as shown in figure 3 The Risk Matrix in figure 3 has been devised for this purpose. The middle zone highlights the scenarios that can be selected for quantitative modelling then risk severity mapping. The upper zone means that not enough barriers have been implemented and risk cannot be tolerated. The lower zone finally states that enough layers of protection are present in order not to select the scenario for e.g. land-use planning purpose but rather emergency planning. The limits were proposed within the project from our extended review but they should be discussed in principle in each country. Equivalent Probability of Failure on Demand (PFD) >10" 5 to <10" 4 >10" 4 to<10" J >10" 3 to<10-2 >10" 2 to<10-1

Equivalent probability of failure per hour . >10" y to<10" K MO" 8 to <10" 7 >10-/ to<10" 6 >10' 6 to<10-5

Cl I C2 I C3 I C4

For any risk path (i.e. scenario) composed of a minimal cutset in the fault tree and a branch of the event tree, a couple of exposition level Xj and event probability Pj can be calculated. For each of them, the risk graph proposes a value of confidence class to be reached by the entire set of barriers applied to the risk path. When several barriers are applied on a single risk path, the confidence class is the sum of the individual confidence classes of the barriers. The bow-tie diagrams turn out to be a very powerful tool to communicate about risks, in particular towards non-technicians (managers, politicians, etc.). However building-up a bow-tie could become very rapidly quite time-consuming. That is why in the context of ARAMIS, we also searched for a method to select the most appropriate equipment and critical events within an entire plant to build up bow-ties upon. This is also part of the MIRAS methodology.

Allocating risk reduction objectives and evaluating explicitly the performance of each safety barriers is a very fruitful work to be performed in risk analysis, especially for the operators. It allows to discuss directly the safety strategies onsite through the architecture and implementation of barriers. The levels of frequency derived from the SIL principles also allow to use quantified data when these exist but also qualitative estimation from work group judgement when no data is available. This allows a maximum flexibility but requires anyway at some stage a consensus about the initiating event frequencies and barrier levels of confidence in order to ensure a minimum variability in the resulting evaluation of scenario frequencies.

Assessing the influence of management and safety culture

The management has a strong influence on the capacity to control the risk. Here again, the interest of ARAMIS is to provide tools to assess the safety management system (SMS) and the safety culture and to allow their taking into account by the competent authorities as well as to help the operators identify the opportunities for improving safety management. The approach in ARAMIS [ Duijm 04] consists in devising a process-oriented audit protocol focusing on the activities relating to the life cycle of the safety barriers. This life cycle includes design, installation, use, maintenance and improvement activities. For each, ten important structural elements are evaluated as requirements for the SMS. The outcomes of the audit are then compared to the results of a safety climate questionnaire collected from employees in order to get a contextual level of confidence, in particular regarding behavioural barriers. The questionnaire is made up of eight cultural factors that characterise a company's safety culture.

• learning and willingness to report • felt responsibility • safety prioritisation, rules and compliance

• trust and fairness • leadership involvement and commitment

• work team atmosphere and support • risk and human performance limitation perception • motivation, influence and involvement From paragraph 3.3, each type of barrier is given a generic level of confidence indexed on its probability of failure on demand. These indicative values require then to be adjusted from the local context where they are implemented and maintained. For instance for a behavioural barrier, we would like to adjust the generic confidence in the barrier depending on whether the operator knows the stakes of his actions, or his decisions require complex diagnosis, conflict with production. The aim of the project was also to aggregate the results from the auditing and use of questionnaires into a final score for adjusting -possibly lowering-the generic values into contextual ones. This link and the whole scoring process is obviously an ambitious goal and still needs to be worked out in the project. The case studies already help getting some benchmark between different types of management and will allow eventually to propose a set of "minimum requirements" for both the culture and management system in order to anchor a first scoring scale. This remains however an important area of research.

Risk severity assessment and mapping

Each reference accident scenario (RAS) is defined by an initiating event that leads to a critical event, which can potentially lead to different dangerous phenomena. For each phenomenon, a specific severity index has been defined [ Planas 04]. The aim is to measure and compare the severity of any dangerous effect with a single scale ranging from 0 to 100. This should allow the comparison of risks of different nature. Depending on the phenomenon, different severity levels were associated to different amplitudes of the considered phenomenon. Table 3 presents an example of severity values associated with intensities of dangerous phenomena. The user is free to use any model he considers relevant for modelling intensity along distance. Radiation (W/m 2 ) 1 1800 3000 5000 8000

Table 3 : Severity levels associated with different intensities of effects

One major difference between ARAMIS and usual quantitative risk assessment is our purpose to study separately the vulnerability and the severity from the potential accident scenarios. In this respect, we could not use any Probit function to quantify the severity but had to define thresholds for each phenomenon (table 3) in order to characterise intensity. Even though these thresholds can sometimes be derived from Probit functions (thermal load and toxic load), they above all require consensus first from the competent authorities of the Member States, which we do not have for the moment.

For each RAS, a risk severity map is then produced. Risk severity is defined for one scenario as the combination of the level of frequency with the intensity of the effects. The combination of risk severity with the vulnerability of the targets produces the actual risk. Risk severity can be represented for each scenario in a geographical way, as a function SRAs(d) of the distance from the source term.

Eq. 1

In this equation n is the total number of dangerous phenomena (DP) associated to the RAS; P DPI is the probability of occurrence of each DP,-; and S^d) is the specific severity index associated to the DP h The final mapping of risk severity is then obtained by multiplying the frequency of each RAS with its specific risk severity index:

40=

Eq -2

Where n is the total number of dangerous phenomena considered taking into account all the RAS corresponding to the installation. More elaborated formulas were proposed for anisotropic risks. Risk severity mapping as it is defined makes sense and gives very useful information to a decisionmaker to elaborate relative priorities for land-use or emergency planning purposes. It also makes sense to disconnect the vulnerability study from the hazardous installation for the same reasons. However, the range of values obtained with such an approach still requires to be interpreted. We now rely on the case studies to help characterize the magnitude of this value and eventually define some references for the global risk severity index by the end of the project.

Assessing the vulnerability

The last innovative attempt from ARAMIS is to address the vulnerability of the environment independently of the hazardous site [Tixier 04]. This has the fundamental interest of allowing the local authorities to take useful decisions to reduce the global risk level by reducing the vulnerability whereas the industrialist only can act on the potential hazard or risk of the installation. The vulnerability is calculated on the basis of a multicriteria decision-aiding approach (AHP, Saaty). With the development of new ways of governance involving local population in risk-informed decisions, the main interest of this approach is to base the vulnerability study on any stakeholder risk perception through expert judgement elicitation. On a given spot of the environment, the vulnerability is thus characterised by the number of potential targets and their relative vulnerability to different phenomena. The global vulnerability is a linear combination of each target's own vulnerability.

V global = CC.VH + p.V E + y.V M Eq. 3

Then, each type of vulnerability is a linear combination of the vulnerability to each type of effect.

V H = a,.V H surp + a 2 .V H tf + a 3 .V H tox + a 4 .V H p poll

Eq.4

For each effect, the vulnerability is a linear combination of vulnerabilities on different types of impact (health, economical, psychological impact).

V H suip = x, H . V H suip>san + yi H . V H surPieco + Z! H . V H suip ' psy
Eq. 5

For each type of impact, the vulnerability is also a linear combination of the numbers of different types of target components. For example, the human target is composed of staff onsite (Hi), local population (H2), population in an establishment receiving public (H3), users of transportation ways (H4). The quantification factors Hi are normalised to fit into a 0 to 1 scale. The application of the methodology has generated a questionnaire that can be used or adapted very locally to elicit from any stakeholder judgement their own perception of vulnerability. The equations have been then interfaced to GIS 1 tools (Maplnfo, Arc View and Geoconcept) for easiness of target inventory and quantification. The GIS allow a very quick mapping of felt vulnerability (figure 5).

N.

Figure 5: human vulnerability map (right) obtained from the land cover information (left)

1 GIS : Geographical Information System
The tool is very flexible and offers a large range of available maps considering the type of decisions to be taken: per type of target, per type of effect or overall maps. The figure 5 shows an example of human vulnerability drawn from the available land-cover information.

Even though it is interesting to base the vulnerability study from the stakeholders risk perception, the outcomes (i.e. the quantification factors) can be discussed. For a relevant discussion, a sensitivity study should have been carried out within the project. The case studies will be used to some extent for that purpose but will not be developed in-depth enough to get precise answers during the project.

Cases studies

ARAMIS has now reached a certain degree of completeness, which allows to consider its test through different case studies. These are now under progress in different countries of the European Union. The following paragraphs make a summary of what is expected from these case studies and how they will be carried out.

Objectives of the case studies:

The case studies have several complementary objectives. The first one seems obvious. It is to check the applicability of the method. This will be done by addressing the following issues:

• Is the global method understood by the users ? The different modules of ARAMIS were developed by partners of different European countries and different scientific or industrial cultures. It is now a big challenge that the global method be understood and applied by industrialists, competent authorities and local authorities. • Are the data needed by the method easily available ? A particular focus will be put on frequencies of events for which it was very difficult to obtain trustable generic data and on data about the confidence levels of safety barriers. But the same can be true with the geographical information required for the evaluation of the vulnerability, or even information on the process needed for the calculation of consequences. • Are the links between the different ARAMIS modules easy ? Different partners developed the modules of the method and, despite a good communication during the development process, only the case studies can give the evidence that the outputs of one module really are an input to the next module. No doubt that some adjustments will be made after the case studies.

Beyond the applicability, the case studies will also consider the efficiency and the relevance of the whole methodology:

• Is the method as efficient as already existing risk analysis methods ? This question will be answered by comparing the results obtained by using ARAMIS with the results obtained by methods such as HAZOP or FMEA. Even if no other method has the same level of integration as ARAMIS, which treats in a consistent way all the process of risk management from the source to the vulnerable environment, it is important to check that basic needs covered by traditional tools are also well addressed by ARAMIS. • Does the method answer the needs of its end users? Can the results be easily exploited? This question is of course a major one. As mentioned in the introduction, ARAMIS has several potential users with different needs. Now a key aspect of the methodology is to answer these different needs with a unique method because all actors need to be able to communicate and discuss on common results and information. To answer satisfactorily this question, the case studies take place in different national and industrial contexts. In each situation, the expectations of the local actors were characterised. These will be discussed in the next paragraph. • Is the method adapted to different types of industries, different sizes of plants ? SEVESO II sites can have very diverse activities and configurations. The composition of the case study set aims at reproducing this diversity. • Is the method adapted to different national contexts? As a European Methodology, ARAMIS must comply with the requirements and uses of all the countries of the European Union. A particular focus is put on the Newly integrated countries where industrial risk issues may differ from those in the western part of Europe.

Sites and contexts of the case studies

Five establishments were chosen in five different countries: Czech Republic, Denmark, France, The Netherlands and Slovenia. Each of these countries has its own culture for risk assessment and risk management and faces particular stakes in prospect of a convergent European methodology. France and Denmark have a rather deterministic approach, which has shown some limits, particularly in France with the Toulouse accident. The approach does not allow for flexibility and does not give the opportunity to enforce land-use planning regulations appropriately. The Netherlands is in a different situation. The country has been for a long time a pioneer of the risk-based approach. But the outputs of risk assessment (risk contours or F-N curves) are difficult to visualise then to communicate upon towards decision-makers. For both countries, a barrier-based approach and a distinct mapping of risk severity vs. vulnerability is easier to communicate and structure local negotiation among stakeholders. Czech Republic and Slovenia joined the European Union in May and will face different challenges in applying the Seveso II directive.

The industrial sites are also of different kinds:

• A refinery, where fire and explosion hazards will prevail.

• A chemical plant, with hazardous reactions and storage of chlorine and phosgene.

• A chemical plant using ethylene with polymerisation hazards as well as fire hazards.

• A paper mill, with explosion and toxic hazards.

• A hydrocarbon storage facility, with fire and VCE hazards but simple process.

These case studies are only a first step to assess the exhaustiveness of the method by checking whether it can apply to different types of activities and industrial cultures. It will also show to a limited extent the capacity of the method to answer different local needs such as competent authority control or land use planning. From a scientific point of view, the validation process should be much longer and wider but unfortunately cannot extended within the framework of the project.

Research issues emerging from the ARAMIS project

The risk assessment method described in this paper, ARAMIS, is the result of a voluntary step towards a harmonised approach of risk analysis on SEVESO II industrial sites. ARAMIS has the ambition to solve some of the difficulties encountered with traditional approaches by providing very practical tools in an integrated methodology. Of course, everything is not completely consolidated yet. Some aspects of the methodology will be clearer after the case studies. But the ARAMIS project already points out the need for an increased research effort in a series of specific fields. The first of them is linked to the difficulty to find reliable data for the calculation of accident probabilities. Even if the solution proposed in ARAMIS, the barrier approach, reduces the consequences of such a lack, a lot could be done by unifying the efforts of the industry and research institutions to build accessible databases containing useful information that would be complementary to traditional reliability databases. The quantification of the influence of management on the probability of accidents is also a key question, which will not be resolved in the course of the project. A third field of research relates to the evaluation of vulnerability. ARAMIS already proposes an interesting definition of vulnerability and a set of screening tools to build vulnerability maps. A next interesting result could be to provide more detailed tools to help decision-makers identify what can be done explicitly to reduce the vulnerability. Other questions were raised by the project such as the definition of the unique risk severity index, which implies to be able to compare different types of effects among them. Suggestions were made in the framework of ARAMIS. But the project also highlights the remaining questions and lack of common agreement on many effect thresholds. The interest of ARAMIS is also to provide the right frame to define both requirements and means of valorisation for this future research.

Conclusion

The ARAMIS methodology was briefly described in this paper. It aims at offering an alternative way to the traditional risk-based and consequence-based methodologies for risk analysis by providing a series of integrated tools. These were designed to answer the specific needs of potential ARAMIS users who are industry, competent authorities and the local authorities. They were also elaborated to solve some of the difficulties raised by the lack of reliable data, namely concerning the accident frequencies. By promoting the barrier approach, ARAMIS helps the users define the safety requirements, which apply to its plant, and therefore helps the competent authorities verify the explicit control of risk by the operator. This approach also allows an easy and explicit identification of the reference accident scenarios, making the communication between the stakeholders easier or at least more straightforward and structured. The same should be true with the approaches of the severity and the vulnerability, which are exploited through a clearly understandable graphical representation. The case studies, which are now under progress, will confirm the achievement of these goals and help resolve some of the difficulties, which remain for a complete integration of the method. They will take place in five European industrial sites. These were chosen to reflect the cultural and industrial diversity that can be encountered now in the newly expanded European Union. Eventually, ARAMIS also sets the framework and the objectives of future research on diverse specific fields among which are the production of reliable accident frequency data, the quantification of the influence of management on the accident probability, the vulnerability reduction options or the effect threshold definition.

Figure 3 :

 3 Figure 3: Risk matrix used for ranking the dangerous phenomena and selecting the Reference Accident scenarios for the risk severity mapping

Figure 4 :

 4 Figure 4: Risk path considered for use in the risk graph. Barriers can apply either on the lefthand side (prevention) or the right-hand side (mitigation) of the bow-tie

y

  H suip,san = ^Hsuip.san ^ + ^Hsu^san j^ + ^Hsuip.san ^ + ^Hsuip.san j^ ^ 6

Table 2 : Definition of the Levels of Confidence in the barriers

 2

	10~3/year
	lOVyear
	10 5 /year
	10" 6 /year
	lOVyear
	10-8 /year
	10* 9 /year

Acknowledgements

The work presented in this paper has been elaborated in the frame of the EU project ARAMIS "Accidental Risk Assessment Methodology for Industries", co-ordinated by INERIS (F) and including EC-JRC-IPSC-MAHB (I), Faculté Polytechnique de Mons (B), Universitat Politècnica de Catalunya (E), ARMINES (F), Ris0 National Laboratory (D), Universita di Roma (I), Central Mining Institute (PL), Delft University of Technology (NL), European Process Safety Centre (UK), École des Mines de Paris (F), École des Mines de Saint Etienne (F), École des Mines d'Alès (F), Technical University of Ostrava (CZ) and Jozef Stefan Institute (Si). The project is funded under the Energy, Environment and Sustainable Development Programme in the 5 th Framework Programme for Science Research and Technological Development of the European Commission.


W Sanchez

O Palluel

L Lagadic

S Aït-Aïssa

J.-M Porcher

Biochemical effects of nonylphenol polyethoxylate adjuvant, Diquat herbicide and their mixture on the three-spined stickleback (Gasterosteus aculeatus L.)

Keywords: nonylphenol polyethoxylate, herbicide, oxidative stress, biotransformation enzymes, vitellogenin, three-spined stickleback

This study examined the response of 7-ethoxyresorufine-O-deethylase (EROD), glutathione-S-transferase (GST), glutathione peroxidase (GPx), glutathione content (GSH), level of thiobarbituric acid reactive compounds (TBARS) and circulating vitellogenin, in three-spined sticklebacks after 21 days of exposure to Diquat herbicide, commercial nonylphenol polyethoxylate (NPEO) adjuvant and mixture between Diquat and adjuvant. The results showed that adjuvant exerted more important oxidative effects than Diquat and that mixture effects were unlike to single additivity. This study argues for ecotoxicological risk assessment of adjuvants and mixtures of adjuvants and pesticides.

To increase agricultural treatment efficiency, pesticides are frequently used in combination with adjuvants to improve foliar coverage and leaf absorption. Recently, Xie, Thrippleton, Irwin, Siemering, Mekebri, Crane et al. (2005) showed greater than additive effects on vitellogenin synthesis between pesticides and NPEO adjuvant. However, there is still much to be done to understand the underlying mechanisms in the case of mixtures. This study was performed to examine biochemical biomarker responses to NPEO-containing adjuvant and its combination with an herbicide, in three-spined stickleback.

The adjuvant is Agral90 ® , a commercial non-ionic surfactant including NPEO and widely employed as a tank-mix adjuvant. Nonylphenol and mono-and diethoxylated derivatives are recognized as weak estrogenic endocrine disruptors in aquatic organisms [START_REF] Schwaiger | [END_REF] but little is known about the effects of other ethoxylated derivatives of nonylphenol on aquatic wildlife. The associated herbicide is Diquat dibromide (6,7-dihydrodipyrido[1,2-a:2′,1′-c]pyrazinediium), a quaternary ammonium herbicide employed for potatoes and bean weeding and as aquatic herbicide in many countries. The action of Diquat is based on reactive oxygen species production that can also impair biological molecules of aquatic organisms.

According to the known mode of action of Diquat, we studied biomarkers that were related to both oxidative stress (GPx, GSH and TBARS) and oxidative metabolism of xenobiotics (EROD and GST) in the liver. In addition, because degradation products of NPEO are recognised as weak estrogenic, we also measured plasmatic vitellogenin as an indicator of estrogenic response.

Male and female adult sticklebacks were maintained two weeks at 13 ± 0.5 °C under 8/16 (Light/Dark) photoperiod. 10 fish per condition were waterborne exposed, in semi-static conditions with complete water renewal and food supply every other day, (1) to environmental (22 and 44 µg/L) and sublethal (222 and 444 µg/L) Diquat concentrations, (2) to Agral90 alone at 50, 100, 500 and 1000 µg/L according to the 1:2.25 ratio (Diquat:Agral90 ® ) advised by the supplier, and (3) to Diquat/Agral90 combinations at concentrations of 22:50, 44:100, 222:500 and 444:1000 µg/L respectively. After 21 days, livers were dissected and homogenized in phosphate buffer supplemented with glycerol and protease inhibitor. The post-mitochondrial fraction was used for biochemical assays according to methods described by Sanchez, Palluel, Meunier, Coquery, Porcher, & Aït-Aïssa (2005a).

Male fish blood (0 to 5 fish per concentration) was sampled in phosphate buffer supplemented with protease inhibitor and vitellogenin was quantified using a competitive ELISA (Sanchez Brion, Nilsen, & Porcher, 2005b).

In this study, Diquat alone had no effect on hepatic oxidative stress biomarkers (figure 1) although it has been described as a redox cycling chemical. Nevertheless, it was able to alter biotransformation enzymes by inhibiting basal EROD activity and inducing GST (figure 1) in accordance with Gallagher, Buetler, Stapleton, Wang, Stahl, & Eaton (1995) that showed an inhibition of EROD and mRNA-CYP1A production in rat in vitro and in vivo experiments.

The effect on GST could be explained by its ability to protect against reactive oxygen species and its implication in oxidative metabolism of several pesticides [START_REF] Halliwell | Free radicals in biology and medicine[END_REF] as supported by the negative correlation between EROD and GST (figure 2). Agral90 ® appeared as a strong oxidative agent as shown by induction of GPx and TBARS and depletion of total hepatic GSH pool (figure 1). These results are in accordance with the capacity of alkylphenols to alter redox status in Atlantic cod [START_REF] Hasselberg | [END_REF]) and could reflect the biological membrane degradation by reactive oxygen species and the degradation product elimination by antioxidant parameters. In addition, Agral90 ® inhibited almost totally basal EROD activity at low doses (figure 1). The hypothesis that this effect is related to the known capacity of nonylphenol to exert anti-CYP1A effect through its binding to the estrogen receptor (Arukwe, Forlin, & Goksoyr, 1997) is unlikely since no effect on vitellogenin level in male fish was observed (figure 1). The length of NPEO alkyl group could explain the lack of vtg induction as reported by in vitro experiments (Routledge & Sumpter, 1997). However, the weak number of male fish per group could also explain the lack of effect. Besides, EROD inhibition may rather reflect direct inhibition enzyme through either oxidative mechanism and/or membrane alteration as indicated by TBARS induction.

Few data are available for NPEO effects in fish and further investigations should be done to determine the exact mechanism of NPEO adjuvants. The GST induction after NPEO exposure (figure 1) could be explained by the phenol group of NPEO making it directly available to GST (Ankley & Agosin, 1987). Moreover, GST could have been induced by lipid peroxidation products as indicated by correlation between GST and GPx (figure 2).

Interestingly, co-exposure to the mix Diquat-Agral90 ® nullified the inhibitory effects of both compounds on EROD, which could suggest that they inhibit this enzyme through distinct and antagonistic mechanisms. Conversely, the mixture led to a GST induction stronger than substances alone, suggesting a synergistic interaction. Overall, these results suggest that Diquat and Agral90 ® had some interactive effects on oxidative metabolism capacity. Such possible interaction may have few consequences on oxidative stress parameters, although the mixture induced TBARS at higher levels than with Agral90 ® alone.

Using the three-spined stickleback, this study shows that environmental concentrations of NPEO adjuvant generate oxidative stress and affects biotransformation enzymes in fish.

Moreover, Agral90 ® modulates herbicide adverse effects by increasing GST activity and lipoperoxidation. These results show that the adjuvant can exhibit more important effects than the active substance and argue for ecotoxicological risk assessment of adjuvants and tankmixes between these adjuvants and pesticides.

Figure 1. Biomarker responses after 21 days of exposure to Agral90 ® , Diquat and their mixture. Data are presented as mean ± SD. T-test was performed to evaluate gender differences and data were presented separately when a significant difference was noticed (GPx). Comparison with control group were performed using two-way ANOVA followed by Sidak test . * indicates a significant difference (P<0.05). Numbers 1-4 refer to the increasing concentrations of mixture.

Figure 2 .Figure

 2 Figure 2. Principal component analysis performed with centred and normalized hepatic

Acknowledgements

This work was supported by the French Ministry of Ecology and Sustainable Development through the Programme Evaluation and Reduction of Risks due to the Use of Pesticides. 9 Figure 2.


Sylvain Chaumette

Myriam Merad

Sandrine Descourriere

Nelson Rodrigues

From expert judgement to decision-making in the major risk management

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

INTRODUCTION

If we take a look to the way the industrial risk prevention process was structured in France, we will easily distinguish two times: before and after the Toulouse accident (September, 2001).

During the last fifteen years, three aspects where classically considered, in France, to prevent the occurrence of industrial accidents: reducing risk at its source; limiting the effect of an accident; restraining the consequences of an accident. Regulation measures related to these aspects consist in: (a). Risk reduction. Based on Safety Studies (SS), this refers to the risk reduction inside the industrial site by choosing the right technical solutions according to the best available ones (ex. Reducing quantity of substances, pressure and temperature of reactions, etc.) and by setting safety barrier up (ex. Installations survey, operability parameters control, intervention in case of default).Thus, the severity and/or the probability of an accidental even are than reduced.. (b). Public information. Two structures where incharge of public information:  a regional structures such as "Permanent secretary for the Prevention of Industrial Pollution". This structure bring together locals actors (ex. administrations, local authorities, industrialist, media, experts, etc.) that have common interest in questions dealing with industrial environment aspects. The aim of this structure is to build a trustful climate of dialogue between the actors.

 a local structure, such as "Local Committee of Exchange", created by Seveso industrialists in dialogue with local associations and/or local authorities and/or administrations. This structure allows to: helps the industrialist to have a better understanding of resident expectations; inform the residents of industrialist constraints and recent risk reduction measures. (c). Land use planning. According to the conclusions of the Safety Studies (SS), the land use planning was based on a determinist approach that consist in taking into account the worse consequences of an accidental event that is the "consequences without the risk reduction measures".

(d). Emergency plans.

From expert judgement to decision-making in the major risk management process around Seveso sites in France Sylvain CHAUMETTE, Myriam MERAD Sandrine DESCOURRIERE, Nelson RODRIGUES

INERIS, Accidental Risks Division, BP 2, F-60550 VERNEUIL EN HALATTE, France

ABSTRACT: Since the Toulouse accident (2001), the French Authorities have emphasized the position of the Safety Study in the risk management process. In this new context induced by the promulgation of the law n°2003-699 of 30 July 2003 about the "prevention of the technological and natural risks and to the compensation of the damages", the Safety Studies performed by the industrials is: 1. a demonstration of the risk control, 2. a support to the urbanization control around Seveso sites using Technological Risk Prevention Plans TRPP. Different categories of actors, such as general manager, operators, contractors, central and local Administrations, associations, etc., are involved in the risk management process making it more complex. As a technical support to decision-makers in risk prevention from both public and private sectors, INERIS plays an important role in the evolution of the French risk prevention plan. This paper aims at revealing the different decisional and expertise problems faced during the Safety Study and the Technological Risk Prevention Plans.

As we can notice, the 4 aspects presented above are based on the Safety Study (SS) and more precisely on the way "risk analysis process" is performed. The deterministic conclusions consist in freezing the urbanisation in the largest diameter that represents the worse accidental scenario.

The Toulouse AZF factory accident related to the storage off specification ammonium-nitrate, September 21, 2001 revealed the need to go towards a greater control of the risks and their consequences and towards a stronger implication of the various stakeholders in the industrial risks prevention process. The Toulouse accident (2001) marks a turning in the industrial risk prevention process. Indeed, with more than 30 deaths in a radius of 500 meters, thousands of wounded and more than 26000 residences damaged on a radius of 3 kilometers [START_REF]Dossier d'information : Toulouse, trois ans après l'explosion[END_REF], this accident has revealed the following needs: 1.

Control of the risks by acting on their source.

This mainly consists in improving the way the risks control demonstration is carried out within the framework of the Safety Studies (SS).

Reduction of the vulnerability around the

Seveso sites (High Threshold). This consists in using natural hazard "Risk Prevention Plans" experience feedback to carry out "Technological Risk Prevention Plans". Using the proportionate financial mechanisms, it will become possible to limit population exposure to the consequences of an accidental event. These mechanisms depend on the delimitation of three "regulation zones" to limit the present and the future building around the Seveso industrial sites.

More implication and more dialogue with the various actors in the risk prevention process.

This consists in:

 instituting a greater participation of the employee in the risks control process, with a widening of the Health, Safety and Working Conditions Comity (HSWCC) missions;  going towards more implication of the various actors of risk prevention using the Local Committees of Information and Dialogue (LCID).

These three objectives aim at increasing the transparency of the risk analysis process, and at going towards a greater coordination between the different actors in of the preventive risk management [START_REF]Ministère de l'Environnement et du Développement Durable -Guide relatif aux principes généraux pour l'élaboration et la lecture des études de dangers[END_REF][START_REF]Dossier d'information : Toulouse, trois ans après l'explosion[END_REF].

One can notice that the two official documents represented by the "Safety Study" and the "Emer-gency Plan" did not faced major evolution in their form and their finality.

However, the limit between the "demonstration of risk control by the industrialist" and the "land use planning around the industrial sites" has been emphasized: while the first aspect is still the concern of the Safety Study, the second one is done in an other document called " Technological Risk Prevention Plan".

Moreover, the Technological Risk Prevention Plan offers the potentiality of two major modifications in post-Toulouse French context making the technological risk prevention process, in one hand, more readable by being aims oriented (demonstration, land use planning, emergency) but, in an other hand, more complex. The following points give some aspects of this complexity:

The probability of occurrence of the accidental event is now systematically considered for the land use planning around the industrial sites. That was not the case before the Toulouse accident were a perimeter was fixed, around the industrial site, without considering the measures set up by the industrialist to reduce the risk: This is the so called "determinist approach". Due to a lack of experience feedback, the assessment of a probability value to the occurrence of an accidental event is difficult to find. A level of criticality is obtained for each major accidental scenario considering their kinetic, their probability of occurrence and their intensity. The aggregation of theses three aspects for each scenario is complicated to Asses. The various actors concerned by the decision in the risk prevention process are now all consulted. The part and the limit of their intervention in the decision making process raised a difficult problem. A set of measures is defined to reduce the vulnerability around the Seveso sites. The choice of the adequate measure is done in dialogue with different stakeholders on the basis of technical proposal.

In what follow, we will first present the different steps of two separate processes that will end up by the publication of the two official documents that are the "Safety Study" (SS) and the "Technological Risk Prevention Plan" (TRPP). We will then pre-sent the different difficulties faced when these two processes are put into practice. We will finely synthesize the different difficulties and present some conclusions.

ELABORATION PROCESS OF THE OFFICIAL DOCUMENTS

The French law n° 2003-699 of July 30, 2003, relating to "the prevention of the technological and natural risks and to the damages compensation", has introduce a distinction between the reduction of the risk to the source (hazard) and the urbanization control around Seveso sites. This distinction became effective in two different procedures: the Safety Study (SS) and the Technological Risks Prevention Plan (TRPP).

Both the SS and the TRPP are legal documents based on complex processes were different stakeholders took part. These two processes are presented next.

The Safety Study (SS)

The SS document aims at giving a report of the examination process carried out by the industrialist, in order to prevent and to reduce the risks of an installation or a group of installations, as much as technologically possible and economically acceptable. These risks can be caused by products used, dependent on the processes implemented or due to the vicinity of other internal or external risks [START_REF] Merad | Proposition d'une approche d'aide à la réalisation des Plans de Prévention des Risques Technologiques Expérimentaux[END_REF].

The elaboration of the SS document is, in the majority of the cases sub-contracted completely at a engineering and design department. The SS is seldom the work of the only industrialist who in almost all the cases helped by external specialists especially during the "risk analysis" and "risk modeling" phases presented below.

The SS process is built around the following phases: 1. Identification and characterization of the danger potentials. This phase aims at giving an image of the chemical products, the processes and the reactions dangers produced by the industrialist's installations. This is done according to the industrialist's knowledge and can be possibly enriched by information coming from the products suppliers, the processes licensors or coming from data-bases.

2. Description of the environment. This phase is carried out by the industrialist or, generally, by an engineering and design department on the basis of information received from the various French Administrations (town council, DIREN, DDE, VNF, DRIRE…) and visual information.

The principal objective is then to identify the vulnerable entities and the potential attackers in order to appreciate the potential gravity of the accidental scenarios generated by its installation and to identify, as well as possible, the accidental scenarios whose origin is an external site aggression.

3. Reduction of dangers potentials. The industrialist must carry out a technico-economic examination aiming either at (i) removing or at substituting to the processes and/or the dangerous products, processes or products presenting less dangers, or at (ii) reducing as much as it is possible the quantities of dangerous matters blamed 4. Assessment of the consequences of dangers materialization. This phase aims at determining, for the Administration, dangers distances with an aim at establishing the Particular Intervention Plans (PIP). For that purpose, specialists in accidental scenarios modeling are involved. These specialists must make a choice and establish assumptions on the industrialist procedure with the assistance or not of a engineering and design department. The modeling specialists can belong to industry site, but generally, they came form an engineering and design department, or of specific services of the industrial group to which the site belongs.

Listing of accidents and incidents that have oc-

curred. This phase consists in establishing an experience feedback on the accidents and incidents, which have occurred on the factory site.

To this end, the industrialist, or the employed engineering and design department, must identify all the accidents or incidents that have occurred on his site or on an other sites implementing similar installations, similar products or similar installations. The industrialist can use his own database, or the database of the industrial group to which it belongs, quasi-systematically the ARIA BARPI 1 data base and in some cases trade associations data bases. 6. Preliminary evaluation and detailed risks reduction study. This phase proceeds in four times. Initially, an exhaustive identification of the whole major accidents scenarios that can be generated by an installation is carried out. This work, which constitutes the heart of the SS, must be performed in a working group by im-plementing a risks analysis method. The working group is generally performed by the following stakeholders: specialists in various disciplines (Safety, maintenance, exploitation, instrumentation, processes, …), an organizer that is specialist in risk analysis methodologies and a technical secretary. In the majority of the cases, the specialists belong to the personnel of the site while the organizer and the technical secretary come from an engineering and design department. In the second time, a quotation of the whole identified of major accidental scenarios is carried out. This quotation consists in evaluating the gravity as well as the probability of occurrence of the scenarios by taking into account the organizational safety and technical barriers set up by the industrialist to avoid the occurrence of a done scenario. This quotation can be done according to two approaches: qualitative, in analysis of the risks working group, or quantitative starting from information ing from databases. In the third time, the owner must ensure himself of the acceptability of the risk induced by each identified scenario. For that purpose, it takes support on a "criticality grid" (Figure 1). The determination of the level of acceptability is the responsibility for the industrialist. To finish, the industrialist must prove that he has reduced or maintained his risks as low as "reasonably possible". [START_REF] Rodrigues | Note de réflexion sur l'estimation la probabilité des Scénarios d'Accidents dans le cadre des PPRT expérimentaux[END_REF]. Quantification and hierarchization of the various scenarios. This phase, which is the last of the SS, consists: (i) in a hierarchization of the whole identified major accidental scenarios according to their gravity, their probability and their kinetics; (ii) in an quantitative evaluation of their consequences. Due to the significant number of the identified scenarios (in the preceding phase), the industrialist is obliged to identify and select the scenarios, considered as representative, for which a quantitative estimate of the distances from effects will be carried out. This work is carried out by the industrialist with the assistance of internal or external specialists (engineering and design departments in general). The quantitative estimate of the effects distances associated with these scenarios is carried out by modeling specialists. These specialists are internal or external to the industrial site or group.

The Administration, mainly represented by its Controlling Authority the "Direction Régionale de l'Industrie" (DRIRE), must make sure that the industry site known as "SEVESO high threshold" perform a SS that correspond to what is reglementary fixed. A third expertise done by an engineering and design department is performed to verify the validity and the quality of the SS according to the reglementary criteria.

The Technological Risk Prevention Plan (TRPP)

The TRPP aims at reducing the vulnerability around the Seveso sites notably by reducing vulnerability of the stakes. This consists in choosing a proportional risk reduction measure for urbanization control around Seveso sites. These measures refer concretely to a legal risk zoning which highlights the "zones" which would present the highest levels of risk according to the vulnerability of the stakes around the site. Crossing the hazard map and stakes map allows to make a first proposal of a set of measures for risk reduction.

Theses measures, proposed by technical experts, consist in three urbanization constraints: expropriation, renunciation and pre-emption zones.

The TRPP relate to "foreseeable technological events" and is not properly speaking an urban planning documents. But its must be taken into account in Local Urbanization Plans and aims at a stronger implication of the various actors concerned by risk prevention.

The Technological Risk Prevention Plans (TRPP) is structured around three important parts: a technical part, a regulation part, and a communication part. The technical part of the TRPP includes (i) informative maps (can come from the SS), (ii) a hazard map, (iii) a stakes map [START_REF] Merad | Appui Technique pour la réalisation et la mise en oeuvre des PPRT[END_REF].

The "hazard map" is elaborated by the control authority (DRIRE) using information coming from the SS documents. The following criteria are considered: intensity, probability and kinetic. The "intensity and "probability" criteria are fixed by the Authority in decrees.

The intensity criterion corresponds to three thresholds that delimit the four hazard levels to three categories of effects (Toxic, overpressure and thermic): significant lethal effects threshold, first lethal effects threshold and irreversible effects threshold. The French threshold levels are synthesised in the following table [START_REF] Duplantier | Note sur les seuils d'effets[END_REF]: The qualitative probability criterion is defined according to the following information: data on accident causes, data on the safety barriers in place. These information are combined according to a multiple-steps method. The method suggested consisted in identifying the various major accidental scenarios and the various safety barriers installed. The method used indications on the frequency of the initial events and criteria to characterise the barriers (effectiveness, response time, Safety Integrity Level) [START_REF] Rodrigues | Note de réflexion sur l'estimation la probabilité des Scénarios d'Accidents dans le cadre des PPRT expérimentaux[END_REF].

The kinetic criterion helps to consider the possibility of putting at the shelter the population according to the evolution of the accidental scenario. This criterion is defined using the following information: response time of the safety barriers, prevention and protection measures inside or outside the industrial site considering the scenario kinetic [START_REF] Fontaine | Eléments relatifs à la cinétique des Scénarios d'Accidents pour l'élaboration des PPRT[END_REF].

The "vulnerable stakes map" (Figure 3) is elaborated by the "Direction Départementale de l'Equipement" (DDE) using a three steps method:  Identify all the stakes (building and infrastructure) under the TRPP perimeter. The risk map is the result of hazard map and stakes map crossing.

The TRPP regulation map (zoning) uses the technical zoning proposal done by technical experts. This regulation map must consider local constrain. A local committee named "Local Committee of Information and Dialogue" (LCID) [START_REF]du 1er février 2005 relatif à la création des comités locaux d'information et de concertation en application de l'article L. 125-2 du code de l'environnement[END_REF] is in charge of carrying the local acceptability of the vulnerability reduction measures.

The communication part of the TRPP starts at the first stage of the technical part and continues during the validation of the regulation map (Figure 2).

The TRPP aims at limiting the direct or indirect effects on public health and safety directly or by pollution of the medium of an accidental event accidents likely to occur in the installations at the major risks being able to involve effects. This will consist in delimiting risks exposure perimeters according to the nature, the intensity of the technological risks described in the SS and the proposed prevention measures.

At the interior of the perimeters of exposure to the risks three types of zones are given according to the nature of the risks, their gravity, their probability and their kinetics. These zones, respectively called zones of urban right of pre-emption, zones of renunciation and zones of expropriation, represent three constraints of urbanization with which are associated the financial mechanisms with adequate compensation (Figure 4). Under perimeter delimited by the TRPP, the local authorities can initiate three kinds of destructive mechanism that represent different financial compensation to the local citizen:  Expropriation. This exceptional mechanism is chosen only if the population protection measures are too expensive to be locally used. Expropriation requires, after the approval of the TRPP, the signature of a convention between the plant operator, the local authorities and the State, as well as a declaration of utility easement for the benefit local community (municipality).



Renunciation. This solution is used only for the building and consists in the given possibility to the owner to "put in residence" the local authorities to acquire its good.



Pre-emption.

The constructive mechanism, applied to the existing building, consists in a re-enforcement of the constructions that mean to reduce their vulnerability.

The different stakeholders involved in the SS and the TRPP processes face different problems that we will discuss in what follow.

PRACTICAL PROBLEMS FACED DURING THE IMPLEMENTATION OF THE REGLEMENTARY STUDIES

The SS and the TRPP processes reveal decisional and expertise problems faced in practice. Due to the fact that the TRPP process is highly dependent on the SS one, we will insist on this last one.

The Safety Study (SS)

The preceding chapter reveals the reasons of the SS process complexity. In fact, the SS calls upon many competences and cannot be held without the presence of multidisciplinary knowledge.

Identifying the right stakeholders

Competences and knowledge necessary to the implementation of the SS are generally brought by experienced people that share their knowledge either individually, in quite special situations, or collectively, in working group.

A considerable part of competences and knowledge comes from the industrialist. Indeed, it is him who knows the best the installations and him that most precisely apprehends the situations of exploitation being able to be at the origin of a major accident. It is also in general him who follows the maintenance actions and which manages the modifications of its installations. Moreover, the SS is entirely of his responsibility and that why he is in-charge to provide his own risk acceptability definition.

Let us note that in general, the industrialist calls upon external specialists (either specialized services coming from the industrial group, or an engineering and design departments) for the following aspects in the process: control of work, the animation of the risks analyses process during the meetings or the modeling of the accidental scenarios.

According to the different possibility of involving interns actors as well as external actors necessary to the risk analysis process and according to the importance of information which they will have to provide, it is necessary to make sure that all these actors have the right competence and the necessary experience. This implies that the industrialist must on one hand be able to identify various competences necessary to the SS and on the other hand to determine the corresponding internal or external actors.

However, the majority of the industrialists do not have a right vision of all the actors necessary to the development of a SS and it can happened moreover, that they use the available and not the appropriate human resources. This is why, they often prefer to be advised by an engineering and design departments which they must also choose according to their competence in the required field. Thus, the difficulties are here to make sure that: the industrialist has a right vision of the needed competencies and experience to elaborate the SS; the industrialist lays out in-house or into external people answering these criteria.

Representativeness of the selected stakeholders

The question "of the representativeness of the stakeholders in the risk analysis process" is raised when the stakeholders are selected. Indeed, the "risks analysis" working group must be able to identify the dangerous situations and to evaluate the risk level for each scenario. This evaluation is generally carried out in a qualitative way and depends: on the competence and the experiment of the stakeholder, on the risk perception he has and on his attitude with regard to the risk (risk aversion or risk attraction). Thus, it is important to consider the optimistic or pessimistic nature of the stakeholder during the risk analysis process: the optimistic one will have a tendency to underestimate the major accidental scenario risk level whereas a pessimistic one will over-estimate the risk level for a same scenario.

Moreover, two experts (stakeholders) having the same level of competence will never have completely the same experience and thus will not always put forth the same judgement compared to a given situation. Indeed, an operator, among several, who is the only one who have faced a specific danger situation, difficult to imagine, will easily identify this kind of accidental scenarios where the other operators would not be able to.

Working group Decision-making

One of the major difficulties faced during the decision-making phase occurred when divergences are noticed between the members of the "risk-analysis" working group. The risk analysis process, done in a working group, is the heart of the SS process where the organizer (leader) has to manage the different opinions of the stakeholders can diverge. These divergences can have considerable consequences on the evaluation of the accidental scenarios risk level. Indeed, the risk level of the accidental scenarios can be considered as acceptable, for some group members, and as unacceptable by the other group members. Let us notice that in absence of consensus the risk analysis process can be completely invalidate.

Let us notice that the presence of all the expected competence in the working group does not assure that these competences are really integrated during the risk analysis process. Indeed, some aspect can influence the behavior of a stakeholder in a group: the presence of a hierarchical superior stakeholder, the timidity of the individual or his mood during the meeting (eg. worried by other external subjects).

Lets notice that it is difficult to consider and evaluate the quality of the working group reflexions which can change from a risks analysis meeting to an other; this observation is transposable to the final reglementary SS document where a synthesis of the work done by the working group is presented. These observations make it difficult to the control Authority and to the "third expert" to estimate the quality of work carried out and present in the SS final document.

Definition of the risk acceptability and quotation of the scenarios

One of the principal objectives of the Safety Study (SS) is to present the industrialist's demonstration of his site risks control. This demonstration is built on a level of risk acceptability fixed a priori by the industrialist. In the development process of the SS, the risk acceptability fixed by the industrialist is partly supported by the "criticality grid" (Figure 1). The "criticality grids" are built in the majority of the cases starting from the gravity scale and the probability (or frequency) scale. For each couple (level of gravity, level of frequency), the grid help to identify if the given scenario present an acceptable or unacceptable risk level.

Let notice that:  it seems difficult to conceive that an industrialist can fix itself the rules in term of risk acceptability for situations which endanger the external environment of the site as well as the site employee;  it is interesting to note that there is not commonly allowed rule which defines what is "an acceptable risk" and what are the representative criteria to judge of that;  in practice, only few industrialists present the way in which their "criticality grid" were built up and the acceptability fixed. It is often noticed that the "criticality grid" is selected in non consistent manner by the industrialist (ex. a copy of an existing grid ).

The quotation methods currently used by the industrialists are centered on the acceptability of each identified major accidental scenario, without considering the aggregation of all the scenarios for a considered installation, a considered site or more largely of a considered country or an industrial group. Indeed, the "criticality grids" are all dependent to a selected scenario and not to the whole of the major accidental scenarios.

The questions raised are:

-Is it acceptable on the site level to have 10, 100 or 1000 major accidental scenarios considered individually as acceptable? And what about the cumulative of this scenarios?

-It is acceptable, considering the safety strategy of the industrial site, to have a variation of the safety levels when considering a small site having 10 identified major accidental scenarios and a large site having identified major accidental scenarios?

-How to build a "criticality grid" (Figure 1) adapted to the industry site?

Lastly, the "criticality grid» rests on probability and gravity scales which are as difficult to assess as the acceptability level. This difficulty is still present when it comes to choose the adequate method making it possible to quote various scenarios and to manage the uncertainties inherent to the various existing methods.

Technico-economic studies of risk reduction process

In addition to having to make sure, within the framework of the SS, that the risks level of the major accidental scenarios generated by the site installations are acceptable, the industrialist must on the one hand make a "technico-economic study" aiming at reducing the danger potential, and on the other hand, to reduce his risks to a level "as low as reasonably realizable". These complementary concepts are completely subjective and very difficult to really implement in the SS. Indeed, these aspects are considered depending on the "free will" of the industrialist because no limits are fixed.

1.4 Problems that can be faced during the TRPP

The TRPP are currently in an "exploratory phase".

Indeed, de promulgation of the decree and of the methodological guide will fixe definitively the TRPP process and form. This chapter aims at revealing problems that can be faced during the TRPP process.

Technical part of the TRPP process

The DRIRE is in charge of producing a hazard map during the technical phase of the TRPP. This map is done according to the information provided by the industrialist (scenarios coming from the SS that leave the site limits) and consist in a requalification of the probability dimension, a recomputation of the effects distances and an evaluation of the kinetic dimension. This exercise raises the following problems:

The DRIRE must treat the SS and TRPP processes differently, knowing that in the first process the DRIRE has a "control" role and in the second process the DRIRE is in charge (active actor). The DRIRE must then avoid giving recommendation about the admissibility of the SS when involved in the TRPP process. The aggregation of the three criteria probability, intensity and kinetics that qualify the major accidental scenarios can be considered in different manner to produce a hazard map. However, the choice of an aggregation approach can have an impact on the meaning and the nature of the hazard zoning. The crossing of the hazard map provide by the DRIRE and the vulnerability map provided by the DDE. This crossing must help the selection of a set of appropriate measures (expropriation, renunciation, etc.) suggested to an open dialogue within the LCDI committee. Going owing to the fact that the technical phase must lead to recommendations and not to decisions (decisions are done during the reglementary phase of the TRPP): which form must take these recommendations so as to take all the local constraints raised within the framework of the LCDI?

Dialogue part of the TRPP process

The reglementary phase of the TRPP becomes effective only after the communication phase (Figure 2). The communication phase consists part-ly in a dialogue process done by the LCDI committee. The following questions can be raised:

How to take into account specificities of the local constraints without challenging the technical recommendations? How to take into account the heterogeneity nature of the stakeholders in term of roles, functions, training, etc.? This can be solved by proposing a common glossary? How to establish a conclusion (eg. Risk reduction measure) shared by the whole stakeholders? How as well as possible to help the Prefect and his representatives to take into account both the technical information and the LCDI opinions? CONCLUSIONS The Toulouse accident in September 2001 represents a turning point in the way technological risk prevention is currently taken in France.

The Safety Study (SS) and the Technological Risks Prevention Plans (TRPP) are two official documents: the first one is old and the second one is new. However, when put into practice, the two respective processes reveal difficulties in the way decision and expertise situations are driven.

This paper aims at bringing to the fore the various problems faced during the different expertise and decision-making phases present upstream, during and downstream the major accidental risks analysis process. The different problems were gathered in three groups:

Actors Problematic:

 Checking of the representativeness of the analysis of risk working group. Selection of the stakeholders. This allows to make it possible to see whether the given opinions are neither too optimists nor too pessimists.

Identification and assessment problematic:

 SS process revealed an important set of whole of choice phases carried out by the stakeholders: e.g. choice of the studied scenarios, identification of gravity and probabilities levels for the whole scenarios, choice of effect distances, etc. The purposes of these choices are to reduce the uncertainty in a set of stakeholders conceded states. However, because of the strong effects of these "choices" on the industry risk control strategy and because of the strong overlap between SS and TRPP, it is necessary to institute a set of control mechanisms to validate their relevance.  Identification of the unusual situations. How to identify the probability of rare scenarios  Difficulty of selecting the scenarios to be taken into account within the framework of the TRPP.

Figure 1 .

 1 Figure 1. Criticality grid (probability / gravity)

Figure 2 .

 2 Figure 2. The three parts of the TRPP

Figure 3 .

 3 Figure 3. Vulnerable stakes map

Figure 4 .

 4 Figure 4. Various zones defined within the framework of the Technological Risk Prevention



  Difficulties to integrate the different perceptions and opinions of the various stakeholders.Complexity of the decision-making process based on the information and ending documents provided by the Administrations (DDE and the DRIR) and considering the opinions expressed by the dialogue committee LCDI.  Difficulties (to the Administration) to consider the local territory specificity in a national process.  Management of the different roles played by the Administration (DRIRE) in both the SS and TRPP processes. Information and knowledge problematic:  Presence of imperfect knowledge of the accidental phenomena and the various potentialities of their occurrence.  Integration of the complexity of the various information at disposal such as the of Security Management System (SGS in French), etc; Difficulty of modeling the accidental situations and difficulties to identify completely their consequences. Limits of the calculation models. Difficulty of choosing the adequate model, etc.

Tableau 1 .

 1 Three thresholds to characterize the intensity criterion

		Signifi-		First Lethal	Irreversible	Irreversible ef-
		cant Le-	effects	effects	fects	by
		thal	ef-			breaking of
		fects				panes
	Toxic LC 5%		LC 1%	SEI	-
	Ther	8 kW/m2	5 kW/m2 or	3 kW/m2 or	-
	mic	or		1000	600
		1800		[(kW/m2)	[(kW/m2)
		[(kW/m2)	4/3]. s	4/3]. s
		4/3]. s
	Over-	200 mbar 140 mbar	50 mbar	20 mbar
	pres-
	sure

Bureau d'Analyse des Risques et Pollutions Industrielles.