Olivier Salvi
email: olivier.salvi@ineris.fr

Richard Gowland

EUROPEAN TECHNOLOGY PLATFORM ON INDUSTRIAL SAFETY (ETPIS), A VISION TO GAIN SAFETY FOR A SUSTAINABLE INDUSTRY GROWTH

The paper that will be presented is an extract of the Strategic Research Agenda of the European Technology Platform Industrial Safety (ETPIS). It is a result of a collective work made by researchers from organisations that consider industrial safety as a strategic issue for the sustainable growth of the European Industry.

The list of the main organisations involved in the ETPIS, that participate in the preparation and endorse this text is available at www.industrialsafety-tp.org.

The paper will describe the rationale, the scope and the organisation of the initiative.

It will insist on the structuration and the organisation of a Strategic Research Agenda prepared by more than 150 organisations concerned by industrial safety.

In particular, the analysis of the broader situation, regarding industry and safety interactions and issues, led the ETPIS members to propose a RTD strategy that focuses on 6 major challenges. These have been identified wherever there is a clear need to develop basic knowledge in safety sciences.

• Developing new risk assessment and risk management methods addressing the complexity of industrial systems • Improving methods and technologies to reduce risks at work and to prevent major accidents • Understanding the impact of human and organisational factors in risk control • Improving knowledge transfer to industry and in particular SMEs, education and training activities • Understanding emergent risks and cross-cutting risk & safety issues • Structural safety Some industrial stakes are not concerning only one industrial sector, and should also take the knowledge and expertise from several Focus Group. To enable the mobilisation of the critical mass and attract the interested sectors, the TP has decided to create the concept of research HUB.A research HUB is a group of interest aiming at exchanging knowledge and launching projects after having defined a specific research agenda. The research HUB will take benefice from the Focus Groups and mobilise the interested industries. The first research HUB of the TP on Industrial Safety is the NANO-SAFETY HUB addressing the safety issue of nano-technologies and nano-materials. KEYWORDS: industrial safety, research agenda, risk assessment

RATIONALE SAFETY FOR EUROPEAN QUALITY OF LIFE AND COMPETITIVENESS

The European Union has been defining a number of objectives for the future of RTD activities, which require a variety of concerted actions. The Lisbon summit (2000) established the objective for Europe to become the most dynamic and most competitive knowledge-based economy by 2010, while in the Gothenburg summit (2001) emphasis was put on sustainable development, involving aspects of environment, health, economy and employment.

The achievement of these objectives for the European economy and quality of life requires that industry as a whole modernises itself, improving its efficiency, quality and safety. It also requires improvement in the efficiency, quality and safety of transport systems, as mobility is a requirement for the industrial development and also for the well-being of citizens. It is becoming more evident that the industrial and transport networks in Europe are transnational and increasingly more dependent on each other. Efficiency of industrial production is intimately related to the delivery of materials and products in a timely manner and this can only be viable with adequate logistic and transport infrastructures.

Safety is essential for human well-being but also to ensure the efficiency and competitiveness of the industrial and transport systems as a whole. Any disruption in the chain of production and transport has adverse consequences on the affected industries and transport systems, which may extend across country borders, as national economies are increasingly interlinked. It is therefore essential that in all European countries there is a unified approach to Safety and that this approach is also maintained consistently across the various industries and transportation facilities. This is not the present situation but should be a long-term objective that should mobilise efforts among all parties involved, from Governments to industry and academia, and from technology developers to the public at large.

AN EVOLVING CONTEXT

The performance of the European industry in many sectors is competing with other countries which are growing quickly thanks to structural and economic advantages such as growing market potential. Since Europe is a largely mature market which is not expanding rapidly, investment for expansion is taking place in other regions where there are market and sometimes economic advantages. Investment in Europe is 'plateau-ing' and new production capacity is built in Asia or in south America. This position creates challenges to maintain competitiveness and a proper socio-economic performance level in EU.

Part of the challenge is in meeting public expectations in safety and environmental protection while remaining competitive. New emerging technologies are providing and requiring new design, operation and assessment routes which need immediate considerations to maintain industrial safety. Furthermore, as European industrial installations are becoming older and technical expertise follows new investment and older experts are retiring, making education and training for industry a special issue.

The market is evolving towards specialised production and complex manufacturing processes (speciality chemistry, aeronautics and services ...) which require enhanced knowledge, adaptability and flexibility. If the required technological disciplines and hard science education do not attract enough people, it will be impossible to stimulate innovation.

NEED FOR CHANGES IN INDUSTRIAL SAFETY POLICIES

Policies addressing industrial systems, and in particular safety, must evolve from prescriptive policies to objective policies, because the key players able to implement the solutions are the industries themselves and it is no longer possible to prescribe solutions when the systems are so specific and so complex.

There is a need to harmonise the policies and ensure a consistent implementation throughout Europe, and in particular as theEuropean Union enlarges.

The public expects to take part in decision-making process related to safety and environmental protection issues of the ageing and emerging infrastructures and systems in Europe. There is always a residual risk related to new technologies, design, monitoring, structural assessment methods and human activities. It is important that industry and public authorities' decision making process are as transparent as possible and it is fundamental that it is comprehensible by the public. For that latter reason, there is a need to develop an open and ethical industrial risk (or safety) culture and explain risks and benefits that our society gains from industry.

The solutions to be developed to minimise both accidents and pollution must be integrated ones while maintaining the integrity of manufacturing and operation of industrial systems. The new systems that will be designed must take into account at conception, safety and environmental performance as major opportunities and requirements. Inherently safe and clean concepts should permeate industry at all levels of the life-cycle of manufactured products.

SCOPE OF THE EUROPEAN TECHNOLOGY ON INDUSTRIAL SAFETY

Scope

Industrial safety applies to installations, systems, buildings, transport systems and structural components And deals production safety related with

• Occupational health and safety of the workers in industry • Environmental safety / prevention of major accidents consequences / protection of the environment and the with off-site society Safety of society derives from properly addressing risks to the public, industrial risks and occupational risks, the nature of which changes with the target population to which it relates. Public risks are related to governmental decisions on major topics such as major diseases (e.g. AIDS and cancer), genetically modified products, climate change and natural hazards as examples. Industrial risks are related to the risk that the industrial activity brings to employees and the public in general, including transportation which is considered here as part of the industrial activity. In industrial activity, risks related to the introduction of new technologies (e.g. nanotechnology, hydrogen strorage and common use etc.) and design routes need particular attention as the new hazards need to be properly identified and assessed. Safety in this context results from Governmental regulations, technical codes & standards that generally define minimum acceptable safety levels (and sometimes enforce these levels) and from the various industrial actors that organise their activity in order to achieve the level of safety they consider compatible with their aims and responsibilities. Finally, occupational risks concern the accidents that occur within the industrial and related activities and thus they affect a smaller percentage of population at risk. They all depend on the policies, aims and performance of the various industrial sectors and Governmental regulatory activity.

The scope of the Industrial Safety Technology Platform provides an integrated approach to the safety related aspects of advanced design, production, operation processes and fitness-for-service assessment of industrial products and systems, dealing with technical and human, organisational and cultural aspects, as well as the actual systems and processes used for managing safety. The main emphasis is on the development of preventive technologies, damage assessment routes using risk-based methods for the optimal design of products, production facilities, industrial systems, activities and ageing and new advanced structures from the point of view of delivering recommendations in the form of "Best Practice Documents". These can be basis for development of CEN Norms by the respective Technical Committees for improved safety levels at acceptable costs.

THE VISION AND THE WAY TO ACHIEVE IT SITUATION REGARDING INDUSTRIAL SAFETY

According to European Statistics (Eurostat, 2004), in EU-15, in 2001 there were 7.6 million accidents at work. 4.9 million of these resulted in more than 3 days of absence from work and 4,900 fatalities occurred. This means that one worker became a victim of an industrial accident every 5 seconds and one worker died every two hours. All industry sectors are concerned: manufacturing, energy, transport, construction, agro-industry, process industry.

The MARS database Major accident reporting system of the European Commission (Joint Research Centre, Ispra http://mahbsrv.jrc.it) records that, approximately 30 Major Accidents happen each year within the industry sectors covered by the Seveso 2 Directive. These accidents are not major contributors to the overall statistics but have a major impact on industry and society. The major accident, which occurred at Toulouse on 21st September 2001 killed 21 people on the site, 9 people off-site and injured 2,242 people. 27,000 homes and 1,300 companies suffered significant damage. 5,000 people needed treatment for acute stress. The economic cost exceeded E1 500 million.

Incidents and accidents disrupt the process of sustainable industrial development, directly through the remedial and prevention activity and indirectly through restrictions placed on the whole industry as a result of these failures. Failure of primary components of engineering structures such as nuclear, chemical, offshore and aeronautical industries can easily leads to significant losses in terms of human lives and economical value. It has a paramount significance to maintain the structural integrity of existing, ageing equipments as well as new advanced structures in Europe. Additionally, introduction of new design approaches and technologies brings new challenges, which need to be addressed before they impose added safety risks. Performance statistics for different sectors indicate that some industries are apparently much safer than others. The difference between the best performers and the average for all industry is often dramatic and cannot always be explained by the inherent hazards of the specific features of the structures and workplace or work activity. There are underlying reasons for failure and success which may be known, shared and acted upon within a sector, but no coherent effort has been made to address the failures of one sector by applying the success factors of another. Within sectors there is a wide variation of performance, which depends on many root cause factors including corporate tolerance, scale of operation and resources available for accident prevention and concerns about competitiveness. The new members of the European Union are in some cases at a different stage of development and performance in industrial safety. This presents some new opportunities and challenges.

Research projects on Industrial Safety are funded by a wide range of stakeholders including the European Commission and European member state governments. This investment has not been entirely successful because a Europe-wide life cycle process from problem definition through project activity to implementation and exploitation has not been applied consistently.

Legislation such as the Seveso and "safety at work" Directives has played a constructive role in setting requirements and standards. Consensus Technical Standard setting bodies such as C.E.N. and I.E.C. have been successful in promoting improvement.

The best performers have made their own decisions to be leaders. In so doing, they have initiated, carried out and exploited projects and implemented improved technical standards. In most cases they have developed risk based design, monitoring and advanced fitness-for-service assessment methodologies for their structures and adopted an accident free workplace philosophy and used effective training and education schemes. Harmonisation of all these aspects in Europe is a RTD challenge for coming decades.

THE VISION 2020

The platform will be a major industrial contribution to the design of European policies related to Safety and Health (particularly Framework Directive), SEVESO II Directive, ATEX Directive, IPPC Directive, transport of dangerous goods, REACH, GHS, etc.

The vision for industrial safety performance can be summarised as follows.

By 2020,

/ a new safety paradigm will have been widely adopted in European industry. Safety is seen as a key factor for successful business and an inherent element of business performance. As a result, industrial safety performance will have progressively and measurably improved in terms of reduction of reportable accidents at work, occupational diseases, structural failures lead to environmental incidents and production losses. It is expected that an "incident elimination" and "learning from failures" cultures will be developed where safety is embedded in design, maintenance, operation, fitness-for-service assessment and risk management at all levels in enterprises. This will be identifiable as an output from this Technology Platform with following quantified objectives; / >there will be structured self-regulated safety programmes in all major industrial sectors in all European Countries. These will have firm, measurable performance targets for improved structural performance, accident elimination and will meet the annual reduction rate stated in the Technology Platform objectives / accident free workplaces will become the norm This development will significantly contribute to the sustainable growth of all major industrial sectors in Europe by safer utilization of emerging technologies and life extension of ageing structures and and hence improvement of social welfare. Research work should continue in these fields to develop existing methodologies further by taking into account of emerging technologies and respective risks as well as harmonising the best of them in Europe. The interaction and early involvement of technological knowledge (new technologies, smart structures etc.) in policy development needs improvement. This will lead to early identification of safety relevant issues and thus can guide introduction of new design and manufacturing technologies, life extension and structural performance assessment methodologies and policy/legislation development and improve the quality and sustainability of the final solutions.

Recognising the challenge and opportunities, a group of experts from industry, unions, authorities, NGOs and research and academic organisations have undertaken an inititative to create a Technology Platform to achieve Safety for Sustainable European Industry Growth. This initiative obtained the principal supports of the DG Employment, DG Enterprise, DG Environment and DG Research of the Commission. This TP has prepared the strategic plan described within this document for research for development of new technologies and improvement of existing best practices as well as efficient implementation of R&D results across all major industrial sectors including SMEs. The European Technology Platform for Industrial Safety (ETPIS) has clear understanding of the role and needs of the SMEs for development and implementaion of the best practice procedures for industrial safety. ETPIS works with other European TPs using existing expert groups and contributes to form new groups as networks of National Platforms to ensure success. ETPIS offers a unique opportunity to focus European competences on needed research items and clearly defines how each project which it supports will play its part in delivering the vision.

The main objectives of the Technology Platform ETPIS, therefore, are:

-To gain 'Safety for the Sustainable Growth of all European Industry' by reducing the number of accidents & by supporting safe technological innovation. This has a major impact on cost of manpower, availability of production systems and therefore on the competitiveness of the Industry. -To bridge the different aspects of "industrial safety" (Occupational health & safety of workers plus environmental safety including prevention of major accidents & protection of the environment).

-To facilitate and accelerate the breakthrough for progress in industrial environmental, health & safety (EH&S) via a co-ordinated, integrated research & implementation process. -To valorise, exploit and implement results of research and innovative methods within Industry.

As described above, ETPIS addresses occupational and structural safety related with the industrial activity as a whole and has the vision to significantly reduce the level of accidents involving human and ageing & new structures (with emerging risks) in Europe by 2020 with realistic, measurable targets. The platform activities will result in a substantial improvement of occupational and structural safety in all major industries, including transportation systems and infrastructures while maintaining the profitability of the industry. More specifically, ETPIS addresses the problem of ensuring the safety and cost-effectiveness of industrial products and services, transport systems and services, facilities and structures (made of metals -with or without welds and composite materials) across different industries. Several industries are faced with similar problems requiring solutions that are compatible with new work organisation, including the extended use of information technologies, and which impose no damage to the environment. Industries are also going through processes of consolidation, of relocation in different countries, including establishing industrial parks so that a proper interaction with urban planning and development becomes even more important and critical.

Safety and reliability aspects, which are critical to production efficiency and cost, need to be assured not only in the design and in the manufacturing phase, but also must be maintained during the operational and ageing phases of the products and facilities. Finally, in the longterm prospective (up to 20 years) a great deal of effort is to be directed to a change from the traditional approach of "hazard control" to "accident elimination" by developing and adopting new technologies and methods. Thus the development and evaluation of inherent safety principles and techniques is a long-term objective, together with ensuring their adoption by all stakeholders.

Moreover, a new threat potential has been added to the problem area of safety since the occurrence of tragic events like those of September 11, 2003 in New York andMarch 11, 2004 in Madrid: namely, the security of industrial systems and infrastructures. While safety aims at avoiding accidents and damage resulting from normal operation of installations, security aims at safeguarding the installations from voluntary illicit acts, often of a terrorist nature. Most of the focus in security is towards decreasing vulnerability of systems by better detection and early warning of the potential threats and/or by making systems more robust or eliminating weak links. In this respect, it is clear that public and industrial safety cannot be ensured if measures are not explicitly taken to also deal with these emerging threats. While some methodological aspects of risk assessment and management are the same, the hazard identification requires new types of actions and thus the risk analysis methods and the resulting reduction measures also need to reflect these new threats. The experience in the nuclear sector's safeguarding may represent a good example in this direction.

This Technology Platform aims at improving the coherence of the approaches adopted by the different industries to deal with the above-mentioned problems, and it provides a strategic vision for identifying priority research in RTD and demonstration activities. It will also consider the importance and maturity of the technologies being developed and will contribute to the technology transfers among the sectors and to the much needed education and training activities.

The long-term objective of ETPIS is to improve the methodologies, technology and the practice, making them more integrated and consistent across industrial sectors and across European countries, as this is the only way of improving the overall level throughout. As long as there are sectors of activity, or countries, with less than satisfactory approaches to safety, the overall objective can be jeopardized. This is particularly critical with Small and Medium Enterprises (SMEs) in general as they often they do not always possess sufficient resources and may not be able to lead the processes of safety improvement. This Platform is transversal, crossing all industries and transportation modes, and aims at developing consistent methodologies of risk analysis and management for implementation in the various industrial and transport sectors. Concurrently, the specifics of application of the methods and the details of their implementation in the various industrial and transport practices will need to be dealt in conjunction with the industry-specific Platforms.

WHAT WILL BE DONE -THE GENERAL APPROACH

A general approach will be implemented to reach the objectives of the ETPIS:

-Act to gain the commitment from major industrial sectors and key safety related organisations to the accident elimination vision and the milestones of:

• 25% reduction in accidents by 2020 • Programmes to be in place by 2020 to continue accident reduction at a rate of 5% per year or better -Set up consultation and analysis programmes, which identify needs and matches these to potential research projects for management through the Technology Platform.

Use knowledge gained to expand the scope of the Needless to say that ETPIS will use the existing networks, associations and groups are already working in the wide-range of the indutrial safety topics to be addressed.

CHALLENGES TO GAIN INDUSTRIAL SAFETY FOR SUSTAINABLE INDUSTRY GROWTH

The experts of the European Technology Platform Industrial Safety have pointed out several challenges to radically improve safety in the industry:

• Improve methods for safety managers and practitioners As some industrial challenges involve several industrial sectors and/or expertise from several Focus Groups, the ETPIS has forged the concept of research HUB.

Research Focus Groups

Technology Platform Safety for Sustainable European Industry Growth This HUB seeks support from industry partners.

CONCLUDING REMARKS

The European Technology Platform in Industrial Safety (ETPIS) is open to any interested bona fide organisation, the only requirement being active participation in the Focus Groups of interest. The request for access is freely available through the dedicated web site at www.industrialsafety-tp.org. The content of the Strategic Research Agenda of ETPIS was presented in this paper. It will be updated regularly according to the evolving context and by taking into account the results of research and a specific review of stakeholder concerns and needs. Therefore, every second year the SRA will be reviewed and a new version will be edited after an open workshop gathering the members of ETPIS and the community of interest.

The Strategic Research Agenda is a tool for coordinating the RTD effort in industrial safety at European, national and regional level to prepare research programmes. The objective is to develop synergies between public and private sectors at European, national and regional level to optimise the resources allocated to research in industrial safety. The SRA constitutes therefore the RTD roadmap for industrial safety improvement. The national technology platforms on industrial safety will provide contribution in resources and work and this will be coordinated by the ETPIS.

Figure 1 .

 1 Figure 1. Organisation of the thematic Focus Groups applying to several industrial sectors

  HOW CAN THE VISION BE REALISED? Improved risk control supporting the sustainable growth of European industry needs a co-ordinated effort in research and in identifying and adapting successful practices. Many of the most respected risk assessment and control methodologies have originated or been developed in Europe. Examples include Hazard and Operability Study (HAZOP), Quantitative Risk Assessment (QRA) and Workplace Risk Assessment.

  Integration of Life cycle; Risk perception, Political Price & Value of risk; "Forced" application of risk-based approaches; Impact of demography on industrial safety; Banking and Finance; Security Research. ORGANISATION OF ETPIS According to the above-listed challenges in safety sciences, ETPIS members have set up five topic-based focus groups.

		Understanding the impact of human and organisational
		factors in risk control
		Human-Centred Design; Human Factors in System design
		and modernisation; Human-Technology Interfaces &
		Usability; Integrated Risk Assessment and Management
		Methods & Techniques; Human Factors in Emergencies
	• Develop advanced technologies in the field of industrial safety • Develop and validate new structural safety procedures • Improve the safety culture within the enterprises and society • Improve the knowledge transfer to the industry through new education and	and Crisis Management; Safety Culture & Safety Climate; Decision making process; Human Performance; Human Factors in Organisational and Managerial Safety -SME-related issues; Human Factors Knowledge Engineering & Management; Health & Social Issues; Data Retrieval; Oper-ational feedback and learning from experience; Actual safety and perceived safety.
	training tools and methods • Develop knowledge, technologies and tools against emerging industrial risks	Understanding emergent risks and cross-cutting risk & safety issues Unified/consolidated legislation, codes, standards; Reliable
	FOCUS AREAS OF THE ETPIS The paragraphs hereunder introduce the choice of the focus group topics regarding where basic knowledge, methods and technologies need to be developed. Developing new risk assessment and risk management methods addressing the complexity of industrial systems Understanding hazardous phenomena to develop safety equipment and technologies; Development and validation of methods and tools to improve risk assessment and management; Impact of natural and man-made hazards on plant safety; Harmonisation in risk assessment; Reliability and safety of network systems; Methods for dynamic reliability assessment; Risk management and governance (new forms of participative governance); Multi-criteria analysis and decision support tools; Systemic methods to	data; Economic Price & Value of risk (VAR -the Value-at-Risk concept, too) and risk management; New technologies; "Blind" application of tools; Old/aged plants; Globalisa-tion; -FG 1 : Risk Assessment and Management Methods -FG 2: Advanced Risk Reduction Technologies -FG 3: Structural Safety -FG 4: Human and Organisational Factors -FG 5: Emerging Risks
	address the complexity of the industrial systems; Uncertain-
	ties in risk assessment and management.
	Improving methods and technologies to reduce risks at work
	and to prevent major accidents
	Technologies and methods for eliminating or reducing
	risks at source; Technologies and methods for inherently
	safe design and for inspection, monitoring and assess-
	ment of defects; Application of information technologies
	in advanced safety-related systems; Reducing risks by
	collective protective systems and devices; Advanced
	materials and technologies for developing personal
	protective equipment; Technologies and methods for
	preventing and reducing risks due to Major Industrial
	Accidents.
	Structural safety
	Structural reliability based design; Structural Health Moni-
	toring (SHM) and risk-informed inspection; Structural
	Safety of Aged & Repaired Structures; Fitness-for-Service
	(FFS) of Structures; Integrity of Multi-Material (Hybrid)
	Structures; Structural Safety from Natural Hazards;
	Structural Safety from Accidental loads.

ACKNOWLEDGEMENT

This paper has been prepared thanks to the active participation of the Focus Groups and in particular their leaders hereunder listed: -Risk assessment and management Stale Selmer-Olsen, DNV (Norway) Fiabio Bagnoli, D'Appolonia S.p.A. (Italy) -Advanced risk reduction technologies Daniel Podgorski, Central Institute for Labour Protection -National Research Institute (Poland) Jan J. Meulenbrugge TNO Built Environment and Geosciences (The Netherlands) -Structural safety Carlos Guedes Soares, Instituto Superior Tecnico -IST (Portugal) Mustafa Koçak, GKSS Research Center Geesthacht (Germany) -Human and organisational factors Simone Colombo, Politecnico di Milano (Italy) Patrick Laine, Electricité de France (France) -Emerging risks Aleksandar Jovanovic, Interdisciplinary Center for Risks and Sustainable Technology Development at University of Stuttgart -ZIRN (Germany) Raija Koivisto, VTT (Finland) -Hub education and training Rosa Nomen, IQS (Spain) Dirk Oberhageman, ESMG GmbH (Germany) -Hub Nano-safety Frédéric Schuster, CEA (France) Jacques Bouillard, INERIS (France) More information on Technology Platforms on: http:// cordis.europa.eu/technology-platforms/home_en.html


Wassila Benaissa
email: wassila.benaissa@ensiacet.fr

Sébastien Elgue

Nadine Gabas
email: nadine.gabas@ensiacet.fr

Michel Cabassud
email: michel.cabassud@ensiacet.fr

Douglas Carson
email: douglas.carson@ineris.fr

Michel Demissy
email: michel.demissy@ineris.fr

Safety methodology for the operation of a continuous intensified reactor

Keywords: process safety, intensification, modelling, heat-exchanger/reactor, runaway scenario, intrinsically safer

INTRODUCTION

Today, the chemical industry has to deal with new challenges. In addition to produce more and faster, safer and cleaner production must be performed. Thus, alternatives have emerged to improve chemical processes. Green chemistry is certainly one of the most relevant example but not the only one. Process intensification can be considered as a method that allows to prevent and reduce risks related to major industrial accidents. Indeed significant progress has been reached in the development of new reactor technologies: today, miniaturised and continuous processes are being developed to attain better heat transfer and safer conditions compared to traditional batch or semi-batch operations. These performances authorise to modify operating conditions by employing higher concentrations and using less solvent and reaction volumes. In this field, new prototypes of "heat-exchanger/reactors" are a good illustration: built like a plate heat-exchanger, internal plates are designed in order to carry out chemical synthesis. But these new concepts of reactor design being less familiar than traditional ones, research work is necessary not only to assess their feasibility and potentialities but also to evaluate their efficiency and intrinsic characteristics.

One of the first prototype of "heat-exchanger/ reactor" was provided by Alfa Laval Vicarb, called Open Plate Reactor (OPR). The OPR is composed of several blocks. Each block is made of one reactive plate, where the reactants, products and catalyst of the reactions continuously flow, surrounded by two plates containing the utility fluid, permitting to heat or to cool the reaction mixture [START_REF] Devatine | Process Intensification: performances evaluation of a new concept <JC open plate reactor 3[END_REF]. In parallel to experimental characterisation of this device, a simulation software tool has been developed (Elgue, 2005). The simulation framework is based on a complex dynamic model taking into account the specificities of the reactor. One of the applications of this software is to reproduce and predict the process behaviour solely by specifying the operating conditions. The esterification of propionic anhydride by 2-butanol was chosen as a reference synthesis. It has some characteristics which make it very interesting (exothermic, relatively simple to carry out, liquid homogeneous phase) and a kinetic model has already been determined [START_REF] Galvan | The use of neural networks for fitting complex kinetic data[END_REF] and validated [START_REF] Benaissa | Transposition of an exothermic reaction to a continuous intensified reactor[END_REF]. After having determined the operating conditions, the feasibility of the transposition of this reaction into the continuous reactor OPR was proved experimentally (Benaissa, 2006a). Simulation and experimental results were in good agreement and this study gave the opportunity, in one hand to formalise steps in order to transpose an exothermic reaction into a continuous intensified reactor and on the other hand to validate the simulator. In addition to previous studies (Prat, 2005), these results showed that this new concept of chemical reactor offers enhanced thermal performances during normal operation. An HAZOP analysis carried out on the OPR pilot plant highlighted accidental scenarios for which the consequences were not clearly identified (Benaissa, 2006b). One major scenario is the stoppage of both process and utility flows. It appears that there is no tool to predict the evolution of the process behaviour after failure which can be applied to continuous intensified reactor.

The aim of this work is therefore to propose a methodology in order to study the thermal consequences of flows failure in this type of technology. The heat-exchanger/ reactor OPR and the esterification of anhydride propionic by 2-butanol are chosen to apply the procedure.

PROCESS LINE EVOLUTION AFTER FLOWS FAILURE

The OPR is a continuous reactor with heat transfers taking place in the plates. Process flow modelling is therefore based on the classical representation of a sequence of perfectly stirred tank reactors (called cells) [START_REF] Neuman | Chemical reactor design, optimization, highly exothermic reactions[END_REF]. In the case of a pilot plant composed of three blocks, experimental distribution of residence times, which allows flow analysis, showed that the reaction line could be described by a series of 91 cells which corresponds to the actual number of rows (cf. figure 1). In this configuration, the state and the evolution of a cell depends solely on the phenomena taking place inside (reaction and heat transfer) and on the inlet streams, which are generally the outlet streams of the previous cell (cf. figure 2). In the simulation framework, the model is then based on the expression of balance equations (mass and energy) and on constraints equations for each cell. The simulator can compute the temperature profile along the reaction line after the steady state has been established for a normal operation.

However, when both process and utility fluids stop, another modelling has to be adopted, considering 91 closed cells independent from each other (cf. figure 3). After this deviation, the evolution of the liquid phase contained in a cell is therefore determined only by the reaction inside it and from transfer with its thermal environment, according to the following hypotheses: What is then the final temperature profile reached inside the process line in the case of flows failure? Since each cell is considered as a stirred tank reactor, it is possible to calculate for each cell k the parameters used to build the runaway scenario diagram well-known in the field of chemical process safety methodologies (Stoessel, 1993): the adiabatic temperature rise (DT ad ) (cf. equation 1) and the maximum temperature of the synthesis reaction (MTSR)

(cf. equation 2). DHr • (1 -X k ) DTad k = MTSR k = T k þ DTad k (1) (2)

THERMAL INERTIA OF THE OPR AND ADIABATIC COEFFICIENT

The runaway scenario is usually set up for batch reactors in the case of a cooling failure: the evolution of the reactor switches in adiabatic mode. However, the OPR has one feature which makes it very interesting from a safety point of view: it has got an important thermal inertia. The mass of the "heat exchanger/reactor" is considerably greater than the reaction mixture one, whereas it is the opposite for batch reactor. Indeed, each cell is surrounded by its own thermal environment made of different plates of the structure (cf. figure 4):

• The reaction plate (RP) where the reaction mixture flows. It is built with PEEK (PolyEtherEtherKetone), which is a plastic material able to resist to very high temperatures and most of corrosive chemical products, • Two stainless steel sandwich plates (SP) used to separate process and utility fluids, • The area containing the utility fluid (UF) (water-glycol),

• Two stainless steel transition plates (TP) (left and right) which allow the thermal isolation of each block.

The first line of Table 1 gives the product of the mass by the heat capacity for each element of the thermal environment at the level of a cell. Compared with that of the reacting mass contained in the cell, these values are not negligible. Another parameter estimates the relative importance of the reactor mass: the adiabatic coefficient defined as the ratio of specific heats (cf. equation 3).

SmTE • CPTE m r • Cp r (3)
In the second line of Table 1, the coefficient is calculated taking each element separately (F 0 ), and in the third line, by adding the different terms successively (F). In a batch reactor, the adiabatic coefficient doesn't generally exceed 1.2. It is obvious that the coefficient is more important in the "heat-exchanger/reactor", which confirms that the thermal inertia is an important factor in the study of the OPR.

According to these results, it is possible to consider that a part of the energy released by the reaction would be dissipated in the different parts of the reactor's structure. In this way, the calculation of the temperature rise has to take into account the thermal inertia of the reactor. For this purpose, the equation 1 has to be changed as follows: The reaction plates and sandwich plates are chosen because they are directly in contact with the process fluid. The figure 5 shows the final temperature profiles along the reaction line reached after deviation. The initial conditions are given by a simulation for the following operating conditions: utility temperature (708C), utility flow rate (3 m 3 -h h ), process flow rate (stoichiometric ratio) (50 L-h ), and sulphuric acid mass fraction (0.8 %) (Benai'ssa, 2006b).

The adiabatic mode is the least favourable for the thermal evolution of the reaction mixture, the relative curve provides therefore a border for the maximum temperature which can be reached by the process. We can also notice that more the adiabatic coefficient is high, which means that more the mass taking part in the thermal dissipation is important, more the temperature profile decreases, which is very interesting regarding safety. However this figure does not allow to determine which curve would be effectively reached by the process. For an infinite time, we can assume that the energy would be dissipated by the total mass, but meanwhile, what curve would be reached? Is it the adiabatic case or one of the other scenarios? To answer this question two characteristic times are introduced: one relative to the synthesis reaction and the other one corresponding to the heat transfer in the reactor mass.

CHARACTERISTIC TIMES SYNTHESIS REACTION

The first characteristic time is related to the kinetic of the synthesis and allows answering the question: "how long to reach the final temperature profiles after deviation from normal operation?" This time can be obtained by the resolution of mass and energy balances for each cell taking the normal operation as initial condition. The final condition is reached when the reaction is complete. Moreover, the mass equation has to be modified for each hypothesis (cf. equation 5). Table 2 gives the minimum time calculated for the 91 cells. For instance, it takes at least 18 seconds to reach the adiabatic curve from the normal operation one. The second time is related to the heat transfer inside the reactor mass and allows answering the question: "How long to diffuse the energy in the different element of the structure?" In fact, when both fluids stop, the transfer mode is primarily conductive, each part of the structure behaves then like a resistance to the transfer. These resistances are characterized using the Biot number and the principles of the diffusion in solids [START_REF] Peczalski | Outils simplifiés de Stoessel[END_REF]. Considering a solid at an initial temperature immerged in a fluid at constant temperature different from solid temperature, the characteristic time is defined as the time needed for the solid to reach the fluid temperature (Mc Cabe, 1993). This time is dependant on the thickness of the solid and on its physicochemical properties. Table 3 gives the times calculated for the reaction plate and the sandwich plates.

9T|f ~9t~• V k • DHr 1 • Cpkr (5)

CHOICE OF A SCENARIO

The two characteristic times have to be compared. We can observe that the heat transfer times are considerably smaller (sandwich plates) or of the same order of magnitude (reaction plate) than that obtain for the reaction time. Therefore, we can consider the fourth assumption as acceptable.

That would mean that in comparison with the adiabatic scenario, the maximum temperature would decrease up to 608C (cf figure 5). Thus, the thermal inertia of the "heatexchanger /reactor" allows it to be intrinsically safer.

CONCLUSION

The calculation of two characteristic times shows that part of the energy released by the reaction would be dissipated at the same time in the plates closer to the reaction mixture: the reaction plate and sandwich plates. This approach reveals an intrinsically safer behaviour of the OPR. This method has to be confronted with experimental studies relative on one hand to heat transfer in each plate and on the other hand to experiments with the OPR pilot plant in degraded mode. This result has also to be considered as a guide for the design of new intensified reactors.

•

  Homogeneity of characteristic values (temperature, composition ...) • Homogeneity of physical properties (density, viscosity • Homogeneity of physico-chemical phenomena (reaction, transfer ...) • No variation of volume, • No transfer between the cells.

Figure 1 .Figure 2 .

 12 Figure 1. Reaction line modelling by a series of 91 stirred tank reactors (cells)

Figure 3 .Figure 4 .

 34 Figure 3. Modelling after deviation

Figure 5 .

 5 Figure 5. Final temperature profiles reached by the reaction mixture along the OPR after flows stoppage according to five hypotheses (1 to 5)

  ABBREVIATIONSPS: RP: TP: UF:

Table 1 .

 1 Mass and heat capacity product and adiabatic coefficients of the process fluid containing in one cell and in its thermal environment

		PROCESS		THERMAL ENVIRONMENT
		Reaction	Reaction	Sandwich plates	Utility fluid	Transition plates
		mixture	plate (PEEK)	(stainless steel)	(water glycol)	(stainless steel)
	m.Cp [J.K 21 ]	29	8	12	44	254
		1	1.28	1.41	2.51	9.76
		1	1.28	1.69	3.2	11.96
	3. A part of the energy released is dissipated in the sand-
	wich plates (F 0 -1.41),
	4. A part of the energy released is dissipated at the same
	time in the reaction plate and in the sandwich plates
	(F = 1.69),
	5. The energy is dissipated in the entire mass of the reactor
	(F = 11.96).

Table 2 .

 2 Minimum

	characteristic time to
	reach MTSR after deviation
	Minimum reaction
		time [s]
	Adiabatic	18
	Reaction plate	26
	Sandwich plates	29
	Reaction plates þ	36
	Sandwich plates
	Total mass

Table 3 .

 3 Heat transfer characteristic times for each part of the reactor's structure

	Heat transfer time [s]
	Reaction plate	12
	Sandwich plates	0.03
	HEAT TRANSFER INSIDE THE OPR


Jean-Christophe Le Coze
email: jean-christophe.lecoze@ineris.fr

Nicolas Dechy
email: nicolas.dechy@ineris.fr

THE ORGANISATIONAL SIDE OF MAJOR ACCIDENTS AND SAFETY: PERSPECTIVES ON TRANSFORMING KNOWLEDGE INTO PRACTICES

In September 2006, Michel Llory, an author in the field of the organisational side of major accidents (1996,1999) organised a two days seminar focused on the organisational dimension of safety. Following twenty years of research in the field, from the debates around the High Reliable Organisation (i.e. [START_REF] Roberts | Some characteristics of one type of high reliability in organisation[END_REF] and Normal Accident (i.e. [START_REF] Perrow | Normal accident, living with high risk technology[END_REF], through the Normalisation of deviance (Vaughan, 1996) and some recent important investigations following major accidents (Paddington, 1999, Columbia, 2003) and other insightful contributions [START_REF] Hopkins | Lessons learnt from Longford[END_REF][START_REF] Hopkins | Safety, culture and risk[END_REF], the theme of the seminar was to question the state of the art regarding the core concepts and methodologies of the organisational side of safety, but also to address its practical impact within industry. Contributors from various French bodies where present (INERIS, National Institute for Environmental Safety; IRSN, Institute for Nuclear Safety and Radioprotection), but also researchers in the field as well as companies (Air France, EDF, CEA). Several themes from the organisational side of safety were debated such as:

-The tradeoff between production versus safety, -the dark side of organisations, -the nature of the accident dynamic, -the assessment of organisation, -the organisational side of safety in the practices of the industry and development strategy.

This paper provides a summary of one of the contribution proposed by the authors of this paper for the seminar. The contribution deals with the development of the organisational dimension of safety into industry practices. In order to elaborate on this topic, the paper distinguished among several concepts such as safety management systems, behaviours, human factors and organisational factors. It is stressed that these various expressions cover different understanding of sometimes similar phenomena. The meaning of these terms vary from managers, in companies to researchers in human and social sciences. An important part of this paper is dedicated to an attempt to clarify these different meanings. This is seen helpful to clarify some of the problems. Some directions are then suggested to help for the development of the organisational side of safety in practices. KEYWORDS: accident, safety management system, organisational factors, human factors, behaviour

CONTEXT OF THE STATEMENT, THE ANALYSIS AND THE PROPOSALS

This paper is based on some years of experience by the authors in developing various type of research programs dealing with the integration of human and organisational factors into risk assessment, safety auditing and investigations following accidents. In parallel to these research programs, consultancies have been regularly performed for the industry and control authorities, mainly in the field of investigating accidents and auditing safety management systems, but also in the more traditional field of risk analysis. On the basis of practices in design, risk analysis and assessment, safety studies and accident investigations widely in use in industry and existing consulting activities, one of the aim of INERIS, along with developing knowledge in the field, has been to try to introduce and transfer human and social sciences (through human factors and organisational factors) into these practices, while also questioning the ability to do so, when background regarding these issues is limited within the industry, where engineering is the most dominant profile. Our initial engineering background has been used as a support for a better understanding of the gaps between the different views that are presented in this paper. The industry domain covered is mainly the chemical, petrochemical industry.

DIFFERENT UNDERSTANDINGS OF HUMAN FACTORS, ORGANISATIONAL FACTORS AND SAFETY MANAGEMENT SYSTEMS

In this part we suggest a way of distinguishing the expressions in use for considering different domains, according to what they represent. This helps to identify some of the issues.

Safety management systems (SMS), human factors (HF) and organisational factors (OF) Safety management systems (SMS)

According to our experiences, when the term "organisation" is used and thought within the industry when it comes to safety, it is strongly associated with the principles of Safety Management Systems (SMS). It implies a rather "structural" or also "rational" vision of the organisation. By "rational" or "structural", we mean that functions, responsibilities and skills are clearly defined for people according to specified goals, and as a result, the organisation should behave in a rational way, according to its description and purposes. This type of representation is influenced by the quality approach, associated with the "Plan, Do, Check, Act" (the Deming wheel) and "continuous improvement" principles. This representation leads to a decomposition of the system in activities or processes (often described by procedures) that are articulated in order to provide the expected outcomes of the system. This approach is aimed at managing and monitoring the activities thanks to appropriate indicators. This principle is at the core of many standards (such as ISO 9000, ISO 14, 000 but also OHSAS 18, 000) but can be also found in a way, although not detailed as much as in these standards, in regulations such as in Seveso II Directive framework. In safety, activities such as risk analysis and assessment, emergency preparedness, management of change, roles and responsibilities etc need to be described and implemented for managing safely. It is often therefore that the description of the activities becomes consequently the "reality" against which people should be complying, and therefore be assessed. It represents an "ideal" or "rational" system to be put in motion. This is sometimes described in companies as a "system approach", although we would not associate it to a systemic approach (but this is a question of definition).

Without understanding that this is what managers and safety managers, when influenced by a engineering background, have in mind when they talk about organisations and safety, it is hard to see why difficulties arise when other approaches of organisations, bringing other ways of thinking the organisational dimension, are suggested (this point is discussed after). But in order to go ahead, we introduce now the human perspective (human factors) such as it is introduced, according to us, in companies, along with the SMS approach. This will also help, we hope, to clarify better the situation.

Human factors (HF) and Safety Management Systems (SMS)

The way Human Factors are seen is summarised in the following figure (figure 1).

This type of representation implies that following technology, engineering efforts and implementation of safety management systems, the next improvement should be through the human factor dimension. It is an interesting representation, that [START_REF] Hopkins | What are we to make of safe behaviour programs?[END_REF] has commented this way:

"It has to be said that this three stage analysis is highly contestable; indeed the analysis of Hale and others flatly contradicts it. They assert that a first age of technical, engineering improvements was succeeded by a second age, in the 1960s and 1970s in which human factors were seen as the central issues to be addressed. The late 1980s saw the dawn of a third age in which the structure and functioning of management was seen to be crucial (Hale and Hovden, 1998). "

We also think that this representation is the symptom of a gap between a research community from various disciplinary backgrounds (dealing with human factors and organisational factors) and the industry in general (but this gap would probably be different depending on the industries: nuclear, chemical, aeronautical, transport...). The gap is in the way human factors are understood in industry, compared to how it is understood in the research community. Based on our experience, human factors in industry concern mainly the "last bit" that can't be totally controlled and that need to be solved by providing the appropriate procedures, but also by providing the proper work situation, with a rather physiological approach of this work situation (light, space, size etc). Indeed, when you have made all the efforts to write down and to articulate the activities of

Number of accidents

Technology, engineering

Safety management systems

Human factors

Trend in practices

Figure 1. From engineering to HF following SMS a safety management system and also taken into account the work context, then the only problem arise when people do not comply with what they are supposed to do. As a consequence, following safety management system, the next step is to ensure that "disciplined" people will follow what is expected from them to do. This leads to figure 1 type of rationale. It might sound as an extreme way of describing the underlying models behind safety management system and human factors within industry, but our experience is that this type of rather technical way of thinking (namely that people are "components" to fit into a well definedand well thought -organisational structure), is widely shared. To go with this, three principles are often brought into the explanation for human behaviour that would not comply with what has been defined:

-the motivation issue (everybody remembers the Maslow pyramid ...) -the impact of external life into the practices ("when someone has a bad time at home, this is when human factors can have an impact") -the analogy with the situation of driving above the speed limits for an illustration of by-passing procedure This type of "models" (that are mainly "behaviourist") for interpreting human behaviour are rather limited and lead to difficulties when it comes to explaining incidents and accidents, or also to audit working situations where discrepancies are for instance noticed between procedures and "real" activities. The use of check list integrating human factors dimensions are often supporting tools for incident investigation or for short audits of practices. But, how can these checklists be used when so little knowledge is available for users about human factors and behaviour? Key items in check lists do not mean much when there is no theoretical background helping people to describe and understand situations, and to articulate together these various dimensions (for instance, from "procedures" to "light" through "stress" items). It is as if for understanding a chemical reaction, we would rely on common sense, with no background models in chemistry. The comparison with human factors assessment is not much different at a first level of analogy. How do you integrate in a appropriate way the potential effect of "procedures", "stress" and "light", for making sense of a situation (following an incident or a working situation) and assess it? It is quite a complex situation to deal with. Of course, we, as humans, do experience the presence of procedures, we do experience at times stressful situations and we have a good idea (in a "common sense" perspective) of what the impact of light on an activity is about. We do experience these probably enough to have an idea of how to proceed to evaluate other situations that people face or have faced, based on our own experiences. In comparison, it is true that we don't, everyday, experiment chemical reactions, with no knowledge on chemistry. The analogy with chemistry and process has therefore its limits. But it has definitely its interest too. Indeed, because of this feeling that "common sense" can be used for dealing with human factors, it leads to think that no specific knowledge or sophisticated one is available (it is "soft" sciences, after all). As a consequence, they don't need to worry much about the conceptual dimension behind it. And without it, things do work pretty well anyway. Until incident and accident happen of course and reveal that situations (technically and organisationally) were maybe not that adequate and not that well thought of. As a result, the representation of what human factors are in the industry (from our point of view) is far from what it is for human factors scientists. It is not a major problem because people can't be expert in everything, that would make no sense and a technical and engineering background is necessary for operating plants. But when the level of awareness is very low regarding the nature of knowledge implied for dealing with human factors, then it becomes extremely difficult to support its development in practices. And the issue is very similar when we move from human factors to organisational factors.

Safety management systems and organisational factors

When we move away from the "isolated"1 individual behaviour at the level of the work space, and get into another dimension of the problem, closer to the organisational factors such as described in the literature, then we penetrate into the area of what is often identify in the industry as the "safety culture" where "safety first" and "safety is everyone business" are the key drivers for bringing some "oil" into the safety "rational" management system. However first, there are difficulties with the concept of culture [START_REF] Hale | Editorial for the Special issue on safety culture and safety climate[END_REF][START_REF] Hopkins | Safety, culture and risk[END_REF], because it is a rather abstract concept, difficult to identify, difficult to assess but also to manage directly and practically. Moreover and secondly, [START_REF] Hopkins | Safety, culture and risk[END_REF] has shown how the cultural approach was understood within the industry (here again, the statement should not be understood as too generic and representing all industries): it is ultimately understood that the "safety culture" is located in individuals mindset. It is not understood as a feature of the organisation, as an emergent properties resulting from the safety practices and multiple daily tradeoffs regarding production and safety between managers and workers, that can't be attributed only to individuals, at the sharp end. In fact, many of the organisational insights provided by the literature on accidents and safety provides conceptual elements to think more globally the issue of safety, to escape a narrow vision focused on the individual and on a limited vision of what a "safety culture" is (or could be). Dimensions such as social redundancy, bounded rationality issues that apply to all decision makers from managers to workers, organisational learning, the impact of centralisation or decentralisation on practices, the presence of counter intuitive effects and the use of power, are never in the explanation of incidents or never integrated in safety auditing2 . As noted above, all these conceptual elements do not fit in a vision of the organisation where some principles derive from a more technical or engineering perspective of it. [START_REF] Génelot | Manager dans la complexité. 3 eme édition[END_REF], a consultant and researcher in management has identified some core principles still widely shared among managers:

• Management by planning and objectives, • The implementation by tasks and coordination by standardisation, • The assumption of an optimal organisation, • The primary importance of the structure, • The principle of discipline, • The focus only on economical results.

With such a definition of the organisation, it will indeed always be ultimately the individuals, or in an "disembodied" way, the "ideal" structural safety management system that didn't work as expected, as if structures and activities themselves were behaving without individuals implementing them. Without another vision of the organisational factors, then "common sense", as for human factors, gets back into the picture and understanding incidents or safety auditing can therefore be done without getting into the details of other available and more elaborated models of organisation behaviour. We find ourselves in the same situation as with human factors, where people interacting, at several levels of the organisation need to understand how, through their interactions and the problem that they face collectively, generate patterns leading to safety problems. This is what organisational factors are about. But this again is a situation where a deep gap exists between available models from the researches compared to the models used in practices.

On top of this, that makes it even more difficult than with human factors; these patterns are, first and as explained, complex to describe for untrained people (they need some conceptual support), but secondly as well as more importantly, most managers see it in a bad way to be included "in the loop". Managers see in a bad way to be identified as important contributors generating and sustaining inadequate safety patterns. This issue of including higher levels in the explanation is also one of the difficulty, on top of the conceptual difficulty. Managers do not like to be the targets of the audit or investigations following accidents or incident. It is indeed much better to limit the problems to the operator level. For obvious reasons, when you have the power not to be seen as the source of the problem, you get away with it. It is much better for your self esteem first but also for your carrier, that depends on those who assess your ability to manage. If you appear to be part of the problem, that's not really good. And this leads to the search for the scape goat. We have faced it in almost all incident and accident investigation. It is always an operator fault, an inadequate behaviour of an "isolated" individual, sometimes even if it is within a team, one of them will be chosen as the faulty operator. If not, and if the accident really need to take into account organisational issues, then the structural, "disembodied" safety management system will be targeted. This will be done without indicating much about what decisions were taken at the higher levels within the safety management system. There is nothing much new here, but it is very much a difficulty on top of the conceptual one. The conceptual and accountability difficulties are, we think, very interdependent as we illustrate it with the example of "prevention, not blame". Some of the advanced companies in safety management have captured messages coming from the research area about the inadequacy of focusing on "human error". As a result, we can therefore sometimes hear that what should be the approach is "prevention, not blame", so that investigation or auditing should be done without focusing on individual behaviours with the idea of blaming. The result is sometimes that behaviours are never investigated and understood because the aim is to prevent, and not to blame. So initially, the good idea of not blaming leads eventually to not taking behaviours at all into account in incident or accident investigation. We have seen this situation at least on one site. This, we believe, results partly from the fact that people find difficult to judge a mistake without deep understanding of human behaviour in technical, collective and organisational contexts. Blame should not be a problem if the situation requires it, but how to make the judgement without a good idea of what are the relevant models to be used for judging? It is true that, naturally, when going back to the events leading to an incident and accident for example, every decision appear to participate to the occurrence of the event. Everyone taking a decision "shaping the landscape of risk control" (Rasmussen and Svedung, 2000) can potentially be seen as one to be blamed. It is not an easy situation to deal with because safety patterns are generated by people interacting. [START_REF] Dekker | The field guide to understanding human error[END_REF] has well identified some of the traps of this perspective when investigating "human error" at the sharp end. A similar problem is faced when organisational dimensions are taken into account, when it leads to higher levels that are identified as creating the circumstances for the incident or accident to happen. The issue of blame do not always accommodate well with the systemic type of understanding. Often, the generated pattern can't be attributed to a single individual and the blame is diluted within the global organisation behaviour. However, if the purpose is certainly not to blame straight away, a good understanding of decisions and behaviours of many actors at different levels can't be avoided if we want to learn something from the point of view of the organisational dimensions of safety, and to think of appropriate preventing measures. If behaviours are not taken into account because the issue of blame is to difficult to deal with and meet accountability inhibition, then opportunities for learning may be more difficult.

SOME SUGGESTED DIRECTIONS FOR DEVELOPING ORGANISATIONAL FACTORS

This discussion on the definition of "safety management systems", "human factors" and "organisational factors" from the perspective of the industry and from the perspective of the research community indicates a real gap. This gap has strong impact on the opportunities for developing organisational factors in the industry. We have raised the problem, in the field of learning from accident, by distinguishing the purpose of models [START_REF] Coze | Disasters and organisations : from lessons learnt to theorizing[END_REF]. From prescriptive (with a more practical perspective) to descriptive models, the range of approaches is wide and generate different type of problems. We have for example identified models created by scientists with the purpose of generating new insights, from models used by professional investigators within bodies or within internal company departments (this role is sometimes played by safety managers). Other models are those models designed specifically for providing recommendations, because based on best practices for dealing with some human and organisational factors dimensions. The best practices articulated in the model are extracted from the industry. According to the purpose then resources needed (time, access to information, competencies) are very different. The same type of approach can be retained for human and organisational factors in general, and if we leave the field of learning from accident. Depending on the purposes, and resources available (skills, access to data, time etc), different things can be done. When it comes to human factors and organisational factors in the industry, the level of resources (access to data, skills available from human factors and organisational factors specialists, time available) is often rather low. Given the purpose to improve the management of safety by introducing human and organisational factors, the existing constraints are quite important. It makes developments really difficult. We can therefore only subscribe to the following statement by [START_REF] Hollnagel | Epilogue: resilience engineering precepts[END_REF] "A model that is cumbersome and costly to use will from the very start be at disadvantage, even if it from an academic point of view provides a better explanation. The trick is therefore to find a model that at the same time is so simple that it can be used without engendering problems or requiring too much specialised knowledge, yet powerful enough to go beneath the often deceptive surface descriptions. The problem with any powerful model is that it very quickly becomes "second nature ", which means that we no longer realise the simplifications it embodies. This should, however not lead to the conclusion that we must give up on models and try to describe reality as it really is, since this is a philosophically naive notion. The consequence is rather that we should acknowledge the simplifications that the model brings, and carefully weigh advantages against disadvantages so that a choice of model is made knowingly". However, the challenge is great.

As a way of moving forward, we suggested 2 directions in our contribution to the seminar:

1. There is a great need for making usable some of the concepts from the organisational factors domains. 2. There is a need to introduce human and social sciences and systemic thinking in engineers training.

For the first direction, research should focus on the ability to introduce within the safety management system framework, some of the important messages regarding organisational factors in safety. This is a difficult position where research should be carried out with the intent to introduce within current practices, as far as possible, some concepts from the organisational factor literature that have not been thought for being part of safety management systems. It would imply therefore a action-research type of approach, where the practical dimension is the purpose of the theoretical developments, so that the modelling results can fit in the current mindset, by "enhancing" it with regards to organisational factors. This is to be linked with the quote in this paper from Hollnagel and Woods. This approach might however not be expected to be able to produce too much and reach great results, when lack of basic knowledge regarding social sciences within industry (we imply here the chemical and petrochemical industry) is very important.

This therefore leads to the training needs for engineers. Training for engineers really needs to include recent developments from the social sciences, but also from recent epistemological and scientific developments regarding our understanding of the world, as for example the developments in the field of complexity. We have suggested this idea in a previous paper (Le [START_REF] Le Coze | Compexity and multi (inter or trans-) disciplinary sciences : which job for engineers in risk managament ?[END_REF], by discussing the importance for thinking the complexity of the problems involved in safety and accident when dealing with human, organisational and social issues. As the Turnbull report indicated: "Engineers are accustomed to dealing with uncertainties in the properties and behaviour of materials (. ..) while undoubtedly there is in some of these situations elements of technology inadequacy or failure, the main difficulties and problems lie at the interfaces of technology with commercial, political and social constituencies. The uncertainties inherent in these external constituencies are quite different in kind from the uncertainties that engineers traditionally deal with in addressing technological issues. They are much more qualitative than quantitative and they embrace a whole raft of cultural and emotional factors that often contradict apparently obvious logic. Engineers find this difficult domain to deal with." An effort has to be done for changing mindset and worldviews so that other type of approaches will get introduced into current practices. This is true for engineers being currently trained but also for engineers now working in the industry. Improvements in the way organisational factors (but also human factors) are perceived can evolve. It does happen, although following exceptional circumstances (the Columbia accident in 2003): "As an engineer turned manager for a time, I shared many in the science community's scepticism of organisational theory, such as discussed in this volume. Observing NASA management struggle with the shuttle and space station, I have gained a better appreciation of how these theories can help structure a more effective high reliability learning organisation in a very complicated high technology environment replete with ambiguous safety signals." [START_REF] Mc Donald | Observations on the Columbia accidents[END_REF].

THANKS

To the French Ecology and Sustainable Development Ministry that financed our studies.

Of course, nobody is ever really isolated, we always interact with others and the physical environment, it is more a way here of defining a level of description, in a "common sense".

For a better description of available organisational models in accident and safety but also more generally in organisational theory, see Le[START_REF] Le Coze | Are organisations too complex to be introduced in technical risk assessment and current safety auditing?[END_REF].