Lionel Perrette
email: lionel.perrette@ineris.fr

Helmut K Wiedemann

CNG buses fire safety: learnings from recent accidents in France and Germany

The use of CNG in bus and private vehicles is growing steadily. Recent fire accidents involving CNG buses have shown that tanks may explode though compliant with current ECE UN R110 regulation. Such a repeated scenario is certainly not acceptable having in mind the tremendous amount of energy released when a compressed tank bursts. Investigation of German and French recent cases detailed in this article highlights potential improvements in current CNG buses fire safety concepts. Among others, it includes to rely on a systemlevel test and expectations in combination with the current component-level test. Fire safety should not solely rely on tank behaviour when exposed to fire but also to additional and upstream fire safety barriers. Thermal fuses can not be seen any more as an ultimate option to control tank burst in case of fire.

INTRODUCTION

Over the last decade, the use of CNG (Compressed Natural Gas) in vehicles has been increasing all over Europe as a "green" alternative to conventional liquid fuels. According to the European Natural Gas Vehicle Association (ENGVA), the European CNG fleet is estimated to about 550 000 vehicles of all types (city buses, private cars...) with a prominent share for Italy (see picture below).

Total : 550.000 France counts about 1600 city buses. The number of CNG vehicle will be on the rise in France, especially for private vehicles due to the introduction of CNG vehicles home refuelling apparatus.

Natural gas is stored onboard vehicles under 200 bar in metallic or composite tanks. For buses, tanks are associated in series (tank system) and located on the roof.

In comparison with liquid-fuel-powered buses, CNG buses may pause additional hazards which comprise:

• tank burst and associated pressure waves, projectiles (projection of tank fragments and other equipment) and eventually thermal effects (fire ball resulting from the combustion of released natural gas), jet fire and associated thermal and pressure effects,

• and finally explosive atmosphere and associated thermal and pressure effects.

Mechanical 1 (road accident...) and thermal aggressions (onboard or nearby fire) are the main causes that may lead to any of the above hazards. Though tank burst is not supposed to happen based on existing UN ECE regulations [START_REF](GNC) sur les véhicules, des véhicules munis d'organes spéciaux d'un type homologué pour l'alimentation du moteur au gaz naturel comprimé (GNC) en ce qui concerne l'installation de ces organes[END_REF], recent CNG buses tank bursts in Europe have highlighted potential deficiencies in the present fire safety concept.

Therefore, we will concentrate in this article on CNG bus fire safety issues. After introducing the CNG bus fire safety topic, we will study recent CNG bus fires in France and Germany and will extract "lessons to be learned" for CNG and other compressed fuels such as hydrogen.

CNG BUS FIRE SAFETY STRATEGY

Fire onboard buses may be caused by internal or external factors. Internal factors include events such as electrical short circuits, excessive temperature of bus components including the braking system, the turbocompressor, the exhaust pipe... in combination with combustible materials including polymeric materials, oil, dust and debris... . Experience shows that fires usually start in the engine compartment [START_REF] Bonduelle | Rapport d'enquête technique sur les incendies d'autobus fonctionnant au GNV notamment les incendies survenus en août 2005à Montbéliard et à Nancy[END_REF].

As far as external causes are concerned we can mention human error during maintenance (use of open flames...), vandalism and propagating fires from nearby vehicles or infrastructure.

The most unwanted event in case of CNG bus fire is the burst of one or more of the compressed storage tanks located on the roof of the vehicle. Tank burst is definitely not a tolerable option having in mind the tremendous amount of mechanical and chemical energy released in the course of this event.

The current safety strategy to prevent tank burst consists in fitting pressurised tanks with devices that release stored compressed natural gas as they fuse under the effect of temperature rise (fire). The melting temperature of these fuses is about 110°C. In practical terms, to prevent tank burst, internal tank pressure has to decay before the fire degrades the mechanical strength of the compressed storage. Experience shows that unprotected tank (inhibited pressure relief devices) can not survive a standard bonfire test for more than few minutes [START_REF] Chaineaux | Security of highly pressurised tanks equipping GH2 fuelled road vehicles[END_REF] & [START_REF]Analysis of induced catastrophic failure of a 5000 PSIG Type IV hydrogen cylinder[END_REF]. The main cause for a tank to burst is the decay of its mechanical strength and rise in internal pressure.

Therefore, pressure relief devices (PRD) should be capable of depressurising a tank within a couple of minutes. According to experience, bus tanks can be exposed to fire for about 20 to 30 minutes which is an average time frame for a bus to be burnt out 2 .

Isolated compressed tank or tank systems are submitted to standardised bonfire test (component-level test according to UN ECE R110, test A15 [START_REF](GNC) sur les véhicules, des véhicules munis d'organes spéciaux d'un type homologué pour l'alimentation du moteur au gaz naturel comprimé (GNC) en ce qui concerne l'installation de ces organes[END_REF]) to certify that they work in accordance with this fire safety strategy.

Though tank burst is not supposed to happen, recent CNG buses tank bursts in Europe have highlighted potential deficiencies in the existing fire safety concept.

PRESSURISED TANK BURST

Large quantity of mechanical and chemical energy are stored in compressed combustible gas storage. Sudden release of this energy in case of tank burst may cause some severe damage to the bus environment.

When a tank bursts, observation shows [START_REF] Chaineaux | Security of highly pressurised tanks equipping GH2 fuelled road vehicles[END_REF] two consecutive pressure wave propagating in the surrounding environment. The first one which is also the more severe is associated with the pneumatic rupture (gas expansion) whereas the second is caused by the combustion of the released combustible gas into the air (fire ball). It is therefore to be noticed that although the chemical energy stored is usually an order of magnitude larger than the mechanical energy, the sudden release of the mechanical energy induces greater overpressure effects.

Theoretically, the pneumatic burst of a 130 L tank at a pressure of 200 bar releases an energy equivalent to the detonation of about 1.85 kg of TNT (8.7 MJ). Windows can be broken within a 30 meters radius (50 mbar) and pressure wave induced lethality is to be foreseen within a radius of 12 meters (140 mbar). These calculations can worsen due to pressure wave reflection and pressure build up as well as to directional energy release (axial direction) due to the rupture mode of the cylindrical tank. Moreover, projectiles can also cause severe damages within a radius much larger than the one estimated above for overpressure effects. [START_REF]Analysis of induced catastrophic failure of a 5000 PSIG Type IV hydrogen cylinder[END_REF] shows that fragments of up to 14 kg (type IV tank filled with hydrogen at 350 bar, test conducted in open atmosphere / projectiles not hindered by bus equipment) have travelled a distance of 82 m from tank fire location. The mechanical energy released as the tank ruptured was equivalent to about 1.35 kg of TNT (6.3 MJ).

Therefore, an unacceptable event such as a tank burst induces a significant damage radius (missiles and overpressure) that goes far beyond the bus geometry. This makes a major difference with conventional liquidfuel-buses with damage radius in case of fire limited to the bus itself (unless the fire propagates). 1 There is no evidence so far of any mechanically induced rupture failures of tanks in CNG service worldwide. This scenario is however plausible.

It takes about 10 to 15 minutes for a bus to be fully involved in fire.

The tank may be subject to fire aggression in various ways:

• engulfing fire as combustible materials in the vicinity of the tank are burning,

• localised fire aggression (at one end of the tank) as combustible materials in the vicinity of the tank are burning,

• and finally impinging jet flame fed with high pressure natural gas.

Experience shows that fire protected tanks may not survive some of the aggressions above indicating that PRD efficiency is limited. This limitation should be acknowledged.

Indeed [START_REF] Chaineaux | Security of highly pressurised tanks equipping GH2 fuelled road vehicles[END_REF] has shown that protected tanks can not survive an impinging jet flame and will fail within a couple of minutes. As far as localised thermal aggressions are concerned we could expect thermal fuses not to be triggered and the tank to fail depending on the distance between local flames and the PRD. Finally, the less severe case for protected tank integrity which consists in engulfing flame is basically what PRD are useful for. This test is part of the certifying process of protected tanks as mentioned before.

RECENT TANK BURST ON OPERATED CNG BUSES

We can mention three CNG bus fire accidents in Europe where one of the tank did burst. The table below summarises the three cases.

CNG articulated buses. Each articulated bus was fitted with 10 CNG type III PRD protected tanks of 172 L each and filled with natural gas at a pressure of 200 bar. On-site first responders tried to put out the fire without success and then called the local fire brigade that arrived on the scene at 3:09 pm.

The fire propagated from the back of the first bus to another articulated bus parked in a row at 1.5 meters behind. At 3:09 pm the fire is well developed inside the depot and violent explosions occur. These explosions are caused by the release through actuated PRDs, mixing and later combustion of natural gas inside the depot. Both buses have been burnt out whereas the other ones have been extracted from the depot before they caught fire. The first bus burnt from the back to the front. The second bus burnt the opposite way. The fire started on a CNG articulated bus in the engine compartment (back of the bus). When the fire took off at 3:00 pm, the bus was parked in a depot along with other It went a different way for one of the tanks mounted on the second bus whereas the fire was "under control".

The tank burst about 15 minutes after the fire started. A large tank fragment was propelled in the tank axial direction. It broke through a nearby wall (hole at 3 meters from ground level) flew through the air and damaged another wall located 25 meters further and ended up its journey on the roof of a bus parked in a nearby depot. The tank that burst was the first in the row when looking at the bus from the front (tank n°1). The fire was put out at 4:30 pm. Nobody was injured.

Figure 4: Destroyed bus with red arrows pointing (from right to left), tank n°3, hanging tank n°2 and hole through which tank n°1 flew (from [START_REF] Demke | Brande von Erdgasbussen, Grossbrand in Saarbriicken[END_REF])

z '

Figure 5: Remains of tank n°1 after it landed (from [START_REF] Demke | Brande von Erdgasbussen, Grossbrand in Saarbriicken[END_REF])

One should notice that tanks were isolated one from the other. The emptying of one tank through its PRDs did not cause adjacent tanks' pressure to decay.

Investigation lead to the following explanations. Tank n°1 burst for two concomitant reasons:

• on one hand it suffered a local fire stress when a fire-induced short-circuit triggered the opening of a roof door mounted nearby tank n°1 (Picture 6). Flame broke through this opening and heated up tank n°1 in its middle part,

• on the other hand, PRDs mounted on tank n°1 did fail to open, hence preventing the tank from depressurising. Investigation concluded that failure to open was caused by an insufficient heat up of the PRDs that did not melt completely. The protective cover mounted on the top of tanks contributed to prevent sufficient heat to reach the PRDs. Picture shows that the metal fuse did not have time to melt completely (from [START_REF] Demke | Brande von Erdgasbussen, Grossbrand in Saarbriicken[END_REF])

Learnings

This accident confirmed that boss mounted PRD on both side of a bus tank is not an ultimate protection if pressurised tanks are exposed to localised fire (sunroof or any other opening underneath or nearby the tanks): PRD may fail to work in time.

In that case PRDs did not fail because they froze 3 but because flames heat did not reach them fast enough. Therefore, a tank system that survives a bonfire test may not survive in a real life situation, similarly a fuse that works correctly in test condition may operate differently in real life conditions. Indeed, as the bonfire test only focuses on the tank system and does not consider the entire vehicle, it misses synergetic effects induced by the association of tank system and the vehicle. This remark underlines that tank fire protection and bus fire safety can not rely only on the performance of isolated protected tank systems.

Further developments of the current "bonfire test" are necessary in order to consider the entire vehicle as suggested also by [START_REF] Stephenson | Fire Safety of hydrogen-fueled vehicles: system-level bonfire test[END_REF] & [START_REF] Stephenson | System-Level Design and Verification Concepts for Hydrogen-fueled Vehicles: Fireworthiness[END_REF]. Besides, any opening underneath or nearby the tank must be avoided (or be sealed and fire resistant). Finally, PRD performance and potential failures should be further investigated including PRD freezing has also been observed in the past. It is known to be the consequence of a competing effect between the heat from the fire and the cooling down from expanding gas. appropriate location that does not shield them from heat or allow them to freeze. As far as freezing is concerned, new PRDs exist with fuse made of glass-cylinders containing expanding liquids. Glass brakes up at 110°C and completely free the release orifice with no possibility of PRD reclosure.

THE MONTBÉLIARD ACCIDENT: DESCRIPTION AND LEARNING Description

A 12 meter CNG bus was in daily commercial service on the 1 st of August 2005. This bus was equipped with nine 126 L, 200 bar working pressure type IV CNG tanks. Each of the nine tanks was fitted with one thermal fuse located alternatively on the right or on the left side of the bus. There were two other thermal fuses located respectively ahead and behind the tank system. These two fuses are supposed to open before the fire reaches the tank system (from the front or the rear of the bus).

One single valve isolates the entire tank system from downstream components which means that when the valve is closed the tanks remained connected one to the others. The only way to isolate one tank from the others is to shut down its manual valve. Gas release deviators pointing upwards are mounted on the PRDs outlet in order to discharge CNG in the upward direction.

Bended pipes at PRD outlet to release CNG upward (even tanks)

PRD upstream from manual valves (odd tanks)

Roof opening

Figure 8: Top view of a CNG bus of a similar type to the one that caught fire (tank cover has been removed for taking the picture)

CNG tanks were full as the bus was just starting its working day. At 06:15 am, the driver saw an alarm signal on the dashboard indicating "no battery charging". He then called his central office that suggested to turn off the engine in order to reset the electronics. He tried but did not succeed to switch off the engine and finally drove away as suggested by the central office. Few kilometres later, as the bus was leaving the city center, the driver witnessed an abnormal heavy smoke rising from left side of the motor room and smelled something burning. He stopped the bus at the village exit and evacuated the 3 passengers. He then tried to put off the fire with the onboard extinguisher by injecting the chemical agent through the motor room ventilation grids (as prescribed). He did not succeed to put off the fire. As the fire rapidly propagated, he called the fire brigade at 6:27 am. Then, the driver saw the PRDs opening progressively from the rear to the front of the bus as the fire was propagating.

By the time the fire brigade arrived at 6:40 am, the fire had propagated to the entire bus. Firemen rapidly set a safety perimeter. As they arrived on the scene, they witnessed jet flames pointing upwards (about 5 meters high and more) and a shorter one pointing horizontally. These jet flames were fed by PRDs releases.

Firemen stood at a safe distance in front of the bus and tried to cool down the tank system with water spray. 10 minutes later at 6:51 am, the front cylinder exploded causing slight and directional damages to the environment within a distance of 100 m. Damages were caused by tank debris (tank n°1 damaged the roof of an adjacent house after a 30 m fly) and overpressure (poster frame unhooked and damaged sliding shutters 60 m away from explosion). As it burst, tank n°1 also propelled the adjacent tank to the other side of the road (10 m away). The tank n°1 ruptured in large pieces whereas carbon fiber could be found as far as 150 m away. Tank n°1 valve and associated fuse have not been found after the accident. Bursting noise could be heard at a 5 km distance. Firemen did not report any noticeable fireball though they felt a transient heat.

Nobody was injured. Investigation took place and some realistic explanations can be put forward:

1. Excessive depressurisation time or no depressurisation at all for tank n°1 : PRDs which were mounted on the bus were not of a fast release type since they were fitted with a 1.5 mm flow limiter orifice in order to comply with an ancient French draft regulation dated from 1996 (before ECE R110 took over) that required emptying time to be comprised between 25 to 35 minutes. This surprising timeframe which is not compatible with bus fire kinetics was deemed to mitigate gas releases through PRDs in confined spaces like tunnels or parking structures, Since tanks are not isolated one from the others the pressure drops evenly in the entire tank system. However, if one tank is manually isolated from the others, its internal pressure will not drop unless its sole thermal fuse is actuated (single thermal fuse located upstream from manual valve for odd tanks like tank n°1 and located on the bottom boss of the tank for even tanks). The tank n°1 manual valve may have been voluntarily shut off in order to use its gas content as a back up.

Localised thermal aggression that caused tank mechanical strength to weaken and tank to burst:

The fire broke through the roof opening located 20 cm ahead of tank n°1 and caused a severe localised thermal stress in the middle part of tankn°1,

A horizontal jet flame may have come from tank n°2 PRD release and also caused a severe localised thermal stress to the bottom of tank n°1. This abnormal horizontal jet flame is a possibility since on one hand firemen witnessed horizontal jet flames and on the other hand PRD outlet deviators (on even tanks) have been found pointing horizontally when investigating bus remains. Deviators may have collapsed during the fire or some times before due to vibrations or other operational constraints.

As for the fire cause, experts concluded that it was an electrical failure of the alternator system located on the left side of the engine room.

Out of the 11 PRDs mounted directly on tanks, 3 have been lost during the accident: the one mounted ahead of tank n°1, the one mounted on tank n°1 (plus its manual valve) as well as the thermal fuse of tank n°2. It is therefore not possible to conclude on any failure of these thermal fuses 4 such as:

• Insufficient heat up of PRDs to melt the fuse (like in Saarbriicken), • Freezing of PRDs, • misuse of manual valve n°1, • or any failure of the deviator mounted on tank n°2.

Learnings

Some learnings are common with the German case and some others are specific. First of all, it is advisable to avoid roof openings unless they can offer a fire resistance at least equivalent to that of the roof as well as any design that may cause tanks to suffer from localised thermal stress in a fire scenario.

Then, it is advisable that tank complete emptying take place within few minutes after the PRD opened. In that case, detailed study should be undertaken for accidental release of natural gas inside confined spaces like tunnel or parking structures as explosion may occur.

Thermal fuses were of the same type as those involved in the Saarbrucken accident.

The PRD outlet must be so designed that the fire jet can only point upward and can not in any circumstances impinge a nearby tank.

Finally, both accidents have shown that first responders did not manage to put out the fire. This may suggest that early response fire fighting means or procedures are not appropriate for an efficient action. However, heavy fire fighting capacities will never be available within the first couple of minutes. Automatic or manually actuated fire suppression systems located in the engine compartment should therefore be envisaged in order to effectively control fire development. Automated or manually actuated fire suppression systems in the engine room where fires are most likely to start are of a primary relevance for CNG buses. These systems may be highly relevant having in mind that somehow vulnerable compressed gas cylinders are mounted on the bus roof in a design that severely expose tank cylinders to the fire.

THE BORDEAUX ACCIDENT: SHORT DESCRIPTION AND LEARNING

The bus concerned by this later accident is exactly of the same type as the one we have just presented in the Montbeliard case though accidental circumstances are different. On the 8th of November 2005, at 6:50 pm, vandals deliberately threw a Molotov cocktail inside the passenger compartment at the rear of the bus. At that time the remaining pressure inside the storage system was estimated between 100 and 70 bar. Witnesses reported that the fire propagated rapidly and soon broke through the roof panel mounted 20 cm ahead of tank n°1. Tank n°1 burst within 10 minutes after fire broke out and before the fire brigade arrived. Horizontal jet flames were also witnessed meaning that PRD release deviators did also collapsed. Finally, firemen reported various moderate deflagrations. Damages were limited and nobody was injured as a result of this accident.

-Figure 13: View of the bus after the fire (courtesy bus manufacturer)

Figure 14: View of tank n°1 that exploded (one half)

Figure 15: View of the bus from the inside (tank n°2)

Figure 16: View of the bus from the inside (tank n°2)

Learnings from the Montbéliard and Saarbrucken cases also fully apply to this one. However, we can also, in that specific case, underline the vulnerability of buses when submitted to vandalism as fire propagates very rapidly: tank n°1 exploded before the fire brigade arrived. A fire suppression system located in the engine room as suggested above would have been of no use in this specific case. Therefore, additional fire safety measures should be thought of as discussed in the next paragraph.

PROPOSED REVISIONS OF FIRE SAFETY STRATEGY FOR CNG BUSES

Up to now, fire safety and associated tank burst control measures as suggested in ECE R110 concentrate on tank system protection using PRDs. This strategy necessitates PRDs to be both highly reliable and to be efficient in various types of compressed tank fire stresses whether homogeneous or localised. Though none of the bus presented above were ECE R110 compliant (they were put in service before ECE R110 was promulgated), experience discussed in that article has proven the safety strategy that consists in focussing on tank systems not to be always appropriate. Fire safety for CNG buses should rely on more sensible principles as those applied on a usual basis whenever managing risk i.e. prevent, limit and mitigate consequences.

Therefore, the following measures should be technically investigated:

• In parallel, we would expect a fire protected tank with inhibited PRD to be able to withstand fire exposure for at least 15 minutes in order to give sufficient time for firemen to arrive on the accident scene and to set up a safety perimeter.

This type of test should also be standardised as a complementary test to the bonfire test with PRD protected tanks that rather investigates the effectiveness of the PRD to prevent tanks from bursting rather than the tank itself. Limitation of the current bonfire test are well described in [START_REF] Stephenson | Fire Safety of hydrogen-fueled vehicles: system-level bonfire test[END_REF] & [START_REF] Stephenson | System-Level Design and Verification Concepts for Hydrogen-fueled Vehicles: Fireworthiness[END_REF].

On a more general basis, component-level tests as prescribed by ECE R110 though useful are not sufficient as they may miss synergetic effects between the bus and the tank system. A system-level fire strategy is highly advisable to prevent any more tank from bursting. Therefore, in combination with proposed measures, a complementary system-level bonfire test is also highly advisable in order to evaluate the safe behaviour of a CNG bus when submitted to a engine room or passenger compartment fire.

TODAY CNG BUSES AND TOMORROW... CH2 BUSES

Lessons learned from CNG buses are entirely applicable to future compressed (CH 2 ) hydrogen buses since storage technology is similar though storage pressure is significantly higher (350 bar for CH 2 buses). As innovative technologies, we would hope that inherently safe fire safety principles will be incorporated into their design.

EC has recently submitted a draft regulation for hydrogen vehicles. This component-level based regulation based on a draft UN ECE document was open for suggestions. HySafe partners made the comment that a system-level based document with performance requirements on the system configuration would be more appropriate.

Finally, fire safety strategy on buses might not be appropriate for cars. Indeed, whereas a PRD release might be acceptable for buses because it takes place at a safe height and because city buses are not likely to roll over, it may not be the same for cars.

CONCLUSION

The use of CNG in bus and private vehicles is growing steadily. Recent fire accidents involving CNG buses have shown that tanks may in some explode. Such a repeated scenario is certainly not acceptable having in mind the tremendous amount of energy released when a compressed tank bursts. Though none of the bus mentioned in this article was ECE R110 compliant, this article highlighted, potential improvements in current CNG buses fire safety concepts. Among others, it includes to rely on a system-level test and expectations in combination with the current component-level test. Fire safety should not solely rely on tank behaviour when exposed to fire but also to additional and upstream fire safety barriers. Thermal fuses can not be seen any more as an ultimate option to control tank burst in case of fire though "well" located.

Reported cases did not cause any injury or severe damages. It would be a pity not to learn from these lucky cases rather than wait for something unacceptable to happen.

International regulations like UN ECE may also be accompanied with international accident reporting scheme in order to improve regulations content over time.

Figure 1 :

 1 Figure 1: CNG vehicles number and distribution in Europe in 2005 (from European Natural Gas Véhicule Association)

Figure 2 :

 2 Figure2: Side picture of a bus similar the ones that burned (from[START_REF] Demke | Brande von Erdgasbussen, Grossbrand in Saarbriicken[END_REF])

Figure 6 :Figure 7 :

 67 Figure 6: Roof opening ahead of tank n°1 (from [6])

Figure 9 :Figure 10 :Figure 11 :Figure 12 :

 9101112 Figure 9: Side view of the bus with tank n°3 hanging (Courtesy SDIS 25)

Table 1 :

 1 Summary of the three studied bus fire accidents

	each

Figure 3: View of the fire once it was under control

(from

[START_REF] Demke | Brande von Erdgasbussen, Grossbrand in Saarbriicken[END_REF]

)

19 of the 20 CNG tanks exposed to the fire did behave as expected. The stored gas was released through PRDs hence preventing tanks from exploding. Each tank was fit with two boss mounted PRDs (one on

ACKNOWLEDGMENTS

The authors would like to thank the following people who did provide explanations and pictures that greatly contribute to this paper:

Monsieur Miermont (Gaz de France)


Bruno Debray
email: bruno.debray@ineris.fr

Amjad Abou

Isabelle Pradaud

Jacques Vaudelin

Dominique Lenne

KNOWLEDGE MANAGEMENT FOR INDUSTRIAL SAFETY, GENERIC RESOURCE PLATFORM COMBINED WITH AN ONTOLOGY BASED APPROACH

Keywords: safety, knowledge management, risk analysis, information system, ontology

The capacity to manage risks and maintain industrial safety is largely based on the capacity of various actors to acquire, maintain and share knowledge on a large variety of subjects. The actors are, of course, the plant operator but also the employees, the competent authorities, the external maintenance teams or internal or external experts in charge of risk assessment and design of risk management. The knowledge ranges from the regulatory framework to the details of a machine or a process but also includes the general knowledge about industrial safety, the hazardous phenomena, the properties of the substances. Part of this knowledge is also largely tacit. It lies in the brain of the scientific experts or the employees who are able to make the connection between apparently disconnected pieces of knowledge. Detecting, extracting, maintaining and communicating this knowledge are typical knowledge management activities. This is the reason why INERIS has initiated a research program dedicated to knowledge management with several initial outcomes that will be presented in this paper together with the general objectives of the program and the perspectives for the coming years.

The first part of the paper is dedicated to a recall of the knowledge management principles based mainly on the typology of knowledge introduced by Nonaka. It is put in relation with the typology of knowledge used in safety management activities. Two examples of knowledge management systems are presented and related to the typology of knowledge previously described. In both cases, the added value resides in the capacity to establish relations between different knowledge elements. This is partly realised by documents indexing and the use of efficient information retrieval tools. The development of an ontology of industrial safety contributes to achieving these goals. It constitutes a reference for indexing and will offer a structure for future developments of semantic web-based tools. Such an ontology is presently under development. Its use to improve the indexing and information retrieval in the knowledge management systems is illustrated.

INTRODUCTION

Human factor is the cause of up to 80% of industrial accidents [START_REF] Cacciabue | Human factors impact on risks analysis of complex systems[END_REF]. In a recent paper Z. Nivolianitou [START_REF] Nivolianitou | Statistical analysis of major accidents in petrochemical industry notified to the major accident reporting system (MARS)[END_REF] analysed the full accident reports in the MARS database and showed that after examination, many causes initially classified as equipment failure were actually due to organisational factors. An examination of accident reports and recommendations in the accident databases shows that in many cases the organisational deficiencies can be formulated in terms of lack of knowledge. A frequent conclusion is that there is a lack of training of operators, but often, it is a more general lack of knowledge of risks or safety issues associated with equipment or substances that caused an insufficient control of the situation. This lack of knowledge is, for example, the lack of preliminary knowledge that would have led to a risk analysis, the lack of risk analysis itself, the lack of communication of safety critical information, the lack of application of hazard lessons learned from similar activities. In her conclusions concerning the petrochemical industry, Z. Nivolianitou considers that there is a lack of proper safety culture to enable effective use of available knowledge for the prevention of major accidents and that there is a lack of a structured communication system to diffuse this knowledge. This conclusion is used to stress the need of a major accident reporting system to collect and diffuse the knowledge on industrial accidents. However it can also be extended to the need of a more general knowledge management system dedicated to managing the knowledge necessary to deal with industrial risks. This paper is dedicated to presenting some elements of such a system. It introduces the basis of knowledge management, explores the variety of knowledge involved in safety management situations and presents a first structure of a KM system. It then deals with the potential applications of ontologies to improve the KM activities.

WHAT IS KNOWLEDGE MANAGEMENT?

Knowledge Management (KM) refers to a range of practices used by organisations to identify, create, represent, and distribute knowledge for reuse, awareness and learning across the organisation 1 .

MANAGING TACIT AND EXPLICIT KNOWLEDGE

The knowledge can be divided into two main categories: the explicit knowledge and the tacit knowledge [START_REF] Nonaka | Dynamic theory of Organizational Knowledge Creation[END_REF]]. Explicit knowledge is the knowledge that is conscious and can be documented. Tacit knowledge is the knowledge that resides in the people's mind in a more or less formalised form, most of the time unconsciously. Nonaka identifies the various operations that can be undertaken on knowledge. Transforming the tacit knowledge into explicit knowledge is often called formalisation or externalisation. Making explicit knowledge accessible to people who may benefit from it is diffusion. Making the explicit knowledge turn into tacit knowledge of actors who will then be able to use it is internalisation. A complete knowledge management system should be able to perform all these tasks. It should also be able to deal with generic and specific knowledge.

GENERIC VERSUS SPECIFIC KNOWLEDGE

Beside the traditional tacit versus explicit classification of knowledge the distinction between generic and specific knowledge is essential. Generic knowledge corresponds to the general concepts. Specific corresponds to the instances of these concepts in a given context. Competence is the ability to use generic knowledge in a specific context. Many situations illustrate this need to possess generic knowledge that will be used to extract and interpret specific information or knowledge. Among them, risk analysis is the most emblematic. On the other hand, learning from experience, and especially from past accidents obeys to the opposite process. It is specific knowledge that is used to produce generic information that will be used in other context to interpret specific data.

However, there is a large variety of knowledge management system structures and processes answering to a large variety of needs. Designing a KM system requires following a series of steps that will be described in the next paragraphs.

KNOWLEDGE MANAGEMENT ISSUES IN RELATION WITH INDUSTRIAL SAFETY

The issue of the application of knowledge management to industrial safety is not new. The need for a safety related knowledge management strategy was already stressed in 1996 by F. Lees who wrote "knowledge of its processes and plants is one of the prime assets of a company, but the management of this asset often appears to be relatively neglected". Yet, it seems that the link between knowledge management and industrial safety has not been intensively dealt with by researchers in the last decade except for the implementation and exploitation of a learning from accidents system. In the meantime however, knowledge management has become an issue in many companies.

Different factors contribute to the development of knowledge management. Companies are facing an ever more complex world because of the evolution of technologies. They have to react quickly to keep their rank in the economic competition. They must be able to capitalise former experience. At the same time they are facing new threats such as the retirement of generations of experienced workers, the transformations due to fusion and reorganisations of entire economic sectors. All these evolutions are seen as having a potential impact on the economic capacity of the companies. They also can have an impact on safety. Authors such as Rassmussen, Svendung or Leveson have considered the accidents in the light of the socio-technical model of system operation. In such an approach, the information subsystem plays an important role in the development of accidents. Knowledge management at various organisational levels is thus a key among the others to improve safety of industrial activities.

SPECIFYING AND IMPLEMENTING A KNOWLEDGE MANAGEMENT SYSTEM

A first approach of the design of a knowledge management system is user-centred. It focuses on the future users of the system, their needs and the way they will use the system. The users are not only the beneficiary of the formalised knowledge but also the actors owning a tacit or explicit knowledge that will be used as input to the system. The following questions are thus in the heart of the design process:

Who will be the users? Which are the various user types? What are their characteristics and behaviours? What are their goals and tasks? In which situations and contexts will they operate the system? What types of knowledge is going to be processed by the system? What are the tools and organisation already existing? What is the life cycle of knowledge in the organisation, how is it validated, when and how does it become obsolete?

The users of a safety related Knowledge Management system could be all the actors involved in the industrial safety management at the various stages of an industrial plant: design, building, operation, maintenance, shutdown, decommissioning. Those actors are, authorities, process experts, risk experts, plant designers, plant builders, plant operators, plant workers, plant management staff, contractors. Their needs are different but they all interact with common knowledge elements and should be able to share common representations, to be aware of risks associated with given substances or equipment and to take sound decisions within the organisation.

Examples of knowledge associated with safety of hazardous equipment are given in [START_REF] Wintle | Plant ageing, Management of equipment containing hazardous fluids or pressure, Health and Safety Executive[END_REF] where the key competencies required to manage equipment containing hazardous and/or pressurised fluids are listed. This knowledge ranges from very general competencies such as education and training in technical and mechanical engineering or teamwork skills and understanding the roles of others to very specific knowledge such as familiarity with the equipment concerned, together with the detail of the design and materials of construction, and the operation and maintenance requirements or understanding of the relevant regulatory requirements and any approved code of practice and guidance for the equipment.

This list illustrates the large variety of knowledge involved in safety related processes and the difficulty of setting up a knowledge management system dedicated to safety aspects. In fact an ideal knowledge management system should be able to deal with information, i.e. explicit formalised knowledge, skills, which can be considered as tacit knowledge, and competence which is the ability to operate explicit and tacit knowledge in a given context. Safety culture should also be in the heart of a reflection on safety related knowledge management. Safety culture is the capacity to interpret information and give it a sense in terms of safety. In addition, it is the understanding of safety concepts, safety operations and rules.

TOWARDS THE DEFINITION OF SAFETY CRITICAL KNOWLEDGE

Given this general context, our objective is to define and set up a knowledge management system that would enable the industry to better manage its safety critical knowledge. This objective imposes to define the Safety Critical Knowledge (SCK). In a first approach it could be defined as the knowledge necessary to design, build, operate, maintain and shutdown a system in safe conditions. SCK is the knowledge that can, if it fails, lead to an accident or an increase of the accident probability. It includes the knowledge necessary to operate the safety barriers and the emergency procedures. It is also the contextual knowledge necessary to understand the safety management context and proceed to the risk communication operations.

SCK can be identified in various situations at different stages in the life cycle of the plant:

Design: The SCK is, for example, the knowledge necessary to identify potential risks of the future plant and design the process, storage and other plant equipment to inherently reduce the risk. It is also the knowledge necessary to design the safety devices and procedures. Several authors have dealt with the safety critical knowledge management in the design phase (refs).

Building: The SCK is, for example, the knowledge that will ensure that building procedures and building codes are understood and respected and that the plant will be built to operate safely.

Operation: During operation of a hazardous plant, the SCK is the knowledge that will ensure that the plant is operated safely: understanding of the signs, procedures, rules, information on the process but also of the safety devices and procedures that are used to control potential accident scenarios.

Maintenance: There are many examples of wrong operations done in maintenance that were responsible of major accidents. In many cases, the knowledge of the maintenance team was not suitable to interpret the potential consequences of the choices made during the maintenance operation. On the other hand, risk-based maintenance is developing as a means to optimise the maintenance process. Risk-based maintenance relies on the active processing of knowledge on the installation and its equipment, including the use of learning from accidents or incidents.

Decommissioning: Decommissioning is also a critical phase of a plant life. During this phase, operators are faced with aspects of the plant that they didn't have the opportunity to see during the operation. At this stage, generic knowledge and knowledge gained from learning from other's experience are essential.

SAFETY CRITICAL KNOWLEDGE AND SPECIFIC SAFETY MANAGEMENT ACTIVITIES

Within the general life cycle of an industrial plant, some activities have a specific role in the safety management process and are of special interest in terms of knowledge management because of their specific role in the knowledge identification and production process but also because they allow to stress some of the functions that are expected from a safety critical knowledge management system.

EMERGENCY PLANNING AND INTERVENTION

Emergency situations are clearly situations in which safety critical knowledge is mobilised. Emergency rescue teams must have an immediate access to all the information and more generally knowledge useful for understanding the accident and its potential consequences in order to design a safe and efficient intervention strategy. The peculiarity of these situations is the time constraint which prohibits the delivery of a noisy information and imposes that tacit knowledge and personal skills compensate the lack of information.

LEARNING FROM ACCIDENT Learning from accidents is typically a knowledge management activity. It can take various aspects: in depth analysis of accidents to set up improvements, accident databases describing accident scenarios, analysis of the emergency response of an organisation facing an accident. But exploiting the information contained in accident databases remains a difficult task because of the lack of efficient information retrieval tools. Knowledge management technologies exposed in the following paragraphs can also contribute to improving the learning from accident process. RISK ASSESSMENT: A KNOWLEDGE INTENSIVE TASK Risk analysis, and more generally risk assessment, is a knowledge formalisation process in the sense that it consists in extracting tacit knowledge from the participants of a risk analysis work group and turning it into explicit knowledge. Yet to do so, risk analysis also requires that the participants have quite an extensive explicit knowledge both at a specific and generic level. Figure 1 [START_REF] Salvi | A global view on ARAMIS, a risk assessment methodology for industries in the framework of the SEVESO II directive[END_REF] have also produced large amounts of risk analysis specific knowledge. A first issue is how to make this necessary knowledge available to the actors. This is partly the goal of a tool like PRIMARISK described below.

Another issue is how to insure that risk analysis results will remain useful and known by the safety management actors. Risk analysis is among the best way to produce SCK. Far too often, risk analysis remains under exploited once the decisions for which it was done have been taken. At best, it is read by operators or maintenance teams before new decisions are taken. At worst it ends up lost somewhere in the plant. However there should be a means to make risk analysis results easily available as a central piece of the safety management system.

AN EXAMPLE OF GENERIC KNOWLEDGE ACCESS TOOL: PRIMARISK

As described in figure 1, the risk expert uses a large variety of models and data associated to the various steps of risk assessment processes. To make these models, tools and data available to the risk assessment community, INERIS is presently developing the resource platform PRI-MARISKw [START_REF] Debray | Knowledge management and major industrial hazards: an integrated approach[END_REF]. It is available on INERIS web site since January 2007 2 . The next paragraphs describe the 2 Http://www.ineris.fr/primarisk main features of this web platform and present its basic structure in relation with the needs of potential users.

Specific risk assessment processes are defined by the legislation, standards or state of the art. At the end of its development, PRIMARISK will describe several risk assessment processes related to the main activity domains of INERIS. The first to be implemented in PRIMARISK is the safety report of a hazardous industrial plant as it is required by the transposition of the SEVESO II directive. It involves the following steps:

• Description of the plant; • Identification of the hazardous pieces of equipment; • Selection of the pertinent equipment; • Risk analysis; • Identification of the safety barriers; • Assessment of the consequences of accidents; • Definition of the safety control and requirements for the safety management system.

Each of these steps mobilises a specific knowledge. The description of the process is explicit but the understanding of which models, tools and data to use is more of a tacit type. The expertise lies in the ability to use the right model for a given hazardous situation. It lies also in the capacity to understand the results of the process. In PRIMARISKw , each steps is described in terms of objectives. The relevant legislative texts are given together with other reference text, when they exist. Then the tasks are listed. Each of them is described and linked with useful resources and knowledge elements that will ease the risk assessment.

The resources can be of three main types:

• Local resources: PRIMARISK lists the elements of information that the person in charge of the risk assessment has to obtain from the plant operator such as the maps or process instrumentation diagrams. • General resources: These are the resources available elsewhere that the user should consult to obtain useful information. Most of these resources are available online from INERIS or other web sites. Among these are databases, documentation, etc. • Specific resources available directly from PRIMARISK:

These are tools and databases that were developed specially for being made accessible through PRI-MARISK. For example, PRIMARSIK supports a series of computer models for the online calculation of effect distances of hazardous phenomena such as BLEVE, Boil-Over and pool fire. Other models are being developed and should constitute progressively a global tool kit for major industrial risk assessment.

Figure 2 shows the general structure of PRI-MARISKw. The core system was implemented on a database and establishes the link with classical web pages and more specific online software.

EXAMPLE OF A SPECIFIC KNOWLEDGE MANAGEMENT SYSTEM

Prior to PRIMARISK, which is dedicated mostly to external users, INERIS has set up an internal document management tool called GEIDE. It is the collection of all the documents produced by INERIS personnel. These are of very varied types ranging from reports to short notes or quality management procedures. The primary objective of this system was knowledge capitalisation, aiming at making any knowledge production by INERIS available to INERIS experts. GEIDE is thus a huge document database which uses a Verity K2 search engine. Queries can be formulated in natural language on the full text or on specific meta-data fields.

The difficulty both in PRIMARISK and GEIDE resides in the capacity of a user to formulate a precise query and in the number of documents that can be retrieved from one query. Depending on the quality of this query, the results can be either too scarce or too many. To improve the search efficiency, it is necessary to develop new search tools based on semantic technologies. This is done by developing an ontology of industrial safety and tools to exploit this ontology in PRIMARISK and GEIDE.

DEFINITION OF AN ONTOLOGY OF INDUSTRIAL SAFETY FOR THE IMPROVEMENT OF KNOWLEDGE RETRIEVAL

Ontologies are efficient structures used to formalise the knowledge of a specific domain. An ontology contains a set of concepts of the studied domain organised in a hierarchy of classes and sub-classes along with other relations between them. In practical terms, developing an ontology includes defining classes of concepts, arranging them into a taxonomic (subclass-superclass) hierarchy, defining properties and their facets (constraints). A knowledge base can then be created by defining individual instances of these classes filling in specific property value information and additional property restrictions.

Developing ontologies has many advantages mentioned by N. F. [START_REF] Noy | Ontology Development 101: A Guide to Creating Your First Ontology[END_REF] • Share a common understanding of the structure of information among people or software agents. • Enable reuse of domain knowledge.

• Make domain assumptions explicit.

BUILDING AN ONTOLOGY OF INDUSTRIAL SAFETY

Ontology tools were developed to extract terms from the documents present in PRIMARISK and existing glossaries. Experts were then asked to organise this knowledge into classes and subclasses, defining the properties of classes and their relations. Building the ontology was initiated using the Protégé 3.3 ontology editor and other tools developed specifically [START_REF] Assali | Construction et Utilisation d'une Ontologie pour la Recherche d'Information[END_REF]]. The process is described in Figure 3. A first version of the ontology was built and used as a test support for the elaboration of an information retrieval system described in Figure 4. The evolution of this ontology will continue in the coming years as a central knowledge formalisation process.

CURRENT USE OF THE ONTOLOGY

A simple ontology-based information retrieval system was developed to improve the search capabilities in PRI-MARISK and will be soon adapted to the GEIDE system. From a first input of the user, this tool proposes the list of concepts containing at least one of the entered words. The user chooses the concept that suits most his query. Then, a list of related close terms is proposed. A close term is defined as any term having a direct relationship with the initial term. This relation can be an is_a relation but also any other type of relation such as the produces relation described in Figure 5. For example, a user entering the keyword "ATEX explosion" will be proposed to refine his query by choosing among "gas explosion" and "dust explosion" but also "overpressure effect" and "thermal effect". This system allows at the same time for a better formulation of the query by the user and offers possibilities of refinement or enrichment of the results. Indeed the user has the choice to limit the search to the specific term of the ontology that best describes his search or to enlarge the results to all the documents linked to this term by a specific relation (close terms).

POTENTIAL USE IN THE FUTURE

This first application of the ontology can be compared with that of thesaurus and structured lists such as the one realised in the S-2-S project [START_REF] Nomen | Improving the knowledge in process safety through S2S, Safety and Reliability for Managing Risk[END_REF]. It is a first step. But the ontology can have many other applications. Its ability to represent a variety of relations between abstract concepts and concrete instances makes it a very powerful tool for information processing and knowledge management. The next step of the research project is the use of an ontology to represent plant specific knowledge (description of equipment, procedures, etc.) and to make the link between this Examples of such approaches for the taking into account of safety requirements in the design and maintenance activities are given by [Bragatto 2006, Ansaldi 2006]. This will constitute a first element of a safety critical knowledge management system. In the future, the ontology will also be used to structure the content of PRIMARISK and GEIDE so that this information can be better accessible and shared with other actors including other risk specialised institutes. Indeed an ontology is not only a set of concepts and relations but also a complete database structure in which the instances of concepts can be compared to database records. The same ontology will thus become the common tool for knowledge formalisation (defining the concepts and relations), information search and retrieval and database structure definition.

CONCLUSION

Through the description of the variety of knowledge involved in various activities and plant life cycle stages, this paper has underlined the critical role of knowledge in the safety management. The concept of Safety Critical Knowledge is introduced and the need for a Safety critical Knowledge management system are sketched. To answer some of these needs, INERIS has set up a knowledge access tools for external use (PRIMARISK) and an internal knowledge management system (GEIDE). It has also initiated the development of an ontology of industrial safety which will become a basis for knowledge formalisation (defining the concepts and relations), information retrieval and retrieval and database structure definition. This ontology proposes a representation of the main concepts of industrial safety and their relations. It is presently used to improve the document search in PRIMARISK and GEIDE but will soon provide the base for the definition of a more general Safety Critical Knowledge management system.

Figure 3 .

 3 Figure 2. General structure of PRIMARISK

Figure 4 .Figure 5 .

 45 Figure 4. Architecture of the search system in PRIMARISK exploiting the ontology structure

  describes the various types of

	Explicit Knowledge/ information	Tacit knowledge
	Hazard associated with substances Hazard associated with equipment Risk assessment methodology Regulatory requirements Risk analysis methodology Usual safety barriers Accident databases /learning from experience Plant description Process description Inventory of substances \L N. ^^. ^^. ocal safety rules ^v Management system ^Local requirements ^v Records of past events ^v Risk analysis process / ^^^ y yS ^^ ^^	Communication skills Imagination Knowledge of the physical principles Practical knowledge of risk analysis Knowledge of the equipment Experience of past events Knowledge of the actual organisation (who knows what, who does what)	Generic knowledge (Plant) Specific knowledge
	Explicit, plant specific knowledge (formalised in the RA documents)	Tacit (for the participants of the RA), plant specific knowledge
	Potential accident causes Potential accident consequences Risk level of the plant Specific safety barriers and rules Management requirements on safety barriers	Common vision of the plant and its risks Sharing of the models (component behaviour) Sharing of rules, values, procedures and of their utility for safety Safety critical tacit knowledge
	Safety critical explicit knowledge

Figure 1. Various types of knowledge involved in the risk analysis process knowledge involved in the risk analysis process. Projects such as ARAMIS

Definition from Wikipedia, example of a participatory knowledge management system.


Bruno Debray
email: bruno.debray@ineris.fr

Bastien Affeltranger

Gautier Vincent

INERIS Ruth Coutto

COMMUNITY RISK PROFILE: A TOOL TO ASSESS A VARIETY OF HAZARDS ON A TERRITORY

Communities are facing a large variety of risks that community leaders have the responsibility to manage and reduce in relation with numerous stakeholders and partners. Risk assessment is the first step of the risk management process and serves as a base for the risk reduction decisions that can have a strong impact on the territory. A detailed risk assessment is not an easy task and the decision to undertake such assessments should be based on a first simple estimate of the risk level. From a community point of view, it is also essential to be able to consider all the types of hazards to take coherent decisions and to characterise the relative contribution of each type of hazard to the global risk on the community.

It is to answer to these needs that the APELL program of UNEP has asked to INERIS to develop the community risk profile tool described in the present paper. The tool is based on a multidimensional definition of risk. Nine dimensions are considered and assessed for each of the hazard types. Risk is considered as a combination of the presence of a hazard source, the probability of the hazardous phenomena it can produce, and its intensity, the presence of vulnerable elements in the surroundings, their vulnerability, the existence of prevention and protection measures, the emergency preparedness and the resilience of the community.

The hazards considered are industrial accidents, transport of dangerous goods, flooding, volcanoes, earthquake, tsunami, landslide, forest fire, tornadoes and cyclones. For each of these hazardous phenomena, a questionnaire allows for the assessment of the nine dimensions of risk. For most of the dimensions, the assessment is based on a multicriteria approach with results expressed in a common scale ranging from 1 to 5, 1 being the most favourable situation and 5 the most unfavourable one. For some of the dimensions, namely intensity and probability, a quantitative scale can be used. The attempt was made to propose common scales, the definition of which is commented in this paper.

Examples of assessment criteria are given together with examples of the methodological difficulties encountered during this project. Some have been solved and the solutions proposed are described. Other difficulties remain open to contributions from the scientific communities but also from the stakeholders of the risk management process.

INTRODUCTION

Communities are facing various types of risks, which they have to assess and manage properly. These risks may be of a human origin: industrial risks or risks related to the transport of hazardous materials. They can also be of natural origin: floods, earthquakes, volcanoes, ground movements. Many decisions should take the risk into account. Those concerning the risk management itself, of course, but also decisions such as land use planning or industrial investment.

Assessing risk is not an easy task. It requires to perform in depth studies which are only justified if the risk level is expected to be high for this reason, there is a need for a risk assessment tool that would provide the user with an information about the necessity to further assess the risk by characterising an expectable risk level on the base of a mostly qualitative approach. Such a tool, a risk community profile, was developed by INERIS for and together with the UNEP APELL program.

RISK ASSESSMENT DIMENSIONS

The aim of the tool is to provide means for communities to assess roughly various types of risks and take appropriate decisions, notably to undertake further investigations, from this initial risk assessment. For this purpose, the definition of risk was voluntarily extended from the classical combination of probability and severity to a broader definition that includes reference to the vulnerability of the area, or emergency preparedness. The community risk profile can be used to assess the initial level of risk independently of existing mitigation measures. It can also be used to assess whether the existing measures are sufficient to cover the initial risk. In any case, a high risk level should induce in depth risk assessment. The risk assessment dimensions are divided into -hazard related dimensions: presence of hazard sources, frequency, intensity of hazardous phenomena; vulnerability related dimensions: presence of vulnerable elements within the effect area of the hazardous phenomena, vulnerability of the exposed elements and of the area, resilience of the area, risk control related dimensions: knowledge of risk (pre-existing risk assessment studies), prevention, protection, emergency preparedness.

It is important to note that we make here a clear distinction between hazard and risk. As there are many definitions of hazard in the literature, we should precise here the definition that we retained for the present work. We consider in the present paper that hazard is the combination of the likelihood and the intensity of a hazardous phenomenon. Risk is the combination of hazard and the vulnerability of the environment exposed to the potential hazardous phenomenon and of the control measures. This definition of risk is inspired by the definition proposed in the ARAMIS project [Salvi 2006]. The next paragraphs are dedicated to the description of the risk assessment dimensions or parameters. The scale in which they are expressed and the sub-parameters used for their assessment are particularly described. As several types of hazards were studied in the community risk profile, it was essential to propose a definition of risk which would fit all these hazard types and which could be assessed through a common approach. For some of the dimensions the nature of the phenomena makes the achievement of this goal not obvious. Tables 1 and2 summarise the definitions of the components of hazard and vulnerability. They are commented more deeply in the next sections.

COMMUNITY RISK PROFILE GRAPHICAL REPRESENTATION AND COMMON SCALE

The result of the assessment done with the community risk profile is composed of two parts: the community risk profile matrix (figure 1) where all the risk assessment dimensions marks are summarised and the community risk profile graphs (figure 2), which, for each specific risk provides a graphical representation of all the risk dimensions. To be able to set up both these tools, it was necessary to define scales. The choice was made to use a common scale fort all the risk assessment parameters. All the parameters are measured in a 1 to 5 scale with always the same orientation: 1 correspond to a favourable situation, 5 to an unfavourable one. In other words 1 corresponds to a low hazard, a low level of elements at risk or vulnerability, or a sufficient level of risk control. On the other hand a 5 means a high hazard, a high level of elements at risk an insufficient control of risk. The meaning of the scales is given by figure 3.

The figure 2 represents the community risk profile graph for a given type of hazard and its interpretation. The bigger the surface area of the community risk profile, the higher the risk and the necessity to take prevention and mitigation measures. The shape of the graph is also significant and attention should be given to the meaning of each area of the graph. The community risk profile can be divided into three main areas:

f f f f f f f f Global frequency Fc = f.Np Fc = f.Lr.Td Fc = f.Nr Fc = f Fc = f.Nv Fc = f Fc = f . NhI . D. VI Fc = f . NhI . D. VI Fc = f ndividual damage .D.V .D.V .D.V .D.Sc.V .D.V .D.Sc.V I.D.V I.D.V .D Global damage .D.V .D.V .D.V .D.Sc.V .D.V .D.Sc.V .D.V .D.V I.D
-The upper right part correspond to the characteristics of hazard, with presence, intensity and frequency of a dangerous phenomenon. -The lower part corresponds to the vulnerability of the community to the hazardous phenomenon -The last part, which covers the entire left half of the community risk profile corresponds to the risk control activities.

If the upper right part has a large surface, it means that the hazard is high. Yet, it doesn't necessary mean that the risk is high as if the lower right part is small, the elements at risk and vulnerability are low and thus the risk is low too. • Volcanoes,

• Rivers, as a potential source of floods,

• Slopes, where landslides can occur,

• Forest and vegetation susceptible to burn, giving rise to a wild fire, • Sea shore, where Tsunami can occur, • Earth as a potential source of earthquake, • Sky from where storms and, in particular tropical cyclones, can come from.

The assessment of the presence of hazard sources is thus apparently relatively simple. Yet it requires some care because hazard sources located outside the community may cause accidental effects within the community and therefore should be taken into account. Other difficulties might be raised by the decision to select a hazard source or not. For example as far as industrial risks accidents are concerned, the question is whether all industrial plants or rather only some activities should be considered. To help the user with this specific question, a guidance list is proposed based on the IAEA guidance report on safety assessment. When useful, for other types of hazards, additional questions help the user identify situations of hazard where the presence of hazard source is not obvious.

PRESENCE OF HAZARD SOURCES

When considering risk in a given geographical area, the first question to be asked is whether the community area bears a hazard source that would be susceptible to produce a hazardous phenomenon. For example, if no industry is present on the area or near its limits an industrial accident is not susceptible to occur. If the hazard source is not present, there is no use to assess the other dimensions. On the other hand, if one or several hazard sources are present, a risk analysis is necessary to estimate all the other dimensions of risk.

The hazard sources considered in the community risk profile are the following:

INTENSITY

If a hazard source is present, the intensity characterises the size of the potential event. As very different types of events are considered in this tool, it was important to define a common intensity scale that could be used to assess any kind of event. It was decided that there should be a direct relation between the intensity level and the damages for a given level of elements at risk and vulnerability. The common proposed intensity scale and the definition of intensity for each type of hazard correspond to this goal.

Many hazards have a point or linear origin and develop an intensity that is maximum at the origin and decreases regularly when moving away from the source. Beyond a certain level of intensity, that is above a certain distance, no effect is observed. However, the level of damage is not only related to the distance from the source but rather to the overall surface area of the impacted zone. The intensity level can then be characterised by the surface area where a given effect can be observed. For example a lethal effect. This is the definition of intensity that was chosen in the community risk profile for most of the hazard types, which have a punctual or linear source. For them, a common intensity scale was proposed (table 3). The limits between risk categories remains arbitrary and should be debated among stakeholders in the future.

For industrial risks, the tool provides an estimate of typical intensity levels for most hazardous industrial activities in terms of potentially affected surface area. This estimate is based on the IAEA Manual for the classification and prioritization of risks due to major accidents in process and related industries [IAEA 1996]. For other risks such as floods or forest fires the user is asked to estimate the potentially affected area. This information can be obtained from existing risk assessment studies or by identifying historical evidences of past events.

For the other types of risk, which have a non localised effect, the intensity level is usually characterised by an intensity indicator (wind speed for cyclones, earthquake intensity for seismic events) coherent with the most usual scales. The establishing of a correspondence between the intensity as a surface area and the intensity of non localised phenomena (cyclones, earthquake) was not easy and should be debated in the future.

Table 3. Common intensity scale

Intensity level

Corresponding surface area 1 2 3 4 5

Effect zone , 0,2ha 0,2ha , effect zone , 3ha 3ha , effect zone , 12ha 12ha , effect zone , 40ha 40ha , effect zone Table 1 lists the various types of hazard considered in the community risk profile, the definition of their intensity and the parameters used to estimate the expected frequency.

The definition of the intensity is not without raising questions. The first one is related with the meaning of a global intensity mark for a territory. Whether the intensity, and beyond the intensity the damage level, should be absolute or relative was a matter of debate. The choice could have been made to measure the intensity as the percentage of the total community area affected by the accident. This would have corresponded to a territorial vision of the damages and translated the idea that the impact of an accident on a given community is dependent on the global size of the community (reflecting somehow its wealth), small communities being more vulnerable to the accident than big ones. This is not what was retained in the community risk profile where it was considered that the same accident occurring in two different communities should have the same intensity.

Such an approach is coherent for industrial accidents and all the punctual hazard sources for which the intensity is independent from the size of the community. It also true for cyclones and earthquake. But it doesn't work for floods and tsunami whose intensity depend directly on the length of river or seashore crossing the community. When considering the damages caused by an accident, it turns out that, whereas they remain independent from the size of the community for punctual sources, it is not the case any more for earthquake and cyclone whose damages are directly linked to the size of the community, which conditions the number of exposed vulnerable elements. Table 2 summarises the various ways to calculate the intensity and frequency of an accident in the Community risk profile and illustrates the difficulty to adopt a unique definition for all types of hazard.

FREQUENCY

The hazard, as we defined it is the combination of the likelihood (expressed in terms of probability or expected frequency) of an hazardous phenomenon and its intensity. In the case of very rare events or events that can occur only once in a given place (for example the collapse of a cliff) the probability is assessed from indirect indicators. In the case of more frequent events, the frequency can be assessed from a historical approach. The frequency is the return period of a given event. From a past frequency, it is possible to extrapolate a future expected frequency if the conditions at the origin of the past event remain true in the future (which is seldom the case).

In the community risk profile, it was decided to express the likelihood of future dread events in terms of frequency. A common frequency scale was proposed for this purpose (table 4). Again this scale should be debated between stakeholders. It was meant to allow the comparison of risks with very different frequency ranges. For example, the typical frequencies of forest fire in fire-prone areas is closer to 1/10 years whereas other events such as major industrial As for the intensity, the estimation of the frequency raises questions because it may be dependent of the limits of the system studied and the reference scenario taken into account. For example, as far as the flooding risk is concerned, the use is to consider a reference flood associated with a reference return period: usually ten or hundred years. The frequency level is thus conventional and directly linked with the associated intensity. If there is only one flood source (one river) in the community, the frequency remains relatively independent from the size of the community. However, from the community point of view, the frequency of a flood is also dependent on the number of rivers in the community which is somehow dependent on the size of the community. In the same way, each industrial plant has its own accident frequency. When considering the community, the industrial accident frequency is proportional to the number of plants and is thus dependent on the size of the community. Frequency is therefore very dependent on the point of view adopted during the risk assessment. This is illustrated by table 2. It shows that the definition of the various risk parameters can vary from one type of risk to the other. The main differences reside in the intensive or extensive character of the dimensions. It stresses the fact that the reference system must be clearly defined prior to the assessment of the dimensions to avoid misunderstanding of the results, in terms of frequency or intensity. When the reference system is the community, the risk estimate is in a first approach the product of the risk generated by a single source by the number of hazard sources present in the community.

ELEMENTS AT RISK

The damage level depends on the number of vulnerable elements that can be hit by the hazardous phenomenon. An accident that would occur in a place where no vulnerable element (population, building, natural environment) is present would produce no damage at all. On the other hand, an accident occurring in a densely populated area will certainly produce a large number of fatalities if its Very high density area (Urban area, centre of city, very active commercial zone), very large number of vulnerable elements exposed intensity passes the lethal effect limit. An estimate of the elements at risk exposed to the effects of the accident is thus an essential aspect of the risk estimate. These elements are firstly the people: population, workers and users of the transportation system. But they can also be economic assets, such as industry or critical facilities. A typology of elements at risk is proposed. For each type, categories were defined, which are representative of the number elements at risk potentially exposed. For example, when considering the population, the area is characterised with the scale given in table 5. The community risk profile provides a list of questions to characterise the elements at risk. The final mark for the community is the maximum of all marks obtained for each type of element at risk.

VULNERABILITY

The vulnerability of a group of elements at risk characterises its capacity to resist or to undergo damages when submitted to a hazardous effect. For example, if a house has been reinforced, it may resist to a flash flooding. In the same way concrete houses may resist better to moderate overpressure than metallic structures. Vulnerability is thus a dimension of risk that has to be assessed. The reduction of vulnerability is among the measures that can be taken to reduce the risk. Two types of vulnerabilities were considered: the technical vulnerability, or capacity of a given set of elements to resist to an accident and the social and economic vulnerability of the community.

For each of these themes, the vulnerability can be characterised from qualitative questions into a scale varying from 1 to 5. For the moment, the vulnerability of the community is considered to be the maximum of the vulnerabilities in each aspect. Other choices could be made as, for example to consider the average of vulnerabilities or some type of linear combination.

PREVENTION (OF THE HAZARDOUS PHENOMENON)

For some of the hazardous phenomena, it is possible to apply a prevention strategy aiming at reducing the probability of the phenomenon. The preventive measures are, for example, possible in the industry where specific safety devices or organisational measures can prevent the occurrence of failures susceptible to lead to an accident. In the risk community profile, it is generally not possible to assess the actual specific preventive measures but rather to consider if general prevention strategies are applied. These refer, for example, to the existence of a legislation and its enforcement or to the existence of local monitoring and alert systems dedicated to the early warning and intervention before a major accident occurs.

In some risk assessment methods, safety barriers are assessed in terms of level of confidence and reliability which has a direct quantitative impact on the probability of the accidental scenario. In the case of the community risk profile, it was impossible to establish such a quantitative link. Thus the level of prevention is calculated on a very simple basis: 1 if all prevention measures identified as possible are in place, 5 if none. No connection is made between the prevention level and the frequency level even if it is obvious that both are strongly dependent. PROTECTION, MITIGATION Protection and mitigation have the effect of reducing the intensity of the hazardous phenomenon that reaches the vulnerable element exposed. For example a mitigation device can be a protection dike against flooding or a reinforced wall to resist a potential blast effect from an explosion.

Specific intervention plans are also covered in the mitigation theme as well as measures aiming at reducing the vulnerability or preventing that it increases. For example, measures such as land use restriction or construction rules and standards are among the mitigation measures.

As for prevention, it is not possible to establish a quantitative scale for protection measures. The assessment is cumulative, from 5 when no protection measure is in place to 1 when all the possible protection measures are present.

EMERGENCY PREPAREDNESS

The emergency preparedness covers all the technical and organisational measures that contribute to the efficient intervention in case of an emergency. The emergency preparedness is the core of the APELL program. The assessment of this dimension in the community risk profile tool is done through a questionnaire that was developed in the framework of the APELL program [START_REF] Apell | Awareness and Preparedness for Emergencies at Local Level: a Process for Responding to Technological Accidents[END_REF]].

The emergency preparedness is assessed globally for all the community and all the hazards. The assumption was that the same organisation should be involved in the emer-gency response to any of the hazards and that if its global organisation is good, it should benefit all the situations. However, in each specific risk assessment sheet, questions are asked in the protection section to assess the specificity of the emergency response for one given hazard type.

RESILIENCE

The resilience characterises the capacity of a person or a community to recover after an accident. This capacity is related with various characteristics of the community, which are not discussed in the present paper. Among them are the existence of a disaster recovery planning, the access to knowledge, the economic capacity of the community, the health system, the learning capacity of the system, the local cohesion and the technical capacity of the community.

CONCLUSIONS AND PERSPECTIVES

The community risk profile is an attempt to build a guided preliminary risk assessment tool for a large variety of natural and technological risks using a common set of dimensions expressed in common scales. It provides the user with the list of questions to ease the assessment of each of these dimensions.

This paper has stressed the difficulties associated with the setting of common definitions and scales for the nine dimensions of risk and the solutions proposed in the Community Risk Profile. These difficulties should not hinder the fact that the community risk profile should be a very useful tool for reflection and risk awareness raising among risk managers, decision makers and stakeholders.

A first version of the tool was experimented for training of community risk managers in Moroco and Sri-Lanka and proved to be at first an efficient teaching support. It is now under revision by the experts of the UNEP APELL program to assess its capacity to be used by risk managers all around the world. The goal is to publish the tool by mid 2007.

  of a hazardous event generated by one single source d = distance from the source L -length of hazard source in the community (road, river, sea shore) f -frequency of an event for one single hazard source Fc = frequency of the hazardous event at the community scale D = density of vulnerable elements V -vulnerability of the vulnerable elements Sc -surface area of the community Np, Nr, Nh, Nv = number of plants, rivers, hazardous spots, volcanoes

Figure 2 .

 2 Figure 1. Community risk profile matrix

Table 1 .

 1 Definition of intensity and parameters taken into account for the qualitative estimation of frequency

	Hazard	Source type	Intensity	Frequency
	Industry	Punctual	Surface area of the reference industrial	Directly related with the number of plants
			accident	and the quality of prevention measures
	Transport of	Punctual	Surface area of the reference transport	Related with number of roads, the traffic
	dangerous		accident involving dangerous goods	density and the quality of the roads as
	goods			well as the prevention measures
	Flood	Linear	Surface area of the reference flood	Related with climatic and morphological
				characteristics of the area plus impact of
				human activities on the water flow
	Earthquake	Whole	Intensity (MSK) or magnitude (Richter) of	Related with the location of the community
		community	the reference earthquake	in a seismic zone
	Volcano	Punctual	Surface area of the lethal effect zone of a	Related with the characteristics of the
			reference volcanic eruption	volcano
	Hurricane	Whole	Intensity of a reference cyclone (Saffir	Related with the location of the community
		community	simpson scale)	in a hurricane prone area
	Landslide	Surface	Surface area of a reference landslide	Related with morphological, geological
				and climatic characteristics of the area
				and with human activities on the area
	Forest fire	Surface	Surface area of the potentially burn forest	Related with morphological, geological
			zone	and climatic characteristics of the area
				and with human activities on the area
	Tsunami	Linear	Surface area of the coastal zone potentially	Related with the location of the community
			flooded by a reference tsunami	on a seashore in a tsunami prone area

Table 2 .

 2 Definition of the various risk assessement dimensions for the various types of hazard considered in the community risk profile

			Global	Individual
	Hazard	Intensity	intensity	frequency
	Industry	Se	Se	f
	Transport of	Se	Se
	dangerous
	goods Flood Earthquake	Se = d.L I	Se = d.L I
	Volcano	Se	Se
	Cyclone	I	I
	Landslide	Se	Se
	Forest fire	Se	Se
	Tsunami	Se = d.L	Se = d.L

If an The table below is filled automatically when the spreadsheets corresopnding to each type of risk are filled

	Name of the
	corresponding area
	Presence
	Intensity
	Frequency
	Elements at risk
	Vulnerability
	Knowledge of risk
	Prevention
	Protection
	Emergency preparedness
	Resilience

  The community risk profile is only an indication of the actual risk level. It is based on average assumptions and very general criteria. If more precise results are available, they should be used to assess the risk in depth instead of the very general indications provided by the community risk profile.Knowing the risk, i.e. analysing and assessing it, is a first essential step of risk management. It is based on risk analysis and other technical studies contributing to the risk assessment. If the knowledge of risk is insufficient, and if the community risk profile let expect that a relatively high Interpretation of the scales risk level is present, further studies should be undertaken to reach a satisfactory knowledge level. Knowledge of risk is thus a first dimension of risk control.

	• Industrial plants including SMEs,
	• Transport infrastructures: roads, railways, waterways,
	pipelines,
	1	2	3	4	5
	Absem hazard				Present hazard
	Low i men s it y				High intensity
	Low likelihood				High likelihood
	Few elements at risk				Many elements at risk
	Low vulnerability				High vulnerability
	Efficient prevention				Insufficient prevention
	Efficient protection				Insufficient protection
	Efficient emergency preparedness		Insufficient emergency preparedness
	High resilience				Low resilience
	Good knowledge of risk			Insufficient knowledge of risk
		Figure 3.

KNOWLEDGE OF RISK: PRE-EXISTING RISK ASSESSMENT

If a hazard source is identified, it is essential that a true risk analysis be performed to obtain a true estimate of the risk.

Table 4 .

 4 Common frequency scale

	Frequency	Frequency
	level	(events per time period)

Table 5 .

 5 Scale for the characterisation of elements at risk: human beings exposed much lower expected frequencies. Yet the estimation of frequency is far from being simple. When no pre-existing risk assessment study nor historical data is available, the assessment is based on qualitative risk criteria. The right column of table1provides examples of such qualitative criteria for each type of hazard.

	Level	Description