Isabelle Zdanevitch

Pascal Mallard

Olivier Bour

Mark Briand

Gaseous émissions réduction from aérobic MBT of municipal solid waste

Keywords: aérobic MBT, gaseous émissions, landfill cell, surface flux, VOC Composting

Surface gaseous émissions, composition of soil gas and VOC concentration were determined on a French MBT plant, where the biodégradation process is aérobic. Measurements were performed on both the composting windrows and on the landfill cell which receives the sorting rejects. This allowed the comparison of the global méthane and CO2 gases, as well as the characterization of the dégradation process on the différent parts of the site. The performance of the sorting chain allow to obtain a highgrade compost, which can be valorised on agricultural fields, and leads to deposit much smaller quantities of degradable waste than in a classical landfill site, and to lowering serîously the génération of méthane. Therefore, landfill gas (LFG) does not need to be recovered and treated by classical means, e.g. flares.

Introduction

Mechànical biological (MBT) treatment of municipal solid waste (MSW) is mainly used to stabilize the organic matter prior to landfilling. Other processes allow energy recovery (by collecting biogas generated during anaerobic digestion) and/or return of organic matter to the soil. Différent processes exist. We hâve evaluated the gaseous émissions of one of the French MBT aérobic plants within two différent studies. The fîrst study aimed to measure the gaseous émissions during the composting process, and the second one focused on the biogas génération from the associated landfill. In order to characterize the gaseous émissions, several direct and indirect measurement methods were used during two campaigns, respectively on the composting plant, then on the two first cells of the landfill. Some methods were used on both the composting plant and the landfill, allowing the comparison between surface fluxes and biogas composition.

Material and methods

The investigation covered three composting windrows of différent âges and two cells of the in-site landfill:

-windrow A, situated in an open shelter, was constituted between one and two weeks prior to the first measuring day, and was turned by an automatic machine twice a week, -windrow B, also under the shelter , was constituted between 15 days and one month before the first measurement, and was also turned twice a week s -windrow C, outside the shelter, was at least 2 months old when the measurements started and was not turned, -cell 1 of the landfill was rehabilitated, It has a 1 m clay cover plus planted soil;

-cell 2 was full of the composting rejects, but uncovered yet at the time of measurements. Therefore weexpeeted the maximum surface émissions from this celi.

Gaseous émissions were characterized by différent techniques:

-Three différent devices were used for surface émission measurements on the composting windrows: two flux chambers (one static, one dynamic) and one tunnel; low concentrations of méthane (CH 4 ), carbon dioxide (CO 2 ), ammonia (NH3) and nitrous oxide (N 2 O) were monitored by an FID (Autofim II) specifically for méthane and a photo acoustic analyzer (Innova) for ail thèse gases; higher concentrations of CH 4 and CO 2 were measured with an infrared portable apparatus (Ecoprobe 5). The static chamber was also used for surface flux measurements on the cell n° 2 of the landfill, -Composition of the soil gas (CH 4 , CO 2 ) was assessed by the use of a probe and the portable analyzer Ecoprobe 5; thèse measurements were performed on both the windrows (where "soil" means compost) and the landfill cell, -Concentrations of trace gases (VOC) were established on some samples taken on the static chamber, also on the windrows and the landfill cell surface.

Due to the relatively high porosity of the material compared to the soil which are usually scanned with the static chamber, there were some différences between the fluxes determined with the static chamber and the dynamic one on the compost windrows (fluxes measured with the static chamber being the lowest). Results of the comparison of the techniques will be published elsewhere (report: MALLARD ET AL, 2008). The flux measured with the static chamber represents more or less the gaseous flux emitted by the surface of the windrows in a total absence of convective gas flows. Nevertheless, due to the short measurement time, a large number of local fluxes can be determined with this method, allowing the interpolation and cartography of the surface émissions.

Surface fluxes measurements

Measurements of méthane and carbon dioxide surface fluxes were performed with a patented static chamber (see Figure 1). Monitoring of the gas concentration increases in the ehamber was done in parallel with a flame ionization detector (FID) for low concentrations of méthane (down to 1-2 pprrïv), and a CH4/CO2 infra-red analyzer (Ecoprobe 5)

for lârger concentrations (up to 100 % v/v). Interpolation of thèse points gives access to the cartography of global émissions and to the mean surface fluxes. Méthane and CO2 fluxes were calculated for windrows of différent âges, and for the landfill cell, allowing the comparison of émissions between the composting process and the landfill.

Composition of bîogas

Composition of the biogas was determined at 1 meter depth with a soil gas probe and the Ecoprobe 5 analyzer. The analyzer also comprises an electrochemical cell to measure oxygen concentrations in the soil gas.

Photo 1 : CH 4 and CO 2 measurements on soil gas (Ecoprobe 5)

Trace VOC émission

Some VOC samples were taken on the flux chamber for identification and quantification, following US-EPA TO15 and TO17 air toxic methods. Sampling was done using the following methods:

-on the windrowà, sampling was performed by pumping 1 liter of chamber air on 3-zones adsorbent tubes ("Air Toxics" type) at 100rnl/min, thus the sampling time is 10 minutes. On some points, during the time period of air sampling, the combustible gases (méthane + trace VOC) concentration increase was monitored by the FID, which allowed an estimation of the VOC fluxes, using the hypothesis that VOC concentrations follow the global combustible gas monitored by the FID, -on the landfill cell, air from the chamber was sampled by diffusion in an emptied steel canister. This method theoretically gives access do compounds of low molecular weight which are not stable on solid adsorbents, such as vinyl chloride.

Analysis was done by preconcentration on Perkin Elmer ATD400 or Turbomatrix (with the thermodesorption of the adsorbent tubes), gas chromatography and mass spectrometry. This method allows the identification of VOC, and the quantification down to 3 for the most usual compounds, by using standard gas mixtures of aromatic and Waste-to-Resources 2009 III International Symposium MBT & MRF waste-to-resources.com wasteconsult.de chlorinated compounds. On the landfill cell 2, toxic compounds: BTEX and chlorinated solvents, were specifically searched. On the windrows, the analysis purpose was différent: identification of the major VOC by the mass detector, and quantification of the most abundant ones.

Results

Surface émissions of CH 4 and CO 2 : comparîson between the windrows and the landfill cell

The first finding is that méthane émissions from the open cell of the landfill are very low: see Figure 2. It cornes from the fact that a large part of the organic matter is diverted from the waste to the composting process. Waste which is landfilled contains mostly materials such as plastics, foams... which are not easily biodegraded. Méthane émissions from the three composting windrows are very différent, as shown on Figure 3, due to the "âge" of the material -e.g. the stabilization of the organic matter. Méthane émission increases with the âge of the windrow, but also when the windrow is not turned (windrow C). Furthermore, méthane émissions are higher at the top of the windrow, which is natural, as température -measured in the same time with an infrared caméra -and gas fluxes are known to be higher at tops. Mean carbon dioxide fluxes are quite similar on each windrow, whatever their âge. Mean émissions from the landfill are a little smaller, indicating that aérobic dégradation process is less important in the landfill cell.

Méthane émissions vary more, from a small value on the younger windrow (2 weeks) to a higher one on the older windrow. This latter value is mainly due to a singular point which shows a high méthane flux on this windrow (7.3 L*h' 1 im" 2 ). In comparison, mean méthane émission is smaller on the landfill, than on two of the 3 windrows, due to low organic content of waste and partial oxidation in the cell cover (results will be published elsewhere : BOUR ET AL, 2009). Landfilling of the rejected fraction from composting, which contains a small proportion of organic matter and is partially stabilized, leads to small méthane émissions, which do not need to be recovered. A simple oxidizing cover could be sufficiént to manage this residual émission, with spécial care on rainwater management.

Because ôf the surface area involved, both méthane and CO 2 émissions are comparable with the sum of the émissions of the windrows. This shows that in the case of MBT prior to landfilling of municipal waste, it is important to take into account both the émissions of the landfill site and of the MBT plant, particularly in this case where the composting material is rather fine and thus poorly aerated, leading to significant émission rates of méthane.

Gas composition in the compost

As for the surface fluxes, windrows of différent âges and the landfill cell n° 2 were studied. Méthane and CO2 concentrations at 1 m depth are given by the Ecoprobe 5. The repartition in composition for both the windrows and the landfill cell are given in figures 4 and 5 under box-plot graphs. Windrow C, which is older and not turned (thus having less oxygen available for biodegratation processes) contains more méthane: mean concentration is 6.9 % v/v, médian value is 6.2, The higher concentration measured at 1 m depth on windrow C corresponds to the higher méthane surface flux. The landfill cell has a very différent behavior: méthane concentrations are very dispersed, from 0 to 50 % v/v, the mean and médian values are différent.

CO2 concentrations show a différent behavior: most values are very similar for the three différent windrows, and close to 17 % v/v, which correspond to the consumption of the atmospheric oxygen in aérobic dégradation. Mean and médian values are also very close, which confirms that the dégradation processes are the same within the three windrows. On the contrary, CO 2 concentrations at 1 m depth in the landfill cell are very similar to the méthane concentrations at the same location, indicating that the soil gas is a mixture of méthane and CO 2 in similar proportions. This is the signature of a typical biogas emitted by the anaerobic dégradation of municipal waste.

Both méthane and CO 2 concentration values inside the landfill cell are much dispersed:

one can imagine that the landfilled waste, which is very heterogeneous, has a variable amount of residual organic matter.

- 1~«~CH4-2 ~»i f c» » CH4-3 -CO2-1 -CO2 -CO2-3
Figure 6 : effect of windrow turning on CH4 and CO2 concentrations in the compost CO2 and CH4 concentrations are considerably iowered just after turning of the windrow. However, after 24 hours, thèse concentrations are quite the same as before the turning. This shows that the available oxygen does not last long inside the windrow. The substrate is relatively fine and homogeneous, it is therefore important to turn regularly the windrows, which is done at least twice a week on this plant.

Since thèse measurements, improvements hâve been brought to the process. The following changes will be made in the composting process itself. In order to obtain an optimum biodégradation, organic matter extracted from the municipal waste will be mixed with crushed végétal residues, and the process will be operated in closed boxes with forced aération, in order to keep a higher amount of oxygen within the material, helping the aérobic biodégradation.

Surface VOC émissions

Composition

As the analytical procédures for identification were différent between the samples from the windrows and the landfill cell, it is not possible to compare exactly ail the VOC présent in ail the samples. But tendencies can be established. Major results are given in Table 2.

Concerning the présence of toxic compounds, the major finding is that trichloroethylene and tetrachloroethylene were never detected on any of the samples. Benzène and toluène are, except in one case, never detected on the samples taken on the windrows, Meanwhile, they are présent on the two samples taken on the landfill cell 2, but at rather low concentrations. This isalways the case for MSW landfills Their présence in the landfill gas shows that, or îhe stored waste probably contains some industria! waste, or they corne from the dégradation of higher molecular weight compounds. More work would be needed to clear this point. Nevertheless, the low concentration level indicates that thèse compounds will not be responsible for a health risk.

There are more VOC, and at larger concentrations, in the gas samples taken on the windrows that on the landfill cell. Several compounds such as the terpenes (a-pinene, limonene) corne from the green waste which is crushed and mixed to the organic matter of the municipal waste. The other compounds probably corne from the municipal waste, and are combined with the organic matter which undergoes composting. A-pinene and limonene on the landfill cell probably corne from the crushed bark used as a temporary cover.

Estimation of VOC surface fluxes

While the air was sampled on adsorbent tubes, the flammable gas concentration was monitored by the FID on some sampling points. We used the hypothesis that VOC concentrations follow the global flammable gas concentration in order to evaluate the VOC fluxes. Partial results, calculated on one point, are given in Table 3.

As the measured concentration of VOC in the static air chamber are low (in the ng/m 3 range), the corresponding fluxes are nàturally very low. Though thèse fluxes were not measured directly, this calculation helps to evaluate local VOC émissions from the composting windrows. This work needs to be continued to get better précision.

Conclusions

The two différent studies on the gaseous émissions of a French MBT plant and the associated landfill gave the opportunity to compare the relative impacts of the plant and of the landfill. Due to the fact that a large part of the organic matter is sorted out from the MSW to undergo composting, the gaseous émissions of the landfill cell are really lowered compared to a classical landfill without MBT. In addition, the sorting of the waste is sufficiently efficient to obtain a high grade compost, which allows its use in amending agricultural soils.

Références

Bour, Zdanevitch, Briand, Llinas Mallard, Zdanevitch, Pradelle, Frejafon

Figure 1 :

 1 Figure1: apparatus for gaseous surface émissions(static chamber)

Figure 2 :

 2 Figure 2 : Interpolated méthane émissions on landfill cell 2, ml/m 2 /min

Figure 3 :

 3 Figure 3 : Interpolated méthane émissions on windrows, mL/m2/min

Figure 4 :

 4 Figure 4 : répartition of méthane values in soil gas, windrows and landfill cell

Figure 5 :. 3

 53 Figure 5 : repartition of CO2 values in soil gas, windrows and landfill cell

Table 1 .

 1 Table 1 : CH4 and CO2 fluxes on composting windrows and the landfill cell

		Composting plant : windrows	Landfill, cell
		A	B	C*	2 : waste refuse
	Age of the windrow/storage	2 weeks	1 month	2-3 months	< 2 years
	Interpolated surface area, m 2	368	293	382	2760
	MeanCH 4 flux, L-h" 1 -m"2	0,08	0,60	1,1	0,25**
	Mean CO 2 flux, L-r f1 -m' 2	6,4	8,3	6,0	2,3
	Total CH 4 flux on each part, m 3 /h	0.029	0.176	0.42	0.69
	Total CO 2 flux on each part, m 3 /h	2.36	2.43	2.29	8.65

* maturation step, not turned; ** méthane is partially oxidized through the surface layer

Table 2 :

 2 VOC composition of air samples taken on the static flux chamber

	Compounds	Wind.	Wind.	Wind.	Wind.	Wind.	Cell2	Cell2
		A, 2	A, 21	B\ 82	C top	B,C8	Can4	Can I
	Ethanol	2354	1496			70
	Pent-1-ene			356	1058
	Pentane		969	846	569
	Acétone	1989	481			1693
	Dimethylsulfide			1350	383
	Methyl vinyl cetone	1302				1287
	Butan-2-one (MEK)	4503	1158			6481
	Butan-2-ol	2774	1000			5628
	Benzène			147			32	5
	Pentan-2-one					283
	Methyl-3 butanol	505				416
	n-Heptane						66	15
	Toluène						203	20
	Octane			124	127		33	8
	m+p Xylenes			53		77	299	14
	o-Xylene + Styrène			90	30	51	214	10
	a-Pinene			289	50	313	1506	57
	Decane					128	50	46
	Limonene	1961	3	12266	862	2341	540	341
	Undecane			264
	Concentrations are given in jug/m

Table 3 :

 3 approximate VOC fluxes, point n ° 2 on the windrow A

	Compound	Flux, uJ/m 2 /min
	Ethanol	29.4
	Acétone	19.7
	Acétate de methyle	5.8
	Methyl vinyl cetone	10.7
	Butan-2-one (MEK)	36.0
	Butan-2-ol	21.8
	Acétate d'ethyle	8.4
	Methyl-3 butanol	3.3
	Limonene	8.3

Acknowledgements 2009 "Estimating méthane émission and oxidation frorn two ternporary covers on landfilling of MBT treated waste". Submitted for présentation to the Sardinia 2009 symposium 2008 « Projet EMISITE: évaluation sur site de différentes méthodes de mesure des émissions gazeuses d'une installation de compostage » Final report, ADEME n e 0675c0081, August 2008 This work was financed by the French Ministry of Environment and ADEME

Author's address

Dr Isabelle Zdanevitch INERIS BP2 F-60550 Verneuil-en-Halatte Tel: 33+ (0)3 44 55 63 90 E-Mail : sabalie.Zdeiievtîcfi @ ineri Web site : www.ineris.fr @ineris.fr


Frédéric Y Bois
email: frederic.bois@ineris.fr

Dany Habka

Yves Frédéric

Bois

An integrated modelling approach for in vitro to in vivo extrapolations

Keywords: Ciclosporin A, Diazepam, PBPK models, PK/PD models, Toxicity prediction

Predicting in vivo drug toxicity from in vitro testing requires modelling those processes that are not reproduced in vitro. The most obvious difference between the two settings is the lack of integrated absorption, distribution, metabolism, and excretion (ADME) that govern target tissue exposure in vivo. For equal input doses, the concentrations to which in vitro systems are exposed may not correspond to those found in vivo. The partners of the European project PREDICT-IV in charge of modelling develop prediction models for ADME processes and integrate them into generic physiologically based pharmacokinetic (PBPK) models. Examples of simulations of concentration-time profiles for diazepam and ciclosporin A, in various human or rat organs and tissues, are presented here. In vivo drugs' toxicity will be forecasted by coupling the predicted target tissue concentration profiles to dose-response relationships observed in vitro. Human variability will be evaluated for each component of the approach.

Introduction

It is now recognised that replacing animals by in vitro systems for assessment of medium to long-term toxicity of drugs or general chemicals requires an integration of pharmacokinetics [START_REF] Bouvier D'yvoire | Physiologically-based kinetic modelling (PBK modelling): meeting the 3Rs agenda -The report and recommendations of ECVAM Workshop 63a[END_REF]. Predicting in vivo drug toxicity from in vitro testing requires modelling the absorption, distribution, metabolism, and excretion (ADME) processes that are not reproduced in vitro.

For equal input doses, the concentrations to which in vitro systems are exposed may not correspond to the target tissue exposure experienced in vivo. INERIS, Simcyp Limited, the German Cancer Research Centre, Emergentec Biodevelopment GmbH, and ECVAM, which constitute the modelling team of the European project PREDICT-IV, will integrate prediction models for ADME processes into global generic physiologically based pharmacokinetic (PBPK) models able to simulate concentration-time profiles in human or rat blood and tissues. In vivo drugs' toxicity will be predicted by coupling the predicted target tissue concentration profiles to dose-response relationships observed in vitro.

Human variability will be evaluated for each component of the approach.

While the establishment of predictive dose-response relationships for neurotoxicity, liver and kidney toxicity is a very important part of the project, this article focuses on the progress made so far on PBPK modelling by PREDICT-IV.

PBPK models are increasingly used in drug development and regulatory toxicology to predict the kinetics and metabolism of substances in the body [START_REF] Barton | Characterizing uncertainty and variability in physiologically-based pharmacokinetic (PBPK) models: state of the science and needs for research and implementation[END_REF][START_REF] Bouvier D'yvoire | Physiologically-based kinetic modelling (PBK modelling): meeting the 3Rs agenda -The report and recommendations of ECVAM Workshop 63a[END_REF][START_REF] Loizou | Development of good modelling practice for physiologically based pharmacokinetic models for use in risk assessment: the first steps[END_REF]. In these models, the body is represented by a set compartments corresponding specific organs or tissues, and the transfers or transports of drugs are dictated by various physiological flows (blood, bile, pulmonary ventilation, etc) [START_REF] Bois | An analysis of exposure rate effects for benzene using a physiologically based pharmacokinetic model[END_REF]. A system of differential equations can be written, with parameters representing blood flow rates, organ volumes etc., for which information is available in the published scientific literature or may be obtainable in vitro (Woodruff andBois, 1993, Parrott, et al., 2005). Numerical integration of that differential system computes the quantity and concentration of the drug considered in each compartment, as a function of time and exposure dose. Indeed, such a description of the body is approximate, if not rough, but a balance has to be found between precision (and therefore complexity) and simplicity (ease of use).

We will briefly describe the global approach taken by PREDICT-IV to integrate experimental evidence for a predictive approach to toxicology. We will then describe Simcyp's generic PBPK model and the specific parameter setting adopted for ciclosporin A and diazepam in rats and humans. Modelling results for those two substances are presented and discussed.

Methods

General modelling framework

Fig. 1 presents graphically the integrated prediction and validation framework of PREDICT-IV. In vitro studies will provide the necessary data for the development of a set of ADME QSARs and multivariate dose-response models for cellular and organ-level effects. Those models will be coupled to a generic PBPK model and will provide an in silico pharmacokinetic-pharmacodynamic (PK/PD) tool predictive of medium-to long-term toxicity. In order to validate that tool, its predictions for plasma and tissue drug levels will be confronted to pharmacokinetic data obtained in humans or rats. We do not expect to get enough data relating plasma to pathological effects in humans. Therefore the pharmacodynamic component will be validated on the basis of already published rat data. We do not expect perfect predictions of pharmacokinetics or toxicity data and meta-analysis models will be developed to analyse and correct for the discrepancies.

Simcyp's generic PBPK models

The structure of the PBPK model developed by Simcyp for rats and humans is shown on Fig. 2. A set of ADME sub-models, able to predict substance-specific parameter values for a large range of molecules, is already coupled to this model [START_REF] Howgate | Prediction of in vivo drug clearance from in vitro data. I. Impact of inter-individual variability[END_REF], Jamei, et al., 2009a, Jamei, et al., 2009b, Jamei, et al., 2009c). Obviously, while the model structure remains the same, parameter values and corresponding absorption, distribution, metabolism and excretion (ADME) sub-models differ between species. Dosing can be by intra-venous injection (i.v.) or per os (p.o.) (the dermal and inhalation routes are also developed for humans).

The liver and gut are sites of metabolism. Renal excretion takes place in the kidney. Solving numerically the corresponding set of differential equations yields the time-course of the quantity or concentration of a given drug in any of the organs or tissues included in the model.

Specific parameters for diazepam in rats

Simcyp also provides default parameter values for diazepam with its rat model. A total in vivo clearance of 20.4 mL/min is reported [START_REF] Klotz | Pharmacokinetics and plasma protein binding of diazepam in man, dog, rabbit, guinea pig and rat[END_REF][START_REF] Igari | Prediction of diazepam disposition in the rat and man by a physiologically based pharmacokinetic model[END_REF]. To model the extra-hepatic metabolism of diazepam in rats, hepatic clearance was set equal to three-quarters of total clearance (CL iv = 0.75 CL tot = 15.3 mL/min; CL r = 0.25 CL tot = 5.1 mL/min).

The intravenous injection of 1.2 mg/kg used by [START_REF] Igari | Prediction of diazepam disposition in the rat and man by a physiologically based pharmacokinetic model[END_REF] in their experiments on Wistar was simulated.

Specific parameters for diazepam in humans

Diazepam is not part of the default substances provided by Simcyp's human model. We used the physico-chemical characteristics specified by Simcyp's rat model (molecular weight: 284.7 g/mol; log octanol to water partition coefficient: 2.9; monoprotic base with a pKa of 3.4). Blood binding parameters where obtained from the literature (fraction unbound in plasma, fu p : 0.022; blood to plasma ratio: 0.58) [START_REF] Klotz | The effects of age and liver disease on the disposition and elimination of diazepam in adult man[END_REF][START_REF] Klotz | Estimation of the blood-plasma concentration ratio of diazepam in the rat[END_REF][START_REF] Jones | Distribution of diazepam and nordiazepam between plasma and whole blood and the influence of hematocrit[END_REF]. Tissue-to-plasma concentration ratios (K p ) were automatically estimated by the corresponding ADME model. For in vivo clearance, CL iv , the published value of 1.596 L/h was used [START_REF] Klotz | The effects of age and liver disease on the disposition and elimination of diazepam in adult man[END_REF].

To simulate [START_REF] Klotz | The effects of age and liver disease on the disposition and elimination of diazepam in adult man[END_REF] data, a two-minute intravenous infusion of 0.1 mg/kg diazepam was simulated for a representative healthy volunteer, followed up for 72 hr.

Specific parameters for ciclosporin A in rats

Ciclosporin A was not one of the drugs predefined for in Simcyp's rat model. We used the physico-chemical properties provided by the Simcyp's human model (molecular weight: 1202 g/mol; log octanol to water partition coefficient: 4.3; neutral compound). Blood binding parameters where obtained from the literature (fraction unbound in plasma, fu p : 0.062; fraction unbound in blood, fu b : 0.05 for intra-venous doses up to 6 mg/kg and 0.094 for doses above) [START_REF] Kawai | Physiologically based pharmacokinetics of cyclosporine A: extension to tissue distribution kinetics in rats and scale-up to human[END_REF][START_REF] Tanaka | Dose-dependent pharmacokinetics of cyclosporin A in rats: events in tissues[END_REF]. The tissue-to-plasma concentration ratios (or partition coefficients, K p ) (Tab. 1) were derived by multiplying published tissue-to-blood ratios [START_REF] Tanaka | Dose-dependent pharmacokinetics of cyclosporin A in rats: events in tissues[END_REF] by fu p / fu b .

In vivo plasma clearance values were derived from [START_REF] Tanaka | Dose-dependent pharmacokinetics of cyclosporin A in rats: events in tissues[END_REF] by multiplying the blood clearance by fu p / fu b : (CL iv : 0.82 mL/min for an intravenous dose of 1.2 mg/kg; 0.94 mL/min for 6 mg/kg; 0.35 mL/min for 30 mg/kg).

Three experiments on Sprague-Dawley rats with 2-minute intra-venous infusions of 1.2 mg/kg, 6 mg/kg and 30 mg/kg ciclosporin A, respectively, were simulated [START_REF] Tanaka | Dose-dependent pharmacokinetics of cyclosporin A in rats: events in tissues[END_REF].

Specific parameters for ciclosporin A in humans

Simcyp provides default parameter values for ciclosporin A pharmacokinetics in humans. We used the predefined "Healthy volunteers" population. To match the characteristics of the population studied by [START_REF] Gupta | Effect of food on the pharmacokinetics of cyclosporine in healthy subjects following oral and intravenous administration[END_REF], the reference body mass of the subjects was set to an average of 64 kg, with age ranging from 24 to 34 years, with 50% males. The duration of the simulated study was 24 hr after an oral administration of 10mg/kg of ciclosporin A. A first-order oral absorption model was used, with rate constant 0.91 h -1 [START_REF] Kawai | Physiologically based pharmacokinetics of cyclosporine A: extension to tissue distribution kinetics in rats and scale-up to human[END_REF].

For extrapolation to a larger population the age range was set from 20 to 70 years. To study variability, Monte Carlo simulations [START_REF] Bois | Precision and sensitivity analysis of pharmacokinetic models for cancer risk assessment: tetrachloroethylene in mice, rats and humans[END_REF][START_REF] Bois | Comparison of three physiologically-based pharmacokinetic models of benzene disposition[END_REF][START_REF] Bois | An analysis of exposure rate effects for benzene using a physiologically based pharmacokinetic model[END_REF][START_REF] Rostami-Hodjegan | Simulation and prediction of in vivo drug metabolism in human populations from in vitro data[END_REF] of 100 subjects were performed.

Results

Diazepam in rats and humans

A set of simulations was performed to compare the model predictions to actual data published on rat and human diazepam pharmacokinetics. Only minimal adjustments to the parameter values, has described in the Methods section, were made. Fig. 3 shows the results obtained for the rat. Only plasma, brain, liver and kidney data [START_REF] Igari | Prediction of diazepam disposition in the rat and man by a physiologically based pharmacokinetic model[END_REF] and model simulations are shown because these are the compartments of primary interest in PREDICT-IV. Similar results are obtained in the other tissues.

Fig. 4 presents similar results in human plasma. The experimental data of [START_REF] Klotz | The effects of age and liver disease on the disposition and elimination of diazepam in adult man[END_REF] for two healthy volunteers are slightly overestimated, but we have not attempted here to account for the heterogeneity of the human population.

Ciclosporin A in rats and humans

Fig. 5 shows the data obtained by [START_REF] Tanaka | Dose-dependent pharmacokinetics of cyclosporin A in rats: events in tissues[END_REF] in Sprague-Dawley rats after intra-venous administrations of 1.2, 6 or 30 mg/kg of ciclosporin. The model-predicted time-courses are shown on the same Figure . Here again, no specific adjustment was made to "fit" the data, beyond the obvious adaptations mentioned in the Methods section.

For humans, Fig. 6 shows the data of [START_REF] Gupta | Effect of food on the pharmacokinetics of cyclosporine in healthy subjects following oral and intravenous administration[END_REF], obtained after oral administration of 10 mg/kg of ciclosporin A to a healthy volunteer, in low fat or high fat diet conditions. Monte Carlo simulation of 100 similar subjects (diet not considered) were performed, and the average, 5 th and 95 th percentiles of the simulated values are plotted. Fig. 7 illustrates the very purpose of all this modelling exercise: predicting the concentration time-course of a substance (here ciclosporin A) in the brain, liver and kidney for a varied human population. We simulated 100 healthy subjects, aged from 20 to 70 years, taking a daily dose of 10 mg/kg of ciclosporin A for 60 days. Note that during the first week of treatment, liver exposure is the highest of the three, but brain exposure after 60 days is higher than liver or kidney exposure.

Discussion

Predicting organ toxicity beyond acute effects is a significant scientific challenge.

The team of PREDICT-IV is taking an inclusive approach to the problem, coupling in vitro testing, in silico ADME, PBPK and dose-response models in an integrated predictive tool. An important aspect of the work will be the validation, or benchmarking, of the model predictions with a set of about 30 reference drugs, known for their neurotoxicity, hepatotoxicity or kidney toxicity. To that effect, Simcyp Ltd has already extended its human pharmacokinetic model and developed a rat model. The results presented here are indeed limited to only two compounds, diazepam and ciclosporin, but give an idea of the quality of the predictions obtained with the current model. We will test the approach with whole set of reference drugs, and we even expect improvements when additional, more precise, ADME properties prediction models will be included.

We have performed here Monte Carlo simulations to describe inter-individual variability only to a limited extent, and only for ciclosporin A. This type of simulations will be performed for more diverse populations, potentially more susceptible to organ toxicity. Accessing this type of results is difficult for in vitro testing alone, hence the synergy with mathematical modelling, which is one of the goals of PREDICT-IV.

The results presented here go only as far as the prediction of organ exposures after medium term repeated administration of a drug. We could have extended our simulations to longer times or different doses, but stable values were obtained for ciclosporin A after 60 days of dosing and we would have gained no more insight with additional follow-up. Obviously this may not be true for other compounds and will have to be assessed on a case by case basis. In any case, long term target organ exposure is the relevant measure of dose for the prediction of organ toxicity after sustained exposure. We have still to couple our PBPK model to doseresponse models for a complete PK/PD approach. The dose-response component will also add a time dimension of its own, but the work on correlated multidimensional dose-response models in PREDICT-IV has just begun.

We are focusing on local organ toxicity, for which the target tissue concentration can be considered as the relevant measure of dose. Systemic toxicity would be much more of a challenge, combining effects of the dysfunction of several organs. However, we are only a step away from being able to describe the toxic effects of co-administered substances, since our models have the capability to account for at least pharmacokinetic and metabolic interactions (Rostami-Hodjegan and Tucker, 2004, Bois, submitted). We are therefore confident in our ability to make significant contributions to the 3Rs agenda and to predictive clinical and environmental toxicology in the near future.

Tables

Tab. 1: Tissue-to-blood partition coefficients used for ciclosporin A in rats. (a) The brain concentration was below the limit of detection in [START_REF] Tanaka | Dose-dependent pharmacokinetics of cyclosporin A in rats: events in tissues[END_REF]. Left panel: Predictive component of project In vitro studies will provide the necessary data for the development of a set of ADME QSARs and multivariate dose-response models for cellular and organ-level effects. Those models will be coupled to a generic PBPK model for humans and rats and will provide an in silico pharmacokinetic-pharmacodynamic (PK/PD) tool predictive of medium-to long-term toxicity. Right panel: In order to validate that tool, its predictions for plasma and tissue drug levels will be confronted to pharmacokinetic data obtained in humans or rats. To relate plasma to pathological effects, the pharmacodynamic component will be validated on the basis of published animal (rat) data. The rat PBPK model was run to simulate the intra-venous administration of 1.25 mg/kg of diazepam to Wistar rats [START_REF] Igari | Prediction of diazepam disposition in the rat and man by a physiologically based pharmacokinetic model[END_REF]. The solid lines represent the predicted time-courses. The dots figure the corresponding data (average concentrations measured in 3 to 5 rats). The human PBPK model (solid line) was run to simulate the intra-venous administration of 0.1 mg/kg of diazepam to human healthy volunteers. The data correspond to those obtained in two subjects (circles and squares, respectively) by [START_REF] Klotz | The effects of age and liver disease on the disposition and elimination of diazepam in adult man[END_REF]. The rat PBPK model was run to simulate the intra-venous administration of 1.2, 6

Tissue

Figure legends

or 30 mg/kg of ciclosporin to Sprague-Dawley rats [START_REF] Tanaka | Dose-dependent pharmacokinetics of cyclosporin A in rats: events in tissues[END_REF]. The solid lines represent the predicted time-courses. The dots (circles: 30 mg/kg dose;

squares: 6 mg/kg dose; diamonds: 1.2 mg/kg dose) figure the corresponding data (average concentrations measured in 3 rats). Left panel: Predictive component of project In vitro studies will provide the necessary data for the development of a set of ADME QSARs and multivariate dose-response models for cellular and organ-level effects. Those models will be coupled to a generic PBPK model for humans and rats and will provide an in silico pharmacokinetic-pharmacodynamic (PK/PD) tool predictive of medium-to long-term toxicity. Right panel: In order to validate that tool, its predictions for plasma and tissue drug levels will be confronted to pharmacokinetic data obtained in humans or rats. To relate plasma to pathological effects, the pharmacodynamic component will be validated on the basis of published animal (rat) data. The rat PBPK model was run to simulate the intra-venous administration of 1.25 mg/kg of diazepam to Wistar rats [START_REF] Igari | Prediction of diazepam disposition in the rat and man by a physiologically based pharmacokinetic model[END_REF]. The solid lines represent the predicted time-courses. The dots figure the corresponding data (average concentrations measured in 3 to 5 rats). The human PBPK model (solid line) was run to simulate the intra-venous administration of 0.1 mg/kg of diazepam to human healthy volunteers. The data correspond to those obtained in two subjects (circles and squares, respectively) by [START_REF] Klotz | The effects of age and liver disease on the disposition and elimination of diazepam in adult man[END_REF]. The rat PBPK model was run to simulate the intra-venous administration of 1.2, 6

or 30 mg/kg of ciclosporin to Sprague-Dawley rats [START_REF] Tanaka | Dose-dependent pharmacokinetics of cyclosporin A in rats: events in tissues[END_REF]. The solid lines represent the predicted time-courses. The dots (circles: 30 mg/kg dose;

squares: 6 mg/kg dose; diamonds: 1.2 mg/kg dose) figure the corresponding data (average concentrations measured in 3 rats).

Fig. 1 :

 1 Fig. 1: Graphical representation of the integrated prediction and validation

Fig. 2 :Fig. 3 :

 23 Fig. 2: Graphical representation of the physiologically based pharmaco-

Fig. 4 :

 4 Fig. 4: Model predictions and published data on diazepam time-course in

Fig. 5 :

 5 Fig. 5: Model predictions and published data on ciclosporin A pharmaco-

Fig. 6 :

 6 Fig. 6: Modelled and observed ciclosporin A pharmacokinetics in human

Fig. 7 :

 7 Fig. 7: Predictions of long-term ciclosporin A pharmacokinetics in humans.

  Fig. 3: Model predictions and published data on diazepam pharmacokinetics

Fig. 4 :

 4 Fig. 4: Model predictions and published data on diazepam time-course in

Fig. 5 :

 5 Fig. 5: Model predictions and published data on ciclosporin A pharmaco-

Acknowledgements

This work was supported by the European Commission, 7 th FP project PREDICT-IV [grant agreement #202222] and the French Ministry for the Environment (PRG189_08_DRC03).

Venous Blood Arterial Blood


Clément Lenoble

Probabilistic accident assessment in the context of the french regulation

Keywords: AZF accident, probability, land-use planning, frequency, safety barrier, risk assessment, bow-tie, major accident

In France, regulations regarding risk prevention and risk management are the result of more than 200 years of legislation, the evolution of which has often been consecutive to industrial accidents. Two years after the industrial accident of AZF (French initials for AZote Fertilisant), a new law was introduced on July 30, 2003 which described both prevention and repair of the damage caused by industrial and natural disasters. Since then, regulations have been made considerably tighter and the entire approach towards risk assessment has changed. This law has developed very interesting tools for risk assessment and risk management (some of which are unique worldwide) and has initiated the use of frequency and probability in the French system. Better information to the public, stronger regulations, new methodology for safety reports, over-hauling of land-use planning and improved accident analysis are some of the mainstays of the law.

Regarding the introduction of frequencies and probabilities, as operators in France are free to choose the methodology of probability assessment, it is interesting to review the different methodologies used by operators, with their advantages and disadvantages.

In the light of these elements, France's National Institute of Industrial Environment and Risks (INERIS) has developed a methodology and tools aiming at helping both operators and authorities in the assessment of accident probabilities. This methodology focuses on installation characteristics. However, to deal with the lack of input data, tools are developed to build up available generic data regarding loss of containment, initiating events, safety barrier failure rates and root causes distributions.

Six years after the law of July 30, 2003 was passed, it is now possible to highlight the challenges and improvements brought about by the use of frequency and probability in risk assessment and policies developed as a result.

INTRODUCTION OF FREQUENCY IN FRANCE FOLLOWING THE AZF ACCIDENT

Clément LENOBLE * , Clarisse DURAND **

LESSONS LEARNED FROM THE AZF ACCIDENT

The AZF accident

The AZF factory belonged to Grande Paroisse (company detained by the TotalFinaElf group). At the time of the accident, the factory had 469 employees and a turnover of 100 M€. The factory, located 3 km from the centre of Toulouse (France -750,000 people in 2001) and surrounded by a urban environment, produced fertilizers and a variety of chemical products.

The accident: On September 21, 2001, at 10:17 AM, a huge detonation occurred in the nitrates area of the factory. The explosion was felt up to 75 km and was compared with an earthquake with an intensity of 3.4 on the Richter scale. An analysis of the consequences has led to estimate a TNT equivalent between 20 and 40 tons [START_REF] Barthélémy | Usine de la société Grande Paroisse à Toulouse, Accident du 21 septembre 2001[END_REF]. Windows broke up to 7 km and more than a thousand buildings were destroyed.

After the explosion, important clouds of dust and red fumes containing oxides of nitrogen and ammonia were emitted.

Human and social consequences: The accident left 31 people dead: 21 on the AZF site, 1 on a neighbouring factory and 9 in the vicinity of the site. Thousands of people were hospitalized (the Haute-Garonne Prefecture counted a total of 2,442 people as of 17 October 2001). The observed pathologies were mutilations, explosions of eardrums and pleura, bruises on spleen and liver, as well as fractures and wounds due to the blast wave, the falling-down of structures, broken glass or projections… For thousands of people, the AZF accident was a major traumatic experience. Approximately 5,000 people consulted their general practitioner for acute post-traumatic stress during the first few days after the disaster (INVS, 2002). According to experts, these numbers are underestimated as they only take into account the individuals who sought medical care. The explosion was responsible for psychological problems (depression, anxiety…).

Environmental consequences:

The explosion destroyed some of the tanks containing ammonium nitrate and led to nitric acid leaks. Nitrogenous and ammonia releases polluted the Garonne river and entailed a fish mortality.

Economic consequences:

The AZF plant and the neighbouring factories were destroyed. About 1,300 firms (hiring approximately 21,000 people) were severely impacted by the accident [START_REF] Dechy | Suivi épidémiologique des conséquences sanitaires de l'explosion de l'usine AZF -Rapport intermédiaire[END_REF]. The consequences were also dramatic on roads, and public buildings such as schools, colleges, hospitals… All in all, 25,000 dwellings were damaged, 11,180 of which severely [START_REF] Aria | Explosion in a fertilizer plant -September 21 st , 2001 -Grande Paroisse Toulouse[END_REF]. More than a thousand were completely destroyed and more than 1200 families had to be rehoused in emergency after the disaster.

Insurance companies appraised the overall economic consequences up to 2 billions € [START_REF] Aria | Explosion in a fertilizer plant -September 21 st , 2001 -Grande Paroisse Toulouse[END_REF].

Emergency response:

The external emergency plan was activated. A crisis centre was installed within the establishment. In total, 1,430 firemen and military men, 950 policemen, about 50 doctors, 32 nurses and 80 emergency medical technicians were called up [START_REF] Aria | Explosion in a fertilizer plant -September 21 st , 2001 -Grande Paroisse Toulouse[END_REF] .

A security perimeter was set up within a 500-meter radius. Many buildings and schools were evacuated. In the vicinity of the site, the air, railway and road traffic was entirely stopped.

Causes and circumstances of the accident: Downgraded nitrates were stored in the shed 221 and were transported from different parts of the factory by subcontractors. At the time of the accident, that shed held between 300 and 400 tons of ammonium nitrates. According to the final legal expert report concluded that it was a chemical accident, due to an accidental combination of sodium dichloro-isocyanurate (SDIC -a product used for water treatment) and ammonium nitrate, causing the explosion. The operator has always disproved this theory.

Legal action: Grande-Paroisse (as a legal entity) and the plant manager were charged with involuntary manslaughter and wounding. The investigation gathered up to 140 policemen (judicial police and forensic and technical police laboratories) and 40 legal experts and lasted more than five years. The four-month trial ended on July 1, 2009 and the verdict is due on November 19, 2009.

Deficiencies identified

A thorough analysis of the accident has led to identify some deficiencies:

-The safety report of the AZF factory did not take into account the downgraded ammonium nitrates store since it was considered as less dangerous (because of the smaller quantity stored). As a matter of fact, the safety report did not describe each possible accident scenario.

-Urbanization has considerably spread out in the vicinity of the site since the launching of the chemical activities. At the time of the accident, the chemical site was surrounded by business parks, hospitals, dwellings… -People living around the industrial site were not perfectly aware of the potential risks of such an establishment.

-The ammonium nitrate storage facilities were not directly managed by the AZF company but by a subcontractor, whose knowledge of the products and the site could sometimes be incomplete. In addition to the 469 AZF employees, 80 people regularly worked on the site and were hired by nine different subcontractors.

As a consequence, the French government clearly stated the need to reassess the whole approach of risk analysis and land-use planning and also to improve the information to the public and the consideration of subcontractors.

1.3The Law of July 30, 2003 and its mainstays

As a starting point, it is interesting to recall that in France, regulations regarding risk prevention and risk management are the result of more than 200 years of legislation, the evolution of which has often been consecutive to industrial accidents. The accident of the gunpowder factory that occurred in Paris in 1794 led to more than a thousand casualties. It brought about the imperial decree of October 15, 1810 about the factories that were sources of nuisances or risks. Three categories of factories were then defined (hazardous, insalubrious or causing inconvenience) and the first elements of land-use planning were enacted. This decree as well as the law of December 19, 1917 regarding "dangerous, unhealthy and inconvenient establishments" have established the fundamental rules for risk prevention and land-use planning in France.

The law of July 19, 1976 has modernized and updated the monitoring of classified installations according to the risks or nuisances that they generate. On the European level, the council directive 82/501/EEC on the major accident hazards of certain industrial activities -so called the Seveso directive -in 1982, laid the bases of a common policy for the prevention of major industrial accidents. The "Seveso II" directive, in 1996, introduced important changes and new concepts, such as safety management systems, emergency plans and land-use planning.

Six years after the publication of that directive and two years after the AZF accident, the law of July 30, 2003 was introduced. It does not only deal with industrial disasters but also with natural disasters, as a response to floods that happened in France (caused by the rivers Somme, Gard and Hérault).

The law of July 30, 2003 regarding the prevention and repair of the damage caused by industrial and natural disasters, along with government actions, has enabled to focus on the following priorities: -Increase of the number of inspectors and improvement of their training curriculum for a better regulation of the classified installations and for a more efficient control force: between 2001 and 2008, the number of inspectors increased by 40%. In 2009, there are approximately 1,400 inspectors in France, including 400 to 500 specialized in Seveso establishments. Since 2005, the training curriculum for inspectors has also been expanded and improved. Within the first 6 to 8 months after the taking up of the position, inspectors have to attend two one-week courses about the legislation and regulation concerning industrial plants and specific regulations regarding water and air emissions, wastes, noise nuisances… Then, over the course of the first three years, nine general courses about industrial risks, crisis management, soil contamination, etc. have to be taken. For Seveso inspectors, more specialized courses about the safety report, safety management system, land-sue planning… are highly recommended. Moreover, the inspectorate has committed to inspecting every year each of the 2,000 high priority establishments (including the Seveso establishments) and every three years each of the 8,000 establishments at stake.

-Creation of interregional units specialised in technological risks: their role is to provide assistance on the assessment of the safety reports of Seveso establishments of several départements. It allows as well to harmonize the decisions and to ensure the circulation of best practices.

-An Emergency Unit (CASU in French, standing for Cellule d'Appui aux Situations d'Urgence) has been created within France's National Institute of Industrial Environment and Risks. Experts can be mobilized 24-hour a day in case of an accident, in order to estimate the consequences and improve the emergency response.

-Development and improvement of the technological accidents database, named ARIA (on the website www.aria.developpement-durable.gouv.fr). It now makes available the details of more than 32,000 accidents and is continuously updated.

-A better information to the public about major industrial risks: The AZF accident highlighted the need of a better and more easily accessible information: The law of July 30, 2003 provides the creation of a local information and dialogue committee (in French, a CLIC, standing for Comité Local d'Information et de Concertation) around the most dangerous establishments. Their role is to promote communication about risks between the public authorities, the operators and the civil society. Besides, the permits of Seveso establishments are made available on the Internet, possibly with some publications of the results of inspections. In October 2003, France ratified the UN/EEC Convention on the transboundary effects of industrial accidents. It aims at preventing industrial accidents that can have transboundary effects, preparing for and responding to them. This convention deals with exchanges of information in case of an accident and providing a mutual assistance. Moreover, the law of July 30, 2003 lays upon sellers or landlords to inform potential purchasers or renters about the technological or the natural risks regarding the property.

-An improvement of the involvement of employees and subcontractors in risk prevention, so that each person on site gets the same level of knowledge. It is important to draw the attention to the importance of the human factor in accidents: in 2008, 61% of accidents were caused by organizational and human factors (Technological accidents inventory 2008). Under the law of July 30, 2003, all employees and subcontractors are kept informed through their representation in CLIC and in the working conditions, hygiene and safety committee (in French, CHSCT, standing for Comité d'Hygiène, de Sécurité et des Conditions de Travail).

-An improvement of the victims' compensation: The law of July 30, 2003 has described the notion of a technological disaster, that has to be inspected by official authorities. Within three months after the disaster was officially declared or after the property damages were assessed, insured people receive a compensation. As for people who are not insured against technological disasters, they get a compensation thanks to a guarantee fund.

-Complete review of the regulations regarding risk prevention: For some industrial sectors, the regulation has been made tighter (for instance, the regulation regarding silos, pyrotechnics, organic peroxides, petrol stations...). A national technical working group has been created at the end of 2008 to think about the ageing of industrial sites.

-New methodology for risk assessment and safety reports: Before 2003, risk assessment was based on the worstcase scenario. It was a deterministic approach. The law of July 30, 2003 now requires that the risk analysis takes into account the probability of occurrence, the kinetic and the gravity of potential accidents (article 4 of the law). It allows to assess precisely and objectively the acceptability of an industrial site in its environment. It can highlight the need for reducing the risks at the source, by cutting down the potientiel de danger (potential of danger), or reducing the probabilities of occurrence of the potential accidents and limiting the consequences through organizational and technical safety measures. The lessons learned from other "probabilistic" regulations (for instance, the Dutch or the British regulations, the French regulation regarding the nuclear plants...) have proven extremely useful.

Then, in order to have a consistent implementation throughout the country, the following actions have been carried out:

-21 technical working groups have been created between 2002 and 2003. They cover many industrial sectors or substances, such as ammonium nitrates, LPG, chlorine, ammonia, flammable liquids, pyrotechnics, refineries... Inspectors, policy advisers, representatives of operators and technical experts are members of these groups.

Their goal is to harmonize the practices within a same industrial sector and to share experience between the inspectors and the operators.

-A guideline describing the "General principles for the elaboration of safety reports" has been issued in 2006 (circular of [START_REF]Guidelines for Quantitative Risk Assessment-"Purple Book" CPR18E[END_REF]. It reviews all the elements that should be featured in a safety report. This circular makes also available other guidelines regarding for instance the human factor, the assessment of the gravity of an accident , BLEVE and UVCE in LPG units, etc. -France's National Institute of Industrial Environment and Risks (INERIS) has published many scientific documents about the new risk assessment methodology. They are useful tools for both inspectors and operators.

The safety report is a key element, as its results are directly used for decision making. The government has indeed developed a risk matrix for assessing the societal acceptability of the risk generated by a Seveso establishment (circular of September 29, 2005). The input data are the probabilities of major accidents and the number of people potentially exposed to their consequences. The matrix (see figure 1 below) defines three levels of accidental risk:

-Acceptable (in white the matrix): the risk is acceptable.

-Unacceptable (in red): the risk is too important.

-ALARP (As Low As Reasonably Practicable, in yellow): the risk has to be reduced in order to become "as low as reasonably practicable". New and existing establishments are distinguished:

-New establishments are authorized if there is no accident in the red zone and if the operator proves that the best available technologies for both prevention and protection are used on the site.

-For existing establishments:

-If there is one accident (or more) in the red zone, the safety must be improved in order to reduce the gravity or the probability and, as a matter of fact, translate the accident in the yellow zone. If accidents still remain in the red zone in spite of an improvement of the safety, the establishment is liable to be closed by the Conseil d'Etat1 . -If there are accidents in the yellow zone, the operator has to add additional safety measures in order to reduce the risk as low as possible, given an acceptable cost/effectiveness ratio. -If there is no accident in the red or yellow zones, the risk is considered as moderate provided the use of the best available technologies on site.

-Moreover, the law of July 30, 2003 involves safety reports for transport infrastructures where large quantities of dangerous goods can be momentarily in presence. The intended infrastructures are the sea-and river-ports, marshalling yards and important parking lots.

-Overhauling of the land-use planning policies: the Technological Risk Prevention plan (PPRT in French, standing for Plan de Prévention des Risques Technologiques) is one of the flag-ship measures of the law of July 30, 2003. The aim of the PPRT is to protect people by acting on the existing urbanization and also by controlling the future land-use planning in the vicinity of the existing top-tier Seveso establishments.

The whole process of the PPRT elaboration is carried out in cooperation between the local authorities, the operator, the CLIC representative and the residents. The lead-time is estimated at approximately 18 months. The most important stages are the following:

-Determination of the aléa2 by combining the probability of a dangerous phenomenon and the potential intensity of its effects. Aléas are calculated for each point of the territory and for each type of effects (thermal, overpressure and toxic effects). -Analysis of the stakes in the vicinity of the establishment. The types if construction and public buildings are distinguished. -Cross-reference of the aléas and the stakes, allowing to draw a zoning map.

The PPRT process is summed up on the following figure. When the PPRT is finalized, it delineates a risk exposure perimeter, at the heart of which regulated zones are established. These zones can be either:

-"ban zones", within which future constructions are banned (red zones on the figure 2 below). Inside this zone, areas can be defined for expropriation (dark red areas on the figure 2 below) or relinquishments (dark or light red areas on the figure below).

or "limitation zones", within which protective measures on the future or existing buildings can be compulsory (blue zones on the figure 2 below). The real-estate measures (expropriation and relinquishment) and additional risk reduction measures are evaluated to approximately 3 billion €. The financing of these measures is subject to a three-way financial agreement between the State, the operator and the local authorities.

The law of July 30, 2003 has hallowed the use of probabilities and frequencies into the French legislation and regulations regarding industrial risks. The risk analysis, at the heart of the safety report, has now to take into account the probability of occurrence, along with the kinetic, the gravity of the potential accidents. Then, combined with the gravity of potential accidents, the probability allows to assess the acceptability of an industrial establishment in its environment and the demonstration of risk control. As for land-use planning, probabilities are used for the calculation of the aléas, jointly required with an analysis of the stakes, for the elaboration of the PPRT.

PROBABILISTIC ASSESSMENT METHODOLOGIES USED IN FRANCE IN COMPULSORY SAFETY REPORTS

The French safety report comprises, among other things, a risk analysis and an assessment of major accident probabilities. In this second part, we will focus on the scenario identification realized through the risk analysis, on the methodologies used for assessing the reliability of safety barriers and on those used for assessing the central event frequencies. The methodologies and data used in order to assess the dangerous phenomenon from a central event frequency will be not detailed here. This includes in particular the use of ignition probabilities and meteorological data.

Scenario identification

The use of probabilistic concepts has turned out to be very useful. All known possible scenarios are indeed identified, analysed and graded with regards to their probability of occurrence. The probability allows studying an exhaustive list of scenarios without focusing the analysis on low occurrence probability accidents that lead to large consequences.

Under the new regulation regarding risk prevention, an industrial operator has to identify all known and possible major accident scenarios, along with their prevention and mitigation barriers. Some of the risk analysis methodologies used are HAZOP, FMEA, Preliminary risk analysis... This analysis is then followed by the assessment of the major accident probability, its kinetic and its potential consequences. The French regulation does not make compulsory a specific methodology, as long as the operator justifies his or her choice. The risk analysis usually identifies the possible central events (example: loss of containment) and their consequences (dangerous phenomena), but also, the initiating events leading to them. In order to present the results of this identification process, bow-tie diagrams have proven very useful. The figure 4 presents an example of a bow tie-diagram.

Fig. 4: An example of a bow-tie diagram

The bow-tie diagram is a combination of a simplified failure tree and an event tree. It is composed by initiating even1s in the left side of the diagram. Examples of initiating events could be a human error in a filling procedure, an impact resulting of a vehicle collision, a hammer effect... These initiating events lead to a central event which is often a loss of containment. Then, the central event leads to several dangerous phenomena such as BLEVE, boilover, pool fire, toxic cloud dispersion... Safety barriers may operate in prevention (before the central event) or in protection (after the central event). In the French regulatory framework, when protection barriers are considered, both the consequences of the success and the failure have to be assessed.

The probabilistic quantification of the scenarios is an important aspect of the safety report. Nevertheless, the qualitative identification of initiating events, central events, prevention and protection safety barriers and possible consequences realized through the implementation of the bow-tie diagram has to be considered also as a major step of the safety report. In terms of safety, this step noticeably improves the quality of the safety report.

When the identification step is achieved, the ability of the barriers to prevent the occurrence of scenario or to limit the consequences has to to be evaluated.

Safety barrier evaluation

In a French safety report, the barrier analysis is a main issue for the demonstration of the risk control. For example, the permit (or the operating authorization) process introduces the ALARP (As Low As Reasonably Practicable) concept through a risk matrix (see the 2.3 part). As before-mentioned, if the risk is considered as unacceptable or ALARP, operators have the responsibility to implement additional safety measures or to bring the proof their safety system meet the ALARP requirements. Moreover, in the land use planning process, the scenarios selected in order to define land-use restriction and modifications are defined on the basis of the probability level and the barriers implemented on the facility.

Under the French regulation, three kinds of safety barriers have been identified: technical barriers, human barriers and barriers which gather both technical and human elements (see figure 5 hereunder).

Fig. 5: Safety barrier typology (complementing the the typology presented in the 10 report (INERIS, 2005).

In order to be considered in the French regulatory framework, a safety barrier has to meet the following requirements. It has to be3 : -Independent: the safety barrier must be independent of the cause of the scenario or of the scenario itself.

-Effective: able to fulfil the safety function that it was chosen for, in its usage context, for a period of operation process independent and independent of other safety barriers. -With a response time in accordance with the kinetic of the scenario.

-Testable.

-Covered by preventive maintenance designed to guarantee that performance levels are maintained over time.

If these requirements are met, the safety barrier can be taken into account in the probabilistic quantification of a dangerous phenomenon. It reduces the occurrence frequency of a given scenario. The question is then how does the failure probability of a barrier can be assessed, and so at which extend the presence of the barrier will reduce the frequency of a scenario. Actually, there are few data about the failure probability on-demand of a specific barrier. Moreover, the available data are generally an average of failure rates and are not applicable for a specific facility, in a specific environment.

In order to assess this value, INERIS has developed a methodology described in the 10 and 20 reports (INERIS 2005 and2006). This methodology is illustrated by the figure 6. The assessment is based on the evaluation of each component of the barrier with regards to three criteria: effectiveness (Eff), response time (RT) and level of confidence (LC). The level of confidence is then converted into a "risk reduction factor" (RR). The risk reduction factor represents by how much the presence of a given barrier would divide the frequency of a given scenario. For example, if there is a scenario with a frequency of 1.10 -1 and a barrier with a risk reduction factor of 10 to prevent its occurrence, this means that the frequency of the event "occurrence of the scenario and failure of the barrier" is 10 -2 . In order to assess the risk reduction factor of the whole barrier, an aggregation of the data related to components is realised using a questioning process as described in the 10 and 20. Fig. 6: An example of the assessment of a barrier according to the 10 methodology The level of confidence, and so, the risk reduction factor of an active barrier is calculated using an extrapolation of SIL (Safety Integrity level) defined in the norms NF EN 61 508 and NF EN 61 511. The approach described in these norms has been extended to all active barriers. Concerning passive barriers and human barriers, a maximum level of confidence has been defined through literature researches. The level of confidence is then reduced on the basis of different criteria (INERIS 2005 and2006).

Most safety reports are based on this methodology in order to assess barriers. However, some other methodologies based on the use of reliability data are also used. In this last case, reliability databases such as OREDA and EIReDA are often used.

When all identified barriers are evaluated, the frequency of major accident can be assessed.

Dangerous phenomena probability

As operators are free to choose the methodology to be used in the safety report for assessing the occurrence probability of a dangerous phenomenon, the methodologies can be very different. Since 2005, two main methodologies have been used for major accident probability assessment: -Quantitative evaluation "from the central event to dangerous phenomena"; -Quantitative evaluation "from initiating events to dangerous phenomena". These two methodologies are approximately equally used.

The figure 7 presents these two methodologies. Fig. 7: The two mains methodologies used in France for the assessment of dangerous phenomena occurrence probability

In the following paragraphs, these two methodologies will be detailed together with their advantages and limits.

Quantitative evaluation "from the central event to dangerous phenomena":

This methodology is based on the quantification of event trees using Boolean algebra. The central event, which is often a loss of containment, is quantified using generic central event data. In France, data mainly comes from the Dutch "Purple book" (CPR 18 E, 1999) or from in-house operator database compiling and synthesizing generic data available in literature.

The main advantage of this methodology is its simplicity, both for the operator to set up and for the inspector to analyse. It also takes into account the activity volume of the facility (for example, for a hoses loss of containment, frequencies are expressed by hours of use) or the sizes of equipments (for example, for a pipes loss of containment, frequencies are expressed by meters).

On the other hand, this methodology has several limits. First, if the prevention of loss of containment is a major issue for the safety of an establishment, it is not taken into account into this methodology for the probabilistic assessment. Site specific aspects like specific lay-out, possible domino effects and specific environment are also neglected. Indeed, these data aim to express an average state-of-the-art of safety without consideration of local specificities. This methodology is indeed adapted to a work which focuses more specifically on limitation of consequences. Beyond limits related to the use of generic data, available generic data themselves present some imperfections: -Generic central event frequencies are an expression of an average state-of-the-art safety in a given period. However, details on this state-of-the-art (design of equipments, norms and regulation in force...) are not always available. As a result, the exact applicability field of these data is generally unknown.

-When available, the applicability field can appear to be limited. Some of the data often used in France come from quite old studies. Examples could be frequencies derived from Bush [START_REF] Bush | des risques d'accidents susceptibles de survenir dans les établissements dits[END_REF] or [START_REF] Smith | A survey of defects in pressure vessels in the UK for the period 1962-1978 and its relevance to nuclear primary circuits[END_REF] studies. It can be also underlined that many of available data come from nuclear studies. Their applicability to the case of chemical plant is often unknown.

-A generally well accepted method used to balance the non-specific characteristic of generic data is the use of "correction factors". However, an accurate quantified evaluation of these factors implies a precise knowledge of the applicability field and distribution of causes linked to the loss of containment frequency.

-Finally, data are not always available for all chemical facility equipments (example: data related to oil depot vapour treatment unit failures).

The good quality of central event occurrence data is, indeed, a major issue for the accuracy of the quantitative evaluation "from the central event to the dangerous phenomena". Unfortunately, although it has to be noticed that some data from recent studies are available for several equipments (example: oil open top floating roof tanks), good quality data are rare in the public domain.

Quantitative evaluation "from the initiating event to dangerous phenomena": This methodology is based on the use of simplified failure trees and event trees. Two main approaches are used in order to estimate the frequency of initiating events.

A first one uses reliability data, or generic frequencies obtained by using reliability data. These data can be available for failure related to equipments. However, data related to human and organizational failures are very limited. A second one, used by INERIS, is the assessment of the frequencies through a questioning process applied to a working group (which could gather for example the risk manager of the facility, people from the maintenance, operators, etc.). Each initiating event is derived by the working group. They are expressed using frequency classes (frequency ranges). The table 1 presents the scale of frequency classes usually used. Between 10 -1 and 1 per year F1

Between 10 -2 and 10 -1 per year F2

Between 10 -3 and 10 -2 per year F3

Between 10 -3 and 10 -4 per year

Initiating events leading to a common central event are combined using AND and OR operators:

-If any of the initiating event can cause the central event, an OR operator is used. In that case, the frequency class of the central event is equal to the minimum frequency class of the initiating event;

-If multiple initiating events (and the frequency of these events are below 10 -1 ) are required for the occurrence of the central event, an AND operator is used. In this case, the frequency class of the central event is equal to the sum of the frequency classes of the required initiating event;

-If a prevention barrier exists, the risk reduction factor of the barrier is added to the frequency class of the cause, which gives the frequency class of the intermediate event.

One of the more obvious advantages of this methodology is that it results from a deep analysis of the safety and of accident scenarios that could occur, their causes and barriers that prevent their occurrence. Therefore, site specific aspects (example: domino effects) and risk prevention issues are explicitly taken into account in probabilistic calculations. In this framework, operator's safety efforts are well promoted and their effectiveness is demonstrated qualitatively and quantitatively. The main possible causes of an accident are identified and graded in function of their frequency. The operator can, on this basis, target the future implementation of its prevention system.

As the methodology of the quantitative evaluation from the central event to the dangerous phenomenon, this methodology has numerous limits: -At first, when frequency classes are used, the assessment does not aim to be as accurate as an assessment using frequency values. This implies an increase of uncertainties when there is a need for aggregating the probabilities of different dangerous phenomena; -This methodology can take longer time to carry out. The identification and the quantification of multiple initiating events is a longer task than the definition and the quantification of a unique central event.

-Some initiating events are difficult to assess. This refers mainly to rare events that the working group have not observed in their facility or in similar facilities. An example of this could be an external impact on a pressure vessel. The frequency of some human errors may also be difficult to assess: distinguishing the occurrence of an initiating event from the occurrence of an initiating event together with the failure of a human prevention barrier may be difficult. In these cases, generic data on initiating events and reliability data can be used. However, when this solution is retained, the generic characteristic of the data implies several limits already presented above. An alternative way to assess the frequency of these events is the use of expert judgements. As for the methodology from the central event to the dangerous phenomena, the good quality of input data is also a main stake of the quality of the probabilistic assessment.

This second methodology fits better with the French regulation framework. Indeed, this framework gives the possibility to exclude from the societal risk assessment (MMR matrix related to permit to operate) and the land-use planning process a number of initiating events (earthquake, pressure vessel metallurgic default, aircraft crash...) if some conditions are respected. A probabilistic quantification "from the initiating events to the dangerous phenomena" allows taking into account these exclusions more easily than a probabilistic quantification "from the central event to the dangerous phenomena".

Conclusions

In the French regulatory framework, the ministry has proposed several guidelines for risk assessment. Nevertheless, the operator has the possibility to choose a general methodology in order to assess the reliability of barriers, the occurrence frequency of events and ultimately the occurrence probability of a major accident.

The probability of an accident is estimated by taking into account safety measures (barriers). The performance of safety barriers is evaluated with regards to the following criteria: independence, effectiveness, time response, testability and preventive maintenance. A methodology used in order to assess safety measures performance is described in the 10 and 20 reports (INERIS 2005 and2006). Reliability analysis and data may also be used. These performances allow to decrease the occurrence frequency of initiating events (corrosion, works nearby a pipe, etc.) or of dangerous phenomena following the occurrence of a central event (loss of containment).

Concerning the assessment of event frequencies, two main methodologies are used by French operators. As before mentioned, they present advantages, but their main limit is the lack of good quality data.

LESSONS LEARNED FROM THE USE OF PROBABILITIES

Six years after the law of July 30, 2003, a first analysis of the main challenges of the use of probabilities is proposed hereafter.

Site-specific frequency assessment

Under the law of July 30, 2003 and the regulations resulting from it, an assessment of the frequencies of events is required. As each industrial site is different, uses various types of safety barriers and can be located in a different environment, this assessment has to be site-specific. As a demonstration, two refineries could be considered:

-One refinery dating from the 1960s and located in the vicinity of the sea, -The other refinery dating from the 1990s and located in an area without any oceanic influence.

It seems pretty obvious that the frequencies of initiating events, such as for instance corrosion, can not be equivalent. Likewise, if the newest refinery has multiple barriers, the frequency should aim to reflect it. This explains why the French national authorities promote a site-specific assessment.

Nevertheless, a certain homogeneity within a same industrial sector is required. In order to face up these difficulties, the 21 technical working groups, created after 2003, have proven very useful. They allow indeed operators, inspectors and experts to share their experience, and, as a matter of fact, can help harmonizing practices.

Database gathering central event probabilities

In relation with the importance of a site-specific assessment, databases gathering central event frequencies are not scientifically satisfactory. Such databases can not help to discriminate the good sites from the bad ones: neither the prevention safety barriers are taken into account, nor the age of the facility, the safety management… As a matter of fact, it renders difficult to focus on safety improvements and to make cost-effective investments, as many informations on a given scenario are missing. That is why the French authorities do not promote such methodologies.

Low frequencies

As before mentioned, in the French frequency scale, the smallest frequency class is [0 -10 -5 ]. Frequencies lower than 10 -5 happen to be not statistically and scientifically representative. In order to adjust this deficiency, two alternatives could be identified:

-Frequencies could artificially be increased, by a precautionary approach. No scientific analysis is then considered in this process.

-The range of magnitude of frequencies could be justified by taking into account the failure rates of safety barriers.

The second alternative has been chosen in France. As an illustration in the land-use planning, the PPRT does not take into account the most improbable dangerous phenomena, provided the following conditions (Circular of October 3, 2005 regarding the implementation of PPRTs) :

-Their probability has to be lower than 10 -5 .

-In order to be sure that the probability is not intrinsic of the phenomenon, it should take into account at least two technical safety barriers.

-In case of an increase of the probability of failure on-demand of any of the safety barriers, the probability has to remain lower than 10 -5 .

If all the above mentioned criteria are met, then the dangerous phenomena will not be taken into account for the land-use planning.

CONCLUSIONS

The law of July 30, 2003 has created very powerful tools regarding risk prevention, crisis management, communication to the public, involvement of employees and subcontractors and land -use planning.

Before 2003, only the worst-case scenarios were taken into account according to a deterministic approach. The law of July 30, 2003 has introduced the use of frequencies and probabilities into the French system. The safety report has now to describe accurately the probability of occurrence, along with the kinetic, the gravity of the potential accidents. Then, combined with the gravity of potential accidents, the probability allows to assess the acceptability of an industrial establishment in its environment and the demonstration of risk control. As for land-use planning, probabilities are used for the calculation of the aléas, jointly required with an analysis of the stakes, for the elaboration of the PPRT.

Several methodologies for risk assessment can be used (operator choice), but the French authorities favour the probabilistic quantification "from the initiating events to the dangerous phenomena": safety barriers are well taken into account (and the operator efforts are then better promoted) and it is site-specific. Moreover, for the land-use planning, it can be helpful to exclude some very rare dangerous phenomena.

More precise conclusions about the benefits and the challenges brought about by the use of frequencies and probabilities in French risk prevention policies will be available at the end of the whole PPRT process.

  Fig.1: A simplified risk matrix and its input data: effects thresholds, gravity and probabilities.

Fig. 2 :

 2 Fig. 2: Simplistic scheme presenting the elaboration process of a PPRT.

Fig. 3 :

 3 Fig. 3: Simplistic scheme of the zones and areas resulting from the PPRT process.

Table 1

 1 Frequency classes used by INERIS in order to quantify initiating events

	Frequency class	Failure frequency
	F-1	Between 1 and 10 per year
	F0

The Conseil d'Etat is the highest level of the French administrative jurisdiction.

Aléa: Probability that a dangerous phenomenon creates effects of a given intensity, and over a determined period of time at a given point of the territory.

Definitions from the 10 and 20 reports(INERIS, 2005 and 2006).