Y El-Shayeb
email: elshayeb@mineis.u-nancy.fr

T Verdel

C Didier

Fuzzy Reasoning for the analysis of risks in geotechnical engineering. Application to a French Case

Since the beginning of the year 1995, in France, geotechnical works must undergo what is called a Plan of Natural Risks Prevention (Pian de Prevention des Risques Naturels, so called PPR). Such a plan is supposed to include the analysis of risks induced by the geotechnical works on the environment as well as its geotechnical impact (rock falls, rock slides, etc.). The analysis is based on various parameters and leads to the evaluation of the induced risk in order to classify it into four classes according to French standards. This type of study has been mcagerly developed through the experience of geotechnical engineers using linguistic evaluation of parameters that determines zones sensible to these different types of risks based on classes of values for different judging parameters such as slope angle, joint .inclination, etc. In the present study, a computer program has been developed for this analysis based on a fuzzy algorithm and fuzzy reasoning. The fuzzy algorithm has been developed in order to replace a part of the experts' work by using fuzzy numbers to overcome the problem of describing various parameters affecting the risk.

INTRODUCTION

The analysis of risks induced by unstable cliffs is one of the major and important tasks in geotechnieal engineering, This analysas should take into account the fact that some engineering parameters that are necessary for any risk analysts around unstable eliffs are difficult to be quantified and/or they are vague and imprecise. That is why such risk analysis should depend meagerly on the experience of the geotechnical engineer in charge for measurements. According to the French law, an area that is subjected to a PPR study, should be classified into four categories expressing the natural risk into High, Intermediate, Low, or Negligible. This classification is then used by local administrations, insurance companies, and political issues of urban planning. This paper shows part of the analysis made by the engineers of die INERIS (Institut National de l'Environnement Industriel et des Risques, in France) for the evaluation of geotechnical risks around an unstable cliff zone situated in the Parisian basin. This work is based mainly upon die experience of die geotechnical engineers as well as observation and proposition of discrete values describing the state of the cliff overlying sometimes abandoned underground workings. The authors have proposed -with the help and consultation of INERIS-some modifications to die current methodology in order to account for the vagueness, uncertainties and the imprecision in the estimation of each observed parameter, Thi$ methodology has been optimized and automated using Visual Basic Programming in order to aid and facilitate lhe judgment of the experts' work needed for the analysis. In order to perform such operations, fuzzy numbers have been proposed in place of the discrete numbers used in the analysis and the fuzzy reasoning is used to evaluate the risk.

GENERAL METHODOLOGY FOR NATURAL RISK ANALYSIS

The methodology for risk analysis proposed by INERIS is based upon the observation of some parameters at the sites underconaideration. The method of analysis is inspired by the classical method of Rock Mass Classification proposed by [START_REF] Bieniawski | Engineering Rock Mass Classifications[END_REF]. The procedure of this analysis is divided into 4 stages. The first one is the observation stage in which, the engineer has to observe and document some parameters at the field concerning the cliff, and the area around it. This stage is followed by a stage of calculations in order to find out the sensitivity of the site towards a certain phenomena. The.other two stages consist of table crossing in order to find out the possibility of occurrence of the phenomena and the risk imposed on the site. Figure 1 shows the diffèrent stages of this analysis. All observed parameters (Intensity, Activity, Sensitivity Parameters) are classified into 4 classes. In order to calculate the sensitivity of the site towards a certain phenomena, five parameters are measured. These parameters are: joint spacing (JS), joint roughness (JR), humidity of fissures (HF), direction of joints with respect to the front (DIR) and the dip angle o{ joints with respect to the front (DIP). The activity of the site could be considered as the history of the site and classified into four classes as sleeping, inactive, fresh, and active. The intensity of the phenomenon is also classified into four classes determining the volume of the possible blocks fall. Table 1 shows the different classes of the sensitivity parameters and their classification. The second stage of the analysis consists of the calculation of the sensitivity from the notes given to the sensitivity parameters mentioned earlier. This calculation of the sensitivity is adapted and adjusted to the present case according to the available data and is done in a way similar to the methods used for the RMC of Bieni^wski (1989). The calculation of the sensitivity of the studied cliff follows the next equation:

S-((4 JS)+(2 JR)+(HF)+(DIR)+(2 DIP))x(I/3)

The third and the fourth stages of the analysis consist of crossing rules cables in order to find the possibility (the activity vs this sensitivity), and another crossing to find the risk (the possibility vs the intensity). These table crossings define the rulesfor the fuzzy logic reasoning used in the analysis.

.

COMPUTER PROGRAMMING

In order to perform the classical analysts as well as the fuzzy analysis, a computer program has been developed using Visual Basic edition Application (VBA) on EXCEL™. This computer program includes three modules, the first one is for classical (Discrete) analysis, the second is for statistical simulation analysis using different types of probability distribution for each parameter, and the third module is devoted to the analysis using fuzzy Sets theory. This program could be adapted in later stages in order to take into account different parameters and to analyze the risk in other sites encountering the same types of problems. In the third module of the program, we have proposed two types of fuzzy numbers in order to describe each observed parameter. The first type is a continuous -Beta shape-number which could serve to describe an "around X" number. In this case, the user has to supply only the minimum and the maximum values of the number. The second type of fuzzy number is a trapezoidal shape number, which could serve in describing a parameter that has multiple values with multiple possibilities. Figure 2 FUZZY REASONING In order to find out the results of the analysis using fuzzy numbers, we have applied the method of ot-cut in order to convert -after normalization-the fuzzy numbers supplied by the user into 50 ft-cuts. Then &. fuzzy reasoning is applied to these numbers in accordance with the rules supplied in the Gables in order to rind out a fuzzy result for the sensitivity, the possibility, and the risk. This fuzzy reasoning is based on the Min-Max reasoning method as shown in figure 3. The geotechnical engineers along with the experts have to define the classes of each parameter interfering in the analysis as well as the classes of the results for the sensitivity, possibility, and the risk,

RESULTS

Figure 4 shows a result of the analysis carried on in a part of the cliff. It can be seen that the sensitivity plot which is situated to the left hand side of figure 4 is located in the second and the third class with a possibility of 82% in the second (Favorable) and an 18% in the third (Unfavorable), and the same possibilities for the risk plot which is on the right hand side of figure 4-In our analysis, we have used the method of center of gravity in order to defuzzify the fuzzy results. We can notice that the center of gravity for the sensitivity is at 51.6 ÛS for the risk it is at 47.55. These values are measured on a pre-defined scale from 0 to 100.

CONCLUSION

Since the method of geotechnical risk analysis at the cliff under consideration is based upon the experience of the geotechnical engineer in charge, a computerized assistance is essential in order to aid the judgment of the engineer, to normalize the decision, and to automate the procedure of the analysis. Another need for this type of analysis is to overcome the problems of uncertainties, imprecision, and vagueness in parameters estimation. The fuzzy algorithms are used here in order to find a feasible solution although some points have to be re-considered such as die definition of the classes for the input and the results and also in order to re-define the reasoning rules. This work is critical and requires the gathering of various experts and specialized engineers in the field of geotechnical engineering. It was our main concern in this paper to present the methodology of fuzzy reasoning for the quantification of risk. We have found out Chat this method is applicable to our case and could be adapted to other cases and sites

mFigure 1 .

 1 Figure 1. General Procedure of the Analysis applied to the cliff of under consideration

Figure 2 ,

 2 Figure 2, The choice between continuous and trapezoidal fiKzy number

Figure 4 .

 4 Figure 4. The result of the analysis showing the sensitivity and the final risk.

Table 1 -

 1 Sensitivity Parameters Parameter

		ote
		Assigned
	Spacing between Fractures (PF)
	< 0.2 m		3
	0.2 ~ 0.6 m		2
	0.6 ~ 2 m		1
	>2m	0
	Spacing and Roughness of Joints (ER)
	Spacing > 5 mm, continuous filled with clays	3
	Spacing < 5 mm, surface of potential sliding		2
	Spacing < 1 mm, Altered surface		1
	Closed, no alteration of roughness		0
	Humidity of Fissures (HF)
	Water current		3
	Water drops		2
	Humidity		1
	Dry		0
	Structural direction with respect to thejront (DIR)
	<5°5		3
	*-15°1		2
	5° -30°> 30 D		1 0
	Inclination of fissures with respect to the.front (PEN)
	-15" --5°-		3
	5-5°5		2
	°-15°>		1
	15°N	0


ROAD TRANSPORTATION OF DANGEROUS GOODS

QUANTITATIVE RISK ASSESSMENT AND ROUTE COMPARISON

Philippe CASSINI -INERIS -BP 2 -60550 Verneuil en Halatte -FRANCE

Transportation of Dangerous Goods (TDG) by road creates risk for the people present on and along the routes (road users and surrounding population). To minimize them is it better to have TDG going through a city or on the contrary by a longer detour through less populated areas ? The choice is not always easy. It may become very difficult when the detour goes through tunnels. There, accidents may have developments and consequences very different from what might happen on an open air route. To make the right choice it becomes necessary to use a QRA (Quantitative Risk Assessment) approach dealing with the accident scenarios likely to occur, their probability and possible consequences. It may be useful to identify the DG (Dangerous Goods) classes which contribute most to the risk and examine the interest of non-uniform strategies i.e. different routing for certain DG.

Studies for real sites

INERIS has determined the risks due to TDG for real sites where traffic could go either through a city or an alternative route including a tunnel. Lengths of the tunnels ranked between 2 and 9 km. To perform these studies, INERIS has devised and used a method for determining curves of yearly frequency against number of fatalities corresponding to the risks due to TDG on each route. These curves are hereafter mentioned as « F/N curves ». This method is very flexible and may be used in very various configurations.

To practically use it, it is necessary to gather, during a first stage, data concerning :

• density of population in the concerned geographical area (possibility to take into account diurnal or seasonal variations),

• traffic of all vehicles and foreseeable routes (possibility to take into account diurnal or seasonal variations),

• traffic of DG : nature of contents and holders, global annual traffic, foreseeable evolutions,

• meteorology in the concerned geographical area,

• layout of the open-air routes (which are divided in « segments » with constant probability of occurrence of each scenario),

• if it applies, dispositions taken for the design and equipment of the tunnels.

Generally around ten scenarios are chosen (table 1). Five of them are relative to LPGs (propane has been chosen as a representative DG) because of the different physical phenomena they can generate. Their physical consequences (overpressure, heat flux, toxic concentrations for different meteorological conditions) have been calculated and entered in a data-base.

Nature

Minimizing risk between several alternative routes

In case where DG may be transported by different routes, the method enables to determine the risk that would result from TDG for each route if it were the only one chosen for the DG traffic (DG traffic forbiden on the other routes). Interpretation of results relies on comparing the various F/N curves pertaining to the routes or on comparing the various associated « mathematical hopes » (Each F/N curve gives a mathematical hope which represents the area located under the F/N curve. It indicates the yearly number of fatalities when the accidents of every severity are summed up and is expressed in fatalities per year).

This comparison leads to a certain conclusion in the case of F/N curves that do not intersect (as shown on figure F1).

It is also possible to get intersecting curves, but with significantly different mathematical hopes (as shown on figure F2), and this even when uncertainties are taken into account. Once more, a conclusion is at hand.

When F/N curves intersect and lead to close mathematical hopes, the method does not help in the decision process except give indication that the comparison of risks linked with DG is not discriminating and decision might be made on other criteria.

Judging of the acceptability of risk on a route.

It is possible to judge of the acceptability of the risks due to TDG on a route by comparing the F/N curve with acceptance criteria in case such criteria are available and accepted (Figure 3 shows a fictitious use of such criteria).

Societal risk may also be judged on a local basis using iso-contours like those appearing in Figure 4 . These contours indicate for each area the statistical probability level to get fatalities. These probabilities take into account the population densities and their eventual daily and seasonal variations.

It is also possible to compare individual risk for the surrounding populations with individual risk acceptance criteria.

Conclusion

QRA of risks due to TDG helps in decision making when routes have to be chosen for DG transit and one wants to minimize resulting risks. It also enables to situate the risks due to TDG against other kind of risks (fatalities due to banal traffic accidents i.e. no have been produced and used for real site cases.

Nevertheless, further work has still to be carried out in order to make these evaluations easier, more accurate and indicate the magnitude of the uncertainties.

List of figures :

Figure

  Figure F1 Example of non intersecting F/N curves.

Figure

  Figure F2 Example of intersecting F/N curves with different mathematical hopes.

Figure 3

 3 Figure 3 Example of comparison of a F/N curve with an acceptance criterion.

Figure 4

 4 Figure 4 Iso-contours of societal risk due to dangerous goods traffic on an open air route (taking into account the population layout).

Fig

  Fig F1 -Example of non intersecting F/N curves

Table 1 -

 1 List of scenarios explored for QRA.

	of scenario

Determination of the occurrence probabilities and effects

For each scenario, the zones of effects are determined. For each scenario and each segment of a route, the occurrence probability is determined. These determinations have been backed up by a review of DG accidents occurred during transportation or in industry.

Two numerical tools have been designed to make possible a practical use of the method.


C Maisonneuve

P Person

C Duquennoi

A Morin

ACCELERATED AGING TESTS FOR GEOMEMBRANES ÜSED IN LANDHLLS

This paper presents an accelerated aging lest for geomembranes which combine the different aging conditions in a landfill (chemical, mechanical and temperature). Results of physicochemical analyses and mechanical tests conducted on aged high density polyethylene geomembrane are presented. Stress cräcking and plasticizing were observed for immersion times less than 4 months.

l. INTRODÜCTION

Nowadays, the use of geomembranes in landfill lining Systems or in final covers can be considered äs state-of-the-art in many countries. Despite the wide use of FMLs, the ubiquitous question of the Service life of geomembranes in landfills is still largely unanswered.

An extensive bibliography exists on the compatibility of polymers with various chemicals. Tests conducted on this issue, mainly consist in immersing polymer samples in pure or dilute chemicals for relatively short periods and then in testing their modified characterisücs. Fewer are the references concenüng ageing processes affecting geomembranes, which are complex mixtures of polymers and additives. Eventually, there is a relative lack of literature on the particular issue of the long-term behaviour of geomembranes immersed in landfill leachates.

 on HDPE and PVC geomembranes.

Practically, a durability test should not take more than several weeks. Otherwise, it would be rejected both by the geomembrane manufacturers, by the landfill operators and by the administration. It is therefore necessary to develop tests in which aging mechanisms are similar to those occurring in landfill conditions, but in an accelerated way.

The goal of the study prcsented herein is to accelerate the aging of geomembranes by the means of artificial conditions. The research program involved four Fiench laboratones : CEMAGREF (Institut de Recherche pour I'Ingenierie de l'Agriculture et de l'Environnement), INERIS (Institut National de l'Environnement et des Risques Industrieis), IRIGM (Institut de Recherche Interdisciplinaire en Geologie et Mecanique, Grenoble University) and CETE (Centre d'Etude Technique de l'Equipement). under financial Support from ADEME (Agence de l'Environnement et de la Mattrise de l'Energie).

AGING IN LANDFILL LEACHATES

Geomembrane aging conditions in a landnil

Solicitations to which a geomembrane may be exposed in a landfill vary with time (installation phase, waste Operation phase, after-closing phase) and wilh location of the membrane in the landfill (bottom, slopes, cover)

X

Swelling is not considered äs a geomembrane degradation proper. A large array of macromolecular solids are able to withstand swelling of their amorphous regions without exhibiting changes in their physical or mechanical properties [START_REF] Koemer | Long tenn durability and ageing of geomembranes[END_REF]). However, swelling enhances molecular mobility and is sometimes the first Step towards severe chemical degradations.

Absorbed solvents may also plasticize the geomembrane. At the molecular level, plasticizing mainly consists in solvent molecules enhancing molecular mobility. The macroscopic impact of plasücizing concems mechanical properties: both yield point and modulus ofelasäcity are lowered when plasticizing occurs. Such effects have been observed on HDPE and PVC-P geomembranes immersed in solvents like water, toluene, acetone and Chloroform (Ferrand, 1995). A decrease in the elasticity modulus was also observed on PVC-P geomembranes immersed in actual leachates [START_REF] Duquennoi | Laboratory ageing of geomembranes in landfill leachates[END_REF] when tested in the humid state. Another effect of solvent plasticizing is the lowering ofthe glass transition temperature (Verdu).

It has to be underiined that solvent swelling and plasücizing are reversible physical phenomena.

Loss of additives

Geomembranes are always consütuted of a base macromolecular (polymeric or bituminous) phase mixed with additives which function is to enhance performances of the base constituent, during the manufacturing process, or during the service life. Additives may be plasticizers, stabilisers, anti-UV, antioxidants, etc.

ünder given conditions, and particularly when the geomembranes are immersed in solvents or in aqueous solutions like landfill leachates, additives may be partially or totally extracted, or chemically modified inside the geomembrane.

Consequences of loss of additives depend on the functional properties of the geomembrane enhanced by the additives. For example, extraction of plasticizers from a PVC-P geomembrane causes its elasticity modulus to increase and its elongation at break to be lowered, which means that the geomembrane is not only rigidified but also fragilized. This phenomenon has been observed in the case of PVC-P geomembranes immersed in actual leachates in the laboratory [START_REF] Duquennoi | Laboratory ageing of geomembranes in landfill leachates[END_REF] äs well äs on PVC-P geomembrane samples from water and landfill leachate storage ponds [START_REF] Duquennoi | Laboratory ageing of geomembranes in landfill leachates[END_REF][START_REF] Fayoux | Assessment on a PVC geomembrane in a landfill after ten years[END_REF].

A loss of antioxidants, äs observed in the case of a HDPE geomembrane immersed in actual leachates [START_REF] Duquennoi | Laboratory ageing of geomembranes in landfill leachates[END_REF], may favour oxidation phenomena under given conditions.

The principal factors affecting the loss of additives are the extraction conditions at the geomembrane surface, the diffusivity of the additives in the base constituent-The swelling of the membrane which enhances molecular mobility, and temperature which elevaüon favours additive migration.

The loss of additives is always non-reversible.

Chemical modifications ofthe base constituent

Among all polymer chemical aging mechanisms, oxidation is probably the most quoted in literature. It occurs more frequently in the emerged parts of a geomembrane lining structure or in final covers (reaction between the air and the polymer). The probability of oxidation reactions taking place in geomembranes at the bottom of landfill cells is much reduced, for oxidation reactions underwater occur in a much slower manner (Verdu).

Polymer chain scission is a chemical aging mechanism which may occur in the presence of absorbed water (hydrolysis) or chemicals (alcoolisis, etc.), in given chemical and temperature conditions. Example: the alcaline hydrolysis of polyester geotextiles. Nevertheless, chain scission has never been observed on geomembrane polymers in landfill conditions or similar conditions.

In reticulation reactions, additional bonds between neighbouring polymer chains are created.

The effects of reticulation are an increase in elongation and stress at break (Verdu 1 '). Chain scission and reticulation are generally in competition.

All chemical modifications of the base constituent may be triggered by temperature (thermochemical aging), light (photochemical aging), radioactivity (radiochemical aging) or by the sole presence of chemicals like hydrocarbons. Chemical modifications of the base constituent are always non-reversible. (Lord and Koerner, 1991) Semi-cristalline polymers in the visco-elastic state, can develop two types of break:

Stress cracking

-Ducüle break obtained with a stress large enough to produce a fast yield point. Interiamellar chain tension produces intra-cristallite break.

-Brittle break obtained with a smaller stress. Break occurs in the amorphous zone (intercristallite break). This phenomenon is very interesting because the two conditions to induce stress cracking are present in situ (mechanical stress and chemical agents(tensio-actif) and correspond to usual Situation in landfill.

ACCELERATED AGING

Aging is detined äs a very slow and non-reversible evolution of a functional property of the material [START_REF] Verdu | Vieillissernent des plastiques[END_REF]. Besides natural aging evolulion, it seems interesting to accelerate aging without modifying natural aging process.

Goal of the study

The goal of the study is to artificially accelerale the aging of geomembrane to allöw a fast and practical determination of the durability of geomembranes in contact with landfill leachates. Our tinal goal (not presented in this paper) will be to find accelerate factors between landfill and artificial aging by characterising mechanisms of aging.

It should be underlined that comparisons between geomembrane types in terms of durability and performance is totally out of the scope of the present work. It only aims at preparing a research-based methodology for durability determination.

This aging study concerns only High Density Poly-Ethylene (HDPE) membranes. Others material types of geomembrane will be sludied later. Seamed geomembranes have also been tested for seamed area often more sensible to Stresses.

Tested properties are thought to be representatively related to the barrier function of the geomembrane. The main stresses affecting the geomembrane properties are mechanical, chemical and biological. The original concept of our study is to combine mechanical and chemical Stresses observed in natural aging conditions. In our experiments, aging conditions are temperature, immersion medium and mechanical stress. All the experiments tests and analyses presented in the next sections were conducted at the INERIS.

Analyses

It has to be underlined that aging depends on numerous parameters: some parameters can be isolated and others are interacting. Mechanical tests will be used to observe modifications of the mechanical properlies and in parallel, physico-chemical analyses used to explain this modification [START_REF] Surmann | Geomembrane liner performance and long terme durability[END_REF]. The final goal is to correlate analytical aspects and evolution of functional properties changes.

Combining experimental results on HDPE polymer with bibliographical analysis, unaged reference samples and aged samples are tested using the t'ollowing methods: i Mass Variation measurements: the mass change is measured after immersion, and after 48 hours drying at 60°C. This drying process is used to extract all the solvents absorbed by the geomembrane.

i Density: Itis measured by comparing the weight ofthe sample and the weight of water occupying the same volume äs the sample.

-Physico-chemical analyses

i MFl: Melting Flow Index. A given amount of polymer is heated in a furnace until it melts. A constant load pushes it through an orifice and in the bottoni of the test device. The MFI value is the weight of extruded material in grams for a 10 minutes duration. Higher is the value of MFl, lower is the molecular weight of the polymer [START_REF] Koemer | Long tenn durability and ageing of geomembranes[END_REF].

i DSC: Differential Scanning Calorimetry. With DSC, temperature of fusion and cristallinity can he determined.

i TG: thermogravimetry. The weight of geomembrane samples is measured with temperature increases. With TG, we can detennine the mass of residue at a given temperature and the loss of additives.

i OIT: oxidative induction time. In isothermal conditions , OIT measurements gives the tüne when oxidaüon appears and specific loss of antioxidants can be deduced. i //?: infrared spectroscopy. Each material has a characteristic infrared spectrum. Through the determination of functional groups. this method leads to the determination of solvent absorption and loss of additives.

i GPC: Gel Permeation Chromatography gives the molecular weight distribution. Chain scission can be detected through comparising curves betöre and after aging.

-Mechanical tests:

i Tensile test: NF 84-501 (French norm). Most important tensile properties determined with tensile test are secant modulus, elongation and stress at yield point and break.

i Shear fest: NF 84-502 (French norm). Tensile test on seamed samples.

i Peel test: NF 84-502 (French norm). Test of the quality of the seam, äs showed in figure l.

i Relaxation: Measures the stress required for a constant deformation. We also measure resilience, i.e. the residual deformation after the mechanical stress is back to zero.

i Sn-ess cracking : Two conditions are necessary lo develop stress cracking.

Mechanical stress: Stress Cracking tests are conducted at stress levels between 35 and 60% of the stress at yield point. Immersion medium; we compare results obtained with SIM and with water + 10% Igepal (tensioactif). Cracks are initiated by a notch (depth 0,2* sheet thickness) perpendicular to the uniaxial stress direction. Figure 2

Study

Chemical, thermal and mechanical aging conditions have been selected on the base of literature and pre-study data. It is very difficult to elaborate a typical leachate composition because leachate composition varies enormously with sites and with time. A synthetic immersion medium (SIM) has to be designed in order to trigger aging mechanisms similar to those observed in unaccelerated conditions (ADEME, 1994). The SIM (table 2) is an aqueous solution of selected active chemicals and should not be considered äs a synthetic leachate : it does not reproduce a typical leachate composition, but is rather a collection of aging-triggering agents. SIM is defined to age the geomembranes without modifying aging mechanisms.

Each solvent of the SIM represents a family of solvents, known to be interacting with geomembrane; concentrations in SIM are 10 to 3000 times higher than concentrations in the most aggressive landfill leachates.

PH tensio actif aliphatic chlorinated hydrocarbons aliphatic hydrocarbons aromatic hydrocarbons phenol cetone

igepal Co 720 perchlore thylene heptane xylene phenol cyclohexanone 2 10 g/l 0.1 g/l 0.1.s/l 0.1 g/l 3 g/l 30 g/l Table l: Initial* SIM composition Mechanical and physico-chemical analyses were conducted on unaged and aged samples in order to quantify aging in terms of evolution of key macroscopical material characteristics, and to identify the corresponding physical and chemical aging mechanisms.

Aging tests were conducted on seamed geomembranes äs well äs on unseamed material. *It has been observed that the initial SIM composition changed with time (measured by mass spectroscopy). Solvent evaporation can never be completely avoided; it has to be considered äs one of the experimental condition Samples are immersed in the SIM at 60°C and under 5% tensile strain. They are regularly taken out from the tanks (every 2 months with a maximum immersion time of 8 months). Samples are then weighted (before and after drying at 60°C during 48 hours) and tested using the above described methods.

Results

Mass Variation measurement: The absorption appears very quickly and is reversible.

. Density: No change is observed.

Physico-chemical analyses:

. DSC and TG: We notice no significant Variation. For DSC analyses, variations between aged and unaged samples are less than 3°C, which is the occuracy of the measure.

. IR: No significant spectral Variation is observed. for the geomembranes which were immerged 8 months in SIM at 60°C, compared to the reference sample (non immerged).

. OIT: We can notice a significant decrease of the induction time corresponding to a loss of antioxidants (figure 3) . tensile lest: Values of secant modulus of elasticity decrease. The stress and deformaüon at yield also decrease: material is plasticized and becomes softer. The plasticizing appears not before 4 months.

. peel tesr. no significant Variation is noticed. This test is generally used äs a performance lest [START_REF] Lempereur | Etüde critique des methodes d'evaluation des assemblages de geomembranes[END_REF].

. relaxaüon: (figure 6) a residual intemal stress is observed during aging under constant strain. This residual stress is higher in unaged samples than in aged samples at the same imposed strain. This phenomenon may be attributed to the plasticizing of aged samples. ------------------------------------------------------------

CONCLUSION

We notice no physico-chemical changes in HDPE except a loss of antioxidants.

The mechanical results show a plasticizing noticed on seamed äs well äs on non seamed samples. This change appears in tensile test and in relaxation measurement after about 4 months.

HDPE geomembrane have a good resistance to the applied Stresses. Analytical methods reveal no differences between non aged and aged samples. Only mechanical tests show differences. Additional analyses are necessary to correlate mechanical Stresses with a change in structure.

Under financial support from ADEME, this study should continue: results and interpretations for EPR-PP, PVC-P and bituminous geomembrane will be presented and discussed in future publications.

ACKOWLEDGEMENTS

This study was partially financed by ADEME and could be achieve thanks to the CETE laboratory in Lyon (France). The aging study on HDPE was conducted at INERIS laboratory (which supported a PhD work with ADEME on this subject) and at IRIGM, university of Grenoble (France).

  Figure l: Pecl lest

-Figure 4 :

 4 Figure 3: Oxidation induction time (T=200°C) -Mechanical results: shear fest: We also notice a plasticizing presented in figures 4 and 5. & Jtfv S ,» 'S) 16 • | 14-G« 2 12u '^ 10-

Figure 4 :

 4 Figure 4: relaxaüon modulus (MPa) vs. time. stress cracking: Figure6shows the time until break of samples submitted to different stress level. The first results show the transition t'rom brittle break to ductile break (40% stress at yield) and confirms the sensibility of semi cristallin polymer to stress cracking, äs said in 2.2.4. Photos l and 2 (next page) present the two types of break: ductile break (photo l) and brittle break (phpto 2).

Figure 6 .

 6 Figure 5: Stress cracking

  . Most of the physical, chemical and biological solicitarions a geomembrane may encounter in a landfill are presented in table l:

	solicitation	bottoni
	Puncturing by drainage layer gravels (during	X
	installation and under static waste load)
	Puncturing by tools during installation
	Tensile strain if settlement of the supportin.e soil
	Traffic during installation and waste disposal
	Light and climate exposure before covering
	Immersion in leachate
	Heat produced by waste degradation
	Micro-organisms
	Rodents
	Permanent stress at seams and Singular point
	Puncturing by static concrete structure loads
	Puncturing by waste
	Tensile stress
	Contact with landfill gas or oxygen
	Tensile strain if settlement of the waste
	Roots

X X X X X X X X X » slopes X X X X X X X X X cover X X X X X X X X Table l: solicitations in a landfill2.2. Observed aging mechanisms2.2.7 Solvent absorptionMany types of solvents are present in landfill leachates, the most available of them being of course water. Organic solvents are also present in leachates and may have large affinities with geomembrane materials.Solvent absorption leads to two types of modification of the polymer properties: swelling and plasticizing.


P Pandard'

E Thybaud

' V Ducrocq

S Hallier-Soullier'

N Truffaut'

Contribution of ecotoxicological tests in the evaluation of soil bioremediation efficiency

INTRODUCTION

Clean-up of contaminated soils became a high priority only recently. Several techniques have been developed forthis purpose such äs chemical, physical, thermic or microbiological methods. Efficiency of the remediation can be estimated using two approaches : a chemical specific approach and a toxicity-based approach. So far, the efficiency of the decontamination process was based essentially on chemical analyses which does not integrale the toxicity of all the soil contaminants and does not give a response on effects caused by the bioavailable fraction of these contaminants äs the toxicity-based approach.

In the present study, bioremediation efficiency of a soil contaminated by 4-chlorobiphenyl was evaluated using chemical and biological analyses. Experiments were carried out in microcosms contaminated at a rate of 1 g/kg. Control microcosms without specific degrader were performed simultaneously. Acute toxicity to earthworms and inhibition of growth of barley roots were selected, from previous work, äs relevant ecotoxicological teste.

METHODS

Microcosms

Experiments were performed in microcosms: 30 kg of OECD artificial soil contaminated at a rate of 1 g/kg. 4-chlorobiphenyl was dissolved in acetone before addition to the soil. After mixing and evaporation of the soivant, deionised water (control microcosm) or bacterial Suspension in saline were added to give an overall moisture content of 30 % of dry weight. Microcosms were incubated at 20°C in the dark.

Bacterial strains

In the first experiment, microcosm was inoculated with Pseuctomonas sp. B4, a biphenyl and a chlorinated biphenyl degrader (10 7 bacteria per g of dry soil). In the second one, two bacterial strains were introduced successively : Pseudomonas sp. B4 and Pseudomonas sp. CBS3, a chlorobenzoate degrader (10 7 bacteria per g of dry soil). These strains were inoculated at the beginning of the experiment and after 3 weeks respectively..During the last experiment, the two strains were inoculated simultaneously. Total and adapted bacterial populations (plating techniques, acridine orange epifluorescence counting, quantitative PCR after total DNA extraction) were followed within the experiments.

AND Pseudomonas sp. B4 slone

Analyticai methods

Experiment n°1

Soil samples (20 g wet weight) were extracted for 30 minutes in an hexane/acetone mixture (1/1) and resuspended in methanoi (1.5 ml) after filtration and evaporation. Soil extracts were analysed by GC/ ECD. Experiments n°2 and 3 In addition, concentrations of 4-chlorobenzoate (intermediate metabolite of the degradation of 4-chlorobiphenyl) were determined. Both compounds were analysed by HPLC with UV detection (254 nm). The same extraction method was used in these experiments.

Ecotoxicological tests

Bioremediation efficiency of the contaminated soil was evaluated during the two experiments using the following tests :

-inhibition of root growth of barley (ISO 11269-1), -acute toxicity to the earthworm Eisenia fetida (ISO 11268-1). Both tests were carried out on 100 % soil (inoculated and control microcosms).

While 4-chlorobiphenyl was rapidlydegraded by Pseudomonas sp. B4 : 87 % in less than one week , the toxicity of contaminated soil remained comparable to the control one.

Notwithstanding a lower concentration of 4-chlorobiphenyl than the no observed effect concentrations for earthworms and barley (127 and 135 mg/kg respectively), no detoxification was observed at the end of the experiment with regards to the initial toxic effects. _k

• ^RESULT S ÄND DISCUSSION

Further experiments demonstrated that the residual toxicity could be attributed to the 4-chlorobenzoate : a dead-end metabolite of 4-chlorobiphenyl degradation by Pseudomonas sp. B4. This compound was found to be äs toxic äs the parent compound towards earthworms and barley (table 1).

After day 28, a decrease of the 4-chlorobiphenyl concentration was observed in the control microcosm (fig1

Pseudomonas sp. B4 and Pseudomonas sp. CBS3 successively

The experiment was repeated with a successive inoculation of two bacterial strains : Pseudomonas sp. B4 and Pseudomonas sp. CBS3, a 4-chlorobenzoate degrader. Inoculation with tnose strains occured respectively at the beginning of the experiment and after 3 weeks. A reduction of the 4-chlorobiphenyl concentration and a corresponding production of 4-chlorobenzoate was observed during the first 3 weeks (fig 3). No decrease of the soil toxicity was recorded within this period (fig 4) äs shown in the first experiment.

Detoxification of soil was effective one week after Pseudomonas sp.CBS3 inoculation in the microcosm äs shown in figure 4, concomitantly with the disapearance of 4 chlorobenzoate (äs observed in figure 3).

A decrease of the 4chlorobiphenyl concentration has also been observed in the control microcosm äs in the first experiment, probably due to an aerial contamination ofthis control microcosm by Pseudomonas sp. B4.

Pseudomonas sp. B4 anct Pseudomonas sp. CBS3 simuitaneousiy

When the two strains are inoculated at the same time, a reduction of the 4-chlorobiphenyl concentration was noticed in both soils: artificial and agricultural (fig 5). No concomitant production of 4-chlorobenzoate was detected. Concerning control microcosm, the 4chlorobiphenyl concentration remained stable during all the experiment (Test conditions were fitted in order to avoid aerial contamination between test and control microcoms). Ecotoxicological tests confirmed the efficiency of the remediation : one week after the beginning of experiment using an artificial soil, two weeks after using an agricultural soil.

CONCLUSiONS

These results underline the need of taking biological effects into account in order to assess remediation efficiency of contaminated areas. In the first experiment indeed, the toxicity of contaminated soil remained stable towards earthworms and barley in spite of a degradation of 4chlorobiphenyl higher than 98 %. With chemical analyses only, we could come to the conclusion that the biological clean-up was effective at the end of the experiment. In that case, biological tests interest is to take toxicity of degradation metabolites into account. More generally, such tests allow to measure aggregate toxicity of all constituents of a contaminated soil including additive, synergistic and antagonistic effects.

  ). Quantitative PCR analysis and biochemical test showed a presence of Pseudomonas sp. B4 that could explain this decrease.

	Specie«	EKect	Compound	NOEC	EC50
				(mg/Kg)-	(mg/hg)-
			4-chlorotiipiienyl	127	127 < LC50 <
	Eanhworm	Mortality			159
	Eisefüa teli^s		4-chlorobenzoaie	128	162
					(154-170)"
			4-chtorobiphenyl	135	560
	Barley	Inhitlifen of			(441-715)"
	Hortfeüfn vulgäre	root growlh	fl-crilorobenzoale	SO	226 (138-236)"
	' : ms'kg öl soll ürf WGISM ; " : S5°° confidence llmils
	Table 1 : NOEC and EC 50 vaiues tor 4-chlorobiphenyl and 4-chlorobenzoa te

Acknowledgements

This work was supported by a grant from Conseil Regional de Picardie'


J F S Lechaudel

Ineris Bauchet

ASSESSMENT OF TWO ACCIDENTS INVOLVING SAFETY DEVICES

This paper mainly aims at describing and analysing two accidents : an ammonia leakage and an explosion in a chemical unit. These accidents are in connection with safety equipment failures. Lessons are pointed out for each accident and, finally, conclusions are drawn about possible requirements for safety devices and the interest of testing them.

INTRODUCTION

In relation to the real or supposed risks, the actions currently carried out generally consist in setting up devices known as «safety devices» to reduce the occurrence or the gravity of potential accidents. These devices are sometimes passive (walls, retention) but generally active, in the sense that they require at least a source of energy or a sequence of activation. These devices are frequently described as « safe », proof of the confidence which is primarily granted to them, but these qualities are not always related to explicitly defined criteria. The application of prescriptions associated with the regulations resulting from the « SEVESO Directive » (/1/) also tends to multiply the recourse to such devices, the risk being « to collect them » and to expose themselves to their own failures. To a certain extent, the failure of these « safety devices », on sites where modifications have been undertaken, makes it possible to qualify some recent accidents as « post-SEVESO accidents ».

This paper presents briefly hereafter two of these accidents. An ammonia leakage on a rail tank cars unloading installation and an explosion in a chemical unit. In addition to the lessons which can be drawn directly from those, this article reminds, in conclusion, important requirements for the qualification of these « safety devices ».

AMMONIA LEAKAGE (DECEMBER 16,1994)

SUMMARY OF THE EVENT

The diagram (see Figure 1) hereafter represents the installation concerned.

Gas arm

Rail tank car

Powered breakaway coupler Safety valves of the installation i. Fastening" During an operation of unloading ammonia from a tank car, an arm of transfer is disconnected brutally a few minutes after the beginning of the operation. An escape on the liquid phase occurs.

2/9

Several actions on the emergency stops remain ineffective and the hook fastening, maintaining the valve of the car, does not open. The formed cloud prevents any access to the chemical protection suits located near the unloading installation.

A foreman of the installation back turn to the wind, equipped with a simple mask, makes profit from the immobility of the arm and a momentary transfer of the aerosols cloud to approach at ten meters from the car. He then succeeds in launching a wheel block on the hook. This one unhooks from its housing and makes fall the valve from the car, thus stopping the ammonia escape.

The quantity of ammonia rejected is approximately 27 tons, in 37 minutes. Nobody was wounded. Ammonia odours are perceived up to 8 km downwind.

ANALYSIS {121)

This installation was equipped with an automatic device of disconnection for the transfer arm (loading or unloading), called « powered breakaway coupler ». The breakaway sequence was engaged as soon as a movement of car was detected on the track. The objective was to put the installation in a secure state, with respect to the potential consequences of a collision between the car being unloaded and another car. This device was an additional one compared to the traditional safety arrangements at the time of unloading operations.

The analysis of this accident showed that the detection device for the approach of a car on the track was the initiating event of this accident. An order (output signal) was generated by this device, following probably some operations on the track.

As much the initiating event has an unspecified cause, as much the induced events occurred according to the programmed sequence. They correspond to an awaited response of the automatism.

In particular, the electronic control system started the automatic procedure of disconnection of the transfer arms. The gas phase safety valves of the arm were well closed. The same applies to the safety valves isolating the units. Unfortunately, on car side, the liquid phase valve of the powered breakaway coupler remained wedged by a nut. Moreover, the hook which was to jump automatically at the time of an emergency procedure remained hung in its fastening.

According to the research undertaken by the company, the nut (standard M16HH) which blocked the liquid phase valve of the arm, on car side, does not originate from the material used in the factory. Its origin remains unknown to date. It should be noted that the presence of nuts, preventing the dissociation of two elements of a loading arm, had already been observed a few months earlier.

3/9

During the analysis of this accident, several anomalies could be highlighted. In particular, it is possible to point out :

• the order of tilting the pneumatic hook fastening was maintained only during the safety valve closing. The detection of the end of the safety valve closing annihilated any order of tilting the fastening ;

• In addition, at the electronic control system level, the sequence setting in safety, started by the emergency stops, should have rocked open the fastening of the hook. In fact, this sequence of setting in safety was activated only when someone pressed on the button. It was stopped in the event of relaxation of this button. The order given by the action on the emergency stop was thus fugitive or not maintained ;

• the hook position on its fastening could give a mechanical jamming, even in the event of effective fastening tilting.

LESSONS

This accident results from a double failure : non releasing of the hook and wedging by a nut in partially open position of the liquid phase valve arm, on car side.

The principal lessons of this accident within the framework of this article are :

• the possible mechanical failures should be taken into consideration, whether they are specific to the system such as mechanical jamming or resulting from an external event (for example, presence of foreign bodies in the installation) ;

• A validation, using in particular tests of the actions performed by the « safety loop » would probably have made it possible to detect several anomalies ;

• Lastly, the ultimate barrier, consisting in the intervention of equipped personnel, must be organised : adequate equipment for the personnel out of the accident potential effect zone and devices on the installation facilitating the approach and the operations.

4/9

EXPLOSION IN A CHEMICAL UNIT (MAY 18,1996)

3.1 SUMMARY At 5 :34, the lightning causes an important decrease of voltage during 140 ms on the 90 kV power supply network of a chemical plant. As a result, for one chemical unit, a switch occurs between the power alimentation and the emergency power unit. After this voltage variation, the normal voltage input does not change anything, because of an emergency power unit internal 16 minutes time lag programmation.

For this installation, in these conditions, the emergency power unit tries to take over, without success.

So the 220 volts and 24 volts tension (see Figure 3) delivered by the emergency power unit decreases gradually and various equipment are stop. The « doubleeffect » valves, normally staying in the same status, open and particularly the valves which allowed the decompression of the gas network for all reactors. It should be noted that, by design, the gas mixture is flammable in the gas network in connection with the reactors.

Consequently, a flammable mixture is evacuated by a chimney. Moreover, the opening of these valves allows a continuity between the sky of the reactors and the atmosphere at the exit of the chimney.

The available elements make it possible to locate the beginning of the process of explosion a few minutes later, when the release through the chimney is quite evanescent. At 5 :41, the lightning strikes the unit, ignites the flammable release and makes possible to a flame front to propagate through pipes and equipment in communication together. Three apparatus break successively : a cyclone, a tank and a reactor. As example, the photography hereafter (see Figure 2) represents the destroyed reactor.

5/9

\ Figure 2: view of the destroyed reactor.

ANALYSIS (/3/)

This accidental sequence seems to have a low probability. In fact, this one was evaluated with less than 10" [START_REF]Functional safety : Safety instrumented systems for the process industry[END_REF] . It is mainly fixed by the probability of having an impact of the lightning on the installation while the gas sky of the reactors is in direct communication with the chimney.

Two elements come into view for this sequence :

• the malfunction of the emergency power unit ;

• the opening of the « double-effect » valves.

Emergency power unit

The first failure is associated with the malfunction of the emergency power unit (group called «time zero »). It can be noted that the control of this relatively old equipment was ensured by a group of electromechanical relays. The further analysis carried out underlined that the possible causes of its absence of operation were numerous (14 possibilities) and some of them could be random (for example, a defective contact). Beyond these elements, the principal point which can be retained for this equipment is the fact that such an electrical power variation was not taken into account in the design specifications of the material.

The decreasing voltage to the entry of the various equipment caused a stop of the former in an anforeseen state, not allowing to keep the « double-effect » valves in the initial state.

In this case also, the characteristics of the electrical alimentation was not taken into account in the design specifications for the electronic control system and the automatic system of the valves.

LESSONS

The principal lessons of this accident within the framework of this article are :

• the devices or equipment of safety having recourse to automatism are obviously not free from potential failures (for example, emergency power unit) ;

• the definition of the operating range of the important equipment for safety should be defined. This operating range should be, as far as possible, the subject of a qualification performed in particular by tests ;

• in this respect, concerning the tests and qualification of equipment, this accident underlines the interactions between several equipment. Consequently, possible tests should check the whole of a safety loop.

CONCLUSION ABOUT REQUIREMENTS FOR SAFETY DEVICES.

The two accidents described above underline failures of safety systems, which are mechanical or associated with automatic devices. These failures emphasise the need of the operating range definition of these systems and their qualification.

In this field, the draft standard IEC 61508 (141), relating to the safety of the electric, electronic systems and programmable systems, and its adaptation to the industrial processes through draft standard IEC 61511 (/5/), make it possible to fix a framework of evaluation. For details, the method associated with this last draft standard is declined in four parts :

• Analysis and ranking of the risks of an installation ;

• Definition of the technical requirements applicable to the safety devices, this definition being carried out through classes of requirements ; • Definition of the qualitative and quantitative requirements ; • Validation of the technical requirements (analyses or tests).

8/9

Beyond a theoretical analysis, the interest to use tests comes out from these accidents, as suggested by Kletz (/6/) for others accidents. In this respect, the draft standard IEC 1511 (//) indicates that the validation of the technical requirements can be treated through tests : functional tests of safety ; tests of behaviour on defect ; tests related on the specifications and the environmental parameters. Such tests must take into account the whole of the « safety loop », including, for example a sensor, an electronic control system and equipment such as valves. Moreover, the mechanical behaviour of the equipment should also be tested. The accidents reported above point it out. Beyond these considerations, it appears important that this qualification of the safety devices lies within a more general scope of evaluation of defence lines or defence barriers {111), with respect to the dangers within an industrial facility. Such an approach is to be undertaken at the design stage of a plant or before safety devices modifications. An evaluation scheme must also integrate the ultimate barrier made up by the intervention of equipped personnel.

  60550 VERNEUIL-EN-HALATTE 9th International Symposium Loss Prevention and Safety Promotion in the Process Industries, Barcelone, 4-8 mai 1998

Figure 1 :

 1 Figure 1: Diagram of the rail tank cars unloading installation .

« Double-effect » valves.

The second failure or situation not dealt with, was the opening of the « doubleeffect » valves which were normally to be remained in their initial state. The figure hereafter (see Figure 3) represents the different parts of the control chain for these valves. In the case of a decreasing voltage, the tests carried out on the electronic control system and the equipment associated made it possible to retain the following sequence : the electronic control system stops, prohibiting any operation.

Electronic Control

I the 24 volt relay falls in preferential position

(rest = open). i the electrovalve is actuated because relay falls and at the release voltage, it remains manoeuvrable.

i the « double-effect » valves open.


Jean-Philippe Pineau

Development and use of the ESReDA directory of accident databases involving chemicals

Keywords: Data collection, Data analysis, Reliability, Uncertainty, Accident, Hazardous material, Risk analysis

The aim of this review paper is a description and possible uses of a directory of accident databases involving chemicals. First, this review paper emphasizes the requirements from end-users of accident data who need validated data for dealing with risk assessment in which they are involved. Then, a brief description of the ESReDA directory of existing databases will be given. The review will end with possible ways for improving the reliability of data especially by using more structured and validated information.

INTRODUCTION

For long with the objective of improving the protection of environment and the avoidance of accidents, plant managers, insurers, authorities, consultants, research organisations are dealing with leaming from investigations of accidents involving chemicals. Many databases on accidents implying chemicals are m existence and data are shared between database developers and end users. The reliability of data is strongly related to the quality of data collected from accident investigations and their subsequent analysis. Many frameworks for collecting, recording and ensuring quality do exist, but there is a need for harmonisation. Since 1993, a working group ofEuropean Safety, Reliability and Data Association (ESReDA) "Accident Analysis" (AA) is dealing with data collection, quality, reliability and networking of accident data.

In the 1994 seminar "Accident Analysis" (prepared under the auspices ofESReDa), the need of using validated and qualified data on accidents was emphasized. In a first step, it implies the collection of reliable data. A preliminary analysis of existing databases led to the conclusion that they are generally all "abstract" databases and result from an aggregation process of existing information. During this stage, some form of "filtering" and coding ofthis information originating from various analysis occurs. Even in a direct collection of data by database operators, the interpretation of the initiating events, the sequence of subsequent events and the effects and causes may be difficult owing to the large variety of involved materials, plants, processes and causative factors A methodology for direct investigation of accident was developed elsewhere and implies four main Steps : gathering evidence with a search for infonnation, exploring possible scenarios, investigating the scenarios and performing the validation of assumptions. More details and lessons leamt from investigations can be found in [START_REF] Pineau | Towards sharing ofdata from accidents with chemicals -2nd European Meeting on Chemical Industry and Environment[END_REF].

Whatever the accident investigation could be, some explanation of the possible discrepancies between data from different databases are given by [START_REF] Haastrup | On the quality of information in accident case histories[END_REF], first on an apparently well defined infonnation such äs the reported nunaber of fatalities for the same accident. Therefore, it should be pointed out the influence of the uncertainty of data. Such findings can be extended to other types of infonnation : chemicals and amounts involved, description of events. As a consequence, in statistical studies for quantitative risk analysis, uncertainty will be inherent in the accident case histories.

Despite these adverse conditions, the "AA" group had the objective to improve the current Situation. Therefore, the involved members devoted their efforts to have a better knowledge of the requirements from end-users of accident data, to prepare a directory of existing accident databases and to define a guidance document for high quality databases. These three aspects will be developed in this review paper.

REQUIREMENTS FROM END-ÜSERS OF ACCIDENT DATA

Various organisations (competent aufhorities, consultants, emergency planners and responders, engineering companies, general public, industrial firms, insurance and banking groups, manufacturers of equipment, research organisations and universities) can have special interests in accident data.

The most general and final objective is the improvement ofthe safety level of an equipment, a plant, a process or a System and the minimisation of losses.

In some countries, competent authorities can have access to tailor-shaped databases for the workplace, for transport system, for a given industrial field, for large accidents implying consequences for man and environment. For the latter object, five databases could be taken into consideration : MARS at the European Union level [START_REF] Rasmussen | The experience with the major accident reporting system from 1984 to 1993[END_REF], ARIA in France [START_REF] Chaugny | Experience from two years operating the ARIA dabatase[END_REF], FACTS in the Netherlands, MHIDAS [START_REF] Painter | The use ofMHIDAS and other databases within the UK Health and Safety Executive -Proceedings of the 7th ESReDA Seminar on Accident Analysis[END_REF] in United Kingdom and ZEMA in Germany [START_REF] Brenig | Accident information Systems and analysis in Germany based on the federal emission protection act[END_REF]. The main goal ofthe review of reported accidents is the definition ofproactive policies regarding safety studies, emergency planning and response, the improvement of reliability of equipment and preventive and protective devices and of safety management Systems.

Manufacturers, consultants and engineering companies in Charge of the Operation and design of equipment and plan shall be able to identify the possible hazardous situations arising from use and manufacturing of a given substance in order to define the safe operating envelope (operating conditions for which no large accident and losses are possible) ofthe system under consideration. Thus, the determination offailure rates is important.

Insurance and banking companies are interested in the worst case scenarios in connection with the acceptability ofrisk and the definition ofinsurance premiums and money loans.

The development of a safety culture in industry and in the large public can be improved by leaming from accident (case histories) at the industry level, in the curricula of scientists and in the general education.

And last but not least, accident investigation can show the lack ofknowledge on the initiation causes, sequence of events in an accident scenario and convenient preventive and protective measures.

Hearing in mind these various objectives, an enquiry was set up among these possible endusers for understanding the strengths and weaknesses of existing databases [START_REF] Keller | Initial assessment of strengths and weaknesses of current accident databases[END_REF]. During this investigation, 93 questionnaires originating from twelve countries and valid for fürther analysis were retumed. One fourth of the total were sent back respectively by govemmental organisations and by consultants and one third by industrial firms. The three most commonly used databases were ARIA, FACTS and MHIDAS (40 % ofthe answers). In this enquiry, 83, different databases either dedicated in house or generic, were mentioned. This analysis allowed a better understanding ofthe main use ofthe generic databases and was the input for fürther work in "AA" group. The particular aims and the important features to be found in a given database are summarised in tables l and 2 in which the percentage of answers from responders are given.

A DIRECTORY OF EXISTING ACCIDENT DATABASES

The basis ofthe directory issued in 1997 [START_REF] Pineau | Development and use of a directory of accident databases involving chemicals -ESREL[END_REF] is a description in four sections : identification, technical aspects, access conditions and use, database details. Answers to an enquiry were received from 48 databases operators, but later only about 40, accepted the introduction of information in this directory äs a two-page form for each database.

The industrial and activities are : chemical, explosives, mines, nuclear, oil including offshore, pesticides, refining, transport and water pollution.

The main criteria for including accidents and incidents are : chemicals involved, type of hazardous events, near miss, number of fatalities, or injuries, material and in some cases environmental losses.

When analysing in details the findmgs from this inquiry, it shall be pointed out that the objectives are so various that covering all the above mentioned industrial areas and activities is rather impossible even with a very extended database. It implies that specialization with experts in the field to be covered will be sought. As a consequence, a better networking of database operators will be required. Another positive effect of a networking will be the avoidance of multiple entries for the same incident. Improving the networking will require the development of a common accident data collection form on the basis of these in existence at European level for the MARS database or at the OECD-UN levels. Whatever this final form could be, more efforts will be devoted in general to have high quality input data.

HIGH QUALITY DATABASES

The work under progress is dealing with various topics such äs :

• database operator • database structure • data collection, recording • quality assurance.

Currently, the members of "AA" group considered that, in the database structure, more relevant information shall be given on the object being exposed to the accident and its surrounding (setting of accident), the conditions of occurrence (extemal) and the operational conditions (intemal), the description of the accident, the causes, the consequences, the emergency responses, the follow-up/resultant actions.

Information should also make reference to the original source and consider a much larger field of data than previously.

Data currently available are : date, time of occurrence, location and establishment, work being done, immediate effects, accident type. Information is to be extended to people working in the area, Job supervision, permits issued, procedures and safety management System used, ecological components (Inland, freshwater, shore, offshore -if relevant -, mid-term and longterm consequences on people and area concemed, specific process, equipment and substances involved, chain ofevents and suspected causes ...).

Regarding the emergency response (if relevant), more information is to be reported on the measures taken with chronology and organisations involved.

The follow-up is dealing with the following aspects : legal, administrative, penalties, disruption of the community life, techrdques used for remediation, post-emergency survey (eco-systems, health), insurance and financial implication.

Last but not least, the database structure should give a summary of the accident description including causes related to the Operation, environment, Organisation and person, and possibly the accident category and severity, referring to accepted scales and the lessons leamed. It should be pointed out that gravity scales (for example, the gravity scale developed at the European level for industrial accidents involving dangerous chemicals - [START_REF] Amendola | Gravity scales for classifying chemical accidents[END_REF] can ease comparison and classification of accidents allowing statistics and trend analysis and unprove the reliability ofdata.

In the "AA" group, such a broad work involves database operators and end-users.

The final goal will be a guidance document to be included in the next revision ofthe Directory of accident databases.

CONCLUSION

Sharing of reliable data frorn accidents is still questionable when looking at the variety of industnal situations, materials involved and origins of data. More efforts should be devoted to investigate accidents according to a well defined and accepted structure. Improvement of the use of reliable data can only occur if high quality data are included in the databases. It is the task of ESReDA "Accident Analysis" working group to develop actions in this area. We would be very pleased to take into account any Suggestion for this work and to have participation ofnew members.

Table l -

 l Aims*

	Supplying data for	Percentage
	Identification of accident scenarios	79
	Identification of deficiencies in design of Operation of hazardous	58
	installations and hazardous Systems
	Evaluation ofemergency procedures	26
	Formulation ofpolicies on national/international scale	14
	Formulation ofpolicies for financial and insurance companies	5
	Validation of modeis describing accidental phenomena	17
	Improving of total quality management of safety	26
	Establishment ofreliability and failure rates	13
	Complying with regulations and Standards
	* Multiple answers possible

Table 4 -

 4 Additional features*

	Additional features
	Safety management
	Initiating cause -Man made
	Initiating cause -Naturai
	Environment -Geography
	Environment -Population
	Emergency response -on site
	Emergency response -off site
	Consequences on man -immediate
	Mid-term consequences
	Long-term consequences

14th ESReDA Seminar, Stockholm, 14-15 mai 1998, p.[189][190][191][192][193][194][195][196]

ACKNOWLEDGEMENT

The author would like to thank all those (especially M. Brascamp, E. Funnemark, S. Harris, A.Z. Keller, D. Painter, A. Hodin) who have been participating in the ESReDA "Accident Analysis" working group since 1993 and ESReDA for fünding.

An analysis of additional features and areas which users would like to see incorporated or improved upon in füture accident databases are summarised in tables 3 and 4. Further Information on this enquiry can be found in [START_REF] Keller | Initial assessment of strengths and weaknesses of current accident databases[END_REF].


L Pioche&j

Rpineau

Perception of an emergency Situation by operators in an oil refinery

This paper describes the first stage of a study m which the general objective is to analyse the operators' behaviour during an emergency Situation m an oil refinery. The aim ofthis stage was to characterize an emergency Situation from operators' perceptions of it. The method consisted in interviewing a sample of operators and in a presentation-validation with all the operators concemed by the study. The results show that two characteristics were expressed more than others : the identification of risks in situations at a given time and the necessity to act quickly. The nature ofthese risks or the probable negative consequences to avoid are significant disturbances of the process, the unit shutdown, the environment, equipment and human body damages. At the end, based on operators' expression, we define the main characteristics of an emergency Situation.

This paper describes the first stage of a study in which the general objective is to analyse the operators' behaviour during an emergency Situation in an oil refinery.

An "emergency Situation" is a general term, used for certain circumstances in personal and Professional life. In the latter, one naturally thinks of men and women who work in fields that specifically treat emergency situations : firemen (their activity was analysed by [START_REF] Samurcay | Cooperative work and decision making in emergency management[END_REF]), and emergency room physicians. In risk industries, Emergency Intervention Plans and emergency procedures exist. This allows to take into account the variety and the complexity of the configurations of an emergency Situation. Notably due to their very diverse forms, it seems that the expression of an "emergency Situation" is subjective. Consequently, what is an emergency Situation ? And, in particular, what is it for the refinery operators ? [START_REF] Fixari | Comment traiter l'urgence[END_REF] define emergency : "given an individual or collective actor, who must carry out a task by a given deadline, emergency is a judgement made by this actor in a given instant, on the importance of this deadline, and on the insufficiency of time remaining to meet it". This definition emphasizes the subjectivity of the word "emergency" through the word "judgement", äs the authors point out. As for Flin, [START_REF] Slaven | Emergency decision making in the offshore oil and gas industry[END_REF], they define the task ofmanagers on high-risk sites (specifically, offshore oil platforms) in an emergency äs being complex and characterized by the time pressure, uncertainty and danger.

Can these definitions of "emergency" be transferred to that of "emergency Situation" ? ; do they characterize the emergency situations experienced by the refinery operators ? In other words, can these definitions be adapted to the particular context of a refinery and of the activities of these operators ? Also, in light of these questions, we have chosen first, to understand what is an emergency Situation for these operators, based on their Statements. The objective is to characterize an emergency Situation from these Statements.

This paper explains first the methodology used to characterize an emergency Situation from the operators' point of view, the hazards in a refinery, the operators' training for emergency Situation. Next, the analysis of the interviews with some operators will be presented before concluding about the main characteristics of an emergency Situation from operators' point ofview. Safety andReliability, Trondheim, 16-19 juin 1998, vol. 2, p. 743-749 2. METHODOLOGY

ESREL Conference on European

Methodology ofGathering Data

We conducted half-direstive individual interviews with voluntary operators (their answers being anonymous). We questioned them about what is an emergency Situation for them, and to describe one of their personal experiences conceming this case. Moreover, these interviews contained other questions conceming the operators' training, their normal work conditions, their work tools ... within the framework of our general knowledge about the specificities of their work.

In order to obtain a representative sample of the operators, we took into account several variables : • the number of operators interviewed to the total number (21 out of 85, in other words a quarter of the total work force) ; • the operators fünctions, which include outside operators, boardmen and chiefoperator ; • their seniority in the Company.

The interviews were tape recorded and later transcribed.

After this first stage was completed, we presented to the operators from every shift the opinions expressed in the interviews conceming the question, "what is an emergency Situation", and added our general formulation on this subject. This stage consisted in three objectives : to expose our work to all of the operators, to globally evaluate the representativity of the interviews and to validate our characterization of an emergency Situation, which was reconstructed from these interviews. In order to achieve these last two goals, we asked the operators to inform us when they did not agree with what their colleagues had expressed in the interviews or with what we have formulated. This last stage allowed the operators to discuss their different perceptions about their work situations and comment on the viewpoints expressed in the individual interviews.

Methodology ofthe DataAnalysis

This method is broken down into three stages.

The first one consists in reworking the interviews in order to make them easier to analyse by distinguishing each Situation and characteristic expressed (not described here).

The second stage was to gather the situations and characteristics that were expressed by more man one operator.

Finally, the last stage consisted in picking out the most frequently occumng elements expressed in order to characterize an emergency Situation.

THE HAZARDS IN AN OIL REFINERY

Potential hazards of various nature are present in a refinery. They can affect environment, and/or equipment and/or humans.

The nature of these hazards consists in : explosions, leakages ofhydrocarbons (liquid or gas), leakages of toxic products (hydrogen sulphide, benzene among others), and fires. The leakage of hydrocarbons can ignite m the presence of a hot source depending on their pressure and temperature : this is a flash fire or an explosion. The environmental risks correspond to air, water and soil pollution.

These hazards can damage the human body in the following ways : • explosion pressure or debris impact; • intoxication, bums and suffocation through inhaling toxic products ; • different degrees ofbody bums ; • contact with toxic or corrosive products.

Facing these different risks, the refinery has developped a Safety Management System whose main objective is the operations integrity. So äs to reach this objective, the System bases on taking actions of different kinds : organizational, technical, training, risks analysis and corrective and preventive measures. Thus, the chief of the operators has the responsability to decide the unit shutdown, if he considers it necessary. Technically, many automatic safety Systems exist and their functioning is regularly tested. Moreover, several committees periodically meet so äs to re-examine and validate the risks assessments already done (notably in incident reports) and the necessary corrective or preventive actions. Finally, the operators' training and the existence of procedures constitute a fundamental measure of the risks management. The next paragraph globally describes the operators' training,

THE OPERATORS' TRAINING FOR EMERGENCY SITUATIONS

All of the operators work in the same control room, from which five units are monitored.

Each shift of operators consists in outside operators, boardmen and one chief operator.

Everyone Starts in the position of outside operator. Later, it is possible for these workers to be promoted to boardmen and eventually to ehief operator. Once the operators are certified to hold several positions, they "rotate". Thus, a certified boardman holds more or less on a regulär basis the outside operator position for which he is certified.

The operators are trained for every position in the same way : they are paired with a senior operator and they leam written procedures. As for the boardmen, they normally receive extra training on a Simulator. Leaming the procedures is the method used to prepare the operators for certain unusual situations during their training, such äs special operations (the shutdown and start up of the units) and emergency situations. More details on operators training are given in Cadet, Pineau & Pioche (1997).

Three types of procedures exist : routine Operation procedures, special Operation and "emergency procedures" (for the last one, the refinery uses the English word). The emergency procedures are written äs a series of actions, in which some ofthem give explanations.

Continued training for emergency situations consists in creating new procedures in teams and in analysing the existing procedures with an expert.

INTERVIEW ANALYSIS : CHARACTERI-ZATION OF AN EMERGENCY SITUATION

The emergency situations expressed by the operators : a risk scale

We asked the operators two questions "what is an emergency Situation for you ?"and "describe one of your personal experiences of emergency situations". Regarding the first question, most of the operators spontaneously responded by giving examples of emergency situations instead of trying to give a straight definition. Nevertheless, certain operators also cited general characteristics: "a work Situation that could involve a significant risk -this is the equipment safe configuration", "a Situation containing something that is a hazard for the outside operators", "when you must extract the unit from a Situation, which if left alone, could lead to danger for the individuais and to significant risks for the equipment", and "a Situation where you must quickly intervene to avoid the problem from getting worse, if not we end up in an 'emergency' (said in English by the operator) and so a safe position must be immediately re-established".

Every operator cited more man one emergency Situation. Naturally, the length of each response depended on the prolixity ofeach operator.

As regards the two questions, the types of situations expressed in decreasing order of fi-equency (number ofanswers) are: • fire (cited by 17 out of 21 operators).

Nevertheless, not all of the operators who cited this case had personally experienced it; • unplanned unit shutdown (cited 15 times); • leakage of hydrocarbons or toxic products (cited 12 times): this includes situations that contain ignition risks. At least two operators mentioned the risk of being bumed in the case of a leak. • essential pumps for the unit's Operation that are out of order, such äs the pumps at the bottom of the tower and the feed pumps (9); • power and utility failures (7); • situations with a risk of explosion (5); • unplanned shutdown ofthe compressors (5); • situations with a risk of unit shutdown (4); • unit emergency shutdown in which the automatic safety funetions stop working (3). In addition to these emergency situations cited by several operators, other cases were brought to us by individual operators. For example, an outside operator remembers a water hammer in a pipe and the Computer screens going blank in the control room ; a chief operator recalls the rupture of a tube in afumace....

First Accounts

The emergency situations described by the operators are most often the consequence of equipment failure. There was no difference between the emergency situations described by the boardmen, outside operators and chief operator.

The situations described äs an emergency: " a risk of unit shutdown ", " the compressor shuts down ", "the main pumps stop working ", " power and utility failure ", " the unit shuts down ", all are connected to an unplanned unit shutdown. They either mention a Situation with great risk of a shutdown or where a shutdown actually occurred.

Due to dynamic process, it seems that if the operators consider unit shutdown äs an emergency Situation to be avoided, thus, a risk Situation is äs much an emergency äs the shutdown itself. So, the first operator said "either we succeed in getting the equipment back on route and thus the emergency is over or we are really in an emergency Situation implying the unit must be shutdown (because it places the individuais and equipment at risk)". Other operators spoke about, "the loss of power in the pumps at the bottom of the tower in a given unit is a great bother because at that point the entire unit can shutdown" and "when a shutdown is triggered in an unit, it's an emergency Situation, but even before... if we can try to save the units, we are however there to getproducts".

Through these responses, two main categories of emergency situations came to light: • situations with a risk of damaging the human body -these correspond to situations of fire, leakage or with a risk ofexplosion -• situations with a risk of unit shutdown äs well äs those where such a shutdown could not be avoided.

In the latter case, the possible causes of a unit shutdown must be explained -a shutdown decided by the operators or an automatic emergency shutdown which depends on the unit and on the nature of the incident-. Schematically, an unit shutdown is required when a major mainmction provokes a disturbance such that, if the malfunction cannot be recovered after a certain amount of time (recovering time depends on the process):

• the process can no longer function (e.g.

unexpected loss of feed pumps due to mechanical incident); • and/or these disturbances will deteriorate the equipment (towers, exchangers, reactors, fürnaces...) (e.g. acid flowing into unequipped zones); • and/or these disturbances could damage the human body (increase in pressure, temperature, risk of leakage...).

For the operators, depending on the causes that lead up to the unit shutdown, the latter signifies that the production is stopped, and/or the equipment is put into a safe configuration, and/or the workers are no longer at risk. Also, the emergency shutdown of the unit corresponds to a phase in which the equipment could be "shaken up". Some operators described emergency situations containing a risk of a unit shutdown where the shutdown was perceived either äs a stop in production which must be avoided, or äs an equipment safe configuration or äs protection ofthe workers and the equipment.

Presentation to the shifts operators

During the presentations to all the shift workers, no major or massive divergence of opinions was expressed in regards to the operators descriptions. Nevertheless, some comments were made conceming certain emergency situations. For example, during an interview, an operator described one emergency Situation äs follows : " when a major pump collapses the other must be quickly started, because if not, it really becomes an emergency... if you let everything shut down the level can rise, so this can create problems soon after without going so far äs causing a fire ". Another operator said, "when the feed pumps collapse, this is an emergency Situation because it implies the unit shutdown". Moreover, a boardman explained, " the level rising in a tower, the pump functions well in order to evacuate the product, but the level continues to rise... so, we don't know the actual level and so we must react ; in an extreme case, we can produce nonconform products or bypass a part of the unit ". Some of the operators expressed during the presentation that they consider these situations urgent to deal with in order to avoid fürther process disturbances or unit shutdown, but they do not consider these äs emergency situations. This difference in perception among the operators did not seem to be linked to experience or seniority since some senior operators described the above cases äs emergency situations.

Levels o f emergency situations

The common point found in all of the described situations and some general definitions given by a couple of operators was : the identification ofrisk by the operator -but depending on the situations, these risks can be of various nature. The nature of these risks corresponds to the idea of the different levels that make up an emergency Situation. This notion of levels was expressed by two of the operators during their personal interviews and by some others during the presentation meeting by way of summarising the diversity ofthe emergency situations described.

We can draw from the operators' responses the nature of these risks or the levels of the emergeney Situation. These are : • risks of significant unit disturbances, of nonconform production; • risks of production shutdown and equipment damage; • risks of human body damage.

Furthermore, due to dynamic process, the risks can evolve, and their nature also. Thus, it can be said that this evolution of risks constitutes a risk in itself for the operators.

These levels encompass the diversity of the perceptions of an emergeney Situation, and notably including those considered äs urgent situations for some and emergeney situations for some others.

Through our initial questions, in addition to these emergeney situations described essentially from a technieal point of view, the operators spontaneously reported other characteristics of their activity in emergeney Situation.

Characteristics of an emergeney Situation from the point ofview ofthe operators' activity

Through the operators' descriptions, other dimensions of an emergeney Situation can be highiighted. These dimensions, formulated with variable fi-equency, turn mostly to work activity and its conditions ofrealisation in emergeney situations.

• An emergeney Situation is a work Situation where actions must be taken quickly (cited by 14 operators)

The rapidity of the action is a fundamental characteristic expressed by numerous operators. The rapidity of the action is necessary so äs to recover the Situation and to avoid it from getting worse. For example, an operator said, " the faster you intervene, the better you avoid the Situation from getting worse". The rapidity of the action is thus intrinsically linked to the evolution of the Situation and its risks.

• An emergeney Situation is a rare or new work Situation (cited by 10 operators)

The senior operators expressed the rarity nowadays of an emergeney Situation occurring by comparing their higher frequency just about a decade ago. The newer operators talked about the rarity and the newness of emergeney situations occurring äs on the one hand a positive fact and on the other a problem of training to cope with this kind of Situation. Effectively, the operators must be able to put into motion knowledge and skills that they have not yet used or have only used on rare occasions. For example, a boardman reported one of the first emergeney situations he had to face in which a senior boardman reassured about the way the process was reacting to sollicitation.

• An emergeney Situation is one in which team work is important (cited by 9 operators) Collective work was mentioned several times but from different perspectives.

-Need of re-enforcement for the operations on the units. Two unit operators talked about the extra number of hands necessary according to the workload to be done in a short amount oftime. -Emergeney assistance. A boardman explained that äs an outside operator, " the first thing is to not be all alone; if you are alone, you can always call for help! ". -Expressing and sharing feelings. One of the outside operators said that it is important to talk about incidents with each other: " team work is very important in these kinds of cases ; we need to speak freely amongst ourselves... that's what we do, and that's how it works. The major incidents that we have had are talked over in the Cafeteria". -Experienced operators help the novices. Three boardmen (two novices and one senior) explained that the senior boardmen help the newer ones by sharing their skills to cope with their first emergeney situations. An outside operator reported that a more experienced operator helped him to cope with an emergeney Situation with his " technieal tricks ". -Obtain different representations of the Situation. An experienced boardman said that it's important to have a colleague behind you : "someone who is behind you does not see the same things that you do, he can very well see things that you can't". [START_REF] Rognin | Cooperation humaine et sürete de fonctionnement des systemes complexes[END_REF] did an in-depth analysis on the safest forms and functions of collective work. In particular, Rognin highiighted regulation activity and collective monitormg, elements that are described by the operators in their own words.

• An emergeney Situation is often an uncertain one (cited by 3 operators) Uncertainty is based on different signs according to the Situation : decision making about which action to take, the causes for the malfünctioning, and/or their consequences, information exactitude, and the real state of the process.... Three outside operators expressed this notion of uncertainty. One of them spoke about the Computer screen going blank: " the problem is that you don't know what's going on ; we ask ourselves what's really going on here ?". Other operators explained, " you must send the products in another direction, sometimes we still don't know what happened", " when you know why you shutdown the unit, it's not a major problem, but when it gets out of control and you don't know why... !". This uncertainty, expressed above conceming the causes for the malfunctioning make operators feel losing the control of the Situation and upset them.

• Fear of not adequately acting in an emergency Situation (2) During an emergency Situation, if the operators act poorly or too late, the Situation can worsen. As this is a rare or completely new work Situation, a wrong action is possible. Conceming this subject, an operator explained, " you think that maybe you can't detect the problem, and you wonder if you can cope " ; and a boardman recalls his first incident at the console a couplc of days after he started, " we were scared to do anything ; we knew what needed to be done, but we had never done it". Thus, a couple of operators expressed their concems about not acting adequately in an emergency Situation, or äs one operator said, " you better not mess this up ". This concem of acting poorly (that is to say, to make a mistake) is also shared by pilots, äs indicated by [START_REF] Amalberti | Perception par les Operateurs des situations d'urgence en raffinerie[END_REF].

• Critical emergency situations where the risks are in conflict In certain situations, the outside operator must evaluate the risks for himself in relation to the other risks ofthe Situation. The operators mentioned the case of a leak of a flammable product: the outside operator, fairly dose to the source ofthe leak risks bodily damage in the goal of reducing the possible consequential damage ofthis leak on the equipment, on the process and eventually on the individuais. This is a difficult Situation to deal with, and it largely depends on the faimess of the evaluation made by the operators on the risks taken by them to recuperate the Situation. This was expressed by two experienced operators, " if an outside operator judges that he ean do it, he does it; ifnot, he calls '18' (unique phone number for firebrigades in France) or " after, it depends on the individual, he either dares to go or doesn't, but in any case, you need to caiculate the danger ".

• Particular assistance from the procedures in an emergency Situation As mentioned in part 4, the emergency procedures are written äs a series of actions to help the operators during these kinds of situations. But, operators and their hierarchy explained that the procedures cannot be used during the emergency Situation or only after the first actions have been taken. Thus, in this last case, they principally serve äs a verification tool in the case that an action is eventually forgotten. As a result, we can say that the emergency procedures are more often used äs training tools man äs guidelines of what to do in a real emergency Situation. If we base our analysis on the classification of " problems linked to the use of procedures" proposed by [START_REF] Veyrac | Modele de l'Operateur et modele du prescripteur : le cas des consignes de resolution de situations incidentelles pour les conducteurs de train[END_REF], this rare utilisation of emergency procedures can be put under the category of " material usability " : this utilisation is difficult due to the significant time constraints. Nevertheless, this particular utilisation is not expressed äs a problem for the operators and their superiors, because the operators explained that they remember the leamed procedure corresponding to a case to be dealt with during an emergency Situation. At the end of this synthesis of the emergency Situation characteristics, we propose to characterize the emergency Situation fi-om the most frequently mentioned points by the interviewed operators.

Characterization ofan emergency Situation

This concems a dynamic Situation where the operator identifies the risks (meaning, the probable negative consequences), which are evolving and various in nature. Here, the operator tries to at least avoid the transformation of these risks into real negative consequences, or at best to eliminate them by acting quickly.

The negative consequences to avoid are : -the significant disturbances of the process, the noconform production, -the stop of the production (signifies the unit shutdown), equipment damage -human body damage (this includes death). These emergency situations are rare, treated collectively and can present uncertainty.

CONCLUSION

Through this study, we have simply attempted to characterize an emergency Situation from the operators perceptions of it. We have not analysed all the diversity of the operators' perceptions, or the differences in perception among certain operators.

Nevertheless, this study has highiighted the following points : • emergency situations do not only contain risks of human body damage. It also includes situations with risks of deteriorating the equipment and those with significant disturbances which could lead to a unit shutdown. • the emergency Situation begins once the operator identifies the potential / the risk that can turn into unwanted consequences, and not just when these consequences become reality. Here we find the activity of anticipation of each operator, which is well known in ergonomics. • the operators spoke in terms of the " rapidity of the action " and not in terms of a " reaction made in an appropriate time or in a given amount of time ", äs formulated by [START_REF] Fixari | Comment traiter l'urgence[END_REF] in their definition of " emergency". Thus, up against evolving risks, the operators do not seem to take the risk of waiting to act in order to analyse the Situation more deeply. • certain operators feit the Situation to become an emergency one eariier than others who preferred to call this an urgent Situation, meaning that they simply make reference to the rapidity of the action.

As for the methodology used, it revealed the benefits of general validation meetings, which allowed to distinguish the differences between the operators' pereeptions that were non-identifiable during the synthesis of the individual interviews. As a result, the method could be improved by gathering less data during the individual interviews, which constitute the starting point of this study for the analyst and the basic work tool for organizing meetings with all the shift operators. Thus, the meetings would no longer correspond simply to a validation stage, but represent the principal stages of data gathering according to a method that needs to be reworked. For example, during these meetings, we can create a table of the characteristics of an emergency Situation with the operators.

Finally, it seems that our characterization of an emergency Situation does not significantly differ from other definitions of "emergency ". It relies on the operators' expressions and takes into account their work context. It seems that an emergency Situation for an individual contains three main notions : • perceive in a given time interval äs being relatively short, • identify the necessity to make a decision or to act,

• warn to avoid the consequences of not making a decision or not acting. The variability of the emergency situations depends on the form of action, and/or of the time interval available, and/or on the nature of the unwanted consequences. In particular, a significant Variation of the nature of the emergency situations depends on the knowledge or the imprecision of one or several of these three elements for the individual.