Bruno Debray
email: bruno.debray@ineris.fr

Claire Joly

Myriam Merad

Olivier Salvi

Knowledge management and major industrial hazards : an integrated approach

Keywords: Knowledge management, industrial hazard, risk assessment

The reflection that followed the Toulouse 2001 accident has stressed the fact that there was an urgent need for a coherent and trustable information about industrial hazards. This is true for the public who needs to be informed about the surrounding risks but it is also, and all the more, true for the industrial operators who have the responsibility to assess the risk and take the necessary provisions to reduce it, the workers who face the risk everyday and the competent authorities, in charge of the control With this context in mind, INERIS is developing a series of tools for the knowledge management in the context of industrial major hazards. The aim is to make accessible the right information to the right person at the right moment. For this purpose, it is necessary to clearly analyze the needs of the different actors of industrial risks management and then to propose the structure of the system that will support and make the knowledge available. This paper presents the results of this preliminary analysis. It describes the first features of the system developed in the framework of this project, PRIMARSIK®, and illustrates how it was built in a fully integrated approach ofknowledge management. PRIMARISlf*is not only a way to make different models and data available but it is also a way to provide the structure for future capitalization of the knowledge.

Introduction : Situation in France after the AZF accident

The AZF accident that occurred in Toulouse in September 2001 has led to a large debate about risk management in and around industrial sites. Among the conclusions of this debate was the evidence that knowledge was not enough shared among stakeholders with a series of consequences. The report of the inquiry commission leaded by the deputies F. Loos and J.Y. Le Déaut [START_REF] Loos | rapport fait au nom de la commission d'enquête sur la sûreté des installations industrielles et des centres de recherche et sur la protection des personnes et de l'environnement en cas d'accident industriel majeur[END_REF] mentions a loss of memory resulting to an everyday acceptance of risk. The safety studies realised by plant operators or, more often by consulting firms were often of poor quality and could lead to very different results in comparable situations. The decisions were taken without a real debate among the stakeholders : plant operators, populations, local communities, state authorities. This lack of debate and of diffusion of the knowledge had the consequence of reducing or falsify the perception of the industrial risk by the population but also by local community representatives.

The Toulouse situation is not unique. In France, the proximity of urban zones (housings, commercial activity) with industrial zones is common due to the historical context. Initially build outside the cities, the plants were progressively circled by the houses in a time when the legislation was not sufficient and was not imposing land use restriction. The opposite also existed: plants newly build or, more often, modified to increase their capacity in the middle of an existing city. With time an evolution of the population also occurred. In the origin, the surrounding population was often composed of people working in the hazardous plants, thus having some knowledge of the industry and its dangers. Part of this population moved to more comfortable places away from the industrial zones, and were replaced by people having no link with the plant and no risk culture.

The legislation evolved but, in many circumstances, the local political or economic pressure as well as the poor understanding of the risk by the local representatives, the population and even sometimes the administration, led to the continuation of abusive growth of the suburbs around the hazardous plants.

Cindynics analysis of the situation

G.Y. Kervern has developed a conceptual model (Figure 1) for the investigation of hazardous situations generated by organisational deficiencies. This model states that a hazardous situation can always be analysed in terms of values, rules, objectives, models and data [START_REF] Kervern | Eléments fondamentaux de cindyniques[END_REF]. When the actors of the situation lack or experience differences in one of these elements the situation presents a risk. It is qualified ofcindynogenic.

Epistemic (Models)Statistical (Data)Teleologic

Déontologie (Rules)Axiolc Using this model helps to understand the reasons of the AZF accident and its dramatic consequences. Indeed, differences of values and objectives existed between the industry, the population, the local and the national authorities. For example the population demanded more information and possibilities to express its opinion whereas the national authorities had the belief that the question was too complex to be debated and that the elite of the republic could certainly find the most rational and adequate solution. The industry and, somehow the local authorities were asking for less obstacles to the economic growth in the plant and around them.

To face these differences, the rules were insufficient. Their requirements were not clear enough, leading to divergences of interpretation. They were also not adapted to the situation of the many cities where an hazardous industry was cohabitating with a urban area.

The last deficiency concerned models and data. The report by F.Loos and J-Y.Le Déaut was underlying the necessity to improve the knowledge of hazardous substances and to improve the risk assessment methodologies [START_REF] Loos | rapport fait au nom de la commission d'enquête sur la sûreté des installations industrielles et des centres de recherche et sur la protection des personnes et de l'environnement en cas d'accident industriel majeur[END_REF]. It was also insisting on the very broad variety of results obtained by the risk analysis of industrial plants.

The European project ASSURANCE [START_REF] Hourtolou | ASSURANCE -Assessment of the Uncertainties in Risk ANalysis of Chemical Establishments[END_REF] realised in the same period had shown that for a same set of data about the same plant, the results of the risk analysis could vary by a factor 5 in terms of distances of effect and by a factor 1000 in terms of probability. This project was involving the top consulting firms and national risk institutes of seven European countries. Part of these results could be attributed to the lack of knowledge, the imprecision of models and the assumptions made to compensate them.

From the previous paragraph it can be concluded that the situation in terms of hazardous risk managements was cindynogenic. Progress had to be made for an improvement and sharing of common values, rules, objectives, models and data.

The values reflect what is considered as essential by the stakeholders. The values change slowly as the results of the general public debate and the evolution of the society. The debate that followed the accident contributed to the reinforcing of a common certitude that the management of risks around industrial sites could not be a solely technical activity and that, as the most concerned were the population, and the workers of the plant (who are often the same), they should be involved in a democratic way. A common value was that making profits could not justify to let risks uncontrolled. And, somehow, the question was too serious to be let in the sole hands of the technical experts and the politicians.

The rules are the results of the legislative and regulatory process. They are the formalisation and the implementation of the values. The debate that followed the accident in Toulouse led to the voting of a new law (n° 2003-699) of July 30th 2003 [START_REF] Loi | 699 du 30 juillet 2003 relative à la prévention des risques technologiques et naturels et à la réparation des dommages[END_REF] relative to the prevention of technological and natural risks and the compensation of the damages.

The new law aims at reversing the effects of the past lack of knowledge or differences in rules and values by introducing new rules and reducing the vulnerability around industrial sites. The evolution of the legislation aims at reinforcing the democracy by introducing a debate before the taking of decisions. Somehow this debate should also reduce the divergence of objectives among the actors as it should bring the actors to formulate common objectives in terms of risk reduction and control.

But the debate between the stakeholders only can work if its actors share common models and data. Those are often the result of a scientific process. Their formalisation and making accessible to the stakeholders is a typical knowledge management task that will be described in the next paragraphs.

In fact, the objectives of making the knowledge available go beyond the need of facilitating the debate. It also aims at making the risk assessment more efficient by providing to the people in charge of this activity the necessary models and data. It also aims at facilitating the comparison and interpretation of the results by the stakeholders, and then, it enhances the transparency of the decision-making process.

What Knowledge management can bring

Knowledge Management is the process through which organizations generate value from their intellectual and knowledge-based assets1. Knowledge management recovers all the methods and techniques that can be used to make the knowledge available and usable by those who pertain to the organisation.

The knowledge can be divided into two main categories : the explicit knowledge and the tacit knowledge. The first one is the knowledge that can be documented, the second one is the knowledge that resides in the people's mind in a more or less formalised form. One of the aims of knowledge management is to transform the tacit knowledge into explicit knowledge. A second one is to make the explicit knowledge accessible to people who may benefit from it.

One of the first step of knowledge management can constitute in the formalisation of expertise : making the expert tacit knowledge become an explicit knowledge understandable by other people. This is what was done in INERIS with the writing of the Q reports. These reports are a formalisation of the present knowledge of INERIS experts on various subjects related with the management of major hazards. The second step is to make this knowledge available to other potential users. This was done by the diffusion of the Q reports on the web site of INERIS. Table I lists the already available reference documents. The same number is under preparation at the moment.

Yet, this was not sufficient as the knowledge required to assess and control risk and to take decisions in a risk environment is not limited to literal knowledge. The risk expert uses a large variety of models and data associated to the various steps of risk assessment processes. To make these models, tools and data available to the risk assessment community, INERIS is presently developing the resource platform PRIMARISK® . It should be available to the public in the course of year 2006. The next paragraphs describe the main features of this web platform and present its basic structure in relation with the needs of potential users.

Table I : • Estimation of the exposition to risk; • Risk evaluation. Each of these steps requires that some knowledge be mobilised to produce the expected results. Specialists of risk assessment, experts, implement this process for the benefit of the community and the decision makers, who need to have a good understanding of the process itself and of its different stages to be able to interpret properly its results.

Q-l Q-2 Q-3 Q-4 Q-5 Q-6 Q-7 Q-8 Q-9 Q-
It requires also from them an initial understanding of these basic concepts : hazard, risk, accident, severity, vulnerability, and of the general decision-making process based on risk analysis. [START_REF]ARAMIS user guide[END_REF]. Specific risk assessment processes: the example of the safety report of industrial plants Specific risk assessment processes are defined by the legislation, standards or state of the art. At the end of its development, PRIMARISK® will describe several risk assessment processes related to the main activity domains of INERIS. The first to be implemented in PREVIARISK® is the safety report of a hazardous industrial plant (in French : étude de dangers). It involves the following steps :

• Description of the plant;

• Identification of the hazardous pieces of equipment;

These reports are prensently available only in French. The title was translated into english for the sake of the present paper.

• Selection of the pertinent equipment; • Risk analysis; • Identification of the safety barriers; • Assessment of the consequences of accidents; • Definition of the safety control and requirements for the safety management system.

Each of these steps mobilises a specific knowledge.

The description of the process is explicit but the understanding of which models, tools and data to use is more of a tacit type. The expertise lies in the ability to use the right model for a given hazardous situation. It lies also in the capacity to understand the results of the process.

Therefore, the first step of knowledge description involved the description of the risk assessment process. To ease the understanding, a logical decomposition was decided.

The risk assessment process is composed of steps. Each step involves the fulfilment of tasks.

In PRIMARISK®, each steps is described in terms of objectives. The relevant legislative texts are given together with other reference text, when they exist. Then the tasks are listed. Each of them is described and linked with useful resources.

The resources can be of three main types :

• Local resources : PRIMARISK® lists the elements of information that the person in charge of the risk assessment has to obtain from the plant operator such as the maps or process instrumentation diagrams. • General resources : these are the resources available elsewhere that the user should consults to obtain useful information. Most of these resources are available online from other web sites. Among these are databases, documentation etc. • Specific resources available directly from PRIMARISK®: These are tools and databases that were developed specially for being made accessible through PRIMARISK®.

Figure 2 shows the general structure of PRIMARISK®. The core system was implemented on a database and establishes the link with classical web pages and more specific online software.

WWW. External resources

Risk assessment processes

General knowledge Cognitive maps

Preventi

\^ Hazard

Figure 2 : general structure of PRIMARISK

Risk analysis methods and support tools

Risk analysis is an essential step of the safety report elaboration. Depending on the type of activity considered, different risk analysis methods can be used. PRIMARISK® provides descriptions of some methods as well as support tools, check lists, tables etc.

A decision support tool for the choice of an appropriate method is also proposed. The selection involves the type of process to be analysed, the complexity of the method, the depth of the analysis or the integrated aspect of the analysis.

A second development step will lead to the building of a complete risk analysis support tool dedicated to the management of the data collected during risk analysis. This tool makes use of the bowtie representation of the accident scenarios, which was promoted by the European project ARAMIS [START_REF]ARAMIS user guide[END_REF].

The associated risk analysis process begins with the identification of the hazardous equipments in the plant. ARAMIS provides lists of hazardous equipments 3 together with the critical events they can provoke. For each critical event, the method also proposes a generic fault tree and event tree that serves as initial basis for the risk analysis. A database with the hazardous equipments, their descriptions, and the associated fault trees and event trees was build in PRIMARISK®. It can already serve as a support for risk analysis before the building of the future tool.

A next step involves the identification of safety functions and safety barriers. A database with typical safety barriers for different types of activities, BADORIS 4 , was already developed in INERIS and is available online.

Once the safety barriers are identified, their efficiency is assessed so that finally the frequency of the accident scenario may be assessed. This step has revealed to be relatively difficult because of a general lack of data about initiating events or reliability of the safety barriers. Producing such data could be an objective assigned to a knowledge management tool such as PRIMARISK®. This goal will be discussed in paragraph 11.

Tools for the modelling of the consequences

The tools presently proposed in PRIMARISK® are mostly mathematical models for the assessment of the consequences of accidents. Most of them were developed as a result of INERIS research programs. They are dedicated to the modelling of physical phenomena such as fire, explosion or BLEVE (boiling liquid expanding vapour explosion). Progressively PRIMARISK® will provide a complete set of tools for the description of all the relevant phenomena that can be associated to major hazards.

Beyond, PRIMARISK® also aims at providing the expertise in the selection of the appropriate model for a given situation. A decision support tool was developed. It classifies the various models according to the type of phenomena, the physical state of the substance involved, the type of effect of interest. For each configuration, a pertinence level is defined together with the validity limits of the model and most typical assumptions.

Chemical databases

The major accidents, as they are defined in the SEVESO directive always involve hazardous chemicals. The modelling of accident consequences implies that the physical properties of the substances involved in the accident be known. PRIMARISK contains its own chemical substances database which directly provides the needed data to the models. Of course this database is not exhaustive and it will evolve permanently during years. This will be done by letting the possibility to certified users to enter their own data and share them with the rest of the users. A validation process is being devised to avoid the filling of the database with erroneous data. However, these aspects of content validation are one of the key aspects of the success of such a project. They will be further discussed in paragraph 11.

Decision support and land use planning

One of the aims of making the knowledge available is to allow for a better debate among the stakeholders. To achieve this goal, the basis of the land use planning decisions should be explained. This is somehow done in the general knowledge section where relevant articles explain the structure and objectives of the legislation and legislative process. But the system could be used further as a true support tool for the debate between the technical stakeholders and the public actors. Multicriteria decision systems could be proposed to establish the priorities in land-use planning, for example. The system would not provide a predefined decision grid but rather help the users defining their own and, by this way, progressing in their definition of risk acceptance.

GIS tools for the representation of risk zones around industrial sites could be also proposed. Such tools have been developed in the framework of the ARAMIS project.

Evolution towards a true knowledge management

The elements presented in the previous paragraphs, the structure and the content of the resource platform constitute a first step towards the implementation of a knowledge management system for the control of major accidental hazards. Yet the knowledge management approach could go far beyond, as many authors agree to consider that information technologies and web based tools are only a part of the KM philosophy. In fact knowledge management could aim at a permanent capitalisation of the knowledge of all the actors of risk management who all are potential future users of PRIMARISK® Figure 3 represents the steps of the evolution towards a full knowledge management tool. The first step, the formalisation of expert knowledge corresponds to the writing of the Q reports. The second step, the development of tools and databases from this initial knowledge is the first aim of PRIMARISK®. The next step involves the sharing of knowledge by future users. It could begin by the sharing of data: data about chemical substances, data about hazardous equipment, modelling hypotheses. This would be relatively easy to do on a technical aspect but would raise a series of legal issues about responsibility, intellectual property and the control of the quality of the data.

A further step would be to propose the users to provide the system with information about accidents or equipment failure with the objective of producing the lacking data for probabilistic risk analysis. Accident databases exist such as the European MARS 5 or the French ARIA 6 . Their feeding is done by the authorities on the base of mandatory declaration by the plant operators. Yet the useful information is often not available, and no quantitative treatment of the data is possible. Going further and proposing a structure for voluntary declaration would allow to obtain more information. The missing data are frequencies of initiating events, failure rates of safety barriers and safety integrity levels as defined by the IEC 61508 [START_REF]Functional safety of electrical, electronic and programmable electronic safety-related systems, parts[END_REF] and IEC 61511 [START_REF]EEC 61511, Functional safety instrumented systems for the process industry sector, parts 1-3[END_REF] standards. Obtaining this information would require to process the raw data produced by the users. Information about the damages caused by accidents would also be useful to assess the potential impact of future accidents. But the way will probably be long before being able to get voluntary declaration of accidents by the industry in a system hosted by a third party.

Experts

Obstacles to the development of an open knowledge management approach

Making knowledge available is not as straightforward as it may appear for numerous reasons. Among the various question it raises, one of the most critical is related with the responsibility and the validation of the contents. When a user visits the site of a reference institution such as INERIS, he expects to find trustable and validated information that he will be able to use to control the risk in his plant or system. Therefore, the process of formalisation of tacit knowledge of experts has to be controlled in such a way that only stabilised and proofed information be made available. This, somehow, hinders the free feeding of the platform by a community of experts and, later, by a community of users. Methods and procedures have to be developed to validate the content and guaranty to future users a safe use of the data.

Legal aspects also have to be considered. Different points should be examined.

-the property of the information provided to the system by the users; the responsibility of the users or that of the system operator in case of abusive use of the data; -the confidentiality of the data.

Other issues are raised by such a system and are somehow related to the structure of responsibility around Seveso sites and the position of the various actors. The legislation requires that the plant operator do a risk analysis of the plant and produce a safety report. The competent authorities assess the validity of the report. At this step, the report can be accepted. Or, if it is considered as incomplete, complementary studies can be demanded. The administration also has the possibility to ask for an independent expertise on the validity of the risk assessment. This kind of third party expertise is increasing regularly as the administration has more and more difficulties in assessing documents that have become relatively complex. Very often the conclusions of this expertise are taken as the reference by the administration, which raises questions about the interest of the first step of risk assessment. Somehow, having a system like PRIMARISK® would be a solution for reducing the need of such third party expertise. The administration would have all the elements for assessing the validity of the initial document. But it also raises new risks.

The legislation do not impose the tools that should be used at the different steps of risk assessment and many models are currently available and used by plant operators and consulting firms, who also have developed their own tools. If the conclusions of the debate following the accident in Toulouse had insisted on the variability of the results obtained in the risk assessment process, the origin of this variability was more attributed to a lack of expertise in the use of the tools rather than to the poor quality of the tools themselves.

What will happen when the administration have reference tools at hand ? Will the studies made by alternative models be accepted ? What kind of information should be given to prevent that PRIMARISK® becomes the unique reference system ? All these questions still have to be assessed and answer clearly before the final dissemination of PRIMARISK®.

More generally, the development of this tool may imposes to redefine the position of the expert, the administration, the plant operator and the other stakeholders in their relation to knowledge and the use of this knowledge for risk management.

Conclusion

The debate that followed the accident in Toulouse on September 21 st 2001 has underlined the necessity of a better sharing of knowledge among the various actors of risk management around hazardous industrial plants. To answer such a necessity, a four stage knowledge management scheme is proposed. The first stage involves the formalisation of the expert knowledge into documents made accessible on the INERIS web site. The second stage is dedicated to the conversion of these documents into tools and databases to constitute the base of a resource platform : PRIMARISK . The third and fourth stage involve the sharing of knowledge by the potential PRIMARISK® users : administration, plant operators, consulting firms. At first by making their data available, and then by feeding the system with more sensitive information such as exemplary accident or, what may be more useful, incident description or data about equipment failures, allowing for a processing of these elements and the production of data needed for the risk analysis. Implementing this knowledge management scheme raises a number of difficulties mostly related to the position of the actors of risk management, future users of PRIMARISK®. These questions are relative to the legal responsibility induces by the providing of such resources, the risk of defining a monolithic reference that would be considered as the only valid approach by the administration, the difficulty of making users share information about a sensitive subject such as risk. Somehow, the implementation of PRIMARISK® and its use question the role of experts and more generally of the actors involved in the risk management process.

Figure 1 :

 1 Figure 1 : The hazard hyper-space model (G.Y. Kervem) [2]

2Figure 3 :

 3 Figure 3 : four stages of the implementation of a knowledge management system

  10 list of the Q reference documents available on www.ineris.fr Guide for the conception and operation of farm-produce storage capacities with regard to the fire

	and explosion hazards
	Pool fire
	Lightning hazard in process plants
	Modelling of a fire affecting aerosol generators
	BLE VE -phenomenology and modelling of thermal effects
	Important for safety elements
	Risk analysis methods for industrial installations
	Jet fire
	Safety report of an industrial plant
	Assessment of the performances of safety barriers
	4. Structure of knowledge
	The heart of the process leading to the decision making around industrial sites is the
	risk assessment process.
	It is structured as follows:
	• Hazard identification;
	• Description of the scenarios;

• Determination of the dose-response relationship; • Estimation of the risk emission;

http ://www.cio.com/research/knowledge/edit/kmabcs.html

http://aramis.jrc.it 4 http://badoris.ineris.fr

http://mahbsrv.jrc.it/mars/Default.html http://aria.ecologie.gouv.fr

Acknowledgements

The authors acknowledge the French Ministry of Ecology and Sustainable Development for its institutional and financial support to the project described above.


Chabane Mazri

About the relevance of the concept of « risk acceptability » in the risk analysis and risk management process: A decisional approach in the French national context

Keywords: Governance, decision aid, risk analysis, risk acceptability, land-use

A rapid view to the evolution of the legal context at the national European and international level shows a need to introduce both more "visibility" and more "legibility" on the 'way the decisions in risk analysis and risk management are taken. This can be introduced by: ft) giving an image ofwhat the scientific and the experts agree to be the technical "state of the Art" in there respective discipline to reduce and control hazardous activities; (ii) improving the way the population and the other stakeholders are involved and participate to the risk management process.

In France, the Toulouse disaster has revealed a real need to improve the way decisions are taken in the risk prevention processes. In this paper, we will show how the establish concept of "risks acceptability" can induce bias on the way risk analysis are performed in the context of the hazard induced by industrial activities. We will show that there is a need to distinguish the acceptability known as "technical" from the one known as "social". We will then propose a new enlightenment on the way risk analysis are performed in Safety Studies and then discuss about the issue of land-use planning in France using "Risk prevention plans" (TRPP) aroundSEVESO sites.

Prevention of technological risks: The French context

The various industrial catastrophes, such as Bhopal (for the chemical industry, December 1984), Chernobyl (for nuclear industry, April 1986), Enschede (related to the storage fireworks, May 2000), and more recently the Toulouse AZF factory (related to the storage off specification ammonium-nitrate, September 21, 2001), revealed the need to go towards a greater control of the risks and their consequences and towards a stronger implication of the various stakeholders in the industrial risks prevention process.

In France, the Toulouse accident (2001) marks a turning in the industrial risk prevention process. Indeed, with more than 30 deaths in a radius of 500 meters, thousands of wounded and more than 26000 residences damaged on a radius of 3 kilometers [START_REF]Dossier d'information : Toulouse, trois ans après l'explosion[END_REF], this accident has revealed the following needs:

1. Control of the risks by acting on their source. This mainly consists in improving the way the risks control demonstration is carried out within the framework of the Safety Studies (SS).

Reduction of the vulnerability around the Seveso sites (High Threshold

). This consists in using the experience of the Risk Prevention Plans, carried out in the context of natural hazard, and proposes Technological Risk Prevention Plans (TRPP).

More implication and more dialogue with the various actors in the risk prevention process. This consists in:

• instituting a greater participation of the employee in the risks control process, with a widening of the Health, Safety and Working Conditions Comity (HSWCC) missions;

• going towards more implication of the various actors of risk prevention using the Local Committees of Information and Dialogue (LCID).

These three objectives aim at increasing the transparency of the risk analysis process, and at going towards a greater coordination between the different actors in of the preventive risk management.

In what follows, we will highlight the link between risk acceptability and the decisionmaking processes in risk prevention.

The first part of this paper highlights the relation between acceptability concept and the risk prevention process, in general and within the French context. The second part of this paper presents the estimation of a risk acceptability level within the framework of the SS. This part is based on a critical analysis of about thirty "criticality grid". The third and last part of this paper examines the acceptability concept within the framework of TRPP by studying the role of the dialogue process in urbanization control around the Seveso sites.

Risk acceptability and technological risks prevention

Risk is more than a simple mathematical formulation. Risk is a relative notion that depends on its perception [5JP6]1.

2.1.

Short history of a relative concept: risk and perception Risk definition was strongly influenced by the economics concerns in decision problems. Indeed, Frank Knight [START_REF] Knight | Risk, Uncertainty, and Profit[END_REF] defines a standard situation of decision where a rational actor conscious of his preferences must, by knowing the future consequences of a set of proposed decisions, choose among these the best one. In this context, if the actor does not have any possibility of checking the veracity of the evaluation of the suggested alternative consequences, then the decision situation is known as "uncertain". On the other hand, if uncertainty is measurable then this is known as a risk and the decision in this case is based on a probability calculation [START_REF] Merad | Apport des méthodes d'aide multicritère à la décision pour l'analyse et la gestion des risques liés aux mouvements de terrains induits par les ouvrages souterrains[END_REF]. Here, the risk is defined in opposition to uncertainty.

In the Sixties, the study of risks induced by the large technical systems, such as the industrial facilities, made it possible to add to the risk a new component. The risk was then defined as a quantifiable mono-dimensional value resulting from the combination of the probability and the intensity of an "event" [START_REF] Kampere | Decision Making Under Risk in Organisations: The case of germon Waste management[END_REF]. The advent of the social choice theory gives to the risk its social dimension [3][7][8] [START_REF] Luhmannn | Risk: a sociological theory[END_REF]. Luhmann [START_REF] Luhmannn | Risk: a sociological theory[END_REF] provided an interesting description of the distinction between "undergone decision" and " taken decision "; between danger and risk. For Luhmann, risk, defines a context where the future potential damage is the consequences of a "taken decision". The danger relates to the contexts where the decision is " undergone".

Nowadays, the interest for the study of "risk" invested various disciplinary fields. One speaks then about "natural risk"; "technological risk"; "chemical risk"; "management risk"; "risk of information systems"; "major risk"; "military risk" [START_REF] Ayral | Contribution à l 'élaboration d'une méthodologie d'évaluation de la vulnérabilité face à quatre risques « naturels » particuliers liés à la ressource en eau[END_REF]. Due to this diversity, many definitions of the risk concepts are available (more then sixty-eight) [START_REF] Ayral | Contribution à l 'élaboration d'une méthodologie d'évaluation de la vulnérabilité face à quatre risques « naturels » particuliers liés à la ressource en eau[END_REF]. In these various risk contexts the risk evaluation aims at organizing the available knowledge "to highlight" the "world" uncertainties [START_REF] Jasanoff | The political science of risk perception[END_REF] to enable the decision-makers to take the best decisions. This cannot be done only on the basis of one single rationality i.e. the technical rationality. Values, attitudes, preferences as well as motivations in choice-making situations vary from one actor to another In what follows, the risk is defined as a combination of "hazard" and "vulnerable stakes"

[28].

2.2.

Risk acceptability Acceptability is commonly defined as a "Set of conditions that make something acceptable" [START_REF] Atilf | Le trésor de la langue française informatisée[END_REF]. In an other hand, what is considered as tolerable is defined as "what one can admit by indulgence" [START_REF] Atilf | Le trésor de la langue française informatisée[END_REF]. Using these two definitions, one can say that risk is sometimes accepted and sometimes tolerated. [START_REF]Reducing Risk, Protecting People. Discussion Document[END_REF] in England and the VROM in Netherlands [START_REF] Vrom | Premises for Risk Management: Risk Limits in the Context of Environmental Policy -Annex to the Dutch National Environmental Policy Plan « Kiezen of Verliezen[END_REF] were the first to introduce the two concepts of "acceptable risk and/or tolerable risk" in the risks prevention process.

For the HSE, the acceptable risk represents "what is negligible" and the tolerable one "what is not negligible considering the possibility of a benefit and the emergence of a confidence in risk control measures". Within this framework, the standards defining a risk threshold, beyond which no reduction action were required, used the tolerable risk approach. That means that risk reduction measures must be established according to what is reasonable "and/or" practicable.

For the Netherlands, the Environment Ministry has defined a contextual set of "acceptable" and of "negligible" threshold. The risks above the acceptable threshold are prohibited and it is advisable to reduce them until the limit of the negligible risk. The risk level considered as "negligible" is fixed at 100 times lower than the acceptable threshold. HSE and VROM approaches are both based on the ALARA/ ALARP approaches « As Low As Reasonably Achievable » and « As Low As Reasonably Practicable » used for nuclear risks. The ALARA/ALARP approaches consider a continuity between exposition and effects and do not help to identify an acceptable risk threshold. Thus, the values of the acceptable individual excess risk2 threshold is different for the HSE (10 ~4 per annum for the public living in the vicinity of the factory site) and VROM (10 ~6 per annum for the public living in the vicinity of the factory site).

In France, acceptable risk is "what is legally allowed, knowing the expected benefit" [6]. Different acceptable risk thresholds are defined in different regulatory risk assessment processes: the Safety Studies3 and the TRPP. The first one aims at identifying whether the risk reduction at the source is enough. The second one examines if additional measures should be taken to reduce the vulnerability. Two acceptable risk levels are thus defined. The first one is based on the ALARA principle: the lowers risk level achievable with the techniques available to the plant operator. The second one should take into account the expectations of the exposed populations.

Acceptability within the framework of the Safety Study (SS)

The Safety Study (SS) is the industrialist demonstration of the control of risks induced by its activity. In the French present context, the SS is used as a reference for further land-use planning decisions, for emergency planning and for public information [START_REF] Belassian | Formalisation du savoir et des outils dans le domaine des risques majeurs (DRA-35) Q-9-Etude des dangers d'une installation classée pour la protection de l'environnement[END_REF]. The SS is based on risk analysis procedure that consists in: 1. Identifying a set of scenarios of accident. This consists mainly in:

• describing the site and the installations environment ; • identifying danger potentials of the installations ; • developing experience feedback of the last accidents ; 2. Valuing quotation of the criticality of the set of scenarios according to their probability of occurrence and of the gravity of their consequences.

3. Taking risk reduction measures (of technical and organizational nature) for the set of scenarios judged as unacceptable.

The choice of measures and their impacts on risk reduction is done using a support interface called " criticality grids " (Table 1). This grid helps to estimate a level of criticality using the following information: the level of probability of occurrence and the gravity level of the consequences of a scenario. The level of criticality helps to identify the unacceptable risk. Thus, this grid is a decision-aid tool that helps to:

(i) identify a risk hierarchy on major accident scenarios ;

(ii) define measures to reduce the risk at its source ;

(iii) draft the TRPP and the Specific Intervention Plans for risk management around the industrial site. As we can notice, the acceptability estimated, using the criticality grid, for the SS help to "identify what can be perceived as tolerable, for the stakeholders, once damages and losses occurred caused by the occurrence of an accidental scenario". In the context of the SS, the stakeholders are those who are implied in risk analysis process: a person in charge of the considered installation, a person in charge of the security, an operator, a person in charge of the maintenance, an engineering specialist of the considered installation [START_REF] Emeris | Référentiel «Outils d'Analyse des Risques générés par une installation industrielle[END_REF]. Thus, the acceptability in the Safety Study is a "technical" one. A set of explicit or implicit criteria (e.g. Ethiques, moral, economic, political etc.) and of practical constraints for the industrial site are identified to estimate the technical acceptability and than to choose the appropriate measures to reduce risk

Acceptability within the framework of Technological Risks Prevention Plans (TKPV)

The French law n° 2003-699 of July 30, 2003, relating to "the prevention of the technological and natural risks and to the damages compensation", has introduce a distinction between the reduction of the risk to the source (hazard) and the urbanization control around Seveso sites. This distinction became effective in two different procedures: the Safety Study (SS) and the Technological Risks Prevention Plan (TRPP).

The Technological Risks Plans of Prevention (TRPP) aims at limiting the direct or indirect effects on public health and safety directly or by pollution of the medium of an accidental event accidents likely to occur in the installations at the major risks being able to involve effects. This will consist in delimiting risks exposure perimeters according to the nature, the intensity of the technological risks described in the SS and the proposed prevention measures.

At the interior of the perimeters of exposure to the risks three types of zones are given according to the nature of the risks, their gravity, their probability and their kinetics. These zones, respectively called zones of urban right of pre-emption, zones of renunciation and zones of expropriation, represent three constraints of urbanization with which are associated the financial mechanisms with adequate compensation (Figure 1). The approval of zoning (expropriation, pre-emption and renunciation) and the corresponding measures is done by a committee of actors representing the various typologies of stakeholders involved in the risk prevention process (administration, authorities local, owners, residents and employees). This committee "Local Committee of Information and Dialogue" (LCDD) is set up by the Prefect in each risk area where hazardous installations are identified. The LCÏÏD aims at providing to the decision -maker an estimation of the local risk perception of the acceptability both of the accidental risk itself, of the land use planning restrictions or technical measures that could be taken to reduce the risk [START_REF]du 1er février 2005 relatif à la création des comités locaux d'information et de concertation en application de l'article L. 125-2 du code de l'environnement[END_REF]. Thus, this societal acceptability is obtained by providing more proximity between the actors involved in the TRPP within the frame of a dialogue and information process.

From this first general presentation of the acceptability, it can be concluded that semantic and methodological differentiation of acceptability concept is needed for both Safety Studies (SS) (technical acceptability) and Technological Risks Prevention Plans (TRPP) (societal acceptability).

Technical acceptability within the framework of Safety Studies: A critical study of 29 "criticality grids"

An analysis of 29 " criticality grids " usually used in risk analysis in various fields (e.g. natural, industrial, social, etc.) and countries, was realized. This analysis aim at (i) identifying the conditions and the approach used to estimate risk acceptability in the Safety Studies (SS), and (ii) highlighting heterogeneity of practice used to estimate the technical acceptability of risk [START_REF] Merad | Analyse de l'état de l'Art sur les grilles de criticité[END_REF]. This study contain two levels of analysis: a macro-analysis that has revealed some deficits on the "criticality grid" and a micro-analysis which provide a set of criteria explaining the noticed convergence or divergence between the various studied grids.

On this paper, we will present the conclusions of the macro-analysis and then propose some improvements for "criticality grid" and to the way the technical acceptability on estimated in the Safety Studies.

3.1.

A macro-analysis of the set of 29 "criticality grid" The analysis of the 29 grids has revealed:

• needs in experience feedback structuring ; biases in risk scale transition from qualitative to quantitative ;

• difficulties in evaluating accidents occurrence probability ;

• difficulties in identifying the level (or a set of criteria) where accidental scenarios are considered as non tolerable or non acceptable ;

In addition to these observations, some deficits were identified: a). StructuraldeficitThese deficits represent gravity and probability scales biases in the way the levels of risk and the level of acceptability are identified.

• For the "gravity" scale. The gravity of an accidental scenario is sometimes defined with reference to the consequences on people, on goods, on environment, and on reputation of the company. Each consequence takes a value on a distinct scale sometimes qualitative and sometimes quantitative. The following non appropriate practices are noticed: o If the different consequence scale evaluation are similarly incremented, then for a selected level of gravity a direct correspondence (correlation) between different consequences is considered (ex. consequence on people, consequence on environment).

o Subjectivity in identifying a level of gravity: non-explicit criteria are proposed.

• For the probability scale, we can notice:

o Occurrence references are heterogeneous for a same scale: temporal reference, decisional reference, and spatial reference.

o The use of different probability approaches: frequentist, possibilitic, etc.

• For the risk criticality level. The criticality is obtained by crossing two dimensions: probability and gravity. This aggregation presents a significant loss of information.

Moreover, the criticality level can differ and can take different significances according to the method or the approach used to estimate the level of probability and the level of gravity. The last remark concern the fact that a quantitative significance is given to the criticality level even if the information used to obtain this level is purely qualitative. b). Deficit of standardization. The analysis of the criticality grids shows a great diversity of practice. Thus, if the criticality grid must represent a decision-aid tool, it becomes necessary to converge towards a set of criteria, a set of methods and coherent structure of grid making it possible to be used as a basis for a common vocabulary between the various actors of the decision. This is necessary to go toward more objectivity, and more homogeneity in risk evaluation of a level of criticality of the set of scenarios selected for the risk analysis. c). Deficit in their communication junction. The criticality grid is a decision-aid tool that must respect the fact that the criticality level and the acceptability level must have the same meaning for all the actors involved in the risk analysis process. Thus, if this is not true, that means that the Safety Study is not robust. In what follows, we will give some suggestions to improve the way acceptability is evaluated in the safety studies.

3.2.

Suggestion of improvement of the current grids A "criticality grid" is both a decision-aid tool and a dialogue tool. The analysis of various grids was done in the framework of a program aiming at improving the current practices in risk assessment for a better risk prevention. The suggestions below were formulated on the basis of the conclusion of this program.

The nature of the scale

The "nature of the scale" must be considered for both gravity and probability estimation in order to avoid wrong interpretations of numbers. By definition, a scale helps to provide an evaluation to a given scenario according to its effects and its characteristics.

A scale is known as « ordinal » if the distance between two rungs does not have meaning (a, Figure 2). This scale can be verbal or numerical (qualitative scale) [START_REF]Bulletin du Groupe de Travail Européen "Aide Multicritère à la Décision[END_REF].

A scale is said to be quantitative when this one is a numerical one and when the rungs are defined according to a specific unit [START_REF]Bulletin du Groupe de Travail Européen "Aide Multicritère à la Décision[END_REF]. In this scale a sense is given to « having no quantity » (rung 0) and the ration between two given rungs is equal to the ratio of the given rung number (b, Figure 2).

A scale is considered as hybrid when this one balances between the two precedent scales. The interval scales are considered as hybrid scales because the ratio between two different numbers associated to an interval has a meaning when the ratio between to number associated to a rung has no meaning (Example: Temperature level using Celsius or Fahrenheit scale). The following suggestions can be done considering given precision on scale nature:

a). The level ofprobability. The définition of the probability scale depends strongly on the nature and the quantity of the available data. Thus, even if various evaluation procedures can be imagined to identify a level of probability, it is necessary to show the correlation between them (Table 2). If the data used to estimate a level of probability offer the possibility of statistical handling, the results can arise in a form similar to column 2 of Table 1. In this context, the column 2 represents a quantitative scale.

In other situations where the data are offered less easily to this type of handling, different approach can be used according to nature and the quantity of the information (Figure 3).

EventsPerspective of a futur evenîP^istPresentfuturProbability (/ historicalevents)Subjective probability Figure 3. Statistical or expertise approaches to evaluate an occurrence of an event The multiple-criteria approaches are an example of "expertise approach". This kind of approaches makes it possible to pass from a partial evaluation of a probability level (evaluation on several criteria) to a global evaluation of the probability level thanks to aggregation rules (Figure 4). In the example Figure 4, the aggregate level of probability takes its value on an order numerical scale (column 3, Table 2).

b). The level of gravity. The analysis of the various evaluation methods, used to estimate a gravity level, shows the existence of a large variety of approaches to take into account several targets(human, technical, environmental, etc.) (Figure 5). The use of qualitative scale or quantitative one depend on the nature of the available data and to the different actors involved in risk analysis process. If a global level of gravity is suitable, then it is important to consider the nature of the different partial gravity scales to choose the right aggregation rule.

The study of the "29 criticality grids" has shown that the most current aggregation rules were the "maximum logic" and the "weighted sum logic". The first one can give an overestimation of the gravity of scenario without considering the relative importance of the different targets. The second one can introduce important biases in the way the scenario are selected and considered as unacceptable. Indeed, if the partial gravity scales are qualitative one (verbal or numerical) than no numerical meaning can be given to the aggregate value.

Risk and acceptability evaluation

Once that the levels of probability and gravity were identified, the level of risk is obtained by positioning the scenario in the criticality grid. To avoid a loss of information, it seems preferable to indicate each scenario by the couple (gravity, probability of occurrence) rather than give a global evaluation of a level of risk.

This precaution aims at avoiding wrong use of aggregation rules and of focusing in risk evaluation rather than risk reduction measures. Thus, it is necessary to keep in mind that the purpose of positioning the set of scenarios in the criticality grid aims at choosing the right measures to reduce risk acting sometimes on probability level and sometimes in gravity level. According to this, the criticality grid can efficiently help to coordinate the actors in choosing the adequate risk reduction measures.

Positioning in the criticality grid makes it possible to visualize the various scenarios and to discuss of the risk reduction measures. The judgement on the risk acceptability or the risk non-acceptability of a scenario is a later stage. It makes it possible to distinguish, among the scenarios positioned on the grid, those that require an improvement in priority. The criticality grid must be used as a basis of dialogue to the technicians. So the levels of acceptability must reflect at this stage "what is technically acceptable "to reduce the level of risk of an unacceptable scenario (Figure 6).

Probability

Zones where nsk reduction m$a$y suitable

Todlnodate:

Risk evaluation (using criticality grid)

from 'onlifivous

Choosing risk reduction measures (using risk acceptability classes)

Figure 6. Two steps: Risk evaluation (G, P) and risk acceptability judgment

Risk Acceptability: Towards a Co-construction of measures to reduce vulnerability

The TRPP relate to "foreseeable technological events" and are not properly speaking a urban planning documents. But the Technological Risk Prevention Plans must be taken into account in Local Urbanization Plans.

The Technological Risk Prevention Plans (TRPP) includes three parts: a technical part, a regulation part, and a communication part. The TRPP aims at a stronger implication of the various actors concerned by risk prevention.

4.1.

Technical measures for urbanization control The technical part of the TRPP includes (i) informative maps (can come from the SS), (ii) a hazard map, (iii) a stakes map.

The TRPP aims at reducing the vulnerability around the Seveso sites notably by reducing vulnerability of the stakes. This consists in choosing a proportional risk reduction measure for urbanization control around Seveso sites. These measures refer concretely to a legal risk zoning which highlights the "zones" which would present the highest levels of risk according to the vulnerability of the stakes around the site. Crossing the hazard map and stakes map allows to make a first proposal of a set of measures for risk reduction. Theses measures, proposed by technical experts, consist in three urbanization constraints: expropriation, renunciation and pre-emption zones.

The regulation map (zoning) uses the technical zoning proposal done by technical experts. The regulation map of the Technical Risk Prevention Plans must consider local constrain. The Local Committee of Information and Dialogue (LCID) is in charge of carrying the local acceptability of the vulnerability reduction measures.

The mission of Local committee of Information and DialoguefLCID) in Prevention Plans

The Table 3 shows the missions of the LCID in the TRPP. The LCID aims at accrediting the technical proposal and their adequacy to the local regional concerns in terms of risk prevention. The dialogue on the choice of risk reduction measures intervenes at various levels and in different ways at each step of the TRPP. Thus, the two sub-groups of experts in "hazard" and "Vulnerability" propose a first set of measures to reduce the risk. The Local Committees of Information and Dialogue (LCID) must "be informed" on the way technical advises are done. This information step aims at creating more proximity between experts and local risk prevention actors.

The first set of risks reduction measures are then submitted to the LCID. The LCID consult it's members and gives its conclusions. The dialogue aims at "considering the local conditions (ex. Economical, social, etc.) on the feasibility of the experts proposal measures.

In order to understand the conditions of a constructive dialogue within the framework of the Technological risk Prevention Plans (TRPP), INERIS hasjoin the European project for an inclusive risk governance Trustnet-In-Action [START_REF]TRUSTNET-IN-ACTION (TIA): Inclusive governance of hazardous activities[END_REF].

Conclusion

Risk cannot be dissociated from its perception. According to this point of view, this paper has studied the relation between "risk assessment and decision-making process", then "risk and acceptability".

In France, the promulgation of the law n° 2002-276 of February 27, 2002 relating to "the democracy of proximity" then more recently the law n° 2003-699 of July 30, 2003 relating to " technological and natural risks prevention and to damages compensation " highlights a need for a re-handling of the acceptability concept considered in Safety Studies (SS) and more recently within the framework of the Technological Risks Prevention Plans (TRPP).

In this paper, two kinds of acceptability were identified. The first one "technical acceptability" represents experts' agreement on the risk reduction measures proposed in the SS. The second one "social acceptability" is the result of a dialogue between the various groups of actor involved in risk prevention process (TRPP).

In the framework of the SS, the definition of acceptability is based on a decision-aid interface called "criticality grid". An analysis of about thirty grids made it possible to propose a set of suggestion to improve the way acceptability is estimated.

Figure 1 .

 1 Figure 1. Various zones defined within the framework of the Technological Risks Preventions

Figure Z

 Z Figure Z Example of a qualitative gravity scale (RODIA criticality grid) (a) and an example of quantitative gravity scale (OFEFP criticality grid) (b)

Figure 4 .

 4 Figure 4. From a partial evaluation to a global evaluation of probability level

Figure 5 .

 5 Figure 5. An example of a partial evaluation of gravity level

9][10]

	2.2.1. ALARA/ ALARP :«As Low As Reasonably Achievable » and «As Low As
	Reasonably Practicable »
	The Health and Safety Executive [

Table 1 .

 1 An example of a criticality gridRisks considered to be unacceptable Measures must be proposed.

			-	'	•	• • • '...	.
	Gravity 4	4.1
	Gravity 3	3.1	3.2
	Gravity 2	2.1	2.2			2.3	2.4
	Gravity 1	1.1	1.2			1.3	1.4
		Frequency 1	Frequency 2	Frequency 3	Frequency 4
	Critical	risks	Safety measures considered being sufficient according with the level of risk.

Table 2 .

 2 4 levels ofprobability: two approaches according to the availability of data

	Level of probability

(*) n1>n2>n3>n4 ; (**)This is an example.

Table 3 .

 3 The role of the LCID in TRPP process

	Technological Risk Prevention Plan (TRPP)	Local Committee of Information and Dialogue (LCID)
			Inform ed	Implied	Concerned
	Technical part	A hazard map and a vulnerability map are produced under the responsibility	m v. Vî'• '• • • «'	! V:
		of the competent services

With,[START_REF] Simon | Administrative bihaviour[END_REF] March (1959, 1991) rationality is initially limited culturally[START_REF] Simon | Administrative bihaviour[END_REF](Simon, , 1966(Simon, , 1982;; Simon and March, 1991), to be widened, in the second time, by Bourdieu (1992) with limited rationality socially and a genetically (Delavallee, 1995).

Defined as the probability for one person to die from the consequences of the hazard.

Etude de Danger.

The acceptability within the urbanization control in the framework of the TRPP is captured using a dialogue process establish between the various actors represented in the Local committee of Information and Dialogue (LCDD). This committee allows a local coconstruction of risk prevention measures around Seveso sites. The European project "Trustnet-in-action" contributes to create the conditions of inclusive risk governance within the framework of the Local Committee in France.


Nelson Rodrigues
email: nelson.rodrigues@ineris.fr

Françoise Abiven

Olivier Salvi

EVOLUTION IN industrial risk MANAGEMENT in France The Agenda Concerning LUP, Risks And Stakeholder Perspective on A National Level

Introduction

Industrial risk management in France has recently evolved for several reasons, both technical and societal. First of all, the consequences based approach for risk assessment appeared to be inappropriate to fulfil the requirements of the Seveso II directive, in particular in terms of demonstration that major risks are controlled, and especially when the demonstration is based on the reduction of the probability of occurrence of the possible accident scenarios. Second, the analysis of the situation regarding land-use planning in France has shown a lot of discrepancies difficult to justify, in front of the public. The discrepancies seem to be generated by the uncertainties related to the selection of the scenarios, the models to quantify the consequences of the accident and the assumptions for the calculations. Third, the changes in our «information society» have led to increase the public interest and participation in decision making process related to environmental and risks issues.

This diagnosis was made in the framework of a project funded by the French Ministry in charge of Environment, which started in 1999. Then the Toulouse disaster occurred on the 21 st September 2001. This major event has played the role of a catalyst for changes in the risk management process and has led the authorities to prepare a new law that covers both natural and technological hazards and the compensation of the damages. For the technological part, the law took advantage of the recommendations made by the project and it was adopted on the30th July 2003.

In 2004, the competent authorities, with the help of INERIS and other technical supports have developed methods and tools to accompany the implementation of the technological part of this law which introduced 4 new aspects :

S the involvement of stakeholders with the creation of Local Committees for Information and Dialogue, S the preparation of Technological Risk Prevention Plans (long term view), S the participation of the workers, and subcontractors in risk management, S measures to speed up the compensation related to the damages.

The methods and tools were under development and tested in several real situations in 2004 and they were made public at the end of 2004. This paper will first describe the evolutions of the concepts related to risk management for hazardous installations in France, in particular in the aspects related to the link between risk assessment and land-use planning. Then, the paper will present in details the main novelties introduced by the law of 30 * July 2003, and the methods and tools that have been developed to enable its implementation. The results related to the cases studies carried in 2004 on several industrial sites will be presented and analyzed.

1.

Review of the current situation

1.1

The policy of industrial Risk management in France is well structured

If we consider the traditional model of the accident made up of the source of hazard (the industrial plant), the flow of hazard (propagation of the dangerous phenomena -pollutant gas dispersions, fires, explosions, liquid pollution) and the risk receptor (human, environmental and material), the industrial risk management policy in France takes shape according to 3 complementary general principles' which are :

1. The risk reduction (action on the potential of hazard).

2. The limitation of the effects of an accident (action on the vector of propagation).

3. The limitation of the consequences (action on the exposure of the receptor)

Thus, these principles are declined by the competent authorities according to the step in four points :

1. The risk reduction, 2. The land use planning, 3. The public information, 4. Emergency plans, This four points have defined the bases of the policy of industrial risk management in France during the 15 last years. The recent evolutions of the concepts related to the industrial risk management in France did not call into question its principles. However, they considerably contributed to modify the way of applying them while insisting on the first three points previously quoted.

1.2

The risk reduction is not enough applied and thus the authorities must enforce it.

Risks reduction refers to the reduction of the potentials of hazard (quantity of substances, pressure and temperature of reactions...) and the application of the best available techniques in term of process and safety measures. It is accompanied by the control of the reduction of the occurrence probability of the accidental events and on the attenuation of their severity.

This principle, which is however the first principle of the French policy, was not always applied in the past. Indeed, for a long time, it seemed in opposition with the idea of industrial growth whereas the idea of sustainable development haven't developed in the mind of the risk managers.

1.3

Lessons learnt from the implementation of LDP in France

After more than 15 years of application of the legislative and lawful texts relative to land use planning, it has appeared necessary to draw up an assessment on its implementation.

It comes out from this assessment that the overall application of the principles of the previous laws made it possible to limit the urbanisation around the seveso sites and that the tools used were relatively well adapted for new installations. However, it appeared that the legislative framework was complex and not very readable. This aspect was amplified by the variety of the decision authorities the weak readability of the responsibility for the various actors. Moreover, the concept of acceptance of risk for the public had never been explicitly defined

In addition, it appears that the legacy of the past (old plants) was difficult to manage with the existing tools, more adapted for the new installations. The implementing rules of the tools were insufficient for a homogeneous dimensioning of the safety zones. Moreover, there was a difficulty in carrying out a true dialogue between the local actors, without counting the delicate legal context.

Evolutions in risk assessment practices

Quality improvement of the safety reports for seveso plants

In France, the Safety report was, until a few years, elaborated with a very deterministic approach. It presented only in a very pessimistic way a list of scenarios (worst case scenarios) which were used only:

• For Land use Planning,

• For emergency plans.

This kind of approach did not pose problems for the preparation of the emergency plans but it was proven not very effective for the urbanisation management (cf. point 1). Indeed, in the cases where the deterministic scenarios were used for the land use planning that often resulted in the introduction of large unusable zones.

With the wish to be more pragmatic and for choosing the appropriate scenarios for land use planning, the safety report is improved by making more and more place to the risk assessment. The concept of probability was progressively introduced by taking into account the safety measures and the application of grid of criticity. With this, the safety report became the official key document in the management of the hazardous establishments and the communication on the major risks. The guiding principles governing its development became double:

• The industrial operator must demonstrate that all the risks on the site are identified and are actually controlled. This first condition makes it possible to deliver the permit to operate.

•

The industrial operator must provide in the safety report, all necessary information to land use planning and emergency plans New assessment methods proposed at the European Level

With the evolution of the contents of the safety reports (INERIS is one of the driver of this change in France), at the European Level was also bom a will to improve risk assessment methods for seveso plants.

The European project ARAMIS 1 precisely aimed to develop a new risk assessment method for major risks that integrates the forces of the various existing approaches at the European Level (deterministic or probabilistic culture). This project lays within the scope of the European directive Seveso ÏÏ.

For a more explicit demonstration of the risk control, ARAMIS had chosen to be directed towards a safety barrier approach. It was a question of identifying all the scenarios leading to major accidents, then to count the safety measures (barriers) being opposed to the development of the accident. The acceptability of the risk lays then in the choice of the number and the performance of the barriers in order to consider that the risk is controlled.

The human organisation ensured the maintenance in the time of the quality of the barriers.

Concerning land use planning, except the political or social stakes, one noted that the current representation of the risks did not make it possible to the decision-makers to have an overall vision of the problems. ARAMIS sought to develop on this point the current tools for cartography and in particular the GIS (Geographical Information System). The strong idea was to dissociate the danger potential of the seveso site of the sensitivity of its impacted environment, in the representation of the consequences of a major accident. Thus, research proposed the development of a vulnerability map independent but superposable to a severity map of the scenarios selected.

The work within this program contributed to the writing of guide related to the elaboration of the safety report in France and which was published in June 2003.

The main novelties introduced by the law of 30 July 2003

The law of 30th July 2003

The law related to the prevention of the technological and natural risks, and to the compensation for the damages envisages to bring answers to certain deficiencies of the existing laws as regards to technological risk.

In particular, the accident of Toulouse, at the origin of the great reflection in France, which led to the proposals contained in the technological part of the law, revealed:

1. Insufficient information of the public and a need for a stronger involvement of the public in risk related decisions, 2. A need to involve employees of the seveso sites, as well as the personnel subcontractor intervening on the hazardous installations, in the risk management leaded in the companies, 3. A need for engaging a reflection on the compensation to the victims so that it is faster and more effective, 4. Situations where the proximity of very urbanised zones is likely to strongly worsen the consequences of major accidents on seveso sites.

Accidental Risk Assessment Methodology for Industries in the framework of Seveso II Directive Concerning the later point; this law introduced two new tools to facilitate the land use planning around the high-risk sites:

• Utility easements compensated by the owner who generates the Risk. This utility easements are instituted for any "new" Risk generated by the extension or the creation of an industrial facility witch would require an additional restriction of the land use.. These tools, which existed already in the L. 515-8 article of the French environment laws, was extended by the law of July 30, 2003

• The creation of Technological Risk Prevention Plans (TRPP). These plans are foreseen to limit the exposure of the population to the consequences of the accidents. They will make it possible to reabsorb a difficult existing situation as regards town planning and to prevent that such a situation is renewed in the future.

The TRPP delimits, around the seveso sites, zones inside where regulations can be imposed on existing and future constructions.

TRPPs also define the sectors inside where expropriation is possible due to very serious hazard threatening the human life. They define the sectors inside where the local authorities can give to the owners a right of renunciation due to serious hazard threatening the human life, and those inside where the local authorities can preempt the goods at the time of transfers of properties.

The figures 1 and 2 below present how starting from zone of risk qualified by the State (on the basis of information provided by the industry) the authority determines sectors of expropriation or renunciation).

ndustnal zoneMotorwayTownnazards zones The number of TRPP to be elaborated from now to July 31, 2008 on the French territory is estimated at approximately 400. About 700 industrial plants and 500 towns are concerned with the TRPP process. Time necessary to the application of the whole process associated with the TRPP is estimated at approximately a generation (20 years).

New Technical and legal tools to apply the Land use planning

Three phases are to be distinguished for the realisation of the TRPP: the technical phase, the dialogue phase and the lawful phase.

The technical phase is the definition of the hazards. Upstream of this definition, it is advisable to check that the reduction of Risk was indeed applied by the owner in accordance with the Seveso regulation. This characterisation of the risks must come before the characterisation of the sensitivity of the receptor in the environment (surrounding the plant).

The dialogue phase is intended to carry out an analysis of the costs of an additional reduction of risks. It is necessary to set up the local committee of dialogue.

After that is the phase of drafting and consultation (with public consultation), which ends in the drafting of the lawful text and the signature of tripartite convention for the payment of measure related to the TRPP and rules applying on the land.

Concerning the Technical phase, this one is held in five stages:

• Hazard assessment and identification of risk receptors.

• superposition of these data;

• costing associated with land measurements;

• strategy of risks definitions ;

• preliminary draft of zoning A national framework is necessary in order to determine the scenarios of accidents and the vulnerability of risk receptor.

Tools to evaluate the hazards

The objective is to have solid technical tools for the phases of characterisation of the hazards and the vulnerability of the risk receptors. The publication of a Technical guide is planned for the second six-month period 2005.

The guide will provide a methodology to evaluate the hazards and the vulnerability of the risk receptors. It will define simple rules to work out the TRPP. It will present an illustration starting from the experiments carried out.

Because of the 3 dimension of the hazards, -intensity, probability, kinetic -, adapted tools are thus necessary.

Firstly, a definition was necessary to the glance of the law of 2003: It was brought by the decree of 22 October 2004 relating to the reference values of the thresholds of effects of the accidental phenomena.

The threshold of very serious hazards corresponds, at the national level, to the threshold of the significant lethal effects. The thresholds of the serious hazards correspond of the first lethal effects. The thresholds of the significant hazards correspond to the threshold of the irreversible effects the ministerial decree indicates three types of effects: toxic, overpressure, and thermies effects.

With regard to the toxic effects, the ministerial decree distinguishes four reference thresholds. Reference thresholds exist for twenty-six substances, defining thresholds for the significant dangers and dangers serious. For the other substances, the industry will have the responsibility to propose values. Overpressure (explosion) and the heating effects are also evoked. For the three levels of hazards (very serious, serious, significant) are indicated the corresponding thresholds.

The French threshold levels are synthesised in table 1.

For the kinetic, scenario will be described as slow if it is possible to set up measurements putting at the shelter the population. Principles were to be highlighted : response time of the safety barriers, prevention and protection measures inside or outside the site in coherence with the kinetic of the accident scenario.

mbar

About the probability, it is necessary to have: data on accident causes, on the safety barriers in place. We need also a framework for their use. Various stages result in working out an accident scenario: causes, loss of containment, sequence of events leading to a major event. Barriers make it possible to avoid this one. The method suggested consisted in identifying the various accidents scenarios being able to lead to the major accident and the various safety barriers installed. The initial events have several orders: intrinsic with the process, external with the process (domino effect), and external and natural causes. The method gives indications on the frequency of these initial events. The barriers must be qualified according to several criteria: effectiveness, response time, Safety Integrity Level. An index of probability of the major accident must also be defined according to the scarcity. This method allows an easier visualisation of the devices acting on the control of the risks and preventing thus major accidents. It authorises also a better transparency in the presentation of the control of the Risk. Lastly, it helps to understand the concept of probability.

Tools to estimate the vulnerability of the risk receptors

Three great stages must be distinguished:

• to carry out a total analysis of the risk receptors on the whole of the study perimeter 4 to engage the studies of vulnerability on more restricted sectors 4 to define a strategy of Risk control financially and technically acceptable by the stakeholders (operating, local authorities, State, private individuals)

The analysis of the risk receptors is an essential phase. Competent authorities must elaborate several studies on the populations and the territory giving place to a cartography. From a synthesis of these studies, it will be possible to concentrate on the particularly vulnerable zones.

On the base of these elements a total strategy of risks control will be developed with an aim of controlling the evolution of the population exposed to the Risk. This phase will make it possible:

• to evoke the possibility of reducing the risk at the source,

• to examine the possible effects of a reduction of vulnerability on the buildings,

• and to consider to remove buildings from given sectors.

The strategy of risk reduction will be declined through measurements taken within the framework of the TRPP, but also within the territory project of transfer of public equipment.

Tools for land control :

In very serious hazards zone it is possible to delimit sectors of expropriation. In serious danger zone , sectors of renunciation can be given. On the whole of the TRPP, the local authorities have the possibility of exerting an urban right of pre-emption.

Expropriation:

Expropriation must be used in an exceptional way. The law states indeed that expropriation is not possible only if the measures for protection of the populations proved to be impossible or more expensive than acquisition. It is thus an ultimate recourse.

Expropriation requires in addition, after the approval of the TRPP, the signature of a convention between the plant operator, the local authorities and the State, as well as a declaration of utility easement for the benefit local community (municipality).

It should be noted that this expropriation will apply to the built properties, not with the public domain (inalienable). It is carried out in accordance with the French Code of expropriation.

The renunciation:

The renunciation is the possibility given to the owner of a building to put in residence the local authorities to acquire its good. It will be exerted in sectors delimited for this purpose within the framework of the TRPP.

The right of renunciation applies to the only built properties.

The right of pre-emption is exerted in the perimeter of exposure to the risk for a reason of risk reduction.

Constructive measures:

Constructive measures are another specific tool related to the TRPP. They are intended to defend oneself of dangerous effects (panes, adaptation of materials). These measurements will apply to the existing buildings and the new buildings. In addition, the reflections on this subject are in hand to identify the tools and the needs for future work.

3.

Case studies to improve applicability

Justification of the experiments

The French approach was regarded as deterministic, maximalist, being based on the consequences of reference scenarios, which one considered only according to their intensity. The control of the risks was not sufficiently taken into account. The innovation of the law of 2003 is the introduction of the possibility of an action on what exists.

Since this law, the adopted step is intermediate, between determinism and probabilism.

Several possible scenarios must be drawn up, that will be only analysed in terms of intensity but also in capacity of appearance (probability) and kinetics of development. The concept of danger zones is abandoned. The concept of Risk indeed implies the presence of a technological Risk but also of vulnerable stakes. The reasoning thus does not relate any more on danger zones, but to risks zones and levels of hazards, with various vulnerabilities of stakes.

The experiments were launched in 2004 to help the ministry for national and regional development and the environment in the drafting of texts on the subject like the decree for the TRPP. They were necessary because the law introduced new and/or complex concepts. The experiments were intended to help to write operational texts sticking to real situations. For this reason, the experimental TRPP do not profit from a single method.

The State has also wished to encourage a broad discussion, very upstream, with the various stakeholders of the real TRPP: industry, elected officials, associations of environmental protection. The objective was to facilitate making of the regulatory texts and a Technical guide bound for local competent authorities.

Eight experiments took place in 2004, in different industrial sectors, in two phases. The first phase covered the experiments having begun in the first half of 2004, with a strong assistance of the national steering committee. The objective was to test the method and the tools. The second phase started later, by taking account of the first results of the experiments of phase 1.

The eight experiments are to synthesise in following the table. In the development of the TRPP, two phases were considered at the beginning: one is technical, the other commits of dialogue. During the Technical phase, it was envisaged to carry out in parallel the characterisation of the hazards and to analyse the risk receptor and their vulnerability. The superposition of these two characterisations was to give an idea of the zones of Risk and lawful zoning. The lawful project of zoning was then subjected to discussion with the associated parts to lead to a final draft.

3.2

Example of Mazingarbe.

The industrial complex of Mazingarbe is made up of two establishments. The first contains vinyl monochlorure, flammable gas, with an explosion risk. The second (the Grande Paroisse Firm) contains ammonia, whose risk is toxic. Both have storage zone and a discharge area. In addition we find other products which are toxic or explosive.

September 21, 2001, the company Grande Paroisse underwent the catastrophe of Toulouse following the explosion of a hangar containing off spec ammonium nitrates stored in bulk.

As in Toulouse, the factory of Mazingarbe produces pure ammonium nitrate, for industry purpose. Following this catastrophe and in preamble with experimentation TRPP, it was set up an important plan of risk reduction. The first measure consisted in removing the storage in bulk of industrial ammonium nitrate. Since the end of 2001, these products are bagged with the wire of the production. 500 tons per day are conditioned. A new storage area of these products is in construction; it will be entirely concreted and completely enclosed.

Storage will be split in small batches. The size of the batches and the distance are made to contain the possible effects of one explosion inside the site and to avoid a domino effect between batches.

This experimentation began in April 2004 and ended up in December 2004. The objective was to characterise the hazards goshawks of this site according to the new methodology and to characterise the associated stakes.

The classification of the risks was carried out by a semi-quantitative approach, called "Safety barriers approach". It was necessary to determine for each accident scenario the initial events (frequency of initial events classified from 1 to 6, 6 being the lowest sequence) and their barriers, with dimensions according to their Safety Integrity Level). By integrating the frequencies of initial events and the Safety Integrity Level by the means of a matrix, the authority has led to a characterisation of the hazards in the form of probability indices of major incident with dimensions from 1 to 7. It was considered various types of risks: thermies, toxic and overpressure. For each scenario, the various types of effectswere evaluated and all initial events were studied. Vis-a-vis with these events, barriers are interposed, classified according to their reliability and their response time. That made it possible to reach indices of probability of accidents and to analyse coherence. It was then proposed to draw aside the scenarios characterised by an index 7 and presenting moreover one additional and independent barrier, not taken into account in the index.

The following figures show the hazards map of the case study :

figure 3 : toxic effectgenerated in case of accidents (from the safety report)

Figure 4 : toxic hazards considered for the experiments of the TRPP Concerning risk receptors, the principal results of the experimental method were charted, by presenting the human stakes and the use operation of the territory. This method enabled the implication of each actor and a shared appropriation of the stakes of the territory.

The two following stages were the study of the vulnerability and the estimation of the costs of land and buildings.

About buildings, the vulnerability study was carried out considering a homogeneous type of residences. The principal results consist in determining built sectors having vocation to give place to expropriation and to renunciation. The study of vulnerability also continues on the infrastructures of general interest.

With regard to the estimation of the costs, the first provisional result is as follows: on the perimeter of risk retained at October 28 2004, 61 residences that need to be expropriated or renunciated represent a cost of about 5 to 7 millions Euros.

Major lessons learnt from case studies

The TRPP were created from the report of an insufficiency of the Land Use planning around the existing sites; they aimed at solving this coexistence between the risk sites and urban network. These plans act on three components:

• to examine the possibilities of the risk reduction,

• to set up constraints of public utility proportioned at the risk • to reinforce constructions if the hazards or the vulnerability requires it

• and, in the most exposed sectors, to set up the rules for of renunciation and expropriation.

It seems essential to reduce the risks before considering the creation of the TRPP. That simplifies very much the discussions during of the TRPP.

To work out the TRPP, the administration must have the elements necessary in order to determine the relevant risk in terms of town planning.

It is thus essential to obtain a safety report, which provide the necessary information, in particular regarding the probability.

The experimentation also shown that it is in addition necessary to progress on the decisionmaking relates to the probability criteria, kinetics and intensity. The definition of acceptability becomes essential. The competent authority in France has prepared for several months a decree on the control of the risks. These rules will make enable the administration to give an opinion, whether the probabilities of accident are quantified or taken into account in a qualitative way.

Lastly, It is necessary to have industrial databases on safety barriers, frequency of occurrence of the initial events.

Figure 1 :

 1 Figure 1 : hazards map with the localisation ofthe risk receptor

Table I

 I

		thresholds of	thresholds	of	thresholds	of	thresholds	of
		the significant	the first Lethal	the irreversible	the irreversible
		Lethal effects	effects		effects		effects	by
							breaking	of
							panes
	Toxic	LC 5%	LC 1%		SEI		-
	Thermies	8 kW/m2 or	5 kW/m2 or		3 kW/m2 or		-
		1800[(kW/m2)	1000[(kW/m2)	600 [(kW/m2)
		4/3]. s	4/3]. s		4/3]. s
	Overpressure	200 mbar	140 mbar		50 mbar

Table 2

 2

	Kind of site	Town	Firm	Characteristic of the experimentation
	Petrochemical	Notre Dame de	Exxon Mobil	Relate to only one part of the installations
	platform	Gravanchon (76)
	Oil terminal	Toulouse (31)	Esso	Real size
	Oil terminal	Lorient (56)	Total	Real size
	LGP terminal	Vire (14)	Butagaz	Real size
	LGP terminal	Bollène (84)	Butagaz	Real size
	Chemical Site	Mazingarbe (62)	Total et SA V	Real size
	Chemical Site	Roussillon (38)	Rhodia	Real size
	Raffinage	Fezin (69)	Total	Relate to only one part of the installations