Sandrine Descourriere

Nicolas Dechy

Control of Major-Accident Hazards Involving Land Transmission Pipelines Charlotte BOUISSOU, Project Manager for Pipelines Risk Assessment

Control of major accident hazards involving land transmission pipelines

Charlotte Bouissou, Sandrine Descourriere, Nicolas Dechy

Learning from experience and risk comparison

An overview of the literature on pipeline accident analysis over the last thirty years was performed, with accidents from France (BARPI), Europe (EGIG, CONCAWE), North America (US DOT), and former Soviet Union (VNIIGAS) and with a review conducted by Papadakis [START_REF] Papadakis | Review of transmission pipelines accidents involving hazardous substances[END_REF] in 1999 for the EU.

Statistics show that both gas and oil pipelines have caused major accidents. For example, in 1989, in former Soviet Union, more than 500 fatalities were caused by an oil pipeline rupture and in 1984, in Peru 3000 persons were evacuated because of a tetraethyl pipeline rupture. Pipelines are therefore considered as a source of industrial major-accident hazard [1,2].

The HSE [START_REF] Ws Atkins | An assessment of measures in use for gas pipelines to mitigate against damage caused by third party activity[END_REF] has noticed that main causes of failure in Western Europe are:

• Mechanical failure (fault in construction or fault in material quality) -28 % of total causes • Operational failure (excessive pressure or malfunctions of equipment) -4 % of total causes • Internal or external corrosion -16 % of total causes due mainly to the network ageing • Natural hazards -2% of total causes • Third Party activity -41 % of total causes

Considering the number of accidents and the relative experience of each database, several authors estimated failure rates and victims rates. From such state of the art, orders of magnitude of accident frequency varying approximately from 10" 4 to 10" 3 per km-year and rate of victims (fatalities, injuries...) about 10" 5 to 10" 4 per km-year may be considered in Europe, for gas and oil pipeline.

After these observations, it was decided to compare risk due to pipelines with risk of fixed installations and hazardous goods transportation in France and in the EU. The final use of such a comparison aims to help authorities to balance the requirement of the new pipeline regulation with regards to several technological risk levels and with regards to requirements of the regulations in such fields.

Different questions are raised for the study: How to compare risks? Which approach is relevant? Which risk indices should be used? An historical approach is used to achieve the objective to get a global view of the risk level for an industrial sector at the scale of the country. The comparison is based on accident gravity and on major and fatal accident frequency. These events are well-notified [START_REF] Dechy | Récent accident frequency on fixed installations in France an in the E. U[END_REF].

With regard to gravity, pipelines have a similar potential of major accident to the fixed installations [START_REF] Papadakis | Review of transmission pipelines accidents involving hazardous substances[END_REF][START_REF] Papadakis | Pipeline Safety Instrument, Regulatory Benchmark, Overview of Responses from Competent Authorities of the Member States[END_REF]. With regard to accident frequency, the accident rates estimated for the Seveso II sites in the EU vary from 3.10" 3 to 7.10" 2 major accidents per installation per year and the best order of magnitude estimate would be of 10" 2 major accidents per year per site [START_REF] Kirchsteiger | How frequent are major industrial accidents in Europe? Process Safety and Environnmental Protection[END_REF]. From the literature [START_REF] Papadakis | Review of transmission pipelines accidents involving hazardous substances[END_REF][START_REF] Papadakis | Pipeline Safety Instrument, Regulatory Benchmark, Overview of Responses from Competent Authorities of the Member States[END_REF], a fatal accident rate of 10" 5 per km-year for pipelines can be considered. However, notice that these estimates are attempted despite lack of detailed data [START_REF] Kirchsteiger | How frequent are major industrial accidents in Europe? Process Safety and Environnmental Protection[END_REF], and do contain various uncertainties [START_REF] Dechy | Récent accident frequency on fixed installations in France an in the E. U[END_REF]. Moreover, these estimates may not be used for such basic comparison due to the significant difference between a fixed installation and a pipeline kilometre.

Thus, risk indices at the global scale of the country and for the industrial sector would be more relevant as they contain variety of context, and because they should be useful only to global decisionmakers [START_REF] Dechy | Récent accident frequency on fixed installations in France an in the E. U[END_REF]. Considering the environmental regulations such as Seveso II Directive focusing on protecting public in the neighbourhood, one may consider the estimates for France of 3 fatalities per year in the public due to fixed installations (1992-2002 observation period) whereas one fatality every two years due to pipelines (1970-2000 observation period). As a reminder, these results could be tricky with regards to low frequency-high consequence events such as Toulouse disaster in France in 2001 with 8 fatalities in the public, and show once again the lack of robustness of such estimates for this type of events.

After this extract of preliminary results, the next step will be to analyse statistics available for the various means of hazardous goods transportation, pipeline, rail and road. The risk criteria to use for the comparison between transportation means will be easier, because it is possible to work on a common basis, the quantity of transported material. Also, societal risk indices as F/N curves will be used.

Damage prevention measures

Damage prevention measures are often required when pipelines are located in a vulnerable zone as densely populated zone, road or rail crossings, water catchments, rivers... The learning from experience showed that third party activity is the main cause of failure [START_REF] Ws Atkins | An assessment of measures in use for gas pipelines to mitigate against damage caused by third party activity[END_REF]. A review of safety measures against third party activity with earth-moving machinery was done, in order to quantify risk reduction brought by their use. Risk reduction may affect frequency of failure or consequences extent of an accident alike reducing the size of the spillage. Main data come from UK databases analysis and experiments [START_REF] Ws Atkins | An assessment of measures in use for gas pipelines to mitigate against damage caused by third party activity[END_REF]. These measures can be either technical (mechanical protection), or related to safety in operation. They can be implemented at various states of the process :

• Design : depth of cover increase, route choice, wall material choice, wall thickness... • Construction : mechanical protection like concrete sleeves or steel plate, warning tape... • Operation : walk, road, air observation increased, spillage detection system, information to the public or to earth moving engine users...

A study of the literature on 5 damage prevention measures is reported below.

The influence of depth of cover

Several studies were made to estimate the influence of the measure with various results. A HSE report [START_REF] Ws Atkins | An assessment of measures in use for gas pipelines to mitigate against damage caused by third party activity[END_REF], mentioned the following results: Knight and Grieve, concluded that increasing cover from 0,93 m (3 ft) appeared to have little effect on the vulnerability of pipelines to external interference. Neville (1981) conducted further work in this area and concluded that an increase in depth from 0,93 m (3ft) to 1,22 m (4ft) resulted in a 38% reduction in the incident rate and to 1,6 m (5,25ft) resulted in a 64% reduction. Fearaehough and Corder, 1989, concluded that 50% of the damages were concentrated in the 30% of pipelines with a depth of cover less than 1,05 m. Furthermore, BG Transco data show that increasing the depth of cover from 1,1 to 2 m has reduced the mechanical damage frequency by a factor of 6. In different perspective, Gasunie, [6] distinguished depth dependent activities (piling, drilling, hot taping...) to depth independent activities (cable laying, drainage activities, ditch cleaning...) in rural or suburban area. In extrapolating data, relations below were developed for suburban area. For depth dependent activities failure rate F= e " 1>8d~3 ' 8 per km-year where 'd' is the depth of cover and d< 2 m. For depth independent activities F= 6,2 10"4per km-year.

The influence of depth cover is stated. However, a drawback of this measure when it is advocated to face a modification of the pipeline environment during its operation, is its technical difficulty to implement.

In France, by present law, depth of cover must be over 0,8 m, but this value may be increased to 1 m in the future regulation.

The influence of wall thickness increase

In Europe, the Institution of Gas Engineers makes recommendations for high-pressure minimum wall thickness of gas transmission pipelines [START_REF] Ws Atkins | An assessment of measures in use for gas pipelines to mitigate against damage caused by third party activity[END_REF]. In France, a formula giving a relationship between thickness, diameter, pressure, and steel properties is given in the regulation and used by operators. The scarce data available to estimate the influence of this measure show that increasing wall thickness lowers the failure rate [4]. In France, there was a case where population density was increased in the vicinity of the pipeline and required a modification of the pipeline. The authorities agreed to not replace the pipeline because of its increased thickness in accordance with the regulation.

The influence of mechanical protection

The British Gas [6] designed and executed a series of experiments involving a range of excavating engines and several techniques of pipeline protection. The approach used was to bury protected sections of pipeline and to ask operators, who were not informed of the presence of the pipeline, to dig as usual. As an interesting conclusion, warnings tapes are shown to have a relatively small effect used alone but are extremely effective when combined with protective barriers like concrete sleeves.

The influence of third party information

According to CONCAWE data, a major part of accidents, 65%, result on the ignorance of the pipeline location, especially in case of non-notified works. The other causes result on a negligence of the third party operator. Pipeline signalling and third party information are among the most important preventive measures [START_REF] Ham | Control of third party interference as a cause of pipeline leakage[END_REF]. Setting markers on the pipeline route is a standard practice in all European countries. Information of the third party activity can vary according to the country, from one phone call system to few meetings with local authorities. No review was found on the effectiveness of such systems.

The influence of air surveillance, mobile/walking monitoring

All operators commonly use monitoring. It allows monitoring the global aspect of the pipeline, detecting potential non-notified works or detecting leakage by apparition of oil on the ground or modification of the ground aspect. The efficiency of the monitoring will change with the frequency, but it is difficult to say if there is a change between a weekly monitoring and a twice-monthly monitoring. New technology using satellite monitoring will be developed later in this paper.

After this state of the art study, INERIS intends to develop a methodology to assess risk reduction benefits.

When it was possible for the authors in the literature, risk reduction brought by damage prevention measures were quantified. It could correspond to a failure rate reduction or to a consequence extent reduction as a decrease of the leak size: breach diameter, leak duration.

Starting point of this methodology is to define a reference state for the pipeline that corresponds to maximum risk acceptability. It could be the risk induced by the same pipeline in a rural area with no specific risk as specific agricultural work, important corrosion and with low vulnerability of the targets. Then, starting in the situation of the pipeline without any prevention measures, the influence of all measures used or proposed will be estimated. The aim is to reach the reference state with all safety measures set. If this is not the case, additional measures have to be defined. The main methodology difficulty is the risk reduction quantification of some safety barriers that can be quantitative, semiquantitative or qualitative. Some results will be agreed in a French work group composed of main pipeline operators to study the effect of damage prevention measures. The main purpose is to write a guideline recognised by law to inform operators and help them to choose whether damage prevention measure to use in several case.

Evaluation of consequences

Evaluation of risk includes consequence assessment on human health and environment in case of accidental releases from a pipeline. Calculations should be performed for several typical configurations (materials, pipelines diameter, pressure...). The TNO report called "Methodology for selection of pipelines which potentially can cause a major hazard" [8] is a state of reference in the EU on the subject. Therefore, the first step for INERIS was to study this report. INERIS made some comments on the methodologies or models used hypothesis taken and lethality threshold chosen. These comments aim to advise the MinEFI on how to interpret the TNO results. Second step was to compare TNO and INERIS results with the same hypothesis but with INERIS models for effects calculation. Third step was to remake calculations with hypothesis used on pipeline safety studies in France and models used at INERIS. Fourth and last step is to remake calculations with hypothesis taken in safety studies on fixed installations required by the French regulation.

TNO study is based on:

• A classification of materials in function of the hazard it represents (toxic, flammable...),

• A representative substances for each category of hazard (chlorine for toxic...)

• Specific pipeline characteristics (diameter...),

• Specific transport conditions in term of pressure and temperature,

• Specific conditions of leakage (time of leakage, leakage after isolation of the section).

A pipeline is considered to potentially cause a major hazard for the TNO, if distance of effects corresponding to 1% of lethality is over 100 m, or ifmore than 10 000 m 3 of ground are polluted.

As an example of the study, the table 1 shows some results and the differences between INERIS and TNO simulations, for same pipelines and products with same hypothesis but by changing only models used. This table shows that 80 % of the simulations produce same conclusions for INERIS and TNO. A few differences in particular for hydrogen, propane and oxygen are identified. For hydrogen, unlike the TNO, INERIS considers UVCE scenario because of the explosion potential of hydrogen cloud (an immediate ignition is not considered). For propane, unlike the TNO, INERIS has rather chosen UVCE scenario than BLEVE scenario. For oxygen, the flammability risk is considered with an increase to 30 % of oxygen in volume. INERIS found no effect at 1,5 m high for a vertical release due to important air mixing.

Table 1: Results of INERIS simulations for a selection of pipeline that can be hazardous

Then, using INERIS models and hypothesis of French safety studies on pipeline (GESIP guidelines, [START_REF]GESIP Guide méthodologique pour la réalisation d'une étude de sécurité concernant une canalisation de transport (Hydrocarbures / gaz / produits chimiques) Rapport[END_REF]), some differences are found, with carbon monoxide that is not considered to be a hazardous material contrary to TNO results. Petrol appears to INERIS to be non-hazardous for health effects only for under 6" diameter pipeline.

The aim for these simulations is to compare methodologies of calculation and to see the influence of various parameters in simulation. First of all, this study aims to help the MinEFI to widen or not the scope of the future regulation that will define which pipelines and materials should be assessed within safety studies according to risk of major accident.

Secondly, it will help to define the distances from the pipeline where the risk exposure of the environment and its targets will have to be assessed.

Conclusion and perspectives

Pipelines are fixed installations that carry hazardous materials on large distances from a point to another crossing, as well, public and private areas. Fixed installations are regulated by Directive 96/82/CE known as Seveso II Directive that requires the operators of industrial facilities using hazardous materials to develop a major accident prevention policy and a Safety Management System (SMS) in order to prevent major accidents. Pipelines are not in the scope of this directive. Whereas comparing risk due to fixed installations and risk due to pipeline is complex some studies show that pipelines can be a major hazard accident source as for Seveso sites [1]. Therefore, the European Commission considers a similar approach trough a future directive for land transmission pipeline that can cause major accident. Thus, pipelines that will be covered by this directive have to be identified.

The TNO has issued a report [8] to select those pipelines. To transfer these results into the French context, INERIS has reviewed this report to advise the MinEFI before issuing a new regulation.

Thereafter the identification of pipelines, the application of such type of directive requires developing an approach with the step of identification of accident scenarios for risk evaluation and the step of risk control by operators. The first step goes by specifying the assumptions and the conditions of occurrence of the scenarios to assess in safety studies. It can be based on learning from experience and on evaluation of consequence extent. Some items on these subjects were exposed in this paper. Once hazards acknowledged, the second step requires reaching an acceptable risk level to demonstrate risk control. By the way, that will require quantifying risk reduction brought by prevention measures. INERIS intends to develop with operators in France a methodology to assess risk reduction benefits especially against third party activity that is the main accident cause. This methodology is based on the literature study of several measures commonly used by operators. Five measures are presented in this paper and in particular pipeline satellite monitoring. With the actual state of the art (presented in main terms in this paper) the risk reduction quantification is not completed for all measures. This can be achieved by setting up expert work groups, carrying out experiments and simulations and learning from experience at national and EU levels. Notice that no pipeline disaster occurred in the EU for recent years that enable a co-operative working context between stakeholders to issue a new regulation (low media pressure, no urgency).

However, to reach this objective of risk control, a main question stays in mind: who is going to define this level of residual risk acceptance in France or in the EU and with which criteria. Moreover this risk level should be discussed at a local level for decision making in accordance with the local context and environmental vulnerability. Same criteria as for fixed installations may not be used. As an example, in France, for land use planning stemming from the definition of this level, the regulation requires that there are a very few existing houses in the lethal effect area. The same requirement for pipelines in France would be equal to "freeze" an area of approximately 3% of the French territory that is not conceivable.

  ; LG = liquefied pressurised gas; G = + Pipeline that could potentially generate a major accident -Pipeline that is not considered as a pipeline with major risk Greyed cells represent a difference between INERIS and TNO simulations.

  Cloudy weather disables the process. Therefore, in Europe, all areas can not be covered at all times. To improve that, Radar technologies can be used but they are very costly and not directly usable, • Actual precision of civil imagery, about 10 m does not allow to detect precisely all kind of engine.Gaz de France conclusions on PRESENCE project are:• Satellite surveillance is a long-term promising technology even if this application has to be more clearly defined, • In a global view, this technology can be used in a local situation but not in a global one, • Used alone, this technology does not seem economically affordable. It has to be combined with other monitoring technologies often used by operators of underground network (water,

	3	Satellite surveillance
		exposed
	below:
	• Necessary high frequency of flying over requires an important mean of data treatment with
		inevitably high costs,
	• Data transmission times are incompatible with immediate risk characteristic of third activity
		near pipeline,
	•

Remote satellite technology can provide a new way to monitor pipelines for a better detection of earthmoving machinery, ground movement or leaks. INERIS defined specifications for such a monitoring with Spotimage and Gaz de France. Spotimage is specialised on satellite imagery and Gaz de France participates to a European research project: Pipeline REmote SENsing for Safety and the Environment, PRESENSE, that aims to assess the potential benefits of these technologies. PRESENSE

[12]

gathers European gas operators, European Space Agency and companies specialised in data processing technologies.

One of the technical conclusions of the exchanges with Spotimage is that present technology can not fulfil the requirement of earth-moving machinery detection near pipeline. Some reasons are cable, electricity...).


Charlotte Bouissou

Emmanuel Ruffin

Raphaël Defert

Franck Prats

Eric Dannin

A new QRA model for rail transportation of hazardous goods

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Balancing the different way to transport goods is one of the European Union wills expressed in the « white paper » of transportation [START_REF]White paper "European transport policy for 2010 : time to decide[END_REF]. This new view leads to consider the railway mode, in order to choose the less risky route for the transportation of goods, these routes being able to combine several means of transports by road or rail. For this objective, it then appears important to be able to assess and compare the risks related to hazardous goods transportation.

The aim of this paper is to show the INERIS research project funded by the French Ministry of Ecology and Sustainable Growth and by the French Ministry of Equipment, Transportation and Buildings [START_REF] Ruffine | Elaboration d'un modèle d'évaluation quantitative des risques pour le transport multimodal des marchandises dangereuses[END_REF]. This project is related to the assessment of the risk induced by the transportation of hazardous goods by road, by rail and by the combined means of transportation. The main target of this project is to develop a "multi-modal" quantitative risk assessment model (QRAM).

A QRA Model applicable to the road transportation already exists. Within the framework of a research project carried out for both the OECD and the PIARC (World Road Association) INERIS with WS-Atkins and the Institute of Risk Research (University of Waterloo) has already produced such a model. For two years, this tool is recommended in the French regulation and used to realise comparative risk studies for roads including tunnels, crossing more or less populated areas, with a more or less dense traffic [7].

QRA Model

The main purpose of the QRA model is to assess the risks relative to the transport of Dangerous Goods in a quantitative way. The model evaluates simultaneously the consequences and the frequencies of occurrence of possible scenarios. This makes it possible to assess quantitatively the societal risk (if the distribution of the people liable to be exposed is at hand) and the individual risk.

A complete assessment of the risks due to Dangerous Goods would require to consider all the possible weather situations, all kinds of accidents with all types of vehicle partially or fully loaded, etc. Such an evaluation is completely impossible and some simplifications have to be introduced. The QRA model is based on the following steps:

• Choice of a restricted number of Dangerous Goods.

• Choice of some representative accidental scenarios implying those Dangerous Goods with their usual packagings. • Identification of physical effects of those scenarios for an open air or a tunnel section.

• Evaluation of their physiological effects on road or rail users and local population.

•

Taking into account of the possibilities of escape/sheltering. • Determination of the yearly frequency of occurrence for each scenario. F/N curves and their expected values are the major outputs of the QRA model. They are defined as follows:

Frequencies / Gravity curves (F/N curves): stand for the annual frequency of occurrence F to have a scenario likely to cause an effect (generally, the number of fatalities) equal to or higher than N.

Expected value (EV): number of fatalities per year, obtained by integration of a F/N curve. In fact these TSI are not specific to dangerous goods but related to the fire events. The specifications mainly concern the limitation of the generation, the propagation and the effects of fire and smoke in the event of fire [START_REF] Ruffine | Elaboration d'un modèle d'évaluation quantitative des risques pour le transport multimodal des marchandises dangereuses[END_REF],

-UNECE (draft recommendations 30 July 2003) "Report of the Ad Hoc Multidisciplinary group of experts on safely in tunnels (rail) on its fourth session", -UIC leaflet 779 -9 on Safety in Railway Tunnels which has been taken into account for the elaboration of the UNECE document, -CEN prEN 45545 related to fire resistance for railway passenger wagons (no specific indications about dangerous goods),

Thus the UNECE and UIC documents appear to be the most specific documents on rail tunnel safety but they are not enforced at the law level. At law level TSIs concerning the infrastructure subsystem give the minimum safety requirements for rail tunnels within the scope of the interoperability purpose and only for the fire events.

It is also important to note that the causes of DG accident is depending at a primary step on railway incidents and thus the Directives 96/48/EC, 2001/16/EC giving TSIs as well as the Project Directive relative to the Safety of European Railways setting up the Common Safety Objectives, Methods and Indicators (CSO, CSM, CSI) might to be considered.

All these documents related to safety in rail tunnels or for the transport of dangerous goods by rail thus appear to be, a complex set of references, hard to use efficiently and not sufficiently harmonised with the road mode.

The Situation in the Professional Engineering World for Rail mode

Compared to the road mode the question of the dangerous goods transport (DOT) by rail is following a quite different regulation scheme mainly based on prescriptions.

The main prescriptions relative to the transport of dangerous goods through rail tunnels are included in the following documents:

-UNECE -R C1 -10 (only for new tunnels), Invoke the possibility for the high-risk tunnel and if operating conditions permit to segregate trains carrying dangerous goods in bulk from passenger trains, The trains driver have to know information about DGs carried when going through a tunnel and the operator must be able to pass information on the carried DGs to fire brigades, Risk analysis of safety measures involving DGs are based on cost-benefit considerations of various options, for example freigth train carrying DGs are diverted on routes without tunnels or diverted on routes without dense populated area...

-UNECE -S C4-15 (only for new tunnels), "... operating company should normally provide such information (train consist) to the network operator before the departure of the train carrying dangerous goods. " Within the UNECE prescription (draft document) we can notice that there is no specific recommendation or standard indicated for DGs through existing rail tunnels. But a global recommendation to raise the safety level is made if possible with no-structural measures in order to limit the cost. The use of QRA approaches and performance objectives appears to be the better way to raise the safety level for existing tunnels by optimising the operation of the rail network.

Also in the framework of the present regulations the Directive 96/49/EC suggests that for some safety aspects not treated in the RID Member States can propose specific safety measures (Article 1.2). These points are the following:

-the traffic trains planning, -the order of the wagons in a train for intra-State transport, -the operation safety rules for the nodes of the rail transport system such as marshalling yards or parking,

-the operators staff training and the management of information related to dangerous goods, -the specific rules concerning the transport of some dangerous goods in passengers trains.

The Article 6.11 should also lead Member States to make use of the QRA approaches for the rail mode in order to define specific safety rules for regular local transport of dangerous goods from a given industry site and on a given well-defined route. Thus, the application of this article also implicitly entails the identification of the less risky route.

Reaching the appropriate balance in the different modes in use for the transport of goods is also one of the European Union strong wills expressed in the « white book » of transportation. This new view leads to consider the railway mode as well as the road mode, in order to choose the less risky route for the transportation of goods. Moreover, whereas in some cases alternative route can result in a combination of various modes. For this objective, it then appears important to be able to assess and compare the risks related to hazardous goods transportation even though the perception of the "common" accidental risks is not often is relation with dangerous good transportation concerns.

Nevertheless reasonable assessment of the risks involved by the dangerous goods has be to taken into account properly in the overall decision making process for upgrading or building railway infrastructures taking into account the interactions with the road network.

Thus in the same way as for the risk assessment process pertaining to the road transportation mode, making use of the QRA approach could lead to a better management of global risks pertaining to DGs in complement to the RID prescriptive approach.

QRA rail model

General approach

Even though the present regulation does not recommend QRA models for the rail mode some objectives are more or less related to the QRA application and should involve this kind of model in the near future. Considering a such possibility INERIS has developed a model for rail transportation of DGs. This new model has been developed taking into account the same global philosophy on which the road OECD/PIARC model was based. By this way road and rail models produce homogeneous assessment and then allow the study of multi-modal transport systems.

The long-term principles of a global assessment of risks on multi-modal routes can schematically be drawn as shown in Figure 2.

""V?:'."';!. '. ' ' J ". J *™*' * • ' V .':.;"• '" ul |. 1 ïl|'"V i a *"'^"-«i " During the development, two points stayed in mind: homogeneity with the "road tool" and specificity of rail transportation. Risk assessment, level of details, global approach have to be similar for both mode to allow comparison between modes. Therefore, the philosophy of the "road tool" has been kept. This philosophy is based on a choice of a limited number of hazardous good, a choice of a limited number of scenarios, assessment of probability and assessment of physical and physiological effects. However, capacities engaged, accident progress, traffic are different in the two modes. These differences have been assessed with a systemic approach of the railway mode. Especially frequencies of accident scenarios take into account the probability of incident weighted by conditional probabilities to reach a major accident implying hazardous goods. The frequencies are also connected to the local properties of the line environment and to the type of operating system. The rail QRA model was elaborated using an approach similar to the one used for the road QRA model. But it will require the development of new "sub-modules", specific to the railway routes. On certain aspects, a direct adaptation from the Road QRA model is not possible. For instance road traffic, constituted by a large number of vehicles may be described as continuous. On the other hand, rail traffic constituted by trains appears as essentially discontinuous.

Choice of scenario

The numbers of scenarios and of Dangerous Goods involved had to be very restricted for simplification and applicability purpose. Scenarios had to be in accordance with scenarios in the road model and had to be representative of Dangerous Goods Transport by rail. This challenge was met with a panel of 10 scenarios that have been developed for each mode in the QRA and are listed below

Scenario

Nr: 1

Type of accident considered

Only accidents involving a transport of hazardous material are considered. Learning from experience was used to see what type of accidents can occur and what were the cause and the consequences. These approaches were completed with a basic study of the rail system. As one can suppose, these accidents are essentially derailments or collisions.

For road accidents, HG transports are in the continuous flow of vehicles including passenger vehicles so passengers are always involved in the accident. Each accident could be treated in the same way, considering that the accident will produce a traffic jam growing proportionally to the traffic flow.

For rail accidents, in most case only one or two trains are involved and that will be the only cases considered. Passenger trains can be present or not. Treatment, particularly evaluation of gravity, will be different in both cases.

For each accident that can occur involving HG, frequency and gravity have been evaluated. All results are aggregated in a FN curve.

Evaluation of frequency

As mentioned before, the study was funded by the French ministry of transport, indeed French database of accidents involving hazardous material was used. Hopefully, they're only few accidents that make difficult to be significant and exhaustive. Therefore generic accidents involving all types of trains have been taken into account. For all kind of accident: collision, derailment, a frequency has been estimated. Next the ratio of trains transporting HG and a probability to have a failure has been introduced.

0130

PG 4287 D2.1720S415 According to the grade of sensibility wondered in the study and data available, two methods were developed, a global one and a method that take into account local environment particularities of the railway lines that induce risk as exploitation specificity called 'contextual method'.

On one hand, the global method will be used in case of poor knowledge of the data or for a global evaluation, the frequency of accidents will be the same all the route long. On the other hand, the contextual method is based on the definition of contexts with specific rate of collisions and derailments. Four families of contexts were chosen: type of track as double track, type of exploitation, type of environment as bridge or tunnel and specific risk as malicious intent. The contextual method can be use only if data can be put behind each kind of context defined previously.

The overall risk assessment can rely on the establishment of a typical (simplified below) scenario tree considering a major rail accident involving dangerous goods. In the open air, consequences of physical phenomena are calculated by existing dedicated models. Consequences are calculated using percentages of lethality and/or injuries, using probit equations (Equation which allows to deduct the physiological consequences from the exposure to physical consequences of a phenomenon) and considering the possibility to escape or to get shelter.

Usually, open-air models calculating consequences of scenarios can not be used in tunnels and a specific development has been made to determinate:

• The tunnel zones which can be affected by the scenario,

• Effects that can overflow out of the tunnel and which can generate effects in the open air outside the tunnel.

The complexity of problems to deal with and the number of possibilities of equipment and ventilation system (longitudinal, transversal or semi-transversal ventilation, one or two tubes...) in the tunnels lead to use simplifications.

The model used in the road tool developed with the collaboration of WS Atkins, UK, is an independent module and can be used separately. It was modified to considered rail scenario and rail tunnel specificity as piston effect induced by train's stop in the tunnel.

Conclusion

Present developments will broaden the possibilities and the scope of the already existing road QRA model. In the fields of Risk Assessment relative to the Dangerous Goods transport, comparisons between different routes and means of transport will become possible.

Furthermore, one have to keep in mind that Risks are an important component of the transport development in Europe and that a local regulations of DGs transit or requests can influence significantly long travel. In that way, QRA Models developed can estimate the influence of various modes on various routes. So, it would be interesting to introduce this parameter on the level of the management of European transport in the future. Of course, the parameters of risks are not the only important ones and of the multi-criteria approaches that would put in parallel risk assessment but also the economic impacts, the society profits and a better management of the costs of transport would be extremely useful.

A

  new QRA Model for Rail Transportation of Hazardous Goods BOUISSOU Charlotte, RUFFIN Emmanuel**, DEFERT Raphaël, PRATS Franck, DANNIN Eric***, Engineers -Safety in Transportation System -** Program manager for Tunnel Safety and Transportation of Hazardous Goods -***Technician -Software developments Contact : charlotte.bouissou(a>.ineris.fr Institut National de l'Environnement Industriel et des Risques (INERIS), Parc Technologique Alata, F-60550 Verneuil-en-Halatte, FRANCE, www.ineris.fr Tel : (33) 3 44 55 65 92 -Fax : (33) 3 44 55 62 95 1. Context

Figure 1 :[ 4 1 Part 1 -Part 2 -

 14112 Figure 1: Example ofFN curve

Figure 2 :

 2 Figure 2: Principle diagram for the Multi-modal plate-form for DGs risks assessment.

Figure 4 : 4 . 4

 444 Figure 4 : Simplified scenario tree governing the new QRA-rail model

Scenario chosen for rail QRA model

		Description	Road/ Intermodal/ Rail-Road	Rail
		Fire 1	20 MW	30 MW
	2	Fire 2	100 MW	130 MW
	3	BLEVE of LPG in cylinder	50 kg	-
	4	Motor spirit pool fire	28 tons	65 tons
	5	VCE of motor spirit	28 tons	65 tons
	6	Chlorine release	20 tons	65 tons
	7	BLEVE of LPG in bulk	18 tons	51 tons
	8	VCEofLPGinbulk	18 tons	51 tons
	9	Torch fire of LPG in bulk	18 tons	51 tons
	10	Ammonia release	20 tons	58 tons
		Figure 3:

  Loss Prevention and Safety Promotion in the Process Industries 11 th International Symposium Loss Prevention 2004 Praha Congress Centre 31 May -3 June 2004


Olivier Salvi
email: olivier.salvi@ineris.fr

Nelson Rodrigues

Sandrine Descourriere

Didier Gaston

S Descourrière

Risk assessment

come

INTRODUCTION

The Third Assessment [START_REF]Europe's environment: the third assessment[END_REF] from the European Environment Agency (2003) indicated that Major technological accidents continue to occur, even with advances in the safety management of hazards and the efforts to control major accident hazards with Seveso I and Seveso II directives. Recent accidents (Enschede in 2000, Toulouse in 2001) have shown that disasters continue to occur throughout the EU. Moreover, a recent communication from the Commission [START_REF]Report on the application in the Member States of Directive 82/50I/EEC[END_REF] indicates that the frequency of major accidents is estimated at about 3.10" 3 per year if we consider the number of accidents reported in the MARS accident database of the European Commission (Major Accident Reporting System, http://mahbsrv.jrc.it/) versus the number of hazardous installations in the EU. So, controlling major accident hazards by reducing the risk at the source is not sufficient to promote a sustainable development for both industry and urban areas in the next decades. It is necessary to organise the settlement of industrial and urban areas with an appropriate land-use planning (LUP). This paper describes and discusses suggestions that will be implemented in the French risk management system according to the new law on the control of technological and natural risks [START_REF] Loi | 699 du 30 juillet 2003 relative à la prévention des risques technologiques et naturels et à la réparation des dommages[END_REF]. In particular, the paper will focus on propositions to improve the efficiency of the land-use planning procedure.

CONTEXT AND ISSUE ADDRESSED 2.1 Seveso II requires land-use planning around hazardous installations

The article 12 of the Seveso II directive requires that: "Member States shall ensure that their land-use and/or other relevant policies and the procedures for implementing those policies take account of the need, in the long term, to maintain appropriate distances between establishments covered by this Directive and residential areas, areas of public use and areas of particular natural sensitivity or interest, and, in the case of existing establishments, of the need for additional technical measures in accordance with Article 5 so as not to increase the risks to people." Even if the directive is the same within the European Union, the history of the legal systems in the different Member States shows that LUP can be implemented in several ways, using a deterministic approach, a probabilistic approach or tables of appropriate distances [4].

LUP, a decision making process involving multidisciplinary expertise

The risk management decisions have to be made for the interest of the Civil Society since the main goal of risk based decision making is to protect people and the environment. As described in the IEC/ISO Guide 73 [START_REF]Risk Management -Vocabulary -Guidelines for use in standards[END_REF] on risk management, it is fundamental to distinguish the risk assessment and the decision making steps. The guide explains that risk assessment is a part of the risk management process, ended up with the decision. Risk assessment is a tool used to estimate the risk, characterised by the likelihood and severity of specific events. Risk based decision making process is naturally based on risk assessment criteria, but must also integrate other criteria that can be economical, cultural, ethical... Having said that, the ISO Guide 73 should apply to the LUP procedure. Moreover, recent major accidents, in particular in Europe, have shown that politicians and riskdecision makers are facing difficulties to manage technological risk. This situation is probably due to, on one hand, the complexity of the issue, and on the other hand, citizen's loss of trust in politics, since in a knowledge-based society, citizens ask for more and more access to information and require transparent decision-making processes. In fact, there seems to be a lack of balance between the citizen's expectations and the decision-maker's behaviour on risk-related problems, mainly due to the uncertainties of the risk assessment and to the complexity of the context. The increasing complexity of industrial systems and the conscience that the role of humans and organisations is a key issue to control major accident hazards have strongly emphasised the need for better methods and tools to manage industrial risks. Such approaches are based on models that integrate a holistic vision of the industrial system. It implies that trans-disciplinary approaches are currently developed by integrating the concepts, models and tools from various sciences : engineering, psychology, sociology, management etc. Therefore, LUP appears as a decision making process involving multidisciplinary expertise.

Public involvement in risk management

The awareness of the general public about technological risks has recently increased and as well the demand for effective, consistent and adequate risk management. Moreover, by nature technological risks are required to be treated at both national and local levels. The national level should define general rules, and the local level should apply the rules and reach agreements according to the local socio-economic, political and cultural context. It has long been recognised that increasing public participation is an essential element in improving environmental and risk-related legislation. It has led to the adoption on 25 June 1998 of the Aarhus convention on access to information, public participation in decision-making and access to justice in environmental matters. When the various stakeholders are aware of risk issues, and involved in decision-making, the solutions inevitably become more sensible and legitimate. The quality of stakeholders participation in risk decision-making is often determined by how well informed they are about the nature of risk issues, and how responsible institutions deal with them. According to the discussion presented here, the key issues seem to be both scientific and societal.

THE SITUATION IN FRANCE 3.1 Risk management policy in France

In France, land-use planning is a major part of the risk management policy implemented by the Competent Authorities in charge of Seveso plants. In the regulation related to the control of hazardous establishments, the deliverance of the license to operate can be subordinated to a sufficient distance between the establishment and people located around. To apply the Seveso II directive requirements and to develop a system on the control of majoraccident hazards involving dangerous substances, the Member States need to built a risk management policy combining several tools. The risk management policy implemented in France is based on the accident model constituted by the following system:

• hazardous source: it is constituted by the hazardous installations, products, equipment, processes, • hazard flux: it corresponds to the dangerous phenomenon like dispersion, fire or explosion, • receptors: they are the elements located in the vicinity of the hazardous installation that could be affected by the hazard flux.

This model and the four components of the risk management policy are presented in Figure 1 [6]:

• risk reduction on-site: to reduce the hazard potential (amount of hazardous substances, process pressures and temperature...) and to implement risk control measures during plant operation, • land-use planning: to maintain appropriate distances between the hazardous installation and the sensitive receptors, • emergency plans: to prepare the public and the rescue services to behave efficiently in case of a major accident, • information to the public: to inform the public about the possible consequences of a major accident and the behaviour they need to have in such a situation, but also to explain about the risk reduction at the source and the land-use planning objectives. Using the model of Figure 1, it is clear that LUP is a complementary tool to the on-site risk reduction and to the emergency plans. The philosophy behind LUP is to maintain a distance between the hazardous source and the receptors in case of a major accident, in particular if the accident can occur so quickly that the emergencies plans cannot be activated, or so that the number of people to evacuate is too high.

Development of the French deterministic approach for risk assessment

To enhance a harmonised implementation of the philosophy presented above, the French Ministry of Environment published in 1990 a guide [START_REF]Secretary of State to the Prime Minister for the Environment and the Prevention of major technological and natural risks[END_REF] that defined reference accident scenarios to be considered for determination of safety distances for land-use planning. Then, in a circular letter published in June 1992, it was explained that the safety distances should be determined using the safety reports written for the licensing procedure. Consequently, to write the safety reports that aim at characterising the hazard of their plants, the operators have been asked to focus on the examination of the reference scenarios described in the guide. This approach is known as the consequence-based approach or as the French deterministic approach. The term deterministic means that the scenarios are pre-defined and considered independently of their likelihood, which is not assessed. The underlying philosophy is based on the idea that if sufficient measures exist to protect the population from the worst accidents, sufficient protection will also be available for any less serious incident. The risk acceptance of hazardous establishments is a very complex decision process based on several criteria difficult to evaluate. In France, the only explicit criteria are those related to the possible consequences of accidents that are used to define the safety distances around hazardous establishments. They are linked to the LUP process.

ANALYSE AND RECOMMENDATIONS TO IMPROVE THE SITUATION 4.1 Methods to analyse the situation in France

In 2000, the French Ministry in charge of the Environment and Spatial planning asked INERIS to take stock of the situation regarding risk assessment and land-use planning in France. Then, a 3-years study was launched to analyse in particular, the procedure to write the safety reports required by the Seveso directive, and the relation with land-use decisions and zoning according to major accident hazards. In this study, INERIS has brought the experience gained from, on one hand, a project entitled "Risk analysis and major accident prevention", and on the other hand, from the critical analyses of the safety reports asked by the authorities. Indeed, the French legal system allows the Authorities to ask a third party expert to make a critical analysis of a safety report provided by an operator of a Seveso plant. The critical analysis is paid by the operator and is delivered to both him and the Authorities. Besides, in order to collect the relevant information and identify the possible changes to improve the situation, several working groups were initiated both at local level and national level, involving inspectors and industry representatives. Both the thoughts of the INERIS team and of the working groups enable to identify the strength but also the weaknesses of the French approach.

Then, the Toulouse accident occurred in September 2001, at the mid term of the study. Its dramatic consequences has reinforced the interest of the study, but has changed both the context of the study and the expectation of the Ministry. Moreover, the regional debates and national debate launched by the French parliament provided substantial information to enrich the study from a technical point of view and also from a societal one. Thanks to this work, lessons have been learnt about the implementation of LUP and the risk assessment used for the LUP purposes. They are presented hereafter as guiding principles that could be used to improve the LUP procedure in France. However, some of them are so general, that they could be applied in other Member States of the European Union.

Distinguish risk assessment for giving the permit to operate and for LUP

In the safety report required by the Seveso II directive, the risk assessment should enable the operator to conduct a deep analysis on the hazards of a plant and on the way to control the associated risks. The analysis should start with a systematic hazard identification and a risk analysis. Then, after the assessment of a set of scenarios, the adequacy of the risk control measures should be discussed. This requires the identification of worst case scenarios and of scenarios that take into account the safety barriers implemented by the operator. The comparison of these two types of scenarios shows the risk reduction and the gain provided by the safety control system. In other words, the demonstration required by article 9 of the Seveso II directive, in particular that "major-accident hazards have been identified and that the necessary measures have been taken to prevent such accidents and to limit their consequences for man and the environment" need a detailed risk assessment. Based on this risk assessment, the authority can verify that the operator has "taken all measures necessary to prevent major accidents and to limit their consequences for man and the environment", as required by the Article 5 of the Seveso II directive.

The purpose of LUP is, as explain in Article 12 of the directive to "maintain appropriate distances between establishments [...] and residential areas, areas of public use and areas of particular natural sensitivity or interest". This objective can be interpreted as the need to estimate the consequences of major accidents in order to determine the zones in which the number of people should be minimised.

Clearly, the objective of risk assessment to deliver the permit to operate and the objective for LUP are different. The later has often a great economical impact outside the plant, the former has the main impact inside the plant. In particular, to do risk assessment, scenarios must be defined. Since an accident scenario is the combination and the conjunction of several events, the assumptions related to the conditions of occurrence of the events including the functioning or not of some safety devices have a great importance on the final results. The risk assessment for LUP purpose should therefore be defined by the authorities in a public guide.

Defining certain assumptions related to the safety barriers and to the consequence assessment

The scenarios that can lead to the most serious consequences are usually used to determine the emergency plans. The scenarios considering that the safety barriers in place can prevent the occurrence of some events or reduce their consequences can also be identified. They are usually used to judge the adequacy of the safety control system which includes naturally the safety equipment and operations, and the organisational measures, both defined and maintained by the safety management system. For land-use planning purpose, intermediate scenarios are needed. Such scenarios should take into account some safety barriers, for example, those prescribed by standards and regulations. In particular, the safety barriers that are the most reliable should be considered as in good operation.

Since there is still a great uncertainty on the performance of safety barriers and the reliability data, the safety barriers should be identified, reviewed and accepted with a consensus by the authorities and the other stakeholders of the LUP process. The scenarios taking into account these barriers can therefore be considered as conventionally defined.

Looking at several risk assessments of similar hazardous installations, strong discrepancies have appeared on the estimation of the distances related to the apparition of the lethal effects and first injuries. This statement was the same in the ASSURANCE project [START_REF] Lauridsen | Uncertainties in risk analysis of chemical establishments -the ASSURANCE project -1998-2001[END_REF]. This benchmark exercise allows to measure the size of the uncertainties in risk assessment and to propose some explanations. The results indicated discrepancies of about 4 orders of magnitude (variation of 1.5 10 ~7to 2.1 10 ~3) in the probability estimation of some events. There is a factor 6 for the estimation of the consequences of a liquefied ammonia release in unfavorable atmospheric conditions (variation from 1510 m to 9700 m for first injuries, and from 570 m to 3800 m for the first deaths). These results are due to the great variety of possible assumptions related to the parameters describing the conditions of occurrence of the scenarios and the hazardous phenomena. The choice of these assumptions generates uncertainties on the estimated safety distances.

However, the decision making process constituted by the LUP should be homogeneous and consistent at the national level, and further at the European level. Therefore, defining certain assumptions could reduce the discrepancy in the decision process, and should make it more transparent. It is no more tolerable that the results of the risk assessment step depends on the experience, the feeling of a risk evaluator, neither the pressures related to the implication of the results. It is essential that the rules are the same for all, should they be discussed and determined after a debate involving all stakeholders: industry, authorities, mayors, communities and risk appraisers. In order to make it explicit that the scenarios used to estimate the danger zones in LUP are based on predefined assumptions, it was proposed to call them "conventional" scenarios. On the basis of the conventional scenarios, then the LUP decisions can be adopted as a function of the local context.

LUP, local concerns

LUP is implemented at the local level and should take account of local specificity. The LUP ACS project [START_REF] Duijmn | Land Use Planning And Chemical Sites -the LUPACS project -1996-2000[END_REF] proposed a methodology for LUP involving chemical sites for making decision in local and regional administration. This European project expressed that LUP is a complex decision process involving actors at different levels with different interests. In that context, the estimation of the consequences of the proposed conventional scenarios should be one of the criteria used to define the danger zones for the use of land. But the problem has other dimensions than the risk level, and decision makers should take into account the economical, social, cultural dimensions of the problem. The danger zones based on the conventional scenarios enable to identify the residential areas and other sensitive areas capable to be affected by the accident. They identify also the stakeholders who should be involved in the discussions and negotiation that will lead to find a consensus on the most adequate alternatives between: a) keeping large zones around the plant and disable the development of the city and b) reducing the zones by implementing technical measures to enable the development of the city. For both new installations or existing ones, the danger zones should not be directly transposed from the risk assessment step. The implication of land-use by taking into account the hazard potential of a plant should be discussed at the local level, and should be analysed regarding all the aspects of the decision.

Recommendation of a two-step approach for a risk-informed land-use planning

Using the lessons learnt for more than 10 years, INERIS formalized a two-step approach described in Figure 2 [START_REF] Salvi | Propositions pour la Révision du Guide de Maîtrise de l'Urbanisation[END_REF]. This two-step approach allows:

• To assess the hazard and estimate the danger zones in a homogeneous manner, following a common procedure defined at the national level,

• To develop and assess alternatives that can be negotiated at the local level, according to criteria defined at the national level, that should be made explicit. The first part of the approach is the risk assessment that leads to the estimation of the danger zones and their communication to the public, in order the public and the stakeholders know about the extension of the possible damages in case of a severe accident. This step is based on the examination of a set of scenarios, covering the different hazardous phenomena associated to accidents involving toxic, explosive and flammable substances. The conventional scenarios used to determine the danger zones should be defined in a guide, which is currently under development. The second part is the treatment of the risk and the negotiation of the alternatives for the land-use planning, according to the local constraints like the composition of the environment in the vicinity of the hazardous installations, and socio-economical context. At this second stage, the discussions and the negotiation should associate the various stakeholders identified within the danger zones determined in the first stage. This phase of the procedure can be iterative if the local constraints need the implementation of several risk reducing measures to reduce the extension of the zones. However, attention should be paid in order to avoid that the final danger zones become too small, because then the principles of LUP (maintain a appropriate distance between the hazardous installations and the receptors in case of a major accident) would not be respected. This two-step approach bring consistency in the risk assessment and the risk management. It offers transparency in the negotiation as well as flexibility to take into account the local context.

CONCLUSION AND PERSPECTIVES

This paper presents the evolution of the situation in France regarding LUP, in particular after the Toulouse accident. The driving idea to make both risk assessment and LUP procedures evolving was to reduce the uncertainty and discrepancy of the evaluations that are used for public decisions. Concerning the risk assessment procedure used to get the permit to operate a Seveso plant, INERIS recommended an approach based on the definition of reference accident scenarios using the bow-tie model and on the evaluation of the safety barriers implemented to prevent or mitigate the possible accidents. This approach helps to fulfil the requirements of the article 9 of the Seveso II directive such as to "demonstrate that major-accident hazards have been identified and that the necessary measures have been taken to prevent such accidents and to limit their consequences for man and the environment". For the LUP procedure which ends with a zoning where constructions can be restricted, INERIS elaborated a two-step approach that allows: 1) To assess the hazard and estimate the danger zones in a homogeneous manner, following a common procedure at the national level, and 2) To assess various alternatives of reducing measures that can be negotiated at the local level by the stakeholders, according to criteria that have to be made explicit. The two-step approach described in this paper results from the experience of more than 10 years of application of LUP in France. It is based on an assessment of the consequences of accident scenarios and on transparent and traceable negotiation of the risk reducing measures to determine the final danger zones that are inscribed in the urbanism documents. The suggested approach brings some responses to the Presidency conclusions of the European Council meeting in Barcelona (15 and 16 March 2002), that expressed the invitation "to develop a strategic approach on the management of technological risks, while considering the social, economic and environmental challenges in relation with the issue of sustainable urban development."

The recommendations suggested by INERIS may be used to implement the new law on technological risks and natural hazards that was elaborated as a follow up of the Toulouse accident and adopted on 30 July 2003. The focus will be now on the implementation in concrete of the recommendations.

As written by the European Environment Agency, major accidents continue to occur despite of the efforts of the industry and of the authorities. "Zero risk doesn't exist" is a reality. This motto should reinforce the conviction that all stakeholders, in particular, the industry, the authorities and also the civil society should optimise the control of the risk in a best way, as a function of the resources of each, and of the benefits associated to the industrial activity. It is also important to underline that the choice of accident scenarios for LUP purposes doesn't mean that more catastrophic accidents will not happen. The choice of scenarios and the estimation of their consequences is a tool to make a risk management decision. From the research point of view, new developments must focus on trans-disciplinary approaches, integration of social sciences, engineering and management sciences for both risk assessment and risk management. This topic is strongly addressed in the development of the ARAMIS methodology [11], which is a shared-cost RTD project of the 5th Framework programme of the EC. Results from the ARAMIS project will certainly bring knowledge to improve the risk management and LUP processes.

Figure 1 :

 1 Figure 1: Risk management policy in France [6]

Figure 2 :

 2 Figure 2: Two-step approach for land-use planning as suggested by INERIS [10]

ACKNOWLEDGEMENT

This paper was partly supported by the project mentioned in the text that is funded by the French Ministry in Charge of Environment.


Emmanuel Ruffin
email: emmanuel.ruffin@ineris.fr

Charlotte Bouissou

Raphaël Defert

Nelson Rodrigues

Eric Dannin

Sébastien Rault Doumax

Bouissou Charlotte

Defert Raphaël

DANNIN Rodrigues Nelson

Dr Rault-Doumax Sébastien
email: sebastien.rault-doumax@ema.rr

GIS interfaced OECD/PIARC QRA model for road transportation of hazardous goods

ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Within the framework of a research project carried out for both the OECD and the PIARC, INERIS developed a Quantitative Risk Assessment Model (QRA model) for the transport of Hazardous Goods on roads including tunnel sections. This work was also carried out with the collaboration of WS-Atkins (UK) and the University of Waterloo (Canada).

INERIS, which was the leading developer of this original model, launched a new research project in order to facilitate the generation of data necessary for a given risk study. A new version of the model is in development. These new developments have been funded by the French Ministry of Ecology and Sustainable Growth and the French Ministry of Equipment, Transport and Buildings, Tourism and the Sea.

These new developments have been processed in order to enhance the user-interface performance of the original models (QRAM 3.20 and 3.60) and to extend the QRAM capacities to the study of longer routes. These objectives has been reached by the introduction of a linked Geographical Information System (GIS).

In between the original model (QRA v3.20) has been used for the application of the French regulation (circular 2000-82, 30 th november 2000). Up to now approximately twenty tunnel safety cases have been studied in order to choose the lowest risky route between the open air route and the tunnel one. Doing that the risk level for the road transportation of hazardous goods has been reduced.

In order to have in one hand a global view of the various developments of the QRAM and in an other hand to linked these models to the European regulation framework the present paper deals with the following topics :

• The present regulation for the transport of dangerous goods by road in Europe,

• The methodology governing the QRAM,

• The lessons from the French application of the QRAM,

• The new developments for a GIS interfaced QRAM,

Methodology governing the OECD/PIARC QRAM

The QRAM reference manual [ix] provides extended explanations on the overall assessment hypotheses. Thus only overview information is given in this section.

The main purpose of the QRA model is to assess the risks relative to the transport of Dangerous Goods in a quantitative way. The model evaluates simultaneously the consequences and the frequencies of occurrence of possible scenarios. This makes it possible to assess quantitatively the societal risk (if the distribution of the people liable to be exposed is at hand) and the individual risk.

A complete assessment of the risks due to Dangerous Goods would require to evaluate all kinds of accidents with all types of vehicle partially or fully loaded, for all the possible materials etc. Such an evaluation is completely impossible and some simplifications have to be introduced. Thus the QRA model is based on the following steps:

• Choice of a restricted number of Dangerous Goods,

• Choice of some representative accidental scenarios implying those Dangerous Goods with their usual packaging (please see table 1), • Identification of physical effects of those scenarios for an open air or a tunnel section, • Evaluation of their physiological effects on road or rail users and local population, • Taking into account of the possibilities of escape/sheltering, • Determination of the yearly frequency of occurrence for each scenario. The risk assessment of each accident scenario is based on a different event tree leading to the major possible hazards that are pressure wave effect, thermal effect or toxic effect. F/N curves and their expected values are the major outputs of the QRA model. They are defined as follows:

• Frequencies / Gravity curves (F/N curves): stand for the annual frequency of occurrence F to have a scenario likely to cause an effect (generally, the number of fatalities) equal to or higher than N. • Expected value (EV): number of fatalities per year, obtained by integration of a F/N curve The risk is characterised by two main aspects: frequency of occurrence and consequences. Consequences can be expressed by a number of fatalities, of injuries, structure and building destruction, damages to the environment. The number of fatalities can be considered as the main criteria to quantify risks. Injuries are also calculated. In order to determinate the societal risk, F/N curves are built (figure 1). Structure damages are evaluated through a semi-quantitative way and environmental damages through a fully qualitative way. Individual risks can also be obtained. The individual risk indicator refers to the risk of fatalities or injuries to the local population due to an incident. Individual risk is expressed as a frequency per year. It could also be expressed in terms of return time, i.e., average number of years between two accidents with the considered consequence (fatality, injury). The QRAM calculates the spatial allocation of risk knowing the average location of the population (figure 2). Thus two-dimensional maps containing the individual risk for the surroundings could be extracted.

Population Grid

4

Lessons from the French application of the QRAM.

Following the Mont Blanc fire accident the French regulations covering road tunnel safety issues were changed and currently rely on two new circulars. One of them, the Circular 2000-82 of November 2000 [x] sets up a new procedure concerning the definition of the restrictions for the transit of dangerous goods through road tunnels. The main requirement is for an evaluation of the risk levels obtained for a given set of alternative routes existing around a tunnel. The evaluation implies the choice of the least risky route on the basis of a quantified risk assessment. In the case of the existence of an obviously low risk tunnel, the risk level assessment process can be based on a qualitative engineering judgement. In a case where a full QRA procedure is needed, the recommendation was made to use the QRAM 3.2 or other comparable model which has been through a similar amount of testing. Quantitative risk assessment is to be considered for all road tunnels with a length of more than 300 metres.

After three years this new legal procedure has led to the evaluation of the quantified risk level of approximately twenty tunnels' routes and their alternative routes in France. This procedure has been shown to give a good level of applicability in the overall decision process of the risk management associated with dangerous goods transport on roads.

These studies have been performed by different consultants who had attended a preliminary one-day basic training course [xi]. The experience acquired during this training period and during the performance of the risk studies allows the consultants to know reasonably well the capabilities and the limits of the model and also provides an indication of how the given results have to be interpreted or presented.

The French experience was also used to suggest a slightly simplified legal procedure by the end of 2003 and suggestions have been accepted by the Comité d'Evaluation de la Sécurité des Tunnels Routiers (CESTR, Committee for Road Tunnel Safety Assessment). The main modification is a simplified evaluation process for tunnel risk level and the implementation of a rough comparison with pre-defined risk level criteria. This first-step comparison routine allows one to decide whether or not it is necessary to perform a complete comparative and quantitative risk study.

Thus the three years experience acquired in France relative to the practical application of the OECD/PIARC QRAM leads to a confirmation of its efficiency as a tool to suggest the restrictions regarding dangerous goods transit through road tunnels.

New developments for a GIS interfaced QRAM

In On the basis of the original OECD/PIARC model INERIS has followed up the development process in order to enhance the user-interface performance of the original models (QRAM 3.20 and 3.60) and to extend its capacities to the study of longer routes. In order to reach these goals, a two step development process was decided as follows: to enhance the user-interface performance of the original models, -to extend capacities to the study of long routes by collecting all the needed road characteristics and population data with the help of a Geographical Information System (GIS).

In order to do that a two step development of the pre-existing model has been achieved: the development of new dialogue boxes and data management and the development of a Geographical Information System (GIS) interface for the data input of the routes and road characteristics. This work was essential for the reduction of the time spent to the data collection during the risk study and by this way to keep more time to spent to the HGs trafic study, risk analysis and the evaluation of options required by the decision-making process about the restriction possibilities Concerning the basic user interface development, the main objective was to separate the data collection from the calculation phase. By doing this it is now possible to reset the data collection process, modify the data set and launch the calculation when all the elements of the data set have been collected. Figure 3 shows the new structure of the user interface. This new interface allows the user to manage the various options tested for a given route more easily. For example modifying 'section characteristics' or 'traffic vehicle hypotheses' etc, is now easier. Besides, the data collection optimised procedure allows the developers to work on data collection without changing the calculation process itself that had been tested and validated during the OECD/PIARC project. This development was also necessary for the GIS user-interface implementation and development.

Input data

Concerning the GIS user interface, the main objective was to reduce the time spent by the users for the data collection process, especially in the case of long routes. This was thought to be an important goal because during a risk study it is essential to spend as much time as possible on the other phases, namely traffic study, the risk analysis phase and the evaluation of options required by the decisionmaking process about potential DGs transit restrictions. Thus the time saved on data collection can lead to better risk analysis and better assessments of the possible restrictions. Figure 4 shows an example of a test case located to the North of the French Alps. The quality of the data collection with GIS has been tested and compared to the manual process (the original OECD/PIARC model) leading to the conclusion that the GIS interface provides : -a tremendous gain of time (typically a 1/100 ratio) for the road and local population data collection of long routes, -the capability to evaluate the risk level for a long route and to detect the more risky locations (black points),

The new possibilities offered by the GIS interface might also help users to compare long road routes and rail routes, rail alternatives implying generally longer routes. An example of F/N curves produced by the original OECD/PIARC model coupled to the GIS userinterface is given in Figure 5. In theory it could be possible to draw profit from this French experience for future practices in all European countries but the sine qua non condition is the existence of properly harmonised GIS databases. Such databases do not exist at the present time but this may change as the result of some projects currently being carried out about harmonisation of GIS data bases.

To conclude, it is now shown that the OECD/PIARC QRAM could operatewith a GIS interface (limited today to French databases) and adequate risk assessment pertaining to transport problems in the case of long road routes are now achievable. In particular, risk studies, such as quantified risk assessment, related to dangerous goods at regional scale, including tunnels or not, are now feasible.

Application of the QRAM at European and International level

Having harmonised regulations does not mean that the same regulation should apply to all tunnels, not even that two similar tunnels in two different places should have the same regulation. The only indispensable point is that the regulations should be expressed in the same way everywhere, which means that they should refer to the same lists of dangerous goods carriage which are authorised or banned.

The Working Party on the Transport of Dangerous Goods of the Economic Commission for Europe's Inland Transport Committee has accepted to introduce a table [xiii] into Chapter 1.9 of ADR (European Agreement concerning the International Carriage of Dangerous Goods by Road ) containing, in grouped form, the various categories of dangerous goods which runnel managers could permit in accordance with parameters linked to tunnel construction, traffic constraints,..., in order to achieve a harmonised approach to restrictions on traffic in tunnels. This table defines the substances and types of load (packages, bulk, tank) to be included in each group of tunnel. These common 'lists' are here called 'groupings of dangerous goods carriage' (or more simply 'groupings'). In a number of the works cited here, the word 'loadings' is used instead of'carriage'. 'Carriage' (or 'loading') refers not only to the nature of the transported goods, but also whether they are transported in bulk or packaged form and the possible presence of different dangerous goods in the same vehicle ("transport unit" in regulatory terms).

The basis of the proposed system is that the definition of the groupings of dangerous goods carriage should be the same for all tunnels in all countries (based on ADR). The decision making process would be unaffected by these regulations and it would remain the responsibility of the authority in charge of the tunnel to decide what is the authorised or banned 'grouping' for a given tunnel. However the definition of the dangerous goods groupings is decided internationally and is based on the general definition given in table 2. No dangerous goods (except those which require no special marking on the vehicle).

Least restrictive

Most restrictive

In fact, a system with six groupings could be chosen to differentiate between the risks of a large explosion and a large toxic release. However cold BLEVEs can happen with any non-flammable compressed or liquefied gas transported in bulk, including those that are toxic. For this reason, and in order to limit the number of groupings, it was deemed appropriate to deal with large toxic releases and large (cold BLEVE) explosions in the same grouping, which led to the proposed system.

The QRAM incorporate accident scenarios representative of each of the groupings then it is possible to assess the risks resulting from a given grouping (table 3). Within that regulation framework the QRAM can be used for defining the practicable grouping class to apply to a given tunnel taking into account its environment and the possible alternative routes. Thus the decision to allow or not a tunnel to a given grouping can be helped by the analysis of the QRAM results. Representative carriages for QRAM and corresponding scenarios Liquefied Petroleum Gas (LPG) in bulk and in cylinders (Scenarios 3, 7, 8 and 9 of the QRAM), Carbon dioxide in bulk (Sc. 13), Ammonia/chlorine* in bulk (Sc. 6 and 10), Acrolein in bulk and cylinders (Sc. 1 1 and 12), Motor spirit in bulk (Sc. 4 and 5), Heavy Goods Vehicle (HGV) without dangerous goods (Sc. 1 and 2). Carbon dioxide in bulk (Sc. 13), Ammonia/chlorine* in bulk (Sc. 6 and 10), Acrolein in bulk and cylinders (Sc. 1 1 and 12), Motor spirit in bulk (Sc. 4 and 5), LPG in cylinders (Sc. 3), HGV without dangerous goods (Sc. 1 and 2). Motor spirit in bulk (Sc. 4 and 5), LPG in cylinders (Sc. 3), Acrolein in cylinders (Sc. 12), HGV without dangerous goods (Sc. 1 and 2). LPG in cylinders (Sc. 3), Acrolein in cylinders (Sc. 12), HGV without dangerous goods (Sc. 1 and 2). HGV without dangerous goods (Sc. 1 and 2).

Restrictions

Least restrictive

Most restrictive * Chlorine is considered in countries where its transport is allowed in appreciable quantities on roads.

With this system, for example, a tunnel authorised to accept 'Grouping A' carriages would be allowed to admit vehicles carrying the most dangerous carriages, whereas tunnels authorised to accept only 'Grouping E' carriages would generally not be allowed to admit vehicles carrying any dangerous goods. When a transport unit carries dangerous goods of more than one class, the most restrictive grouping shall apply to the whole load.

Conclusion

The transport of hazardous goods through tunnels is growing rapidly. There is a lack of knowledge about how to organise this transport in a responsible way and how to find the right balance between economic demands and safety needs. The scientific and research work done so far is the first step on the way to a more rational and responsible treatment of this problem.

At present it is intended that the QRAM v3.60 software be distributed by PIARC at the International level and entraining to users be organised by PIARC with the help of the model developers and skilled bodies.

Tunnels are part of the transport system which can contribute to offer an adequate option for transit of people and goods. However, particular problems occur with the transport of dangerous good through tunnels. There is no simple or uniform solution, and a risk assessment process will be necessary for each individual tunnel, based on a rational scientific methodology, which is now available from the OECD / PIARC research work for the road mode. The efficiency of this tool has been proved for three years in France but there is still the need to extend this experience among others states in the coming years.

There are still many assumptions, which may or may not be justifiable, and not enough sound engineering data. In future years administrations, tunnel operators and experts from fire brigades and research institutes could help to further use and improve the road model.

  liquid expanding vapour explosion HGV = Heavy goods vehicle LPG = Liquid petroleum gas VCE = Vapour cloud explosion Source: QRAM reference manual [Chyba! Zâloîka nenf definovâna.], table 4.9-1

Figure 1 :

 1 Figure 1: Example of F/N curves. Frequency means "yearly frequency ofN or more fatalities"

Figure 2 :

 2 Figure 2: Example of the 2D-population location around a given route (QRAM 3.2)

  parallel with the application of the QRAM within the French regulation framework, INERIS, which was the leading developer of the original model, launched a new research project in order to facilitate the generation of data necessary for a given risk study. These new developments have been funded by the French Ministry of Ecology and Sustainable Growth and the French Ministry of Equipment, Transport and Buildings, Tourism and Sea [xii].

Figure 3 :

 3 Figure 3: Structure of the QRAM model with an enhanced user interface New User Interface OECD/PIARC QRAM

Figure 4 :

 4 Figure 4: An example of the GIS interfaced QRAM -The selection of a long route around Grenoble (France) -ID selection and 2D selection. [Chyba! Zâlozka neni defmovana.J

Figure 5 :

 5 Figure 5: An example of the GIS interfaced QRAM -F/N curves

  ix. Cassini P., Hall R.,Pons P. (2003), Transport of Dangerous Goods Through Road Tunnels Quantitative Risk Assessment Model (Version 3.60), Reference Manual, OECD/PIARC/EU (CD-ROM), February 2003. x. Circulaire Interministérielle n° 2000-82 du 30 Novembre 2000 relative à la réglementation de la circulation des véhicules transportant des marchandises dangereuses dans les tunnels routiers du réseau national (Ministère de l'Economie des Finances et de l'Industrie, Ministère de l'Intérieur et Ministère de l'Equipement, des Transports et du Logement, Ministère de l'Aménagement du Territoire et de l'Environnement). xi. Raphaël DEFERT, Philippe CASSINI, Marie-Astrid KORDEK, L'utilisation du modèle EQR Routier, Formation INERIS, 3 et 26 Octobre 2001. xii. Ruffin E., C. Bouissou, R. Defert (2003), Elaboration d'un modèle d'évaluation quantitative des risques pour le transport multimodal des marchandises dangereuses, BCRD, Ministère de l'Ecologie et du Développement Durable, AP2000 -convention n°2000-0102, Rapport Final Synthétique -INERIS / Direction des Risques Accidentels, Août 2003. xiii. Economie Commission for Europe Inland Transport Committee, 74th session of Working Party on the transport of dangerous goods, Inf. document n°15 , May 2003.

  • The application of the QRAM at European and International level. This directive has been amended by the Directive 2000/61/EC of the European Parliament and of the Council of 10 October 2000 [Official Journal L 279, 01.11.2000] [iii] and the Commission Directive 2003/28/EC of 7 April 2003 [Official Journal L 90, 08.04.2003] [iv]. These regulations do not give specific indications related to the transit of dangerous goods through road tunnels. On the 13 th of May 2003, the working party on Land Transport of the Council of the European Union released the inter-institutional file 2002/0309 (COD) for the subject: Proposal for a Directive of the European Parliament and of the Council on minimum safety requirements for tunnels in the Trans-European Road Network [v]. Chapter 2.5 deals with the transport of dangerous goods and says:

	Member states and their Administrative Authorities shall apply the following measures concerning
	access into tunnels of vehicles, transport and dangerous goods:
	• place signs before the last exit before the tunnel and at tunnel entrances indicating which groups
		of dangerous goods are permitted /prohibited;
	• perform a risk analysis in accordance with Article 13, before deciding on tunnel requirements
		with dangerous goods;
	• consider operating measures designed to reduce the risk of transporting dangerous goods in
		for all four
	points mentioned above within the OECD Road Transport Research Programme [vi,vii ,viii]. These
	main objectives are the skeleton around which the QRAM, developed by INERIS (overall model: open
	and tunnel section) and WS-Atkins (tunnel section), was constructed.
	2	Present regulation for road transport of dangerous goods in Europe

The road transport of dangerous goods is regulated by the Council Directive 94/55/EC of 21 November 1994 on the approximation of the laws of the Member States with regard to the transport of dangerous goods by road [i] and its annex the European Agreement concerning the International Carriage of Dangerous Goods by Road (ADR)

[ii]

. tunnels, such as a declaration before entering or escort, on a case by case basis; this may require the formation of convoys and accompanying vehicles for the transport of some types of particular dangerous goods; • improve traffic management for the transport of dangerous goods.

The joint Organisation for Economic Co-operation and Development (OECD) and World Road Association (formerly known as the Permanent International Association of Road Congresses and still known by the abbreviation PIARC) Scientific Expert Group ERS2 developed objectives

Table 3 :

 3 Main characteristics of the 13 selected scenarios(QRAM v3.60)

	Scenario Nr

Table 4 : Groupings of dangerous goods

 4

	Grouping A	All goods, including all dangerous goods carriages authorised on
		open roads.
	Grouping B	All carriages in grouping A except those which may lead to a very
		large explosion ('hot BLEVE' or equivalent).
	Grouping C	All carriages in grouping B except those which may lead to a large
		explosion ('cold BLEVE' or equivalent) or a large toxic release
		(toxic gas or volatile toxic liquid).
	Grouping D	All carriages in grouping C except those which may lead to a large
		fire.
	Grouping E

Table 5 : Carriages representative of each grouping in the QRAM

 5

	Groupings of
	carriages
	Grouping A
	Grouping B
	Grouping C
	Grouping D
	Grouping E