The regulator-regulatee interaction: insights taken from a high risk business firm Michèle Dupré, MOdys, Lyon Julien Etienne, CURAPP, Amiens Jean-Christophe Lecoze, INERIS, Creil

France

The viewpoint taken in this paper is to give a description of the interaction between regulators and regulated organisations, built on an empirical case-study in the French chemical industry.

The paper stems from a collective interdisciplinary research study on risk management in high-hazard facilities. Therefore, it gathers the observations and reflections of a sociologist (Michèle Dupré), a risk engineer trained in the social sciences (Jean-Christophe Lecoze), and a trainee political scientist (Julien Etienne) who all spent some time studying the same case.

In a first part, we will introduce the French regulation of industrial high risks and uncover its most salient risk tolerant characteristics. In the French case, risk tolerance yields substantial place for exchange in the regulatory interaction, that in due turn may yield cooperation and trust between regulator and regulatee. That, we may illustrate with our case study in the second part of the paper. At several moments in the interaction between the company and the regulating agency over the ten to fifteen years, there have been examples of flexibility and dialogue, in spite of or thanks to a quite strong imbalance between the two. In the third part of the paper, we question the interest of such a flexibility (and of risk tolerance in general) from a reliability standpoint. For that matter, the organisational modes of each party are studied in isolation and in interaction. The question we intend to answer is: does practice in that case suggest that the interaction "works", namely that it yields benefits in terms of risk prevention?

We will then conclude by raising questions about the capacity of the regulator to enhance risk prevention.

I. The French regulatory regime

The French regulation of industrial high hazards consists mainly in what has been called a "safety case approach" (Hale et al. 2002). The general idea of the safety case is that the prevention of risks is under the responsibility of the owner, who is authorised to go on with his productive practices given that he demonstrates to the public authorities (the Inspectorate) that he has identified the main hazards, assessed the magnitude of the outcomes, and taken appropriate steps in order to prevent the hazards from materializing or to mitigate their consequences. Practically, this is achieved with the help of a system of permits and a program of scheduled and spontaneous inspections. Although the implementation of the Seveso II directive (in France, in 2000) has helped to spread further the principles of safety cases in the French regulation of highly hazardous facilities, those were well defined earlier in a law from 19/07/1976. As the safety case approach often implies, the French legislation of high hazards is actually little prescriptive: it does not specify in detail which techniques should be adopted in order to assess or prevent the risks from yielding catastrophe, and generally (and increasingly) demands the satisfaction of goals rather than means. It is therefore not infrequent, especially in bigger groups, that the firm's own prescriptions to tackle risks go beyond public ones.

In other words, it has been well understood that there were several ways to do things right, and that the public authorities would not force firms to pick up one. Of course, this is not an absolute principle, and several other aspects may be called prescriptive. For example, there are times when inspectors actually give firms no choice but to adopt a specific tool, a tendency that has been often observed in small and middle-sized companies where regulators have often gone beyond external control and towards a bigger advisory role. There are also certain specific pieces of legislation (mostly dealing with dangerous substances) which are clearly prescriptive. Besides, the IPPC directive has generalized the idea of "best available technologies" (BAT), which should theoretically rule the prescriptions that the Inspectorate may impose upon regulatees. A recent reform has also favoured a particular method for risk assessment rather than any other, hence inducing companies to adopt it, or rather to go into lengthy and costly justification and explanation of their own method.

Yet, explicit instructions of tolerance have been given to the Inspectorate's agents, mainly consisting in the preservation of firms' economic sustainability. That is not a definitive twist in the French regime, and the issue of safety/economy trade-offs has been handled in different ways over the years: sometimes regulatory texts emphasized the dual role of the Inspectorate as both a controller and a supporter of the industry; at other times, they strived to uncouple control and advice, risk management and economic support. Although there has been a relative regulatory instability on that aspect over the years, one may rather observe stability on the side of the personnel in charge of implementation. In fact, the professionalization of the Inspectorate's agents (engineers for the bigger part) and their institutional situation in the French administration (they are employed by the Ministry of Industry within the bigger Finance Ministry but are permanently "borrowed" by the Ministry of Environment) drives them towards an "integrated" view of companies, one that balances environmental and economic imperatives. One may thus observe that the "integrated" philosophy of the Inspectorate as an administration "at the service of a clean and well-performing industry" has been explicitly abandoned by the Ministry, but endures in the discourse of the union representing about 80% of the Inspectorate's agents (the "SNIIM"). This practically reinforces the risk-tolerant character of the French regulation and counteracts the prescriptive dimension brought about by these other inputs.

Risk-tolerance decisively shapes the regulator-regulatee relationship: inasmuch as companies do not stand in an adversarial attitude towards the Inspectorate, the wide discretion left to the Inspectorate's agent provides space for building a cooperative relationship between the two parties [START_REF] Ayres | Tripartism: Regulatory Capture and Empowerment[END_REF]. That is, there is a range for a negotiation, one that may bear on various aspects, including the schedule for implementing compulsory modifications of an installation for the sake of accident prevention. Practically, dialogue and a sufficient sharing of information could allow the interaction to continuously unfold in an informal, sanction-less way: there, persuasion comes up as a central regulatory strategy (on both sides), while deterrence comes second. Cooperative behaviour is often met with tolerance: unlike the EPA in the United States [START_REF] Eisner | Corporate Environmentalism, Regulatory Reform, and Industry Self-Regulation: Toward Genuine Regulatory Reinvention in the United States[END_REF]), the Inspectorate does not sanction self-reported violations. And when violations are discovered by the Inspectorate, the procedure of administrative sanctioning requires a warning to be issued firstly, and a sanction applied only after the violator has been given time to adjust to regulatory prescriptions. The statistics of the Inspectorate's activities amply demonstrate that risk-tolerance does not necessarily mean permissiveness, for the regulator-regulatee interaction may well be conflictuous and yield the use by the Inspectorate of several warnings, administrative penalties, or lead to bigger criminal sanctions. Hence, the French regime is in practice far from "regulatory unreasonableness" [START_REF] Bardach | Going by the Book: The Problem of Regulatory Unreasonableness[END_REF].

That being said, let us now turn to our case study, and how it developed several characteristics which, in our view, reveal traits of risk tolerance on the regulator's side, and an overall atmosphere of trust and cooperation between regulator and regulatee.

II.Risk tolerance in interaction and trust

After a presentation of the firm and the local branch of the Inspectorate (A), we provide evidence of risk tolerance and cooperation in the relation between that firm and the local branch of the Inspectorate in charge of high risk policy implementation (B).

A. The parties

The plant described here is an entity of a chemical company located in the USA and owner of 100 subsidiaries all over the world. The company is organised under a matrix principle. It means that certain activities are centralised either in the headquarters or in plants having specific resources to deal with specific questions. It is in particular the case of the French plant : two departments have worked either at a global corporate level, namely the safety department, or at a European level, namely the R&D department. Due to different restructurings of the production lines in the world, the plant has gained a leading role in its production segment, but a marginal position when we consider the global production set of the whole company. It has around 350 employees.

In accordance with the literature, the plant can be described as a High Reliability Organisation [START_REF] Roberts | Some characteristics of one type of high reliability in organisation[END_REF]: it has a very safe production history with no accident registered in the last 22 years, the safety perception of the employees is reinforced by different tools and systems, and as we will see, it has very good relations with the regulator because it fits with the objectives given by public regulation to the industry.

The company interacts on a regular basis with one to two agents from the local branch of the Inspectorate, which is an organisation that has lived through various evolutions in terms of size and missions over the last 10 years. It has been lately merged with another administrative agency in charge of natural risks and nature protection plans, and it customarily has been in charge of both risk regulation (chronic and accidental risk), industrial development (namely support to industrial innovation and research) and until recently technical controls of transport vehicles. At the time of the inquiry, it had about 150 employees, with about a third in charge of industrial environment matters. Although about 10'000 premises were eligible to environmental regulation in the area, the Inspectorate focused its attention on about a tenth of them, which due to higher risks were required to obtain permits and were more regularly and stringently controlled.

B. The climate of the interaction

The regulator-regulatee relation has been presented by both parties as a fruitful interaction, one in which it has been easy to reach each other and to exchange, where goodwill and transparency have ruled for quite some time, and where parties respect each other. In other words, a relation of trust. Let us explore it further.

Although the premises have belonged to an American company for about two decades, the Inspectorate has kept the memory of its previous owner, and the way it handled safety issues.

From that time on, the public regulator had faced an open interlocutor, namely the previous director and the managers in charge of environmental matters. Several efforts were initiated at that time, some of them triggered by a major accident which took place in these years, and the subsequent modifications to the premises which the Inspectorate overlooked. Despite the change of owner, it appears that the "good traditions" were kept (possibly passed on with the managers that remained), but also that they echoed with the strong commitment of the new owner towards safety. The latter has, in fact, an enduring excellence in safety and in-house expertise on this matter. As a consequence, some agents of the Inspectorate have expressed satisfaction at the company providing them studies rather than mere administrative paperwork. That is, in contrast with some other high risk facilities, the company did not try to perform merely "ritualistic compliance", namely apparent fit between its safety documentation and the broad requirements of the legislation. This has not always implied that the Inspectorate's agent in charge went into reading these studies in detail and discussed their content. In fact, there have been times over the 20 years or so of interaction between the new direction and the Inspectorate when the treatment of hazard studies by the regulator consisted more in summarizing (and therefore, approving) rather than assessing critically their content.

There, the autonomy of the Inspectorate's agents and the fact that the person in charge changed several times have allowed for some variation in the way regulatory control over safety matters has been implemented. That, however, apparently never jeopardized a by and large non-conflictuous relationship. Hard data and ample demonstration of expertise has generally allowed the company to reach agreement with the regulator, for instance when it has come to re-evaluate some regulatory prescriptions (notably quantity thresholds on release of pollutants) that it was subject to. When it comes to high risk, a salient characteristic of the company's practices is the quality of its own regulation. In fact, since standards are by and large defined on corporate level, these have been either elaborated by internal safety experts or they are those of the country where the company originated, namely the USA. And since the latter's regulation has been more demanding and detailed than the French regulation on these matters, it appears that the company has been always one step ahead of the requirements demanded in France. In general, the company has proven proactive on other matters too, such as safety management systems (it was one of the first in the area to become certified ISO 14001), before the implementation of the Seveso II directive in France introduced it as a regulatory obligation. It has also been ahead in the communication of safety issues to its environment and has taken the lead on several safety issues (such as transportation of hazardous substances) in the area.

Quite logically, the proactive attitude of the company has been praised by the regulator, and it leads the company's director and the head of the safety department to conclude that, so far the public high risk regulation has not had any impact on the company. That evaluation takes into account the changes in regulation which targeted the very relationship between regulator and regulatee. While dialogue has been well established for a long time between both parties, the Inspectorate's hierarchy at the Ministry targeted in the late 1990s and early 2000s the proximity between them, which it saw unfavourably. While the instructions to Inspectorate personnel at the time emphasized the biases induced by a position of advisor to private companies while their primary mission was control, the company's head of the safety department recalls receiving at that time information that, from then on, inspectors were not to give them advice any more. This, however, "did not change anything", and dialogue has remained the principal mode of interaction.

The cooperative relationship between these regulator and regulatee shows an outstanding record. In pair with no accidents over the past 22 years, the company did not receive from the regulator any warning in more than ten years, namely the weakest formal step the Inspectorate may take in enforcement. This is not to say, though, that the company has always been perfectly in compliance with all regulations. For instance, it happened that it decided and implemented substantial modifications of the premises without asking the Inspectorate an authorisation to do so, while legislation required it. Also, it implemented measures to improve safety but did not wait for the Inspectorate to approve them. In both cases, this was not a problem as long as the regulatee kept the regulator informed. In other words, self-reported violation has not been met with sanction. The only consequences of these uncoordinated actions (namely, the fact that risk-management at the company does not follow the rhythm of regulatory practice) have been delays in regulatory procedures, and also costs when the company had to remake expert studies that no longer corresponded to the actual installations.

In no way, however, did that ever impede production activities.

As far as sanctions are concerned, there is an obvious adversarial tone in warnings that could undermine trust in the relationship. Hence the reluctance from the regulator to risk cooperation by sanctioning violations more formally. Also, a recent reform gave the possibility to union members to directly interact with the Inspectorate's agents on high risk matters, an did also reinforce the capacity for the Inspectorate to get directly in touch with operators and workers' representatives (instead of interacting only with their usual correspondent inside the company, namely the head of the safety department). However, the Inspectorate has ignored this possibility, and on the company's side workers' representatives consider it as a last resort in case the company's situation would come to a limit. It appears rather clearly that the continuation of cooperation between the Inspectorate and the company's officer in charge, as well as keeping a good atmosphere inside the company have been at stake here.

All in all, it appears from that overview that trust has been maintained over the years thanks to a number of factors. The fact that the firm has worked without failure during a long time is part of this no-tension based relation between the firm and the Inspectorate. The former has been able to prove regularly that it complied with the high safety demands of the regulator, and in fact went beyond them. It has also taken seriously the standpoint of the Inspectorate and the safety case regulation, which is to take up an expertise-based approach to risk management and require one party (the company) to demonstrate the other (the Inspectorate) that it has taken charge of risk prevention. Also, the public communication engineered by the firm in order to reinforce its image of a reliable firm has contributed to maintaining trust in the interaction between regulator and regulatee. It also appears that both actors have strived not to take any steps which could be perceived by the other as evidence of uncooperative behaviour.

When considering the regulator-regulatee relationships, numerous scholars agree on the advantages of tolerance, trust and cooperation. For instance, regulatory cooperation between regulator and regulatee has been theorized as likely to increase regulatory compliance and the efficiency of policy [START_REF] Ayres | Tripartism: Regulatory Capture and Empowerment[END_REF]. HRO theorists also considered that the demand for trustworthiness which the public usually tends to address high risk organisations constitutes for them an incentive towards increased mindfulness of safety matters (La Porte 1996). By building trust, high risk organisations also tend to "avoid the high transaction costs of suspicion" (ibid. p. 68) and therefore to gain in efficiency (also Rochlin 2001, p. 48). [START_REF] Ayres | Tripartism: Regulatory Capture and Empowerment[END_REF], however, warned against the risks of "regulatory capture", namely of a permissive administration, which might stem from excessive proximity between regulator and regulatee. The data we dispose of does not allow us to conclude that trust could have yielded in any way such pitfalls in the case we studied. And the good record of the company suggests that cooperation has not been an hindrance to efficient risk management either.

According to the theory and to these data, it seems, therefore, that the interaction works. However, if one starts looking at the regulator and the regulatee as what they are, namely complex organisations, one might get a different picture of their interaction. In the following we propose to focus on the advantages and drawbacks that may be generated by the confrontation between two different organisational modes, that of the firm we studied and of the Inspectorate it has been interacting with. With this in sight, one might wonder whether the interaction is truly "working in practice" (La Porte and Consolini 1991)?

III. Is the interaction regulator/regulatee working in practice?

Let us first start with some trivial remarks borrowed from La Porte and Consolini. They remind us that no administrative bureaucracy is error-free, and they add that "administrative folklore teaches us that error-making is the normal bureaucratic condition." (1991). They go further and question how people, convinced that no organisation can really operate error-free, expect a so high reliability from firms working with hazardous materials. They call this apparent paradox the "theoretical challenges" of HRO : "such insistence on failure-free performance, is from a theoretical view, quite extraordinary" (ibid). And they sustain the idea that it could be good to study how good an organisation is in practice because "little is known systematically about the social or management aspects of such activities or the consequences for the operating organisations of attempting to attain nearly failure-free performance." (ibid)

If we were to take this sort of interrogation in our case, we might then wonder whether the apparent failure-free and transparent record of "enforced self-regulation" we observed means that all is really well, or rather whether multiple factors or strategies are operating to hide the "dark side" of risk management from the regulator-regulatee interaction?

How does the firm operate to appear failure-free? On the regulator's side, why are the relations not more tense considering the expectations addressed to high risk activities? We will then need two moments to explain the interaction in practice. Firstly we will describe the two organisations at work (A) : on one side, the firm (A.1), on the other side, the Inspectorate (A.2) and show how the organisational modes of the two parties have an impact on the interaction (A.3). Secondly we reflect on an incident that recently took place in the premises in order to further demonstrate how difficult it is in practice to sustain the high reliability of the firm and to maintain strong ties with the regulatee at the same time (B).

A) Two organisational modes interacting -A.1) Safety and risk prevention in a French HRO or multiple internal and external interactions

In this firm we can find different features which have been extensively described in the literature about the HROs. We will then not go into details about the different concepts guiding most of the analysis. We just would like to underline different properties which will help to emphasize our point of view.

Part of an efficient chemical group, itself leader on its market, the firm has "abundant resources allowing [it]to invest heavily in reliability-enhancing activities." (La [START_REF] La Porte | Working in Practice But Not in Theory: Theoretical Challenges of "High-Reliability Organizations[END_REF]. It knows exactly that it has to work safely if it wants to maintain the activities within their social and economic environment, which has been so far favourable to the firm's performance. For that purpose, they have developed in the firm a department in charge of safety, occupational health and environment protection which can be supported at a global level by peers having a high experience in safety questions: "We have specialists at world level who sometimes originated the standard used in the whole sector, they have a huge experience, they know their business very well, they regularly cross swords with other international experts all over the world. They make their experience felt." (French OEHS-Department leader, interviewed during the case study).

The operators are trained to know very well the numerous operating procedures developed 1 .

Different training or (internal or external) auditing systems have been elaborated to maintain the situational awareness warranting the "collective mindfulness" described as a precondition of an efficient safety culture. It is without a doubt a "networked system" (La Porte, 1996, p. 66), relying on "tight (coupled) horizontal coordination between different technical units in order to produce the desired benefits and services." (La Porte and Consolini, 1991, p. 30).

That is the positive side of the network. But there is another. The OEHS department chief is in the middle of external and internal relations and he has to manage the constraints coming from both sides, namely firm's actors and regulators, and that can lead to self reported violations, as already mentioned above. For example, workers had to go inside a vessel in order to control it, but at some point they suddenly refused to do it, arguing that it was too dangerous. The R&D department developed another way to inspect the vessel, and the material was replaced before the Inspectorate had given the formal authorisation to do it.

The role of the OEHS department chief is very important, and it is partly due to the great authority he gets from his double experience as a chemistry specialist and as a safety expert.

But if we consider the evolution of the firm and especially the evolution of this OEHS department, another picture of a relative decline of the organisation emerges. Firstly, because of his high technical knowledge, the head of the department has been heaved up to become an international expert. Naturally, this proves how experienced he is, but as a consequence he has to leave the production site regularly to visit other companies in the group and to train them, in particular in China, which is a new market for the group. No one has been hired to replace him or to complete the working team. It is rather the opposite, since some functions were recently outsourced after a team's member retired. Secondly, the firm has transformed its internal organisation to enhance the technical exchanges between the maintenance and the building department: they have recently been merged in the same department, so that the 1 The workers call the SOP "the Bible". relative strength of the OEHS department has decreased automatically, even if the safety culture is always pregnant in all activities.

Another element has to be added which puts into question the capacities of the managers to have "wide open eyes" and to always look at the whole organisation and take into account all the alternative consequences of change decisions. Even if the safety level is high, the rationality of the managers is bounded by different elements, as for example the problem they have to solve. And, they have no time for reflecting on how the new decisions can impact the system as such. During the interviews with the heads of the different organisation's departments, it was quite clear that each of them had his own indicator, elaborated in a special work culture, in order to measure how the work has been done. For example, the maintenance department has considered that its main goal was to complete work as quickly as possible.

Therefore, the time necessary to handle the new materials has not been taken into account.

This absence of a wide overlook at the firm and the focus on a small number of tasks is not surprising since "bounded rationality" (March and Simon) or "disjoined incrementalism" (Etzioni) have been well theorised in the managerial literature. But different decisions show how difficult it is to make a choice between different alternatives, so that we can agree with Hopkins when he writes: "Although safety pays, organisations frequently act in ways which are quite irrational from this point of view." (Hopkins, 1999, p. 148) Sometimes it seems to be as if the managers had "eyes wide shut", even though safety remains an important topic in this firm.

-A.2) Organising public oversight in the Inspectorate: dealing with constraints, dependence and imbalance On the regulator's side, one has to deal with the fact that the French regulatory regime for high risks is a safety case approach. Such an approach has its own requirements which administrative agencies may have trouble to fulfil, and the local authority we studied is a case in point. Resource availability has been a crucial aspect, especially since assessing safety cases requires more time and personnel available on the public side than other regulatory approaches, and especially prescriptive, "one-size-fits-all" approaches. In this context, the local Inspectorate has suffered from structural shortage in personnel, especially at the end of the 1990s, as it worked with around three quarters of the total personnel it should have had if all positions budgeted had been fulfilled (this situation is in part attributable to a high rate of of an experienced inspector at the head of the technological risk group also seemed to provide for the transmission of expertise and memory of the high risk firms to the younger inspectors.

Another important organisational aspect is that the work of the Inspectorate is much planned in advance, both at the national and at the local level. The Ministry has issued every year a list of priorities and objectives to reach. Besides, the Inspectorate has to carry a predefined schedule of inspections, especially in premises where there are hazardous process or products.

These objectives collide with the resources available, so that there have been trade-offs in the Inspectorate's action between tasks that had all a high priority on the public agenda.

Inspections in particular had to be less frequent than scheduled. Also, there is a contextual dimension in the Inspectorate's work, namely very intense efforts demanded of the agents on certain types of premises whenever a safety risk has become prominent on the local or the national agenda (for instance, in the aftermath of an accident). That too may imply many trade offs in the Inspectorate's decisions.

Finally, with the multiplication of regulations on various topics and on different aspects of risks (chronic risk, accidental risk, technical and human factors, safety management, etc.), the work of the Inspectorate has become sliced in pieces because there is no possibility to deal with all of these at once. In particular, the inspections of premises by the Inspectorate have been more and more restricted to certain issues, aspects, or areas. In other words, the Inspectorate never inspects more than a little part of the firm, and for instance, it has dealt with safety management systems bit by bit, focusing once on performance monitoring, then on training, etc. There is therefore a structural impossibility for the regulator to have a view of the whole risk regulation effort in the firm.

-A.3) Assessing the impact of two confronting organisational modes on the interaction Slowness has been a striking weakness of the Inspectorate, one that is at the centre of the attention of the company's head of the safety department, who can compare with neighbouring (UK, Germany) or more far away (e.g. China) countries where public regulatory procedures are being processed at a far quicker pace. More precisely, the Inspectorate and the firm have been trapped in a knot of several processes which have undermined the rapidity of public procedures: since an application for a new permit was made shortly before AZF, the company's application has taken much time to be processed by the Inspectorate, while the company's concern for self-regulation led it to modify the premises before the safety case had been approved by the regulator. As a consequence, the latter had to ask for new expert studies regarding the installations in their new configuration, so that the company had to resubmit an updated application. In the meantime, regulatory standards were substantially modified in a way that required both company and Inspectorate to adapt. As a consequence, the procedure was further delayed and it has been several years since it has begun, and yet it is is still not completed.

Nevertheless, the firm has had good relations with the inspector in charge: "he's an engineer, and it is quite easy to negotiate with him" said the department leader. Technical discussions between wannabe or actual experts passes for understanding. The dialogue has but necessary limits due to the imbalance in terms of expertise: "they don't have the in-depth knowledge we can expect from a specialist, not to compare with our experts (see above)." (Head of the Safety department) That imbalance is also triggered by regulatory evolutions: ever since their introduction in the regulatory regime the Inspectorate has felt uneasy with "safety management systems" (SMS), which depart in many ways from the technical realm which the Inspectorate's agents have been trained to deal with. Unprepared to auditing techniques and non-technical matters, the Inspectorate has been used to requiring ever more formalisation of safety management rules (there again the Inspectorate cannot overlook the elaboration of the SMS, only its outcome). As a consequence, in the case studied, the demands of the regulator have necessitated only formal adaptation of the book, nothing else. On the contrary, the firm has been proactive and has got professionals trained in quality management systems, so that there too the interaction has been uneven. On this matter, it must be also emphasized that the regulatee has also benefited from extensive knowledge stemming from performance monitoring at proximate premises ran by the owner in different parts of the world. For instance, safety issues which had already come to fore in other (American) premises employing identical products were dealt with before the Inspectorate could have brought the company's attention to them.

Although the Inspectorate has organisational principles which are non-bureaucratic, and especially a general idea of collegial decision and responsibility, it appears that the shortage of personnel and the workload have for a long time guaranteed the autonomy (or should we say the solitude?) of the inspector in charge when he had to deal with the managers at the firm. Recent modifications in the procedure have made it compulsory that inspections and the assessment of safety cases be carried out by two inspectors rather than one, and this might level up a little the position of the regulator in the interaction.

Another point highlights the form of the interaction: it has been usual for the Inspectorate to alert the firm about what it was about to control on the forthcoming inspection; even more, the national guidelines issued by the Ministry in order to organise the work of the Inspectorate in priorities have been well publicised, so that the firm has been usually informed of what the regulator would focus upon on their next interaction. As a consequence, efforts made in the firm have been naturally concentrated on the part of the premises concerned by the topic of the inspection.

But let us now analyse a specific moment in the firm's history, namely the consequences of two incidents, for they reveal another aspect of the interaction and of the impact of the organisational dimension on the interaction. B) Incidents in practice: How can the interaction work in the case of a "near failing HRO"?

No trial-error operation is possible in such organisations. The incidents therefore resulted from an error, although not a solitary one, but a collective one of all of those who supported a flawed design of the technical architecture. We noticed two incidents over the last few years, and after two decades of good process performance. The main technical cause had to do with the agitator stopping in both cases (one time due to a power cut and the other time due to a failure of a software component) and then creating a direct path for an uncontrollable runaway reaction, leading the rupture disk to blow and then to release the content of the vessel in the catch tank. It could have been severe incidents or accidents, but the positive side of the events is that the back up design of the installations was well dimensioned for the scenario: toxic gases were contained and only a small quantity of gas treated through the scrubber was released to the atmosphere. Different barriers were conceived in the architecture design to prevent the accident. Some of them proved their efficiency, and only one, the first in the architecture, did not succeed twice for two different reasons, but with similar effects. That means that the following barriers had to succeed in order to contain the reactions.

Without going into much detail (also for matters of confidentiality), it is interesting here to notice that a scenario found its way through to create an uncontrolled runaway reaction2 . It is also interesting to analyse how the different actors in the firm handled the aftermath of these incidents3 . Since the incidents were contained, "they proved twice the safe design of the installations" [START_REF] Dupré | How to prevent a normal accident in a Highly Reliable organization ? The art of resilience, a case study in the chemical industry[END_REF]. Even if some barriers did not operate as imagined, the others had the capacity to avoid a catastrophic event. But no one in the firm did put the architecture in question. This way to overlook the problems can be interpreted as evidence of "blind spots of the organisation" which made it impossible to learn from those incidents and hence to enhance the safety level. Different explanations can be found. Let us give two examples: the investments to remove the initial cause could have been too high; or it was impossible to criticise the R&D department without weakening the confidence in the reliability of the technical installations.

We can consider it in a different way: if most of the people working in that organization, not only at production level, but also in the R&D department or the managers contributed to construct the story that "we are very safe, don't worry, you've seen we didn't fail, we will not fail", it may mean that all of them, even confusedly, needed to construct stories about safety : "Although it is very possible to describe what operators do, safety is above all a property emerging from relations, rites and myths, also at individual or group level, but even more at the level of the entire organisation, or at least of a large part of the organisation." (Rochlin, ibid, p .62) Such constructs are not the only consequences of the incidents. Concrete steps were also taken, such as the registration of the incidents in the incident database. Because they did not trigger any concern from the nearby towns and inhabitants, they were unsurprisingly registered as technical internal incidents. This simple act had a double effect: firstly, the representatives of the workers in charge of hygiene and safety did not take them into account, and secondly the regulator was not informed because this was an internal problem to be solved only by the organisation itself.

Here we can start to be suspicious. Are we dealing with trickery? But we can also interpret this second fact as a way to keep the interaction with the regulator as peaceful as possible and to protect the organisation itself: "Operators and their hierarchy are intimately preoccupied by the fact that, in their search for residual errors, public authorities or experts could impose modifications that would alter the trust they themselves have in their installations" (Rochlin, 2001, p. 58) Do these incidents reveal "dark sides" of the organisation [START_REF] Vaughan | The Dark Side of Organizations: Mistake, Misconduct, and Disaster[END_REF]? or can we consider that internally the efforts made to maintain the high safety level imply a high involvement of the management which has to steadily justify its action? Consider for example the efforts made if not to increase the resources, but to insure a safe evolution of the firm: "the better an HRO is in achieving safe, productive performance, the more difficult public overseers are to convince that resources applied to reliability enhancing activities should remain stable." (La Porte, 1996). That is working in practice. And that is also regulating in practice. The regulator has to deal with internal organisational problems but it does not have the capacity to follow the activities and to understand the dynamics at work in a HRO.

Conclusion

When speaking about "risk tolerance" in regulation, one should keep in mind that not all kinds of "risks" lead to the same range of stakes, nor that they could all be handled in similar ways. In fact, when one is dealing with major accidental risk and very hazardous process or products, responsibility and efficiency have obviously a completely different meaning than in, say, waste management, medical practice or driving. In the management of technological risks, the blind spots of regulation may prove absolutely crucial, for they might well cover the signs of an "incubating" large-scale disaster [START_REF] Turner | Man-made Disasters[END_REF]. It is therefore worthwhile to ask whether the public regulator has the capacity to uncover blind spots, and whether risk tolerance is helping or not for that matter. So far, our reflections on an empirical case as presented in this paper could not lead us to a definitive conclusion on this issue. But as we tried to look at the interaction between regulator and regulatee through the lenses of their respective organisational modes and wondered whether the interaction "worked in practice", several points have come up as worth to reflect upon and to inquire deeper about.

French regulation has not been too prescriptive in matters of accidental risks and has been implemented in a way that leaves much space for dialogue and cooperation, the interaction we observed has proven not conflictuous and positive according to both parties.

The very good accidental and administrative record of the company as well as the absence of

We get close here toPerrow's (1984) normal accident idea, of unplanned and hidden interactions within the installations.

That is the reason why we introduce a methodological point, namely, analysing the analyses of incidents, in order to let the "dark sides of the organisation"[START_REF] Vaughan | The Dark Side of Organizations: Mistake, Misconduct, and Disaster[END_REF] appear.

turnover). Substantial additional staff was recruited in the aftermath of the AZF accident (in September 2001), so that some of the delays in regulatory procedures have been eliminated since. But the legislative changes in the meantime also meant increased work, so that practically the Inspectorate has remained under-resourced. As it was conceptualized by various authors (e.g. [START_REF] Vaughan | Autonomy, Interdependence, and Social Control: Nasa and the Space Shuttle Challenger[END_REF]) the regulator-regulatee relation is one of interdependence, where the regulator is in need of information which only the regulatee may provide. In the French case, the regulator asks the regulatee to transmit a number of documents regarding safety, including hazard studies. Since this is an external regulation, the Inspectorate does not carry its own studies. It nevertheless has to assess the outcome of those that the regulatee has passed on them. This type of system has many well-known shortcomings, mainly because there is no way for the Inspectorate to overlook the elaboration of this documentation: with whom, when, according to which method, and with what data were these studies made? The Inspectorate may try to know better by asking directly the authors of these documents. But that does not necessarily work, and in such case the Inspectorate may decide to discard the application. For example, in 2001, the Inspectorate discarded a third-party expertise of the premises because it could not find out which kind of data had been entered into the analysis.

In our case, the structural dependence of the Inspectorate towards the firm has been reinforced by the issue of expertise. Facing company risk specialists, the Inspectorate has often displayed less experienced agents or/and generalists. A striking characteristic of the French Inspectorate is that, despite its members being trained engineers, these have a cherished possibility of switching positions inside the organisation. This means that agents may spend time working on environmental regulation, but they may then switch to other missions of the Inspectorate, such as public support (mostly funding) to industrial innovation or research. Besides, inside "Environment Division" at the Inspectorate, agents may work on other aspects than technological risks, namely pollution and waste. To tackle the issue of expertise on the Inspectorate's side, there have been efforts towards specialisation inside the Inspectorate and building in-house expertise on technological risk, especially since the AZF accident in 2001.

However, the expertise of the Inspectorate seems very dependent on keeping experience, namely field-knowledge, inside the organisation. The high rate of turnover in the organisation is therefore a big problem. One of the solutions brought forth has been tutoring for newcomers, and in spite of hierarchy and position: a technician may be the tutor of a new inspector, while the latter has a better position in the organisation (this denotes a "deference to expertise" which reminds of HROs; see [START_REF] Hopkins | The Problem of Defining High Reliability Organisations[END_REF]. In the case we studied, the presence evidence of permissiveness in policy implementation support the general view of both compliance and HRO theorists, according to which cooperation and trust may yield greater policy effectiveness and industrial safety. However, both intuition as well as organisational theory suggest a less ideal picture, one that a look at the organisational modes of operation in both parties helped to reveal. Our paper shows how difficult the interaction can be due to the different organisational modes which have developed along the history of each organisation.

Multiple constraints in terms of time, personnel and expertise, as well as the more structural weakness of a position of external overseer have durably undermined the capacity for the Inspectorate to level up its position in a very imbalanced interaction. Since the firm has since long considered that it "can't depend on bureaucracy" (La Porte and Consolini, 1991, p. 20) to increase its safety performance, it has been dealing with it at a quick pace that the Inspectorate could hardly follow. This might be all well but the firm itself has got its own weaknesses: the day to day operations reveal how uneasy it is to introduce organisational changes, even to increase safety which is a challenge all actors in the firm deem to be important; there is also flawed design in the safety architecture that organisational processes foreclosed it from seeing. In this context, the problem appears to be that the precautions each party has been taking not to undermine trust and cooperation in the relation has made it impossible for the Inspectorate to help the organisation deal with its blind spots. In a time when various tendencies might weaken the management of safety inside the firm, it is therefore ironic to observe that the efforts of each actor not to jeopardize its relationship with the other might undermine the very goal that this relationship is supposed to play.


Lionel Aufauvre
email: lionel.aufauvre@ineris.fr

HOW TO DEAL WITH THE ESSENTIAL SAFETY REQUIREMENTS OF THE EU DIRECTIVE ON THE PLACING ON THE MARKET OF PYROTECHNIC ARTICLES

For manufacturers and importers that generally have to comply with a different regulation in each country to get technical approvals for their products the principle "tested once, accepted everywhere" is a great expectancy. The Directive 2007/23/EC [1] concerning the placing on the market and the use of pyrotechnic articles could fulfil those dealing with automotive occupant restraint systems (mainly airbags and seat belts pretensioners). By introducing harmonised Essential Safety Requirements (ESR) this new Directive offers the possibilities to replace the National approval procedures concerned by a single legal framework throughout the European Union (EU) for these pyrotechnic articles. Although this EU directive will reduce the administrative burden for everybody by introducing the CE marking and certification procedure, its substitution and application in replacement of the current National regulatory frameworks may create difficulties at the beginning. In this paper we present the different parts of the Directive specifically these concerning pyrotechnic devices for automotive safety and how to comply with it. As Notified Body and Official Laboratory in France INERIS has gained lot of experience in testing, certifying and approving explosives and pyrotechnic devices. In order to ease the understanding of the CE marking and certification procedure for automotive pyrotechnic articles, we suggest and give examples of known test procedures to cope with the Essential Safety Requirements (ESR).

INTRODUCTION

On May 23, 2007 the European Parliament (EP) and the Council adopted the Directive 2007/23/EC [1] on the placing on the market of pyrotechnic articles. This newly published text is another piece of the European regulation concerning explosives and pyrotechnic articles. It completes the Directive 93/15/EEC of 5 April 1993 [2] on the harmonisation of the provision relating to the placing on the market and supervision of explosives for civil uses. These two Directives following the "new approach" aim at ensuring the free movement of products within the European Union (EU), improving safety of both consumers and professionals and implementing harmonised safety requirements for such products in all Members States. Pyrotechnic articles and ammunitions are explicitly excluded from the scope of the Directive 93/15/EEC. But we had to wait until 2004 and the adoption by the European Commission (EC) of the Directive 2004/57/EC of 23 April 2004 [3] (on the identification of pyrotechnic articles and certain ammunition) to know what the term pyrotechnic articles actually covers in the context of the former Directive. Thus, the Directive 2007/23/EC applies specifically to pyrotechnic articles that include, mainly in term of article numbers, fireworks and pyrotechnic articles for vehicles. In Europe, obviously, firework and automotive pyrotechnic markets are significantly different. Whereas on the one hand, EU is a net importer of fireworks, on the other hand, it is a net exporter of automotive components containing pyrotechnic articles. The vast majority of fireworks on the EU market are imported from China. As a result of that, most of the stakeholders in this field are involved in purchasing, storing, distributing and professional displaying of fireworks. These articles are often directly sold to a large public and subject to various regional traditions and habits in each country. Easy access to consumer fireworks increases every year, and correlatively the number of accidents involving fireworks also increases, leading to a stringent reinforcement of the regulation in some countries. Then, the implementation of the new Directive is a real opportunity to achieve a higher safety level with fireworks articles through harmonised testing and quality assessment procedures. By contrast, the EU appears as a major automotive pyrotechnics exporter, not only for manufactured components but also for parts of assembled vehicles. In this field, a large number of stakeholders are employed in designing, manufacturing and assembling. There is no direct consumer market for these products and only automotive factory workers or professional in repair shops buy, handle and use them. It seems that there are no records of accidents involving these products, most probably because of the lack of statistics in currently existing accidents/incidents database. Therefore, on this basis the application of an EU Directive can be seen less necessary. However, as the existing approval processes, regulations and laws were different from one Member State to another leading to the multiplication of delays and cost for approval, harmonisation was also chosen through a EU Directive for the placing on the market of automotive pyrotechnic articles. This solution was also preferred by the automotive supplier industry to other types of solutions as the "new approach" legislation only lays down essential safety requirements and offers more flexibility to the manufacturer (together with more responsibility) to comply with the regulation.

The rest of the document is focusing on the different points of the Directive 2007/23/EC dealing only with pyrotechnic articles for automotive devices, although, as mentioned previously, the Directive also deals with fireworks and other pyrotechnic articles. In the field of automotive pyrotechnics these two definitions cover not only articles like gas generators or inflators for airbags and airbag modules themselves but also seatbelt pretensioners, micro gas generators, igniters (electrical or not) and various pyrotechnical actuators for vehicles. These items fall in the scope of the Directive and have to be CE marked for their placing on the EU market. However the Directive do not apply for pyrotechnic articles intended for non-commercial use as it is usually the case of samples for the purpose of research, development and testing and provided that they bear a visible sign indicating their non-conformity and non-availability.

SCOPE AND APPLICATION OF THE DIRECTIVE 2007/23/EC

In addition, we remind that, substances like ignition mixture, gas generating material, propellant in seat belt equipment are in the scope and the provisions of the Council Directive 93/15/EEC of 5 April 1993 for their placing on the EU market.

Why the Directive 2007/23/EC is good for automotive pyrotechnic safety devices manufacturers

Beyond the fact that some may see this Directive as one more regulation to comply with, it is in fact a great achievement in the regulation of pyrotechnic articles in the EU. And this is true not only for fireworks but also for automotive pyrotechnic devices. The replacement of some 27 parallel National approval procedures (already hard enough to understand for local people) by a harmonised EU Directive based on the "new approach" legislation should ease the process to comply with the regulation in all the Member States. This solution was seen better than the EU alternative type approval system under the UN ECE 1958 Agreement [START_REF]Approval and Reciprocal Recognition of Approval for Motor Vehicle Equipment and Parts of 20[END_REF] by the automotive components supplier industry. The "new approach" legislation by laying down essential safety requirements offers more flexibility to the manufacturers than the EU type approval system that determines everything in the least detail. The other important point to which the automotive industry should be more receptive is the expected time and cost reduction due to less administrative and testing fees and less internal burden to prepare different documentation sets according to country of application. As a result of the application of the Directive the manufacturers of pyrotechnic articles will be able to apply the CE marking on their products by themselves. If this CE marking procedure is already well known and can be found on many different products in Europe, it is also recognised world-wide as a proof of quality and safety and could constitute a plus for exportation outside the EU market.

The Directive entered into force on July 4, 2007 and Member States shall adopt and publish, by January 4, 2010, the appropriate laws, regulations and administrative provisions necessary to comply with this Directive. They shall apply those provisions by July 4, 2013 for other pyrotechnic articles for vehicles However, by way of derogation, National authorisations for pyrotechnic articles for vehicles granted before that date should continue to be valid until their expiry.

CONFORMITY ASSESSMENT PROCEDURES

The manufacturer or the importer of the pyrotechnic articles, established in the Community, has to lodge its application for the assessment of conformity by mean of one of the following procedures allowed by the Directive: (a) the EC type-examination (Module B) procedure, and, at the choice of the manufacturer, either: (i) the conformity to type (Module C) procedure, or (ii) the production quality assurance (Module D) procedure, or (iii) the product quality assurance (Module E) procedure; (b) the unit verification (Module G) procedure. This module is applied alone for each single article and therefore seems less appropriate for pyrotechnic articles for vehicles. This logical scheme can be represented by the following flow chart: Without going in too much details in the content of each module, it is worth to point out that it is third body is requested for the application. Such a third body is called a Notified Body and stands as an organism appointed by Member States to carry out different tasks described in the modules. INERIS has officially applied for being notified for the Directive 2007/23/CE. It is likely that other organisms (lists of all Bodies notified for each directive can be found on the Internet [5]) have or will also apply for this notification. The notifications will be registered shortly after the transposition of the Directive by the different Member States.

According to our experience as Notified Body for the Directive 93/15/EC, most of the manufacturers will probably choose the application of Module B + Module D for the certification of their products. Whereas the Module B consists in describing the type of the article according to a technical documentation and test results and in assessing the conformity of representative samples with the Essential Safety Requirements given in the Annex I of the Directive, the Module D (or similarly Modules C or E) consists rather in assessing the later conformity of pyrotechnic articles produced with the type initially approved and thereby mainly by assessment of the quality system applied by the manufacturer. It also requires the marking of each article, the issuing of a written declaration of conformity and the archiving of specific documents by the manufacturer.

Step by step brief overview of what an applicant for an approval shall do

Contact the Notified Body (notified for the Directive 2007/23/EC) of your choice and lodge your application by submitting the necessary technical documentation to assess the Essential Safety Requirements. The Notified Body will carry out the relevant testing procedures on representative samples you will provide in the frame of the EC type-examination procedure (module B). The Notified Body issues an EC type-examination certificate to the applicant if the provisions of the Directive are satisfied. The Notified Body will either perform examination at random interval on commercial articles (module C) or assess the quality system of the manufacturer (modules D or E). That is to confirm the later conformity of articles manufactured according to the type certified. The manufacturer can affix the CE conformity marking on its certified products and issues the corresponding declaration of conformity to the Directive.

All the information necessary on how to reproduce the CE mark can be found the Internet [6].

ESSENTIAL SAFETY REQUIREMENTS (ESR)

The Essential Safety Requirements are minimum requirements to be satisfied by the pyrotechnic articles in order to ensure a high level of protection of human health and safety and the protection of consumers and professional end users. Although the ESR do not really intend to guarantee any performance reliabilities in the final use of the articles, an adequate and complete operation of the articles according to what it is expected is in some way a basic condition for safety. Hereafter, we list the relevant ESR of the Directive 2007/23/EC relevant to pyrotechnic articles for vehicles and comment them (numbering according to the annex II of the Directive).

(1) Each pyrotechnic article must attain the performance characteristics specified by the manufacturer to the notified body in order to ensure maximum safety and reliability.

The performance characteristics have to be specified in the technical documentation given by the manufacturer to the Notified Body. Usually some of the characteristics are given in the Material Safety Data Sheet (MSDS). The Notified Body carries out an examination of this documentation and the results obtain in the different test procedures carried out. The correct and complete functioning of the pyrotechnic article is checked to assess its performance as well as the conformity to the specified effect.

(

2) Each pyrotechnic article must be designed and manufactured in such a way that it can be disposed of safely by a suitable process with minimum effect on the environment.

The way of disposal must be described in the technical documentation and has to be given in the MSDS. The chemical composition of the different pyrotechnic mixtures must be given as well as information on their toxicity profile.

(

3) Each pyrotechnic article must function correctly when used for its intended purpose.

It is somehow the main objective of the EC type-examination and of the following requirements.

Functioning accordingly to what they are expected to do is a basic condition for pyrotechnic articles to achieve a good level of safety for consumers or professional end users. The Notified Body examines the documentation and the results obtained in the different tests performed.

Each pyrotechnic article must be tested under realistic conditions. If this is not possible in a laboratory, the tests must be carried out in the conditions in which the pyrotechnic article is to be used.

The following information and properties -where applicable -must be considered or tested: (3)(a) Design, construction and characteristic properties, including detailed chemical composition (mass and percentage of substances used) and dimensions;

Most of these information have to be provided in the technical documentation. Some of them like dimensions, weight, electrical resistance of igniters… can be easily checked by careful examination of samples.

(

3)(b) The physical and chemical stability of the pyrotechnic article in all normal, foreseeable environmental conditions;

Indications on what are the foreseeable environmental conditions have to be given in the technical documentation and in the MSDS (minimum and maximum temperatures and hygrometry recommended for storage and use, shelf life time…). Description of all the chemical components and provision of known chemical or thermal stabilities data as well as data regarding ageing behaviour through testing must also be given on articles or on the pyrotechnic materials they contain.

(

3)(c) Sensitivity to normal, foreseeable handling and transportation;

The description of the design, assembling and suitable packaging in the technical documentation together with results obtained in mechanical tests (shock, vibration, drop…) on bared or packaged article could answer this requirement.

(

3)(d) Compatibility of all components as regards their chemical stability;

Description of all chemical components and of their know chemical stability in the technical documentation, results of exposure to low temperatures, high temperatures, thermal cycles, harsh environmental conditions or ageing testing could answer this requirement.

(

3)(e) Resistance of the pyrotechnic article to moisture where it is intended to be used in humid or wet conditions and where its safety or reliability may be adversely affected by moisture;

The technical documentation should specify the environmental conditions where the article is intended to be use (minimum and maximum temperatures and hygrometry recommended for storage and use…), these information should be mentioned in the MSDS. Testing in harsh environmental conditions or after thermal cycles or ageing could answer this requirement.

(

3)(f) Resistance to low and high temperatures, where the pyrotechnic article is intended to be kept or used at such temperatures and its safety or reliability may be adversely affected by cooling or heating of a component or of the pyrotechnic article as a whole;

The technical documentation should specify the environmental conditions where the article is intended to be use (minimum and maximum temperatures and hygrometry recommended for storage and use…), these information should be mentioned in the MSDS. Testing in harsh environmental conditions or after thermal cycles or ageing could answer this requirement.

(

3)(g) Safety features intended to prevent untimely or inadvertent initiation or ignition;

Ability of the article to withstand various stresses (mechanical, electrical, environmental…) without functioning, presence of effective protection features (shunt, ESD/EMI protection…) could answer this requirement.

(3)(h) Suitable instructions and, where necessary, markings in respect of safe handling, storage, use (including safety distances) and disposal in the official language or languages of the recipient Member State;

The technical documentation and/or the MSDS have to describe or give these information. In the case of pyrotechnic articles for vehicles the Article 13 of the Directive specifies the minimum information for the labelling and refers to the Directive 2001/58/EC amending the Directive 91/155/EEC [START_REF][END_REF] for the drafting of the MSDS.

(

3)(i) The ability of the pyrotechnic article, its wrapping or other components to withstand deterioration under normal, foreseeable storage conditions;

The description of the design, assembling and suitable packaging in the technical documentation together with results obtained in mechanical tests (shock, vibration, drop…) on a bared or wrapped article could answer this requirement.

(

3)(j) Specification of all devices and accessories needed and operating instructions for safe functioning of the pyrotechnic article.

The technical documentation and/or specific instructions for the user have to described or give these information and some of them can also appear in the MSDS.

During transportation and normal handling, unless specified by the manufacturer's instructions, the pyrotechnic articles should contain the pyrotechnic composition.

The description of the design, assembling and suitable packaging in the technical documentation could allow to answer this requirement.

(4) Pyrotechnic articles must not contain: (4)(a) commercial blasting agents, except for black powder or flash composition; (4)(b) military explosives.

Description of the design and all the chemical components contained in the article in the technical documentation could answer these requirements.

(5) The various groups of pyrotechnic articles must at least also comply with the following requirements:

(5)A. Fireworks: This paragraph specific to fireworks is not discussed in this paper.

(

5)B. Other pyrotechnic articles (5)B(1) Pyrotechnic articles must be designed in such a way as to minimise risk to health, property and the environment during normal use.

The description of the design, assembling and of all necessary accessories for a correct operation must be given in the technical documentation. The Notified Body examines this documentation and the results obtained in the different test procedures carried out. The correct and complete functioning of the pyrotechnic article is checked to assess the conformity to the expected effect.

(

5)B(2) The method of ignition must be clearly visible or must be indicated by labelling or instructions.

The description of the design and of all necessary accessories for a correct operation must be given in the technical documentation and/or in an instruction notice for the users. The Notified Body examines these documents and the results obtained in the different test procedures carried out.

(5)B(3) The pyrotechnic article must be designed in such a way as to minimise risk to health, property and the environment from debris when initiated inadvertently.

The description of the design, assembling and of all necessary accessories for a correct operation must be given in the technical documentation. The Notified Body examines this documentation and the results obtain in the different test procedures carried out. The correct and complete functioning of the pyrotechnic article is checked to assess the conformity to the expected effect.

(

5)B(4) Where appropriate, the pyrotechnic article must function properly until the 'use by' date specified by the manufacturer.

The description of the design, assembling and of all necessary accessories for a correct operation must be given in the technical documentation. The Notified Body examines this documentation and the results obtain in the different test procedures carried out. The correct and complete functioning of the pyrotechnic article, after suitable ageing or environmental conditioning, is checked to assess the conformity to the expected effect.

(

5)C. Ignition devices (5)C(1) Ignition devices must be capable of being reliably initiated and be of sufficient initiation capability under all normal, foreseeable conditions of use. (5)C(2) Ignition devices must be protected against electrostatic discharge under normal, foreseeable conditions of storage and use. (5)C(3) Electric igniters must be protected against electromagnetic fields under normal, foreseeable conditions of storage and use. (5)C(4) The covering of fuses must be of adequate mechanical strength and adequately protect the explosive filling when exposed to normal, foreseeable mechanical stress. (5)C(5) The parameters for the burning times of fuses must be provided with the article. (5)C(6) The electrical characteristics (e.g. no-fire current, resistance, etc.) of electric igniters must be provided with the article. (5)C(7) The wires of electric igniters must be sufficiently insulated and must be of sufficient mechanical strength, including the solidity of the link to the igniter, taking account of their intended use.

Some or all of these requirements can apply to automotive igniters depending on their design or their uses. The technical documentation should specify the design and the intended uses. The ability to withstand electrostatic discharges or electromagnetic fields without operation, as well as the electrical characteristics can be evaluated by relevant testing procedures already used by the automotive industry.

Harmonised standards

In order to facilitate the process of demonstrating compliance with the essential safety requirements, harmonised standards for the design, manufacture and testing of pyrotechnic articles are being developed. In line with the 'New Approach to technical harmonisation and standardisation', pyrotechnic articles manufactured in compliance with harmonised standards should benefit from a presumption of conformity with the essential safety requirements provided for in the Directive.

However, these harmonised standards will not be available before a few years and the demonstration of the compliance with the ESR will have meantime to be made by the mean of other relevant standards. As far as it concerns pyrotechnic articles for vehiclesespecially inflator assemblies or airbag modulesthe relevant international ISO standards (for example the ISO 12097 Road vehicles -Airbag components) should be taken into account. Other existing testing procedures used in the frame of the national approvals of pyrotechnic articles could also be considered during the transition period.

CONCLUSION

In the recently implemented new process of the certification of pyrotechnic articles, to prove their compliance with essential safety requirements is one thing and to prove the ability to produce them in conformity with the type certified is another thing. The manufacturer of pyrotechnic articles for vehicles has to do both in the frame of the Directive 2007/23/EC. The application of the Directive requires the intervention of a Notified Body to carry out different tasks. In the one hand, it proceeds to a type examination (product certification) in accordance with Essential Safety Requirements based on the manufacturer technical documentation and on test results. And on the other hand, it brings a complementary contribution in the control procedures in terms of periodic audits of the manufacturing and inspection conditions.


Lagny Candice
email: candice.lagny@ineris.fr

Bentivegna Gaetan
email: gaetan.bentivegna@ineris.fr

FLOODING AND GAS EMISSIONS OF OLD IRON MINES IN LORAIN

Keywords: emission, iron mine, natural thermal air circulation gaz, emission, mine de fer, tirage thermique naturel

A study carried out in the iron basin of Lorraine (North-East of France) enlighted on the existence of under-oxygenated and noxious gas emissions (carbon dioxide, radon) in vast built-up areas related to abandoned mine workings. This study has been extended to other sectors of the Lorraine basin, the northern region, which is currently subjected to flooding. Specific devices were put in situ to observe the gas flow characteristics. The natural thermal convection seems to be the main phenomenon to explain the gas circulation. Noxious gas is also emitted but the intensity of the phenomenon was far less spectacular than those observed in Moyeuvre-Grande area. KEYWORDS: gas,

Introduction

Built-up areas of the iron basin of Lorraine (France) (figure 1) are affected by emissions of polluted air: gas mixtures under oxygenated and noxious gas emissions (CO 2 and radon). The most spectacular phenomenon occurred in the built-up area of Moyeuvre-Grande, in Moselle, especially the district of the town located very close to the former underground mining works. They were translated by faulty working of gas cookers and boilers. So, it have been measured within cellars in connection with old mine workings, high level CO 2 content (up to 6 %) and low level O 2 content (down to 13 %). During the same time, measures made by the Institute for Radioprotection and Nuclear Safety (IRSN) and the DASS (governmental organisation under Ministry of Health) investigated and measured high level radon content (up to 20 000 Bq/m 3 ) in the gaseous mixture. In some cases, these emissions affected directly buildings in connection with mine entrances or with the old superficial mine workings. Following the Lorraine local office of the French Ministry of Industry, Research and the Environment (DRIRE) request, INERIS started in 1999, some investigations to assess the scale and the geographical extent of the problem. First study was focused on the nearby reservoirs of "Rosselange", Franchepré and "Orne". Then, investigation was made in non-flooded reservoirs of the Northwest part of the ferriferous basin: Mexy, Lexy and Godbrange. These investigations showed that, in these areas, similar emissions to that observed in Moyeuvre-Grande were occurring. However, the intensity of the phenomenon was farless spectacular than those observed in Moyeuvre-Grande area [START_REF] Pokryszka | Rapport de synthèse sur l'origine et les mécanismes de circulation des gaz dans les vieux travaux du bassin ferrifère lorrain[END_REF]. INERIS is now carrying out research to understand the phenomenon of gaseous emissions from iron mines. These works are realised in the framework of a program funded by the French Ministry in charge of Industry, in collaboration with the local administration (DRIRE) and GEODERIS. These works also join within the framework of the research program GISOS. Today, monitoring continues by means of two devices of measure set up in the past on the site of G7 and G37 adits. The flooding of the north iron basin which began in December, 2005 was the occasion to identify if the north basin would be also subject to these particular gas emissions In this frame, it was decided to instrument 4 openings in connection with the mining voids of this part of the basin. The interest of such instrumentation was to monitor simultaneously, on several points of the same reservoir subjected to flooding, entries and releases of gas. Taking advantage of the acquired experience on the reservoir of Moyeuvre-Grande, specific devices of measures were developed and set up in representative points of that reservoir.

The risks created by gaseous emissions

In an average atmosphere, the volumetric oxygen is 20,9 % and the carbon dioxide one is 0,03 %. The consequences on health of a CO 2 enrichment and an O 2 impoverishment are multiple and vary in gravity according to the amount of these two gases.

It ranges from heads headache, for CO 2 contents between 3 and 4 % and O 2 content between 14 and 16 %, and to death for O 2 contents lower than 6 % and CO 2 higher than 10%. Concerning radon, the risk of lung cancer increases proportionally with the exposure. [START_REF] Colligan | Le radon dans l'air intérieur en France : contours et enjeux techniques et sanitaires de la problématique[END_REF] considers that the risk of cancer increases by 16 % by edge of 100 Bq / m 3 for an exposure between 5 and 34 years before. These observations induced INERIS to carry on its investigations by putting the various openings a station of measures and acquisition.

Measure and acquisition devices

Devices

Every device allows to measure and to register the parameters of the outgoing gaseous flow through the instrumented opening. We used the experience acquired in Moyeuvre and Tressange to conceive these devices. The devices are constituted by the following elements:

pipes to forward the gas pumped inside and to drive towards the various sensors; a set of sensors to characterise the gas flowing through the adit or the shaft (temperature, sense of drainage, speed, composition and differential pressure); a set of sensors to measure the weather conditions (outside temperature and barometric pressure); a set of power supply; a system of acquisition and storage of the data. All the components are put together in a cupboard of protection before on-site installation.

Measured parameters and scale

To measure the parameters influencing gas flow and its characteristics, every station (cf. photo 1) includes the measure of:

the atmospheric pressure between 600 and 1060 hPa; it is measured by means of a barometric pressure sensor; the differential pressure between inside and outside of the mining works, on the range -20 +20 Pa which can be extended to -50 +50 Pa; the oxygen content, on range of measure from 0 to 10 %, measured with a infrared sensor; the volumetric activity of radon, on the range of measure from 0 to 100 000 Bq/m 3 ; measured with a probe Barasol; the gas temperature, on the range of measure -20 to 60 °C; measured with a thermo-couple; some stations are equipped with an anemometer intended to measure the sense and speeds of gas flowing in order to evaluate the gas flow. This equipment can measure speeds until 65 m/s; the ambient temperature is measured on-site with a thermo-couple.

Photo 1. Measuring station and anemometer in Algrange adit

Moyeuvre-Grande case

In order to find the origin of the flow driving the gaseous exchanges between the old mine workings and the atmosphere, two measuring stations were installed in the entry of two former adits connected to the reservoir of Moyeuvre-Grande.

Figures 2 and3 show some interesting results obtained from the data collected since April 2000.

These results show that it exists clearly a correlation between the sense and the intensity of the air flow and the outside temperature. No other parameter, having a significant effect on the flow has been identified. This observation intends to consider the natural thermal convection as the phenomenon playing an essential role in the creation of the gaseous flow between the mining reservoirs and the surface. This phenomenon is due to the thermal differential existing between the external atmosphere and the old workings.

In the old workings, the temperature is usually almost constant (it is estimated in 12-14°C, in our case), contrary to the atmospheric temperature, whose general level varies according to the annual seasonal cycle. Also, a topographic configuration of the surface over the mining reservoir of Moyeuvre-Grande and the other concerned reservoirs seems to facilitate the thermal convection. Indeed, the investigated areas are characterised by a very contrasted topography with rather large plateau, interrupted by an irregular network of valleys. The ferriferous deposit is located at the base of the plateau, with emergences appearing frequently on the hillsides of valleys.

During summer, a part of the atmospheric air in contact with the upper old workings (openings badly or not filled cracks) is subjected to a progressive cooling. An increase of the bulk density, due to the effect of cooling, causes gas migration of gas towards the lowest parts of the old emerged mine workings.

Then, the gas goes out of the mining reservoir by through the various openings situated mainly along the outcrops with in valleys. A circulation of air so becomes established. The functioning of the reservoir according to this model is characterised by two particular and different stages: the summer period, during which the flow is globally coming out of the massif. It corresponds to an outside temperature significantly superior to that inside one (approximately 14°C); the winter period, during which the flow is globally coming into the massif. It corresponds to an outside temperature significantly superior to that inside one (approximately 14°C); These two very different periods are separated by transition time, during which the flow is fluctuating. Figure 2 presents the most interesting results obtained from the nonstop measures made since April, 2000.

Figure 2. Evolution of the outside temperature, the oxygen content and the volumetric activity of the radon observed in G7 adit connected to the reservoir of Moyeuvre-Grande

North basin measures

Hydrogeological situation

The post-mining reservoir is gradually flooded northward from the deeper works located South. Due to dewatering adits, the final flooding level will reach 207 m NGF. Therefore, an important part of space situated in the northern extremity will remain up flooded. The figure below presents the curve of water rising until September 2007. According to the forecasts, the final level should be reached around beginning of 2008.

Mining openings choice

According to the phenomena observed in Moyeuvre, the circulation between outside and the old mine workings could be mainly governed by the natural thermal draught phenomenon. If this phenomenon is reproduced on the northern reservoir, some openings of this reservoir would be out flowing in summer and would become in flowing in winter and vice versa for other points located at a different level.

A study was carried out by INERIS [START_REF] Pokryszka | Etude préliminaire de la ventilation naturelle thermique des travaux miniers non ennoyés à terme de l'ARBED dans la partie nord du bassin ferrifère lorrain[END_REF] to model the importance of circulations in the reservoir of the north basin. The modelisation showed that: some openings had an essential role on the gas circulations in the underground network. So, François shaft seems as a main point for the animation of the flow in the whole network, and whatever the season; 0 1 / 1 2 / 0 5 0 1 / 0 2 / 0 6 0 1 / 0 4 / 0 6 0 1 / 0 6 / 0 6 0 1 / 0 8 / 0 6 0 1 / 1 0 / 0 6 0 1 / 1 2 / 0 6 0 1 / 0 2 / 0 7 0 1 / 0 4 / 0 7 0 1 / 0 6 / 0 7 0 1 / 0 8 / 0 7 0 1 / 1 0 / 0 7 0 1 / 1 2 / 0 7

water level ( m NGF)

openings located north-western (shaft 1, shaft 2 and shaft 3, St Michel, incline, Ottange incline) present an important activity which is distributed uniformly in winter. In summer, these openings are on the contrary little active.

We took into account these conclusions to select openings to be instrumented: low points located in each of the zones (in the East and in the North-West) defined previously and a high point (cf. map of localisation in appendix 4).

The choice concerned the Algrange adit (Ste Barbe mine), low point located close to the front of flooding (East). The quotation of this opening is near 280 m NGF. To be even closer of the flooding front and to observe all the gaseous phenomena, it was decided to pull the line relative to the gas as far as possible from the entry, inside the workings.

To be in communication as long as possible with the mining space of the underground reservoir, an opening (low point) was chosen northwest of the basin. In this frame, the choice concerned Ottange incline which will stay in communication with the unflooded voids. This opening will remain opened. Its level is around 300 m NGF.

The St Michel incline located northwestern was also selected. Its level is around 315 m NGF. The François shaft (former shaft for ventilation) was therefore chosen as the high point to be monitored. Its level is around 400 m NGF.

Observed results

Each opening has a particular behaviour according to the value of the outside temperature (see figure 5). So, Algrange adit and Ottange incline show out flowing when the outside temperature is higher than 15 °C. In summer period, outflows are marked by the presence of radon with volumetric activity reaching about 8000 Bq / m 3 for Algrange adit and about 7000 Bq / m 3 for Ottange incline.

It can be noticed (see figure 5) the presence of CO 2 around 1 to 1,5 % volumic for the Algrange adit and 1 to 1,2 % for Ottange incline. The oxygen content goes down around 18,5 % for the Algrange adit and around 19,3 % for Ottange incline. For Algrange adit, there is a clear relation between O 2 impoverishment and CO 2 and radon enrichment for temperatures higher than 12-14°C. This relation is not so clear for Ottange incline. « François » shaft and « St Michel » incline behave rather as high points. In 2006, temperature had to be underneath 5°C to generate large exits of noxoius gas at « François » shaft. During these period, CO 2 content reaches 1,8% vol. and volumetric activity in radon rises until 6000 Bq / m 3 . However, outflows of noxious gas are noticed for temperature included between 5 and 10 °C, or equal to 12°C). These gas outflows can last several weeks. For St Michel incline, noxious gas outflow is enriched in carbon dioxide (up to 1,2% vol.) and in radon (volumetric activity around 4000 to 4500 Bq/m 3 ).

It is also important to underline that over natural events (such as atmospheric variations, wind effect, water rising) add to the natural thermal draught phenomenon and can disturb temporarily the two main stages characterised previously. 6, shows the level of the content of CO 2 measured over several months according to the atmospheric temperature for two openings, the Algrange adit and St Michel incline. It can be seen the different behaviour of the two openings. For Algrange adit, the atmosphere enriched in CO 2 appears for temperatures larger than 8-10°C, which corresponds to regime of flux going out of the massif. For St Michel incline, the atmosphere enriched in CO 2 appears for much lower temperatures.

Conclusion

Gas composition is rather homogeneous on the whole reservoir of northern basin. The outflow of gas seems more or less dependent on the outside temperature value. Some openings behave like high points and other like low points. The gas, which outflows from north iron basin, is not so rich in noxious gas than the gas observed in Moyeuvre, but the quantity of radon is not negligible. Natural thermal convection seems to be the main factor governing the flow. The monitoring will be carried on the different points until the end of flooding as well as few years after in order to observe any variation in gas composition.

Figure 1 .

 1 Figure 1. Ferriferous lorrain basin limits

Figure 3 .

 3 Figure 3. Water level evolution in north iron basin

  openings located eastern (Ottange 1 shaft, Ottange 2 shaft, Charles Ferdinand roadway and Algrange adit of the former mine Ste Barbe) remain relatively active in summer with a rather homogeneous distribution of the flows. In winter, the flows are globally less important;

Figure 4 .

 4 Figure 4. Position of selected openings in the north part of the ferriferous basin of Lorraine

Figure 6 .

 6 Figure 6. Relation between temperature and CO2 gas content

  Figure 5. Volumetric activity of radon and CO2 gas content measured at different openings of north iron basin

								outside temperature (°C)
	A total relation, introduced on figure
			30
			28
			26
			22 24		outside temperature (°C)
			20
			18
			16
			14
			12
			10
			8
			6
			4
			2
			0
			-2
			-4
			-6
			-8
			-10
			09-nov-06	09-déc-06	08-janv-07	07-févr-07	09-mars-07	08-avr-07 Saint-Michel incline 08-mai-07 07-juin-07	07-juil-07	06-août-07	05-sept-07	05-oct-07
			1,4										5000
								CO2 gas ocntent
								Radon volumetric activity
			1,2
													4000
		CO2 gas content (% vol.)	0,4 0,6 0,8 1										2000 3000	Radon volumetric activity (Bq/m3)
													1000
			0,2
			0										0
			09-nov-06	09-déc-06	08-janv-07	07-févr-07	09-mars-07	08-avr-07	François shaft 08-mai-07	07-juin-07	07-juil-07	06-août-07	05-sept-07	05-oct-07
			2										10000
								CO2 gas content
			1,8					radon volumetric activity			9000
			1,6										8000
		CO2 gas content (% vol.)	0,6 0,8 1 1,2 1,4										3000 4000 5000 6000 7000	radon volumetric activity (Bq/m3)
			0,4										2000
			0,2										1000
			0										0
			09-nov-06	09-déc-06	08-janv-07	07-févr-07	09-mars-07	08-avr-07	08-mai-07	07-juin-07	07-juil-07	06-août-07	05-sept-07	05-oct-07
								Ottange incline
		10000										1,4
					radon volumetric activity
		9000		CO2 gas content
													1,2
		8000
	radon volumetric activity (Bq/m3)	3000 4000 5000 6000 7000										0,4 1 0,6 0,8	CO2 gas content (%)
		2000
													0,2
		1000
			0										0
			09-nov-06	09-déc-06	08-janv-07	07-févr-07	09-mars-07	08-avr-07	08-mai-07	07-juin-07	07-juil-07	06-août-07	05-sept-07	05-oct-07

Acknowledgments

This work forms part of the research program carried out by the GISOS organisation (Research Group for the Impact and Safety of Underground Works).