ARAMIS Accidental Risk Assessment Methodology for Industries in the framework of SEVESO II directive

This paper presents the ARAMIS project accepted for funding in the 5 th Framework Programme of the European Commission, which should start end 2001. ARAMIS project aims at developing a new risk assessment methodology which allows to evaluate the risk level of an industrial plant by taking into account prevention measures against major accidents. The methodology will support the harmonised implementation of the SEVESO II Directive. The project is built to result in the composition of an integrated risk index based on the definition of Reference Scenarios and combining : 1. Scenario consequence severity 2. Safety management effectiveness affecting the probability of occurrence of major accidents 3. Environment vulnerability. The methodology will be validated with case studies. Efforts are given to disseminate the methodology to decisionmakers in charge of the control of major accident hazards. Thus the project development will be continuously monitored by a review team gathering risk experts from industry and EL) competent authorities in order to ensure the widest acceptance of the approach.

Introduction

The ARAMIS project was submitted for funding in the 5 th Framework Programme of the European Commission in February 2001 under the programme ENVIRONMENT AND SUSTAINABLE DEVELOPMENT, in the chapter untitled "The fight against major natural and technological hazards" of the Work Programme. This 3-years project should start at the end of year 2001.

The ARAMIS methodology builds further on methods studied in the 4th Framework Programme such as in ASSURANCE 13 project, a benchmark exercise on the uncertainties in risk analysis, and developed in I-RISK project 0 , which provides a methodology for in-depth judgement of safety management requirements for the design, operation and maintenance of major hazards plants.

The development of ARAMIS is justified by the need of the elaboration of a methodology giving consistent rules for the identification of scenarios that take into account mitigation devices and some aspects of safety management, and being recognised by risk experts from Competent Authorities and Industry.

a Paper written on behalf the consortium described in chapter 5 and including the contribution of the organisation mentioned. b Assessment of the Uncertainties in Risk ANalysis of Chemical Establishments, n°ENV4970627 c Development of an integrated technical and management risk control and monitoring methodology for managing and quantifying on-site and off-site risks, n°ENV4960243.

Beside, there is an need to establish a method that is capable to assess the risk level of an installation by integrating the preventive measures implemented by the operators. Such a method is a prerequisite in order to reach the goals of the SEVESO II Directive, that are to improve the prevention linked in particular with the safety management. So, the ARAMIS methodology propose to characterise the risk level with an integrated risk index composed with independent parameters related to the consequence severity evaluation of scenarios, the prevention management effectiveness and the environment vulnerability estimation describing the sensitivity of the potential targets located in the vicinity of the SEVESO II establishments. The application of this method will result in a more consistent and harmonised risk evaluation and safety management strategy in all European Countries.

The paper starts with the presentation of the general and operational objectives of the project, and a recall of the context of the major-accident hazards control and prevention in the EL). Then, the project and especially the work contents and the consortium are described in details. And finally, the expected impacts of such a methodology are addressed.

Objectives

The objective of ARAMIS project is to create a new integrated risk assessment methodology by combining the strong points from the different methods currently used in risk assessment in European Countries. The methodology will be used as a supportive tool to promote safety in the process industry. In particular, it will contribute to speed-up the harmonised implementation of the Council Directive 96/82/EC of 9 December 1996 on the control of major-accident hazards involving dangerous substances known as SEVESO II Directive. Accordingly, this tool should be flexible enough to take into account the different national cultures in industrial risk assessment like deterministic or risk-based approaches, so that the new methodology could become a recommended tool used by risk experts and endorsed by the risk decision-makers in the whole EU.

In technical terms, ARAMIS project aims at : 1. Establishing a methodology for accident scenarios identification taking into account the prevention process carried out by the operators of SEVESO establishments, and endorsed by the Competent Authorities and the decisionmakers in charge of risk control,

Composing an integrated risk index which takes into account:

• Consequence severity evaluation of scenarios,

• Prevention management effectiveness (preventative, protective and mitigation measures) on initiating and aggravating events, thereby reducing the probability of occurrence of major accidents, • Environment vulnerability estimation.

3.

Context of major-accident hazards control and prevention

The 1999 annual report from the European Environment Agency [START_REF]Environment in the European Union at the turn of the century[END_REF] indicates that the trend in accidents shows that many of the often seemingly simple 'lessons learned' from accidents have not yet been sufficiently implemented in industry's standards. There is no doubt that disasters will continue to occur throughout the EU. Some of these will be due to technology, some to the forces of nature. Inevitably there will be loss of life and environmental damage. However, hazards can be managed to reduce risks. The problem of low-probability, high-consequence events is likely to remain a key issue in terms of risk management. The most significant Ell Directive to help protect people and the environment from major accident hazards is the SEVESO II Directive. This Directive applies to those industries that use significant amounts of hazardous substances. Their operators must demonstrate that they apply a policy for the prevention of major accidents using appropriate measures related to both "hardware" and "software" aspects, such as safety management systems. This is likely to reduce risk levels, not only from highprobability, low-consequence accidents, but also from low-probability, highconsequence events, although these are by nature difficult to address.

In the SEVESO II Directive, the objectives in terms of risk management are very clear, but the remaining question is : How to reach them ? For example, there is no harmonised definition of the scenarios that have to be considered for risk assessment. Typically, the chosen scenarios (BLEVE, total loss of containment, fire in the largest tank, explosion of the largest mass of explosive, etc.) can be different according to the specific risk analysts and according to the deterministic or riskbased approach of the country applying the Directive. This situation is confirmed by the results of the EC project ASSURANCE, in which 6 European organisations perform a benchmark exercise for the risk analysis of a specific plant. The partners use various hazard analysis techniques and arrive at quite different conclusions with respect to the scenarios that are relevant for the safety assessment. Moreover, sometimes, according to reference [START_REF] Cassidy | Special issue : The SEVESO II Directive (96/82/EC) on the control of major accident hazards involving dangerous substances[END_REF], land-use planning constraints urge the operators to consider reduction of the safety distances. Then, it may be proposed to choose 'realistic' scenarios by taking account of the effectiveness of mitigation devices. In fact, because of the lack of rules for identifying scenarios including safety measure effectiveness, the expert's job is tricky and often involves large subjective elements.

Not only risk assessment experts, but also decision makers are confronted with a variety of approaches to assess and manage industrial risk. The difference of cultures in the Member States results in a multiplicity of methods for the evaluation of major accident hazards [START_REF] Kirchsteiger | Special Issue on International Trends in Major Accidents and Activities by the European Commission towards Accident Prevention[END_REF]. This fact makes the comparison of risk studies performed by different analysts a difficult task and has significantly hampered the widespread use of risk assessment for decision making purposes. At the recent EC-JRC International Workshop on Promotion of Technical Harmonisation on Risk-Based Decision Making, held in Italy in May 2000 [START_REF] Kirchsteiger | Promotion of technical harmonization on risk-based decision-making[END_REF], most participants agreed that comparative risk assessment along harmonised procedures would significantly help the decision understanding. A harmonised risk assessment methodology would thus ensure that risk-based decision making provides the necessary transparency and strikes the right balance between scientific understanding and precaution.

To propose a harmonised methodology for risk assessment is difficult. However, some aspects of the different approaches can be put in common such as scenario identification, severity evaluation and the integration of the effectiveness of the safety management that affects the major accident probability of occurrence. Because of these reasons there is a real need to establish common rules to identify scenarios integrating the prevention management achieved by the operator and to propose a harmonised method for their evaluation [START_REF] Salvi | Why changing the way to measure the risk ?[END_REF].

4.

Project work plan

Introduction

The objective of ARAMIS is to develop a risk assessment methodology to evaluate the risk level of installations by taking into account the prevention measures implemented by the operators. The project work plan is built to result in the characterisation of the risk level which is based on the determination of Reference Accident Scenarios and integrates :

• Consequence severity evaluation of scenarios,

• Prevention management effectiveness,

• Environment vulnerability estimation. The end-users of the methodology are both the industrial companies and the Competent Authorities in charge of the application of the SEVESO II Directive. Thus, the valorisation and dissemination plan start at the beginning of the project with large exchanges with the end-users partners in the consortium and in a Review Team.

4.2

Project description This paragraph describes the three main phases of the project which are :

1. Development of the methodology ; 2.Finalising and testing the methodology ; 3.Valorisation and dissemination plan.

Development of the methodology

The development of the methodology starts with the identification of reference scenarios, that are evaluated. Then the prevention management effectiveness and the environment vulnerability of the establishment are characterised. All these results are integrated to assess the risk level of a given establishment. The various phases of the methodology are described in details hereunder.

• Scenarios identification The objective of this phase is to propose a methodology for the identification of Accident Scenarios. F : or industrial installations, the Major Accident Hazards will be first identified with an algorithm based on the labelling of the substances (Directive 67/548/EEC) and the conditions of their use (pressure, temperature, flow, etc.). Then, the Reference Accident Scenarios will be determined from the Major Accident Hazards and from the review of accidents which occurred on similar units. The Reference Accident Scenarios will take into account the current practices (state of the art) mentioned in the legal requirements with regard to design, operation and control, and mitigation. Therefore, the Reference Accident Scenarios will use results from the work on the prevention management effectiveness as described in Figure 1. Reference Accident Scenarios define realistic scenarios, considering an installation operated today. They will be used to evaluate the effects (severity) of the major accident and describe the hazard potential.

• Evaluation of consequence severity of scenarios The objective of this task is to define a severity index S depending only on physical parameters. It is intended to study the physical characteristics of the phenomena involved in accidents (dispersion, explosion, fire), and to take them into account to evaluate the consequence severity of the scenarios. The parameters to be considered are :

-the effect area A concerned with the phenomenon : for instance, a disc in case of an explosion, the projection of a plume for gas dispersion ; -the phenomenon kinetics K : rapid for explosions, slower for dispersion and fires ; -the capability of intervention / to mitigate the disaster : possible for fire and gas dispersion, but possible only at the design step for explosion ; -the potential of domino effects D : fragment emission, interlocking of delayed phenomena. A seventy index S is therefore a function of parameters only associated with physical phenomena. All scenarios identified can then be evaluated and ranked with this severity index according to the calculation of S o for the Major Accident Hazards and S re f for the Reference Accident Scenarios.

• Prevention management effectiveness

The objective of this task is to define an index M characterising the prevention management effectiveness. Because technical and organisational factors are key issues to prevent major accident, this task consists in developing a methodology to evaluate the management effectiveness. Safety management applied in a Major Accident Prevention Policy leads to define actions to manage technical, human and organisational factors. The operational goal of safety management is to strengthen the barriers and lines of defence against accidents (safety equipment or human operation). Safety management contains a large number of responsibilities, tasks and functions that are difficult to disentangle. A way of discriminating different levels in safety management is as follows :

-Policy : The implicit or explicit statement of a company's intentions with respect to plant safety, the objectives and goals for safety management and the way safety is prioritised and incorporated in the company's daily management. -Organisation : Organisation of safety management requires allocation of resources, definition of tasks, and scheduling activities. -Operation and maintenance : An important part of safety management is maintaining the reliability of the safety-critical technical, human and organisational components. This activity/responsibility includes :

• training, education and competence of personnel,

• maintenance of technical systems and introduction of new safety devices,

• maintenance of procedures,

• keeping up hazard awareness, e.g. by updating risk assessments.

-Leadership : Implementation of safety management requires leadership, showing consistency between stated policies, intentions and objectives and decision-making in daily plant management, setting examples, creating common values and attitudes. Leadership has important impact on safety culture, safety awareness and prevention of "unsafe acts". The evaluation methodology will be built on the use of several research approaches :

-Analysis of the effectiveness of safety devices providing physical safety barriers and lines of defence according to their characteristics (nature, availability, reliability, maintainability, testability...). This analysis follow the principle of the norms IEC61508 and draft IEC61511 (Functional safety : safety instrumented systems for the process sector) and lead to general methods to improve safety barriers and some results will be used for the scenario identification. -Analysis and comparison of specific safety management systems (e.g. application of standards) and analysis of how safety policies are embedded in the company's overall management system. -Development and use of theoretical modelling of management tasks, with Structured Analysis and Design Techniques (SADT) or function oriented modelling. This will be built on the work carried out in earlier EU projects, like I-RISK which established different ways of linking technical risk analyses with organisational influences. -Expert judgement, in particular to prioritise the management factors for assessment purposes. -Identification of safety performance indicators using audit techniques, questionnaire techniques and analysis of incident reports. -Development and validation of audit techniques. Safety management affects the probability of occurrence of the scenarios. Therefore the objective of this work will be :

• To assess the effectiveness of various forms and aspects of safety management in preventing accidents.

• To develop reliable indicators that are a good measure of the effectiveness of a plant safety management. This information will be used to define a multidimensional index M characterising the prevention management effectiveness.

• Environment vulnerability estimation

This phase aim at defining an index V characterising the spatial vulnerability of the environment of an hazardous establishment by characterising potential targets (population, natural and man-made environment) and to estimate their sensitivity. To reach this objective, the area of interest in the vicinity of a plant will be divided into meshes : the potential targets belonging to each class (population, natural and man-made environment) will be identified and localised with the support of Geographic Information Systems (GIS). The sensitivity of the targets (workers of the plant, residents, surface and underground waters, public buildings...) will be characterised and ranked, using a multi-criteria ranking method (SAATY), determining a scale of vulnerability levels. Vulnerability maps will be obtained by calculating and combining the vulnerability of all the targets falling in the same mesh.

Finalising and testing the methodology • Characterisation of the Risk Level RL

The severity index S can be combined with the management effectiveness index M and the vulnerability index V to define a risk level RL index of an installation in its environment (See Figure 2). The objective of this phase is to study the relation between S, M and V to characterise the risk level. It will be studied whether the risk level should remain characterised by the 3 indexes or whether the 3 indexes could be aggregated to form a multidimensional index. The ARAMIS method enables ranking the hazards only in terms of severity with the calculation of the severity index S for each scenario. Then the scenarios identified in several units are comparable. It also enables taking into account the efforts (preventive measures) made by the company with the estimation of the prevention management effectiveness M. The result also makes it possible to compare the risk level between two or more units of an industrial group to define the priorities for the investment for safety.

• Case studies To validate and to improve the ARAMIS methodology, case studies will be carried out with the collaboration of industrialists and Competent Authorities in several SEVESO establishments in Europe. For the selection of the test sites, it will be assured that countries with a consequence-based and probabilistic approaches are represented. After this exercise, the definition of the indexes will be modulated to improve applicability and validity of the procedure.

Valorisation and dissemination

In the valorisation and dissemination plan, efforts will be made to transfer the methodology to risk assessors and decision-makers, who are the end-users of the methodology. Industrial end-users are represented in the consortium through an association of European industrial companies. It will help the consortium to relay information about the project and its progress, to find plants for case studies and to disseminate the methodology at the end of the project. For dissemination, a web site will be built aiming at promoting the project and disseminating the public results. An electronic newsletter will also be released by the project management on the web site, after the progress meetings. Moreover, a intermediate workshop is set to provide the end-users with some partial results of the project and to collect comments to improve the relevancy of the further work. And a final workshop is also planned at the end of the project to disseminate the main results to all relevant stakeholders. The two workshops will be open to thirdparties not involved in the consortium and workshop proceedings will be issued and made available on the web-site. Besides, in connection with the workshops, to ensure the widest possible dissemination of the results during the project, the participants will publish papers in scientific international journals and conferences.

5.

Consortium description and involvement

The consortium consists of ten organisations involved in the risk analysis of major accidents. They are presented in Table 1. EC-JRC-IPSC and especially MAHB has a recognised international expertise in the field of major accident prevention. It has animated EL) Working Groups dealing with the application of the SEVESO I and II Directives and is also experienced in the development and use of accident databases and GIS tools at European level. MAHB acts as leader of the activities related to valorisation and dissemination of the results as well as leader of the parallel Review Team.

FPMs-MRRC has a great experience in the application of the SEVESO II Directive, and already developed methodologies on the choice of accident scenarios to study domino effects. It acts as the leader of work on Scenario Identification. In addition, the MRRC also brings its experience about domino effects and accident consequences modelling in the Severity Evaluation.

UPC (through CERTEC) has a recognised expertise in the evaluation of the accident consequences for SEVESO plants (dispersion, explosion, fire modelling). UPC will develop research on the Severity Evaluation as task leader.

The Pôle Cindyniques of ARMINES has built a methodology to formalise the development of accidents as a series of "particles of experience" which are collected and documented from the analysis of reports, debriefing sessions and interviews.

Using this methodology, it will contribute to the scenario identification and the work related to the prevention management effectiveness.

The SITE department of ARMINES has a long experience in environmental system management characterisation. It will mainly focus on the prevention management effectiveness and environment vulnerability characterisation. The LGEI of ARMINES has competencies in using both multi-criteria ranking methods (SAATY) and GIS. It has developed a methodology based on these two aspects for studying risks in transportation of hazardous substances., and will contribute to provide a methodology to rank the vulnerability of targets (human, environmental, equipment) in the vicinity of plants to obtain a vulnerability cartography used to characterise the spatial vulnerability.

RISOE is experienced with drawing up and evaluating safety reports for hazardous installations. It has special experience with applying function-oriented modelling to analyse the effectiveness of the organisation of safety procedures and using questionnaire techniques for assessment of safety culture. RISOE will be leader of the work on the Prevention management effectiveness.

UROM is experienced in methodologies and software tools, including GIS systems, to carry out risk analysis and area risk studies. Its activities will be mainly devoted to the development of the methodology for characterising the potential targets and their vulnerability. It will prepare a software tool for determining the environmental vulnerability index basing on GIS information.

Due to its experience, on one hand in fire and explosion, and, on the other hand in safety management and risk assessment, CMI will carry out research respectively for work related to the Severity evaluation and the Management effectiveness by analysing the implementation of management standards and guidelines.

Bringing its expertise in safety management modelling and risk assessment, TUD will carry out a major effort in the ARAMIS research project in work on Prevention management effectiveness with expert judgement and audit tools developed at TUD.

IChemE-EPSC will participate in the dissemination of the results to the industrial companies which are members or associates of the EPSC. It is important to notice that a lot of EPSC members are end-users of the ARAMIS methodology. In the project, EPSC will circulate to the members information related to the project and its results, and care about the Review Team participation.

In addition to the consortium, a Review Team is indeed built up. It has an essential role for the dissemination of the results through decision-makers involved in the control of major accidents. The Review Team has a role in the management and will comment on the applicability and usefulness of the results achieved. The involvement in the methodology development of risk experts both from the Competent Authorities and industrial companies will ensure that the methodology will be known and recognised at a European level.

Contribution to the implementation of the SEVESO Directive

The project supports the European Research Area concerning the improvement of the knowledge, encouragement of the Science-Industry dialogue and harmonisation in decision-making process related to hazardous establishments.

The ARAMIS method will indeed be proposed as a recommended and harmonised tool used by risk experts and recognised by the risk decision-makers in the EU.

Harmonising industrial risk assessments in Europe would significantly contribute to the European Commission's overall efforts to establish harmonised policies following the SEVESO II Directive. Such a harmonised risk assessment procedure would be of significant interest for both Competent Authorities and Industry :

• It would constitute a risk evaluation and comparison tool for industrial sites, which integrates the strengths of probabilistic and deterministic approaches. • The procedure would enable definition of progress plans within the framework of a safety management system. • It would enable to moderate the selection of scenarios by taking into account realistic data and preventive measures. • It will enable the evaluation and consideration of plant-specific safety devices and safety management effectiveness, as required in the Safety Reports.

The partnership in the consortium and in the Review Team ensures that the ARAMIS project will contribute on a very practical level to the EC research objectives built to support the further development and consistent implementation of European policies.

7.

SCENARIOS IDENTIFICATION

Major Accident Hazards

Reference Accident Scenarios

  co-ordinator of the project, has an international expertise in the field of major accident prevention. It works as technical support for the national Competent Authority in charge of the application of the SEVESO II Directive. INERIS will lead with the steering committee the aggregation of the works for the risk level index composition and validation. INERIS will also provide support for valorisation and dissemination and for the Parallel Review.

Figure 1 :Figure 2 :

 12 Figure 1 : Scenarios identification procedure

Table 1 : Description of partner organisation Organisation name

 1

	1. Institut National de l'Environnement Industriel et des Risques
	Accidental Risk Division
	2. European Commission -Joint Research Centre -Institute for the
	Protection and Security of the Citizen-Major Accident Hazard Bureau
	3. Faculté Polytechnique de Mons
	Major Risk Research Center
	4. Universitat Politecnica de Catalunya
	Centre for Studies on Technological Risk (CERTEC)
	5. Association pour la Recherche et le Développement des Méthodes et
	Processus Industriels -ARMINES
	6. Ris0 National Laboratory
	System Analysis Department
	7. Universita di Roma
	Dipartimento Ingegneria Chimica
	8. Central Mining Institute
	Safety Management and Technical Hazards
	9. Delft University of Technology
	Safety Science Group
	10. Institution of Chemical Engineers European Process Safety Centre

Acknowledgement

The work presented in this paper have been elaborated in the frame of the EL) project ARAMIS " Accidental Risk Assessment Methodology for Industries ", contract no EVG1-CT-2001-00036, co-ordinated by INERIS (F) and including EC -JRC -IPSC -MAHB (I), Faculté Polytechnique de Mons (B), Universitat Politecnica de Catalunya -CERTEC (SP), ARMINES (F),. Ris0 National Laboratory (D), Universita di Roma -Dipartimento Ingegneria Chimica (I), Central Mining Institute -Safety Management and Technical Hazards (PL), Delft University of Technology -Safety Science Group (NL), European Process Safety Centre (UK), Ecole des Mines de Paris -Pôle Cindyniques (F), Ecole des Mines de Saint Etienne -SITE (F), Ecole des Mines d'Alès -LGEI (F). The programme is organised within the Energy, Environment and Sustainable Development Programme in the 5th Framework Programme for Science Research and Technological Development of the European Commission

8.


I INTRODUCTION

At the beginning of this century, electrification of coal mines was more or less developed in industrial European countries. In order to avoid catastrophic fire damp explosions the different national authorities set up rules and technical provisions for the construction and testing of electrical equipment for the coal mines. Each country has its own rules, often with significant differences.

With the technical progress and the Rome treaty, the members states of the European Economic Community have felt the need to harmonise their national regulations in order to facilitate commercial exchanges. This task was given in 1968 to the European committee for the co-ordination of electrotechnical standards (CENELCOM). The technical committee TC 31 started this work based on different national standards and regulations.

Enlarged in 1972 due to the entry of new members in the European Community and those of EFTA, CENELCOM became, the 1 st of January 1973, CENELEC.

The 1 st of March 1977, CENELEC adopted seven standards for electrical apparatus for use in potentially explosive atmospheres.

Following the Directive 76/117/EEC, the Directive 79/196/EEC introduced these standards as harmonised standards. This directive defined also the distinctive European mark H).

These directives and standards have represented a positive development in the prevention of explosions and they have contributed to the removal of trade barriers for explosion protected electrical apparatus.

The experiences have led to the creation of 'New Approach Directives'. In the field of equipment for potentially explosive atmospheres, the Directive 94/9/EC (called ATEX directive) succeeds the old directives.

The ATEX directive applies to all potentially explosive atmospheres caused by gas and dust and applies to all equipment, not only for the electrical one. It defines rules for the safety and the health of persons, domestic animals and property concerned by the use of equipment in potentially explosive atmospheres. It allows also different ways to prove the conformity.

CZYZ, Alain -INERIS

II MANDATED EUROPEAN STANDARDS

A major advantage of the Directive 94/9/EC is the system of presumption of conformity given by using harmonised European standards. The detailed technical specifications in the harmonised standards correspond to the rules of safety of the directive. Although not compulsory, they have the advantage of presumption of conformity. Only standards mandated by the European Commission give this presumption.

To optimise the ATEX directive and to give a help to manufacturers, the European Commission gave a mandate to CEN/CENELEC to produce such harmonised standards. This mandate requires an intensive co-operation between CEN and CENELEC to do the following work:

1-To review and, where necessary, modify existing standards in order to align them with the essential safety requirements of the directive, 2-To establish the new required standards, giving priority to horizontal standards, which apply to broad ranges of products rather to specific products. 3-To elaborate, where they are necessary, specific product standards in a coherent way with the horizontal standards.

This work needs an efficient co-ordination to avoid overlapping and duplication of standards.

III CENELEC TECHNICAL COMMITTEE TC31

The standardisation work for electrical equipment and installation in potentially explosive atmospheres is devolved to the technical committee TC 31 and some specific sub-committees.

The scope of TC31 is the following:

To standardize the general requirements for the construction and testing of electrical apparatus for potentially explosive atmospheres and the specific requirements for the construction and testing of electrical apparatus, type of protection "o " (oil immersed) and type of protection "q" (powder filled) and types with protection for use in the presence of combustible dusts, and to co-ordinate the work of the sub-committees dealing with the standardization of specific requirements for other individual types of protection. An apparatus shall fulfil the general requirements plus one or more types of protection.

The series were published in the three official languages (French, German and English) in 1977. Since the adoption of the series, several of the standards have been amended and have brought in operation by updating the initial directive by the Commission.

It exists also some standards for specific products such as electrostatic spraying equipment for flammable materials and cap-lamps. TC 31 has also written standards for the performances and the testing of flammable gas detectors.

Second editions

The first series of standards have been revised and published since 1993, as the second edition of standards. This second edition takes into account the interpretation sheets, the amendments of the 1 st editions and some changes implemented at an international level by IEC.

To complete the publication under the "old" directive, the European Commission has developed an amending directive, the directive 97/53/EC.

It is now possible to issue certificates of conformity according the second editions.

V CENELEC WORK IN RELATION WITH 94/9/EC ATEX DIRECTIVE

The scope of the new directive is broader compared with the requirements of the present CENELEC standards, comprising the 2 nd editions.

The directive introduces categories according the location where the equipment is intended for use and the nature of explosive atmosphere.

We could summarise the CENELEC work with reference to the categories defined by the directive and the area where the equipment is intended for use (zones according to the Directive 1999/92/EC based on article 137 of EC treaty):

Category Ml: group I equipment, for mines, which remains functional with an explosive atmosphere present Category M2: group I equipment, for mines, which is intended to be de-energised in the event of an explosive atmosphere According to these categories, TC31 and its subcommittees have produced the following standards on the basis of old ones if any.

V.I Category Ml, equipment for mines endangered by firedamp

A joint working group, formed under the guidance of CENELEC TC 31 and CEN TC 305, has prepared a standard for Category Ml. This standard, the EN 50303, applies to electrical and non-electrical equipment used with the presence of an explosive atmosphere.

The requirements of this standard assume:

The required level of protection in the event of two faults occurring independently of each other. For electrical equipment this requirement is met by using Intrinsic safety "ia" or, The required level of protection by using two independent types of protection. Electrical equipment shall also meet the relevant requirements of EN 50014. This standard is harmonised.

V.2 Category 1 G

The EN 50284 contains the requirements for equipment intended for use in areas, in which the explosive atmospheres caused by flammable gases or vapours are present continuously or for long periods. It is based on the same principles as those defined in EN 50303. Electrical equipment shall also meet the relevant requirements of EN 50014. This standard is harmonised.

V.3 Categories M2 and 2G, 3 rd editions of EN 50014 series

The second edition standards, which represent the state of the art, form the basis of the third editions. No major technical changes are needed for compliance with the essential safety requirements given in the directive. Some non-technical changes have been necessary. They have been introduced by interface document in the form of an amendment to the second edition. The third editions comprise this interface amendment. The status of these editions is, for the time being :

V.4 Category 3G

The EN 50021:1999, gives the requirements for category 3G equipment (for zone 2). This type of protection, called type "n", comprises non-sparking equipment and the classical types of protection. The required level of safety is assumed in normal operation. This standard is a stand-alone document.

It is a harmonised standard.

V.5 Category 1,2 and 3 for combustible dusts

The TC 31 has also drafted standards for equipment used in potentially explosive atmospheres caused by the presence of combustible dusts. It exists one standard, the EN 50281-1-1: 1998, for the design and construction of electrical apparatus. The protection is based on the dust tightness of the enclosure surrounding the equipment and the limitation of surface temperatures. Another standard, the EN 50281-2-1:1998, specifies the determination of inflammation temperatures of combustible dusts. These standards are harmonised.

Note: IEC is preparing standards applying types of protection normally used in gas explosive atmospheres (i, m, and p). These standards will be probably adopted as EN standard according parallel voting procedure.

V.6 Harmonised standards for the detection and measurement apparatus of combustible gases (or oxygen)

EN For combustible dusts, the EN 50281-1-2: 1998 specifies the requirements for the selection, the installation and maintenance of electrical equipment for use in the presence of combustible dusts. A draft standard, the prEN 500281-3, tells about the classification of hazardous areas caused by flammable dusts. This draft has been adopted according the Unique Acceptance Procedure (UAP) and will probably be issued at the beginning of 2002.

VII COOPERATION WITH IEC

In September 1996, IEC agreed with CENELEC on the co-ordinated development of new standards in order to increase the efficiency in preparing standards, called the Dresden agreement.

To avoid duplication of the work, the standardisation shall be done only one time by only one organisation. This agreement introduces the parallel voting procedure in IEC and CENELEC. This means that the same document is submitted simultaneously to IEC (in order to have an international standard) and to CENELEC (in order to have a European standard). After voting IEC and CENELEC standards will be published ideally at the same time and identical. But nevertheless, European national committees could formulate a different vote in IEC and in CENELEC.

If members of CENELEC identify a need for a European standard they shall inform IEC in order to start the work at IEC level. CENELEC members could also start the work in CENELEC Technical committees. In this case, when the CENELEC draft arrives at the approval stage, it is proposed to the IEC as an international standard draft.

In the area of explosive atmospheres this has worked well. Technical progress has been made in both sets of Standards over the years and where full agreement could not be reached alternative test methods or requirements were included in the IEC standards.

VIII ROLE OF CENELEC TC31 IN THE FUTURE

Tendency in industry go just one direction: the global market and the abolishment of trade barriers. This requires the availability of globally harmonised standards and rules to avoid inconsistencies of the increasing global trade. It is easy to understand that the provision of just one system for the design, construction and use of explosion protected electrical apparatus incorporates benefits for manufacturers, users and finally the consumers.

The CENELEC TC31 experts are globally recognised. The future role of this TC will be the co-ordination of our standardisation activities in the IEC Maintenance Teams in order to provide their experience to other experts and to articulate the European interest.

It is very important to keep influence on the development processes. The sophisticated European system in this industry field would react very sensitively if the future international standards and rules raise conflicts. Insofar the involvement of European experts is essential to avoid inefficiency by implementing the necessary globally harmonised rules.

We will enjoy sooner or later CENELEC standards which do not contain any National Difference to the IEC standards. The well known series EN 50014 will be superseded by the series EN 60079-0. This big step is to compare with the first edition of the CENELEC standards 1977 superseding national French, British, German, ... standards.

Together with the new option of a Zone classification in addition to the Division system in North America, time is come to agree on an International System of Standards and Certification (see Annex 1, Non-paper for the purpose to discuss this issue in Europe). In a consequence our European TC31 needs more than ever persons who see the need of European activities and who share the vision of one global approach concerning design, engineering, installation and use of electrical apparatus for explosive gas atmospheres on the excellent European safety level.

ANNEX 1: International development in certification of explosion protected electrical equipment

General aspects

The certification of products which are special designed and manufactured to avoid ignition hazards in chemical and petroleum industry is required in many countries. National laws and regulations emphasize the need of domestically recognized notified bodies. This situation makes it very difficult to open markets for free trade of explosion protected electrical equipment which is, considering recent development, against the interest of industry.

Users in the chemical and petroleum industry act more and more global with a uniformed engineering of their plants • to earn savings of engineering, installation and maintenance costs • to buy the equipment in a larger number and to get a better price per piece • to have benefit from the competition under manufacturers. Barriers against this tendency are domestic rules and regulations which require special engineering from country to country.

Manufacturers want to sell and manufacture their products without additional national certification if the prototype is tested once. In other fields of products (e.g. medical devices) mutual recognition agreements (MRAs) help to abolish such trade barriers by recognizing the specific national way 'all in one' to allow the market access for this kind of the products. For explosion protected electrical equipment this 'all in one recognition' seems to run in many conflicts and needs tremendous long time without guaranty of success. Numerous MRAs are necessary to cover the interesting markets in order to satisfy the interests of the manufacturers which requires many resources to manage such a global system of MRAs.

Aspects to modify the existing situation

The users and manufacturers complain about the present situation and require to harmonize national regulations. Supposing • The use of the relevant IEC standards (written down by best recognized experts of the world) and approved by the ATEX-consultant as EN standard and supposing • the influence of the national authorities on the rules of a global certification scheme it could be considered by the European Commission to step in a global approach without running in the risk to loose control on the safety level in the European Union. This makes sense especially for the explosion protected electrical equipment because of the parallel voting and zero difference between IEC and CENELEC.

The Existing European scheme

The European scheme started in 1976 as the group of 'Heads of Test Laboratories (HOTL)' and is established now as the Ex Notified Body Group (ExNBG). Reflecting the existing ATEX system the following three key elements are needed as a guideline for the 'Global-ATEX-system': • a procedure to recognize a standard as applicable because it covers the ESRs of the Diective 94/9/EC • a procedure for a product oriented production audit in the factory, conducted by an expert for quality management systems and a technical expert who is familiar with the product • a notification procedure to recognize certification bodies and test laboratories.

Possible Conditions for a global scheme -reflecting IECExScheme

Recognizing certificates from a global scheme by the EU or a comparable governmental authority, benefits for the safety level should be felt. The genesis of the first global certification scheme (IECExScheme) happened under the strong influence of European experts. Therefore the above mentioned key elements are to find in the rules, enriched by the experience from the ExNB scheme. So it is required • to implement the relevant IEC standards with zero difference as a national standard • to run the scheme with detailed rules (documents IECEx 01, 02) governed by the national committees • to run an accreditation procedure with notified technical experts for certification bodies and laboratories under the rules of ILAC (ISO/IEC 17025:1999, ISO Guide 65) and with a final vote by the national committees about the acceptance of the audit results • to endorse an IECEx certificate of conformity only if a detailed evaluation record is compiled in a clause by clause basis along the standard and only if a production audit on site focussed on the product (in analogy to the ATEX production audit guidelines) is conducted by a technical expert • to form a board of appeal for managing and solving appeal cases in an acceptable time.

Conclusion

There is a need for making a step ahead in the field of explosion protected electrical equipment to a multilateral scheme. An important condition is that there is no critical impact on the existing ExNB group. EU needs the group because they are exclusively permitted to perform product evaluations in accordance to the ESRs of the Directive 94/9/EC without addressing a standard. The non-electrical equipment category 1 is to be certified by this group as well, based on CEN standards.

So it could be a good idea • to see the relevant IEC/EN standards for electrical equipment as a hundred percent match of the Directive 94/9/EC • to see the IECExScheme as a hundred percent match of the requirements for the notification procedure of Notified Bodies in accordance to the Directive 94/9/EC, considering the strong rules.

11/128

To become involved in the evolution of the IECExScheme the rules could foresee an official status (e.g. an advisory committee) of the representatives of the National Authorities. This has to be discussed with the IEC CAB which is very open for such an approach. Until this is implemented, the EU Commission, OSHA and similar authorities can send observers (e.g. EU the ATEX consultant) to the annual meetings,.

In this context it is to remember the situation around 1975 in Europe when the first 'Old Approach Directive 76/117/EEC made it possible that BASEEFA certificates got the same status in Germany like BVS or PTB certificates. This was a big step for Europe at that time. To get control on global acting schemes seems to be a good reason to join in an early stage: to have opportunity to design the scheme and to set the basic conditions before others do it.

12/128

Under approval before harmonisation (amendments and/or 3 rd editions)

	EN 50 016	Electrical apparatus for potentially explosive atmospheres
		Pressurised apparatus 'p'
	EN 50 020	Electrical apparatus for potentially explosive atmospheres
		Intrinsic safety 'i'
	EN 50 028	Electrical apparatus for potentially explosive atmospheres
		Encapsulation 'm'
	EN 50 039	Electrical apparatus for potentially explosive atmospheres
		Intrinsically safe electric systems 'i
	Harmonised standards
	EN 50 014: 1997	Electrical apparatus for potentially explosive atmospheres
			General requirements + Amendments 1 and 2
	EN 50 015: 1998	Electrical apparatus for potentially explosive atmospheres
			Oil immersion 'o'
	EN 50 017: 1998	Electrical apparatus for potentially explosive atmospheres
			Powder filling 'q'
	EN 50 018: 2000	Electrical apparatus for potentially explosive atmospheres
			Flameproof enclosure 'd'
	EN 50 019: 2000	Electrical apparatus for potentially explosive atmospheres
			Increased safety 'e'

  The introduction of the ATEX Directive, which is a legal document, required a change in philosophy regarding European Standards. It was decided by CENELEC to put a pause, for a short period, on the parallel voting procedure to allow the TC31 Committee to bring forward suitable Harmonised Standards under the Directive.As we have now nearly all of them, this procedure has been reintroduced this year. However, this procedure foresees the assessmentof IEC drafts in accordance with the Essential Safety Requirements (ESR) of the Directive 94/9/EC.The ATEX directive is a legal document and takes precedence over any Harmonised Standards. The experts have to know this fact when writing a standard. It is up to the European experts to bring the different concepts and ideas into the IEC Maintenance Teams. It has always been a two way process and should continue in future years to that measure. With the development of IEC for Certification to Standards for Electrical Equipment for Explosive Atmospheres (IEC Ex Scheme) it is essential to continue the joint development work in order to have EN standards very close to IEC standards.


J Chaineaux

L Perrette Ineris, Bp

F-60550 Verneuil

En Halatte

Implementation of Directive 1999/92/EC : some concerns for the definition of ATEX zones

Directive 1999/92/EC [1] is to be implemented within a year. It requires the determination of hazardous zones where an explosive atmosphere (ATEX) may occur. This zoning is expected to be accurate. So is to be the evaluation of effects associated with an ignition of the so defined ATEX zones. Hence, Physical phenomena which are involved in the formation of ATEX must be taken into account and quantified : leak and vaporization of a flammable liquid, leak of a flammable gas, dispersion of a layer of combustible dust. It is not recommended to oversize a zone, nor to design a zone having such a small volume that the effects of an ignition would be negligible.

Introduction

Directive 1999/92/EC defines minimum requirements which every employer must apply for improving the safety and health protection of his workers potentially at risk from explosive atmospheres (ATEX).

Every employer shall assess specific risks arising from an ATEX, by taking into account (article 4) :

the likelihood that an ATEX will occur and its persistence, the likelihood that ignition sources will be present and become active and effective, the installations, substances used, processes, and their possible interactions, the extent of the foreseeable effects. He must classify places where ATEX may occur into zones, on the basis of the frequency and duration of the ATEX (article 7), in accordance with the following classification (annex I) :

Zone 0 or 20 : place where an ATEX is present continuously or for long periods or frequently, Zone 1 or 21 : place where an ATEX is likely to occur occasionally in normal operation, Zone 2 or 22 : place where an ATEX is not likely to occur in normal operation but, if it does occur, will persist for a short period only.

How to define ATEX zones ?

Effects resulting from an ATEX ignition must be evaluated. These effects strongly depend on the volume of this ATEX (especially when the volume of the ATEX is large in caparison with the volume of the containment). Thus it is important to evaluate as precisely as possible the dimension of each zone where an ATEX is expected to occur.

To do so, physical phenomena which are involved in the formation of the ATEX must be understood and quantified.

Evaluation of the volume of ATEX zones

Case of an ATEX generated in free air from a pool of flammable liquid Phenomena involved in the generation of an ATEX are the following: vaporization of the liquid, mixing of the vapour with air. The vaporization of the liquid produces a flow of molecules evolving from the liquid surface ; this flow mainly depends on : the liquid temperature, the area of the pool, the heat transferred from the ground, and the air movement above the liquid surface. If the temperature of the liquid is not sufficient, an ATEX cannot be formed : typically, an ATEX can only occur above a liquid if its temperature is higher than its flash point.

If the air above the liquid is perfectly calm, the mixing of the vapour with air is only due to diffusion which is a very slow phenomenon : theoretically, an equilibrium between liquid and vapour could be reached, producing a homogeneous ATEX in the whole containment. The ATEX vapour content relies on the liquid temperature. The larger the volume, the longer the time it would take to reach such equilibrium.

Actually, equilibrium conditions can hardly be met. Indeed, the air movement above the liquid (due to forced or natural ventilation) would drag vapours and dilute them in such a way that no more than an inhomogeneous ATEX could be formed at the liquid surface.

Mathematical models can calculate the following parameters as a function of liquid temperature, pool area and air speed above the liquid surface : the liquid vaporization rate, the ATEX volume and shape.

Moreover, by taking into account the value of the vapour lower explosibility limit (LEL), it is possible to calculate the air flow conditions for which a forced ventilation of the containment is able to : prevent the presence of any ATEX in the ventilation network, limit the volume of the ATEX above the liquid surface at such a level that this place would not be considered hazardous anymore.

Case of an ATEX generated from a leak of flammable gas

Phenomena involved in the generation of an ATEX from a leak of flammable gas into free air are the following : discharge of the gas as a jet, mixing of gas with air. The mixing of gas with air depends on the nature of the jet : according to its low or high speed, the jet may be respectively laminar or turbulent.

Jet speed mainly depends on the absolute pressure in the containment out of which the gas is leaking : if this pressure is higher than 2 bar, the jet is hypercritic and surely turbulent.

If the jet is laminar, the mixing of gas with air is only due to the diffusion, which is driven by buoyancy forces depending on the difference between air and gas densities : a light gas (hydrogen, methane...) will disperse upwards, while a heavy gas (propane, butane...) will disperse downwards. The movement of air close to the leak can also influence the dispersion of the gas.

If the jet is turbulent, the mixing of gas with air occurs within the jet itself. Mathematical models can calculate, as a function of the nature and the pressure of the gas and of the cross section of the leaking orifice, the following parameters : the gas flow, the distance from the leaking orifice where the LEL is reached on the jet axis, the volume of the ATEX Generally, in process buildings, a flammable gas is fed to equipment (burner, oven...) by a low pressure pipe network (eg. pressure slightly higher than atmospheric). Gas leaks must be considered possible. However, if the network is only made with rigid elements and soldered fittings, the leak orifice is more likely to have a very small cross section, lower than 1 mm 2 (a leak cross section equals to that of the pipe would correspond to an unlikely catastrophic rupture of the pipe).

In such a case and if the jet does not impinge any obstacle, the LEL is reached on the jet axis at a distance less than 20 cm from the leak orifice and the volume of the ATEX is smaller than 1 dm 3 .

Moreover, it must be pointed out that this volume remains constant, as long as the leaking gas is mixed with plain air. Indeed, a mixing with air progressively enriched with combustible gas would steadily lead to an ATEX volume increase.

Finally, the volume of an ATEX generated from a slightly pressurised source discharged into free air through a small orifice is small enough so as to be considered non-hazardous.

Case of an ATEX generated from a layer of combustible dust

The only phenomenon involved in the generation of an ATEX from the dispersion of a layer of dust is the blowing of the dust by an air flow. This flow shall be strong enough to lift the dust and mix it with air.

A very thin layer is able to give rise to a large volume of ATEX : for example, if the LEL and specific gravity of the dust are supposed to be 40 g/m 3 and 1 g/cm 3 respectively, a layer having a mean thickness of 1 mm and covering an area of 1 m 2 is sufficient to form an homogeneous ATEX of 25 m 3 at LEL.

Then, it appears to be awkward to evaluate precisely the volume of the ATEX which can be generated by blowing a layer of dust.

Some concerns for the classification of ATEX zones

It is clear that the classification of ATEX zones (or zoning) is an important stage of the implementation of the Directive 1999/92/EC. Indeed, the extent of measures to be taken in accordance with the minimum requirements for improving the safety and health of workers potentially at risk from ATEX is bound to this classification.

One may think that it is safer when : a zone is classified at a level higher than the real one (eg zone 1 or 21 instead of 2 or 22, or zone 2 or 22 instead of non-hazardous place), or the volume of a zone is oversized. On the contrary, some examples show that such a zoning is neither safe nor recommended.

st example : case of a spray booth for powder coating

In the draft standard prEN 12981 : 2000 [START_REF]Coating plants -Spray booths for application of organic powder coating material -Safety requirements[END_REF] , entitled "Coating plants -Spray booths for application of organic powder coating material -Safety requirements", the following schematic related to hazardous zones, for an enclosed recovery system, is given in the figure A2 of normative annex A, which is shown thereafter. The drawing shows that the whole volume of the spray booth is suggested to be zone 21.

,-Am

However, this proposal does not match the definition of zone 21 given in the Directive.

Indeed, in normal operation, there is a forced ventilation inside the booth which drags and dilutes unused powder particles : so, it is only in the case of a ventilation malfunction that there could be an ATEX throughout the cabin. This failure should lead one to classify the inner volume of the booth as a zone 22 rather than 21.

Another possibility consists of fitting the booth with a secured ventilation or with an automatic safety device which switches the powder gun off whenever ventilation stops. In this case, the inner volume of the booth would then become a non-hazardous zone.

The decision to classify a place as an hazardous zone 21 or 22 or as a nonhazardous zone is paramount since the zoning determines "the extent of measures to be taken in accordance with annex II part A" (ie. minimum requirements for improving the safety and health protection of workers potentially at risk from ATEX). This particular matter is stated in the preliminary note of annex I of the Directive.

If the inner volume of the booth is classified as a zone 21 or 22, it means that, if an ignition source is present, an explosion could occur within it : then, it would develop an overpressure high enough to produce damaging effects, not only within the booth itself, but in its surroundings as well. Thus, if ignition sources cannot be under control, it would be necessary to fit the booth with a protective device (eg. explosion venting).

Another example would be the conical spaces shaped by the powder sprays. ATEX are likely to be found within these spaces. Hence, each cone volume would be entitled for a zone 20 or 21 classification.

But the classification should be decided after having taken into account the first preliminary note of annex I of the Directive 1999/92/EC, which states that "a place in which an ATEX is not expected to occur in such quantities as to require special precautions is deemed to be non-hazardous within the meaning of this Directive". Hence, the folio whig question has to be answered : what could be the effects of an ignition of the ATEX contained within a cone ?

The volume of cones should then be compared with the volume of the whole booth, in order to evaluate whether the explosion could have a significant or negligible effect so as to decide if cones should be classified as a hazardous zone (20 or 21) or a non-hazardous one.

2 nd example : case of premises When combustible dusts, gas or vapours are processed within a premises, one has to answer what the zoning of this premises has to be. This choice is based on a thorough study of normal use or malfunctions, leading for instance to leaks of combustible material into air.

Such a study is likely to split the premises into different zones in regards with the risk of creating and igniting an ATEX.

However, a rapid assessment could lead to a single excessive zoning throughout the premises. Such an approach does not meet the Directive expectations. Indeed, it does not highlight health and safety at work issues.

It only presents a broad pictures that tends to overestimate risks without pointing out the main concerns for workers.

Such an adverse implementation of the Directive is likely to be seen in industries where electrical equipment standards were beyond practices in usual industries. Petroleum industries is an example. In that particular case, it could be tempting to match zoning with existing electrical equipment categories. In doing such, one would fail in assessing workers exposure to potential ATEX.

This unwanted situation could also be seen in places where no or very few electrical / mechanical equipment are in use. In such places, a rough assessment could be favoured since it has no or a limited impact on new and appropriate equipment investment.

Main differences between the control of major-accident hazard involving dangerous substances Directive 96/82/EC and the 1999/92/EC Directive

The major-accident hazard control Directive 96/82/EC (Seveso directive) focuses on the environment (people, properties,...) whereas the ATEX one focuses on workers. Both are concerned with effects of explosions.

A risk assessment carried out within the scope of the Seveso Directive would consider and evaluate the effects (thermal, overpressure, fragments) of an explosion on the surrounding of the industrial site. If these effects turned to be unacceptable, mitigation measures (organisational and technical barriers) will be amended. Among those, explosion venting of a premises can be decided so as to control missile effects,... . Such a conclusion would neither be suitable nor sufficient for an ATEX Directive approach. Indeed, this measure does not evolve from an health and safety at work risk assessment : the venting of the premises does not prevent in any way workers from being injured or killed.

A more appropriate approach in line with the ATEX 1999/92/EC Directive philosophy would rather lead to the reduction of ATEX volume and therefore potential damages.

There are real differences between the objectives of the Directive 1999/92/EC and the directive 96/82/EC. Employers must not be mistaken. Implementing the first one does not mean that expectations of the second one are satisfied. Both approaches have to be implemented.

Conclusion

For implementation of Directive 1999/92/EC, employers have to evaluate volume of places where ATEX can occur as well as effects triggered by the ATEX ignition.

In order to perform an evaluation as accurate as possible, it is necessary to take into account real phenomena which are involved in the generation of ATEX.

By doing so, it makes it easier to take advantage from the first preliminary note of annex I of the Directive, which states that "a place in which an ATEX is not expected to occur in such quantities as to require special precautions is deemed to be non-hazardous within the meaning of this Directive".

Finally it may not be safe nor appropriate to oversize ATEX zones. What seems to be safe and relevant consists in : first, taking prevention measures, in order to minimise or clear ATEX zones, then, taking mitigation measures, dedicated to prevent ignition sources and to protect workers from harmful effects of explosions occurring in ATEX zones.

Figure 1 -

 1 Powder spray booth with enclosed recovery system


E Plot

J C Le-Coze

An integrated approach to organise major risks control in hazardous chemical establishments

In the field of risk prevention, research is often divided or partial. Research work -achieved or in progress -focuses on topics like technical risk assessment, organisation management or human factor : ergonomics, sociology, etc. But little work is dedicated to an integration of all these disciplines into a same methodology.

It is yet obvious that an effective control of major accident risks depends on the ability of an organisation to consider and integrate every aspect of prevention. A separate control of either human factor, or safety technical barriers, or safety management is of course necessary, but does not guarantee a sufficient prevention level on its own. Effective prevention requires the control of every means available.

From this statement, INERIS has started developing an original integrated method to control major accident risks of hazardous establishments under the scope of Seveso II directive. The method is currently tested with voluntary French SEVESO II establishments.

Introduction

In January 2002, the European commission released the following statistics: the probability of am accident is 3 x 10-3 y-1 in industrial installations under the SEVESO II directive. It means concretely that for approximately 300 hundred installations, there is an accident per year. In most of the cases, accidents are described as having a close human or organisational components into it. Indeed, in May 1998, the MARS database, in charge of collecting major hazard within the European community indicates that the human contribution represents 64% of root causes of the declared accidents. These causes can be divided among operational errors or organisational issues. These cover different origins: inappropriate or non existing procedures(13%), bad design of interface (12%), lack of analysis or bad knowledge of the product in use (10%), error due to bad contractors management (10%), device failure following a maintenance operation (9%). These data clearly indicate the weight of human and organisational factors for the major hazard control.

The major accident analysis like the researches done on Bhopal, Flixborough already pointed out these factors, and this has been again recently emphasised after the AZF chemical installation that exploded, in Toulouse, France, in September 2001. The official commission concluded that, among many other propositions, the defence in depth concept could be applied to chemical plants and that the human factors and the organisation were key elements of this principle.

Today industrialists et authorities need methodologies and new tools, integrating the human factors, the organisational issues as well as the technical aspects in order to identify the major hazard risks, to design and improve sociotechnical systems they have in charge, assess their performance and learn from incident and accidents.

1. Meeting the requirements of regulations and facilitate the application of the law

Linking technical risk analysis and organisational features for the compliance

The first objective of that project is to suggest a method that meets the legal requirements of the so called European SEVESO II directive, translated in the French system through the "arrêté du 10 mai 2000", concerning the installation that have the potential for major hazards. That document requires the industrialists to implement a safety management system, depending on threshold of dangerous chemical products. The safety management system must contain several items:

-Structure and training -Identification and evaluation of major hazards -Control of process and operation -Management of change -Emergency planning -Learning from experiences, -Inspection; audit and management review This method describes the activities required for major hazard prevention. It is believed that such a representation can facilitate the design, the implementation and the assessment of a safety management system that will meet the SEVESO II criteria. The way these activities are combined is shown in the next figure (figurel).

There are 3 levels:

1. The starting point is the risk analysis activity. It identifies and assesses the major hazard scenario to be controlled.

Along with the identification of the major hazard scenarios, there are the related functions that ensure their prevention and mitigation, they could be described therefore as critical for safety, and therefore be identified as barriers.

These critical functions can be met by critical technical devices (like an automatic shut down valve) or by critical activities (like the action of an operator who pushes a button).

The device chosen for the critical functions are specified by technical requirements that describe their specifications.

Figure 1 safety management representation

The critical activities depend as well on technical requirements. "Technical" because the actors in charge of ensuring the fulfilment of the critical activities always make use of methods and tools, like the procedures describing the way operations should be carried out, like the action of pushing a button, and these are, in that sense, considered as depending on technical requirements. The pushing button and the method here are seen as a technical assistance for the activity of the actor.

These technical requirements rely on the ability of the organisation to properly buy, install, implement, operate, and maintain them. This ability is seen as the activity of technical requirement management.

Along with the technical requirements, there is the ability of the organisation to provide appropriate means for the co-ordination and the competence for the critical activity. The co-ordination is defined as the distribution of role and responsibilities, the communication and the decision making process at the level of the activity. The competence is described as the knowledge and know-how, and the behaviour (related to safety culture and risk sensibility). In an organisational perspective, the co-ordination and competence are seen as risk and performance factors.

They both rely on the organisational means, as distinguished on the figure from technical requirement and technical requirement management.

2. The second level is under the dependence of what has been defined as the support activities. These indeed provide all the necessary inputs for ensuring appropriate level of co-ordination, and of competence as well as for ensuring the activity of technical requirement management. It implies the definition of role and responsibilities, the training, the document and information management.

3. The last level contains the learning from experience, the monitoring, the auditing and reviewing activities. These are seen as the overall management activities. At the left bottom of the figure there is the management of change activity. This is a crucial activity as the change can affect the initial risk analysis, and imply new barriers implementation like new activities or devices.

The Level 2 and 3 ensure the continuous improvement of the safety management system.

Such a method couldn't be complete, as it describes a really complex system, and it is acknowledged that some points are missing:

-The support activities ensure for themselves, for the management of change and for the overall management activity, the organisational means, -The overall management activity ensure the continuous improvement for themselves, for the support activities and for management of change activity, -The overall management activity and management of change use technical assistance that needs to be managed, by technical requirement management.

For implementation purposes, the first level is described through the use of matrixes. The first matrix divides the critical (safety) function into the chosen activities or/and devices. The second one introduces the technical requirements, as described earlier, associated with the activities and devices selected. The third one can for example put together the critical activities along with the organisational means required to fulfil the activity. These three examples (tables 1,2,3) illustrate this.

Critical functions

Activity or devices The following picture (figure 2) represents an example included in the figure 1.

Activity 1 Activity 2 Device 1 Device 2 Function 1 X X X Function 2 X X

Action of pushing a button technical nssistdnce : pushing button IPBI

Safety key activities

Support activities

Management activities INERIS / DRA

Figure 2: application of the method to a critical activity Remarks: First, this method is not based on health and safety approaches that consist in analysing risks at the level of the operator. The method starts with the risk analysis made in a major hazard perspective, namely based on combined risk analyses approaches like HAZOP for Hazard operability study, and PRA for preliminary risk assessment for example. Secondly, it is based on a process approach that consists in decomposing the activities of the organisation. A process is seen as a system of activity that transform inputs into outputs using resources and constraints. The final outputs are hence in our case, the critical functions defined by the risk analysis.

One of the objectives of this method was to provide a structured way of implementing a safety management system, for the compliance with the SEVESO II requirement. This table (table4) shows how the method fits in the SEVESO requirements.

INERIS method

Risk analysis activity

Critical functions (all life cycles)

Different uses

Actually the MIRIAM model can be applied for three different uses:

«» It provides a guide for the implementation of a safety management system by visualising the combination of activities that are required to build the system. From the risk analysis defining the critical functions decomposed in critical activities (including technical assistance) and critical devices. The technical requirements and organisational means both specify what are the specification of these. The technical requirements rely on the activity of technical requirement management. All these are ensured by appropriate support activities and by the overall activities management.

• It defines the activities linked with the risk analysis that need to be checked through a external or internal audit.

• It provides a frame for learning from experience, as it describes what are the activities that must be implemented to ensure the risk control, from a risk analysis focused on major hazard prevention. Indeed, once the accidental scenario has been described, it is possible to search for what activities have been inappropriate. In order to do so, it is possible to follow the modelling and see what went wrong. A basic first representation is proposed (figure 3) The research works on organisational reliability describe that the core issue is the complexity of the sociotechnical systems, that must be controlled. What is complexity? There is a wide range of definitions, it is possible to simplify by saying that a system is complex because there are unpredicted events or even unpredictable events. These unpredicted events are significant events for safety as there is no designed alternative built to take into account the unpredicted event. This is a problem for safety as their treatment needs to be ensured, especially in hazardous installations.

The factors influencing the presence of unpredicted events are numerous. They are linked to the features of socio technical systems.

The consequence of this is that compliance with safety management system is a first requirement, but because of these unpredictable events generated by the complexity of the systems, more is needed. It is argued here, for this precise reason, that compliance doesn't always guarantee effectiveness.

How integrating human behaviour?

The unpredictable events lead to the following findings.

First, automation requires the human intervention for these unpredicted situations, so that the automation can't be seen as the solution for safety. It could be said in that sense that the human activity allows to make work technical systems that do not work always as intended, and therefore that shouldn't be completely automated.

Secondly, the procedures do not cover all the situations that can arise. It must be acknowledged that working instructions won't be exhaustive, as the context and problems widely vary due, for example, to unpredicted events described here.

The unpredictability of events puts the supervision in a difficult situation, as everything can't be written. All situations can't be described and the supervision is therefore not able to foresee exactly what will be done by the operator. Everything can't therefore be centralised, and a sort of decentralisation is necessary. It implies that in order to find the solutions to the various situations that can be encountered due to unpredicted events, the autonomy of the actors is necessary.

It doesn't mean that the work is considered as being free from planning and monitoring, this remains an important feature of the will to make as rational as possible the way an organisation works. However it is stated that in a complex environment like an organisation in a chemical plant, the supervisors can't control all situations.

The level of safety is based on the co-operative behaviour of the actors who create the necessary synergy to treat and combine information, mental representations, and skills ... for managing this complexity and react accordingly to unpredicted events. A temptation and mistake would consist in trying to rationalise and structure the work through a theoretical frame that would be too general, how much precise it could be. More over, it would be wrong, in such a context to think that every organisational problem comes from the personnel attitude.

This necessary autonomy is implicitly acknowledged by industrialists when in very prescriptive companies, the actors have still a freedom margin and more over, have been asked to use their autonomy to adapt to situations that procedures can't describe. The actors who play a role in safety must comply with procedures but must apply them cleverly. This type of autonomy raises however the question of how to, somehow, "control" it for safety purposes.

The solution consists in implementing performance factors, tailored to the human behaviour (which is free by definition). The method suggests to read each critical activity of a safety management system as described in the following figure (figure 4): The entering point is the strategy that can explain the behaviour of the actor. A strategy is namely that an actor is able to find some solutions to the problems he encountered, the result of this being its behaviour. The strategy means that humans are free and is therefore opposed to the idea of a "programme". Thus, their behaviours must be understood through the solutions they found for solving their problems (the sources of this strategic approach is found in sociology and especially in the works of J.Baechler, "Nature et Histoire", 2000, PUF). This is a fundamental point. Thinking about actors not as "programmed" or "determined" is important. It implies that what is required is to look for the factors which influence their behaviour, but without pretending that it is possible to predict them, it is an inductive approach.

Such a way of looking at the organisation leads to find solutions of constraints and resources which defines these unwritten rules of the game of the organisation. If they create appropriate safety practices (represented on the right of the figure), they are described as performance factors, and if they lead to unsafe practices they are called risk factors.

The first part is therefore to qualify the part 1 of the figure. It corresponds to a safety action identification along with the strategy that led to the safety action. The safety action is appraised according to the level of compliance with the critical activity (as defined in figure 1) but as well with the level of safety margin (autonomy) that is required for the unpredicted events that can arise.

The performance and risk factors are represented on the left of the figure 4, in the part 2. However, given the freedom of the actors, it is impossible to predict which are the risk and performance factors. Consequently, the identification of these factors, and thus the organisational solutions, must go back from the observed practices (good or bad with the safety action description) to the influencing factors, through the understanding of the strategy of the actor (from part 1 to part 2)

It is impossible to find the factors (the rules of the game defined by the resources and constraints) without looking first at the strategies developed by the actors that define the safety action.

Consequently, the method suggests three tools made of check list and methodological guidance for, in a first step:

-identifying the safety practices -analysing the actors strategies that could explain the practices and in a second step:

-identifying the risk and performance factors that influence these strategies A global assessment would therefore consist in applying this type of analyse of human behaviour to the three levels of the model (figure 1 and 2), from the risk analysis activity, through the critical functions to the support activity and overall management activity. IT should give a better understanding of how well the system works.

This could be illustrated by the following representation (figure 5), as a help to visualise what the method intends to do.

Roles and respomibitïtieà. document, svstems

Safety -! k action 2 Figure 5: the human behaviour analysis for all activities of the safety management system

Example

An example, which is summarised, is exposed here. This example is extracted from a real situation where operators are in charge of the control of chemical reactions. In that activity the main risk is the runaway reaction.

• First step: safety actions and rules associated with the strategies:

The rules in that organisation are: Rule 1 : Strict respect of procedures. Everything is written in the documents that describe the safety related activities. This documents can be procedures, but checklist too, that allows to strictly follow how to proceed. The enquiry shows that all this is well classified and that traceability of this activity is ensured. The company invested time and resources to achieve such a result. As the operational manager noted: "the safety principle of safety here is based on the existence of procedures and checklists. If these are followed, there is problem".

Rule 2 : Four monitoring levels of compliance with procedures. The rule 1 is assured by a monitoring of the operations in real time. This first type of control is allowed by the presence of a second person who checks what an operator does. That's the case for the chemical loading phase, where the quantities manipulated have to be precise. The second type of control is ensured by the traceability provided by the checklist filled through tthe first monitoring, and checked by the team leader (first supervisor). The operational manager (or second supervisor) reads them too, and that's the third type of monitoring. Finally, there are process parameters, which are used for the monitoring of the reaction, like temperature, pressure. The monitoring of products storage level against criteria defined by the quantity that should be used for the reaction, if there is a low quantity of product remaining at a certain point, it is probably that they used too much of these Rule 3 : The operational manager is the only one able to decide the solutions to bring to problems that were not planned in the procedures. The decisions are centralised. The operators must validate the action that does not comply with the checklist, exepted in emergency situation. The team leaders must validate their decisions with the operational manager before modifying the written practices.

Rule 4 : These three first rules do not cover every single situations, even if they seem appropriate enough for everyone. The real activity is not totally covered by the three rules described, and the operators find solution in such cases. This fourth rule gives the operators the right to organise their work. This situation is seen as a normal due to the necessity of the real activity. But obviously, some actors use this in a way that does not follow the "spirit" of the written rules, but still comply with the traceability requirement of the written rules (a good example here is the act of filling the checklist without actually doing it in real). Everybody knows this, though they don't like talking about it (especially the managers).

What can be said from his enquiry is that there is a good compliance in respect with safety needs and requirements: 1. Procedures are articulated according to risk analyses. 2. Procedures are applied.

But, the safety margin could be considered as insufficient because: 3. Procedures do not describe all the decisions / actions necessary to comply entirely with safety requirements. 4. Controls can easily fail or be enforced. 5. The operational manager must be warned on time, be given the right information, be available when necessary, and competent at any time (no redundancy)... 6. Team leaders and operators are not given the competence neither the right technical means to make their own careful decisions and then arrangements.

• Second step : identifying the risk and performance factors

The first part describing the rules leads to put in light the following performance and risk factors:

Factors linked to co-ordination :

1. Range of production limited can be controlled by only "one brain". 2. Hall of production easy to walk across, next to operational manager's office. 3. Lack of a real structure of responsibilities, lack of official acknowledged delegations, culture of intrusion into the delegations. 4. Very little communication between production unit and other directions of the establishment. 5. No place or structure dedicated to dialogue nor exchange of information and opinion.

Factors linked to competence : 6. Operators' competence is adapted to the detail of procedures. 7. Operators and team leaders lack of knowledge and information on the substances used onsite, the dangerous runaway reactions and the existing safety barriers chosen to assure safety (agitator in reactor...). 8. Lack of competence for the operational manager about the way to organise and control the actors' autonomy. 9. Lack of a safety culture : everyone seems satisfied with a situation not very careful.

Factors linked to hardware interface : 10. Procedures and control means are totally operational (use of specific checklists for each batch reaction). 11. Methods and procedures don't help operators make their own analysis of the situation and know their autonomy of decision.

The identification of these factors suggests some improvement proposals:

• Developing the competence of team leaders and operators through:

1. the explanation of the decisions of operational manager (namely the definition of daily production planning) 2. asking each operator to communicate two near misses per week. The most critical events should be tackled within the following month.

3. the contribution of each actor alternatively to a risk analysis. 6. the communication on safety, the necessary autonomy of the actors and the limit of this autonomy.

7. Re-placing to other functions the actors who are not able to develop enough their competence.

• Decentralising the decision-making and develop new kind of procedures through: 8. the evaluation of the actors on defined results instead of the strict respect of procedures (new kind of controls). 9. weekly « mini collective risk analysis » to account for all possible change in production, etc... 10. the development of new kind of procedures : operational procedures defining the limits of operators' autonomy, etc...

Conclusion

The aim of such a method is to be integrative, and to embrace several layers of analysis required by the multi dimensional origins of the accident, from the technical failure, to the human behaviour and the organisational context.

From a technical approach with the risk analysis of the technical installation to the organisational side of the assessment with the models developed here, this theoretical work carried out has proved so far to be efficient when it came to apply it on real cases. The next step is to develop further and enhance the validity and usefulness of the method for various users. This will be done through the testing of the method and through the opportunity of comparing the approach with other safety management models.

  Figure 4: A human behaviour analysis approach

  4. asking each actor to propose two ways of improvement per month ... They should be considered the same way as near-misses.5. Setting up a training programme with exercises about employed substances, accidents scenarios and safety barriers implemented.

Table 1

 1

	critical functions / activity or device

the human behaviour 2.1 Why integrating human behaviour?

	^	• •			Management of	Risk analysis activity
	<^	Identified scenario ?	-V		change activity	inappropriate
		"			inappropriate ?	(scenario
		Crncal activities/devices r -i n	»••	. " ''•'	i • ="•' "-*,.*"«.:.." MMMW in.-*.»-.-, .r-	identification) ? Management of -u -
	îai|l|re •			T	technical requirements
					I™-J •.	anc ^ organisational
					;	***	means inappropriate 7
		Risk analysis activity
		ina.^propriateidesign in the				Support and overall
		defence in depth principle)				management activities
						inappropriate ?
		YES
		NO		Figure 3 : Learning from experience application of the method
		2. Integrating


Dr Norbert Gonzalez-Flesca

A NEW LABORATORY TEST CHAMBER FOR THE DETERMINATION 0F DIFFUSIVE SAMPLER PERFORMANCES

A new laboratory test chamber has been developed at INERIS for thé détermination of diffusive sampler performance. It consists in a loop made of glass, stainless steel and PTFE containing thé référence atmosphère where diffùsive samplers are exposed. It is possible to accommodate several samplers simultaneousiy and simulate varions environmental conditions such as température, wind speed, wind direction, humidity, atmosphère composition, total pressure and exposure duration. Ail working parameters are continuousiy monitored. It is shown that certain environmental conditions can deeply affect diffùsive sampler performances. Thanks to thé technical solutions adopted for its design, mis chamber allows thé détermination ofdiffusive sampler performance in a wide range of expérimental conditions in compliance with thé new standards for thé monitoring of ambient air by diffùsive means.

INTRODUCTION.

Thé assessment of ambient air quality by diffùsive samplers, has been expanding continuousiy especially after thé publication of the EC Air Quality Framework Directive. Diffùsive samplers can be seen today as cost effective, sensitive and reliable tools for thé assessment of personal exposure and air quality in both indoor and outdoor environments. Standardisation groups CEN/TC 264 WG11 and WG13 hâve been working in two important standards (réf. 1-2). Thèse standards, should provide thé user of diffusive samplers with guidance and standardised procédures to make thé best possible use of thèse déviées. Part III of the EN 13528 standard spécifies that though performances of a diffùsive sampler can be determined theoretically, it is a good practice to détermine this experimentally in an exposure chamber where environmental conditions in which thé sampler is intended to be used can be reproduced. Exposure chambers should be able to:

-Accommodate at least several samplers for simultaneousiy exposure -Produce a continues référence atmosphère for a duration up to several weeks -Simulate variable wind speeds -Vary humidity and température -Provide equal loading conditions for ail samplers being exposed.

INERIS DEVELOPMENT

Supports:

Thé chamber bas been installée) vertically and is supported by a soldered steel frame. There is a movable section that can swing, leaving access to thé exposure area. An oscillating arm that is fitted with a preloaded spring (fig. 2) hoids this movable section. This mechanical arrangement facilitâtes thé opening of the chamber for thé introduction or thé removal of the samplers. Thèse samplers are attached to a basket made of stainless steel

Gas mixtures:

Thé contaminated atmosphère for thé exposure is prepared separately by continuous dilution of a more concentrated mixture. This dilution is performed with thé help of mass flow meters. Humidity is added by passing part of the dilution gas through a bath of HPLC quality water maintained at constant température. Typical concentrations of gas mixtures are in thé ppb range; theoretically however, any level of concentration can be reproduced. Thé diluted gas mixture is introduced into thé chamber at a flow rate of one to several litres per minute in order to replace thé total volume of the chamber (150L) several times a day and to insure that there is no significant depletion of the mixture concentration down stream thé exposure area. This is particularly important when exposing samplers that hâve high uptake rates.

Wind speed:

Any passive sampler has to be implemented with a device dedicated to prevent turbulent diffusion inside thé sampler air gap. This "wind effect", can be controlled by adjusting thé speed of a "model aéroplane " propeller located inside thé chamber. Since thé flow path is not straight, there is an undesirable jet effect up stream thé exposure zone. This difficulty has been overcome using a flow stabiliser. This device is a drilled polished stainless steel plate. Down stream this plate, thé flow is still turbulent but ail samplers are exposed to similar wind conditions.

Température:

One of the most attractive features of this chamber is thé possibility to work in a wide range of températures, typically from -10°C to +50°C. This can been achieved by thé use of double waiï éléments made of glass. A fluid is heated or cooled down in an extemal conditioner and drawn though thé double walls of the entire device. Thé necessary thermal insulation is composed of 52 spécial jackets made of polyurethane foam, Teflon and aluminium. Thé values of the uptake rates obtained in this experiment hâve been compared with those deduced from an other test carried out with thé same samplers under thé same conditions using thé NPL facility in thé UK (Ref.3). Thé différence observed on thé average was 12.5% Thé low relative standard déviation observed (2.9%), shows that samplers were exposed to very similar conditions in thé exposure area. Thanks to thé technical solutions adopted for its design, this chamber, allows thé détermination of difïùsive sampler performance in a wide range of expérimental conditions in compliance with me new standards for thé monitoring of ambient air by diffusive means.

Monitoring

Acknowledgements.

Thé author wishes to thank Armelle Frezier, Nathalie François and Jean-Claude Pinard for their technical assistance.

Références

Fig. 2

 2 Fig.2

Fig. l

  Fig. l

  After thermal desorption of the samplers and analysis of the benzène sampled during thé exposure, uptake rates were calculated. Resuîts are presented on table 1.

	:
	AU working parameters are continuousiy monitored:
	Températures, by Pt 100 probes.
	Humidity, by a capacity probe ( Hanna Instruments HI 916010 C ).
	Wind speed, by Annubar type probe (Diamond II, Dielerich Standard USA ).
	Total pressure, by an electronic manometer ( Fumess Ltd. ).
	Gas mixture flow rate, by mass flow meters ( Tylan type).
	Gas mixture composition: variable depending on thé compounds of interest e.g. Automatic GC+FID for
	hydrocarbons, Chem. Lum. Monitor for N02, etc.
	VALIDATION TEST
	Several Perkin Elmer type samplers (RPE) packed with carbotrapB hâve been tested under thé following
	conditions:
	Number of samplers n=9
	Type: RPE carbotrap B
	Température: 20°C
	Humidity: 50 %
	Pressure: 1 at
	Duration: 5.7 days
	Gas mixture: benzène in synthetic air
	Concentration generated: 4.19 (ig/m3
	Table 1. RPE tubes exposed to a concentration of 4.19 ug/m3.
	(V and H stand for vertical and horizontal respectively)
	Tube number	Position in thé chamber	Uptake rate ml/min
	A60829	7Vtop	0.42
	A60699	4H middie	0.42
	A49068	3V top	0.43
	A56116	2H bottom	0.43
	A57629	4Vtop	0.43
	A47625	5Vtop	0.41
	A31749	7 H middie	0.44
	A73374	6 V middie	0.41
	A35691	IV top	0.41
		Average (STD%)	0.42(2.9)

  . 1.-European standard EN 13528 Ambient Air Quality. Diffusive samplers for thé détermination of concentration of gases and vapours. Requirements and methods. 2.-European Standard. (In préparation) Référence method for thé détermination of benzène in ambient air. By thermal desorption and gas chromatography. Part 4. Diffusive sampling. 3. Evaluation des performances des préleveurs par diffusion pour l'analyse des BTX à l'air ambiant.Rapport INERIS. December 2001. 4.-The Diffusive Monitor, n°13 September 2002