Jean-Christophe Le-Coze
email: jean-christophe.lecoze@ineris.fr

Safety and security in the light of complexity

There exists a field of epistemology or philosophy 1 of complexity using contemporary scientific developments for questioning our relationship with reality, knowledge and science developments. This field is extremely stimulating and points at ways of thinking about safety science and risk management in general. This paper will elaborate on and present how the epistemology of complexity -focusing in particular in the challenge of articulating disciplines -offers concepts for tackling accident investigation and auditing of complex sociotechnical systems for at least two purposes worth discussing in light of complexity: safety and security.

The discussion will be based on the presentation of Morin's "complex thought", and case studies presented in previous papers which develop these ideas but also from past and current research (since 2000) for the environmental French ministry as well as consulting works for the industry currently carried out by INERIS. This paper will therefore specifically address the issue of modelling (describing, explaining, interpreting, predicting) complex systems for safety and security purposes.

INTRODUCTION

Complexity

Complexity is more a problem than a solution, however it helps a great deal in asking some relevant questions. The developments of philosophy of complexity, and of science of complexity, as developed for example by Morin, find their root in some questions raised after some main scientific revolutions. As the literature dealing with the status of science has shown it, some key questions have been raised following revolutions in natural science as in relativity, quantum physics but also following the assumption of big bang in cosmology (introducing the history of cosmos). Earlier, thermodynamics had created a breach in the deterministic view of the world (especially by questioning the reversibility of time that the Newtonian science implied). Thermodynamics led to further developments as for example in chemistry with the second thermodynamics dealing with dissipative structures (revealing properties of self organisation of matter) and later chaos theory, both introducing questions regarding the status of determinism and reversibility of time.

In science of life, open systems were opposed to the thermodynamic principle of entropy (maximum of disorder) because biological systems exhibit organisational patterns (as dissipative structures in chemistry do) when "fighting" against entropy (leading to maximum of disorder, dispersion). These systems are open to their environment, organised and have purpose, for which feedback principles are key for understanding their nonlinear behaviour, and circular causality. They were therefore opposed to the principle of ext ernal causality, by introducing teleology (goal, purpose) and opposed to the principle of decomposition (found in the reductionist perspective and also in the analytical principle). They imply control and command and information (both quantitative theories of information and symbol treatment). These were features introduced and also therefore found in engineering, with cybernetics 2 . All these developments were made earlier or in parallel with the principles of self organisation, explaining better the creative side of the biological world, but also being the result of emerging features ("the whole is more than the sum of its parts") without external written plan, or without centralised control dictating behaviours of parts. This type of understanding is linked with the idea that the atoms, the cells, the organs, the brain, the human and the societies, are emergence of levels of organisation that can't be reduced and deduced from the level before, but reveal themselves through self organisation and evolutionary principles. The systemic approach (rooted in cybernetics and general system theory) and complexity ideas (more rooted in self-organisation) are therefore intrinsically linked. These ideas of self-organisation and systems were and are also developed in a century where the Darwinian theory of evolution flourished in many ways along with the concepts of ecology starting with the concept of Umwelt (environment) and then of Ecosystem.

In social and human sciences, all these themes obviously echoed and echo strongly today. These ideas have of course spread (but also were originated for some of them) in the development of cognitive sciences (starting with cybernetics, linguistic, artificial intelligence, neuroscience…), in cognitive psychology but also in sociology, sociology of organisation for example but also in philosophy and epistemology, with the field of philosophy of complexity, as developed for example by Morin.

Morin is seen as a leading thinker on the matter of philosophy of complexity and his thought is very influential in the contemporary debate in science in general. The use of his epistemology of complexity (what is called "complex thought") serves the purpose of defining appropriate and useful mental frameworks, or method, to think3 , to organise knowledge. As we will see in this paper, Morin's philosophical and epistemological work has been highly influenced, but not only, by cybernetics, system theory and self-organisation (linked with the key concept of emergence), and these are also major features of the human and social science literature on major accidents.

Self organisation -emergence of pattern -and major accidents

Indeed, as described by many authors in the field of major accidents: history, interactions between actors (located at different levels4 ) and finally the concept of emergence do matter. Such an approach is therefore important and can therefore be understood through self-organisation principles, emphasising the emergence of patterns5 -that are created without centralis ed control -leading to accidents.

We find therefore emergence and self-organisation, although not defined as such by this author, at the heart of the accident modelling (or theorising) of Vaughan, with the idea of emergence of a dynamic pattern of construction of meaning (normalisation of deviance, 1996) over the O-ring behaviour following many years of feedbacks on that specific topic at NASA. This patterns consists in 5 steps:

1. Signal of a potential problem arise, 2. Behaviours deviating from a perfo rmance norm of safety criterion were treated as a serious sign of danger, 3. Investigation of the evidence, 4. After discussion the deviant behaviours of the joint was often "normalized" -thereby defining parameters for a revised working norm too, 5. The risk could then be judged to be "acceptable" according to the new norm.

There is no written plan that people followed but instead the emergence of a pattern. It emerged from people interacting over the years, in a specific social-cultural-historical-political-economical context (NASA's institutional context, NASA's culture of "can do" …) and technological context (the specific behaviour of the technical O ring components)6 . We also find this idea of emergence of organisational behaviour for Snook (2000), but also from human factors scientists as [START_REF] Rasmussen | Risk management in a dynamic society: a modelling problem[END_REF]Rasmussen ( , 2000)), [START_REF] Hollnagel | Barriers and accident prevention[END_REF]. These authors are interested by an emerging behaviour, although without focusing as much as Vaughan on the idea of collective construction of meaning and sense about a single phenomenon over the years (as with a normalisation of deviance regarding the O-rings behaviour). Instead, but also because of the nature of the accidents that he studied, for [START_REF] Snook | Friendly fire, the accidental shootdown of US black hawks over northern Irak[END_REF], there is an emergence at the global level, generated by individuals, each of them independently "self organising" their own tasks around predefined rules and creating a global "practical drift", implying a coordination failure (due to loose coupling between actors and their tasks) leading to the accident. The following pattern is described by Snook this way:

1. An organisation is designed, defining procedures and a tight coordination between activities defined through the formal procedures for the worst case scenario. 2. Actors implement the organisation, but in reality the actors have loosely coupled activities between each other in a normal operations, and they slowly drift from rules defined by formal procedure to task based activities. 3. The organisation behaves according to this principle. 4. The organisation fails when the drift creates a "resonance" when drifting activities align with each other.

Emergence of patterns (linked with self-organisation, but also with adaptive systems and evolution, as we will see) seems therefore a key concept for understanding accidents [START_REF] Lecoze | Are organisations too complex to be introduced in technical risk assessment and safety auditing ?[END_REF]. These patterns could be called "emerging self organised incremental patterns"7 . Vaughan has recently used the idea of "slippery slope" for defining with an image or metaphor8 the type of pattern that she is thinking of when dealing with major accidents and organisational dynamic. The challenge is therefore today, from the "practical drift" of [START_REF] Snook | Friendly fire, the accidental shootdown of US black hawks over northern Irak[END_REF] , to the "Normalisation of Deviance" of [START_REF] Vaughan | The challenger launch decision: risky technology, culture and deviance at NASA[END_REF] , through the 'incubation period" of [START_REF] Turner | Made-man disaster: the failure of foresight[END_REF], from the type of "behaviour towards accidents" of [START_REF] Rasmussen | Risk management in a dynamic society: a modelling problem[END_REF]Rasmussen ( , 2000)), to understand the conditions (which are cognitive-social-cultural-political-economical9 ) of the emergence of these accidental patterns. Doing so consists today in organising the relevant knowledge to help us detecting, anticipating, and preventing, thanks to proper organisational design, the potential emergence of these patterns before they lead towards a major accident. This presentation of patterns and emergence in accident brings us to what Morin did with the idea of selforganisation and emergence in his epistemological and philosophical work.

Self organisation and "complex thought"

Self-organisation (emergence) is indeed a powerful concept that is thus at the core of the work of Morin and his "complex thought", and also, early, at the core of the complexity ideas in general (e.g. in physics [START_REF] Prigogine | La nouvelle alliance[END_REF]Stengers, 1977, in biology Atlan, 1979, in neurosciences, Foerster) from where Morin has been looking at, to "feed" his thought. It seems therefore appropriate for the theme of this conference to see how Morin had elaborated on these ideas for the development of his "complex thought", defining consequently a field of epistemology or philosophy of complexity [START_REF] Ceruti | Constraints and possibilities. The evolution of knowledge and the knwoledge of evolution[END_REF], and to see how this can be helpful to think prevention. The "complex thought" of Morin is however a very atypical kind of thinking that can sometimes meet difficulties in being understood as it doesn't fall into any categories of today's academically established, but also fragmented, knowledge10 .

The ideas generated in the several books of "La méthode" (from -1977 to 200411 ) are therefore not standing very easily in any discipline, which makes it either repulsive or either very attractive (especially attractive for those from a construction due to an active interaction between a subject (here we could assimilate the subject to several people interacting) and an object (here the joints behaviours).

who believe that reality does not know scientific boundaries 12 , believe that meta-models or meta theories are not to be found for tomorrow and that interdisciplinarity is a key process for treating multidimensional problems).

It is an extremely stimulating thought and gives strong scientific strategies for thinking prevention and research, but not only for "thinking it" in a common sense, as we don't need, for instance in the field of major hazard, the powerful intellectual work of Morin to realise that we have to put together engineers, psychologist, sociologist or economists to work out the patterns leading toward accidents 13 . It is rather because he tackled the epistemological question of our knowledge about reality from the physical, the biological and the anthroposociological views and tried to produce some ideas and concepts of organisation of knowledge for coping with the complexity of reality that his work is valuable. Lemoigne (1977[START_REF] Lemoigne | La modélisation des systèmes complexes[END_REF]Lemoigne ( , 2001Lemoigne ( , 2002Lemoigne ( , 2003) ) has actively14 used Morin's work to define a constructivist approach of knowledge, a constructivist epistemology, following a tradition of works such as [START_REF] Piaget | L'épistémologie génétique[END_REF], leading to a circular representation of science and justifying the status of interdisciplinary researches.

The two next parts attemp ts to introduce the principles of Morin's "complex thought" (this presentation must however really be understood as an attempt but also as what the author of this paper was able to understand and to extract from Morin's work!).

Essentially, it could be said that two key principles are important to be understood for getting into his work, which are the concepts of emergence and the value of science15 . Emergence (self-organisation) has already been introduced in this paper. It implies that although organisational levels are not understandable from the understanding of the levels before, there is however a continuum between all of them levels (from the physical, biological and anthropo sociological one) from which human, societies to knowledge (concepts, models , theories, ideologies) are, through evolution, the products. The other one, the value of science, is about the status of objectivity that is defended in scientific developments (and that is often associated with the positivist attitude), and our relationship with reality. Do we see the world as independent observers? Or do we co-create the world that we see in interaction with it? If yes, then do we have to address the situation of the observer? How do we do so?

It appears that Morin's "complex thought" is consequently trying to find a way between the traditional oppositions of:

the subject (the observer) and the object (the observed) -addressing the value of science (or also the "subjective" side of the scientific adventure) nature and culture 16 -addressing the relationship linking the physical, biological and anthropo sociological levels.

12 As Von Foerster (1995) stated it when questioned about his transdisciplinary background, "I don't know where my expertise is; my expertise is no disciplines. I would recommend to drop disciplinarity wherever one can. Disciplines are an outgrowth of academia. In academia you appoint somebody and then in order to give him a name he must be a historian, a physicist, a chemist, a biologist, a biophysicist; he has to have a name. Here is a human being: Joe Smith --he suddenly has a label around the neck: biophysicist. Now he has to live up to that label and push away everything that is not biophysics; otherwise people will doubt that he is a biophysicist. If he's talking to somebody about astronomy, they will say "I don't know, you are not talking about your area of competence, you're talking about astronomy, and there is the department of astronomy, those are the people over there," and things of that sort. Disciplines are an aftereffect of the institutional situation.", interview available at http://www.stanford.edu/group/SHR/4-2/text/interviewvonf.html . 13 Turner for example already stated these needs for investigating disasters in 1978 " the study of the nature and origins of disasters is the kind of inquiry which is naturally a multidisciplinary one and co-operation between psychologists and sociologists, epidemiologist, engineers and managers is needed to understand the complicated relationship between different kinds and levels of event which lead to the development of disasters", and this has been done early after accident, following for example the Three Mile Island accident by putting together various human and social scientists, [START_REF] Sills | Accident at three Mile Island. The human Dimension[END_REF] but also today very recently, following the Columbia accident, with a book released in 2005 [START_REF] Starbuck | Organization at the limit. Lessons from the Columbia disaster[END_REF] and also following the natural disaster Katrina on a website created by social scientists http://understandingkatrina.ssrc.org.

The basic principles are that we must understand our reality through its physical, biological and anthropo sociological dimensions, without having one that would be dominating the other, or reducing the others to their "truth", such as saying that everything is physical, that everything is biological or that everything is anthroposociological 17 . Thinking our world is therefore about thinking the three together, but in a way that is consistent, through principles that link these levels in a circular relationship. Morin's research strategy has been therefore to look at the key scientific developments of science of nature and science of life to question our human and social "nature", and "life". These questions are contained in the two first volumes 18 of "La méthode".

THE PHYSICAL AND BIOLOGICAL DIMENSIONS OF HUMANITY

Some key scientific ideas of our contemporary world

Thus, in a dialogue between philosophy and science, in the two first volumes of "La méthode" (1977,1981) Morin put together a lot of material from science of nature and science of life. His approach is a circular one, starting with the physical to the biological nature of human and societies. Here are some of these (this is not a comprehensive list):

-Cosmos studies and new trends (big bang following Hubble's discoveries of an expansion of the universe 19 ), -First and second thermodynamics (the dissipative structures and the philosophical discussions from Prigogine), -Micro-physics (quantum physics and philosophical discussions from Heinsenberg, Bohr…), -Cybernetics and system theory (and epistemological discussions from Bertalanffy, Wiener, Von Foerster, Bateson…), -Self organisation, recursivity, a utopoësis, emergence and principles of "order out of noise" (with epistemological discussion from Von Foerster, Maturana, Varela, Atlan), -Evolution (Darwinian, neo darwinian developments), -Ecology and Umwlet (from Von Uexküll), -Ecosystem (from Tansley).

Concepts extracted from « The nature of nature »

All these insights are discussed and articulated to produce a number of principles such as (from the volume 1):

1. The presence of order/disorder/interaction/organisation as an underlying basis of the emergence of our world (instead of a strict principle of order but also instead of a strict principle of deterministic laws 20 and instead of matter as a elementary unit, the last point stressing the importance of patterns over elements). 2. Emergence as a principle for understanding the properties of systems that can't be deduced (and reduced) from the parts.

advances obtained in various disciplines since, like paleoanthropology, prehistory, genetics, theory of evolution, ethology [START_REF] Picq | L'évolution de l'homme, de la biologie à la culture[END_REF]. One of the problem consequently concerns the way, the method, in which the various disciplines together are articulated. This raises the question of interdisciplinarity and of the method supporting this process.

17 [START_REF] Dupuy | Ordre et désordre. Enquête sur un nouveau paradigme[END_REF] has argued that reductionism and simplistic assumptions would always have the last word over a more complex, such as Morin's "complex thought", vision of reality.

18 « The nature of nature » (1977) and « The life of life » (1981). 19 In a recent dialogue (2003), between Morin and Cassé, an astrophysician, some of the ideas about our universe and on the cosmos extracted from the first Volume of "la méthode" are discussed.

20 Determinism and consequently the search for laws is one feature that has been seen as a foundation of the scientific approach, as Ceruti notices (1994) "particularly during the Nineteenth century, the search for "laws" progressively becomes the way in which the regulating ideal of omniscience becomes normative in the building of human knowledge. The notion of law is interpreted as a fundamental place of description and explanation of phenomena. The discovery of a law gives access to the Archimedean point, a necessary and sufficient condition for the control and exhaustive explanation of phenomena. It allows for both the dissolving of the particular into the general, the predicting of the past and future course of event, and allows us to conceive of time as the simple unfolding of an atemporal necessity. These epistemological schemata took shape in the interpretation of the great successes attained by rational mechanics throughout the course of the 18 th century and the beginning of the 19 th , and in that attitude we tended to conceive of this science as being paradigmatic of the tasks of scientific explanation in general. Subsequently, even the great scientific events achieved by the emergence of both sciences of evolution and history (whether natural or social) were shaped by an ideal of scientific quality pivoting on this notion of law. The problem thus became that of determining laws of history characterised by the same necessity, invariance, and atemporality as the laws of the physical universe."

3. A systemic principle to be linked with an ecological vision of the world (developed in the second volume).

The systemic principle stresses the fact that any organisational phenomena is embedded and in interaction within other systems. 4. Recursivity and autopoïesis (although the principle of closure from the autopoïesis theory is thought by Morin with a principle of openness) as a common "organisational" feature of the physical, biological and anthropo-sociological world through the concept of self -producing "machine" . 5. Openness as a key principle of intelligibility of reality (a concept that has empirical, methodological, theoritical, logical, paradigmatical impacts leading to a complex vision of the world). 6. A principle of complex causalities (little cause can have big effects, same cause can have different effects, leading to counter-intuitive effects through feedbacks, and exogenous -endogenous principles of open systems and interactions of systems), which makes emerging patterns not predictable.

Concepts extracted from "The life of life"

In volume two, a certain other number of principles are discussed and articulated from science of life developments (here are some selected ones):

1. Oikos/autos and the concept of ecology (environment) and of ecosystem, where the parts (autos) and the whole (oikos) are linked together in a complex relationship of recursivity (parts are the products of the whole but also the producers of the whole in a dialogical relationship). 2. A concept of evolution with a discussion of the notions of adaptation and selection within an ecoorganisation through the use of self-organisation of eco-systems , and the introduction of order/disorder/interaction/organisation as a principle functionning of eco-systems (and also a principle of variety as a principle of resilience). 3. A principle of a ecological science21 as the first "scienca nueva" introducing the importance of the context, the importance of putting together separated disciplines in a systemic approach, the link between nature and culture, and the necessity of a communication of science and the value of science as the future of our world and humanity depends on it. 4. The consequences of this general ecological type of thinking are the following concepts: ecology of action (supported by a principle of complex causalities developed in the first volume22 ), ecology of ideas23 , social ecology. 5. The genotypic and phenotypic relationship of the living, where both must be thought interacting with each other, and not separately (endogenous-exogenous dynamical type of relationship). 6. The emergence of two types of entities: second order (polycellular organisms) and third order (societies of polycellular organisms). 7. The paradigm of auto-eco-re-organisation ( self-eco-re-organisation), as a universal principle for understanding the living (including humans). This paradigm indicates that phenomenon are self organised, but also eco-dependant (they are always open and embedded in a larger eco system, a milieu) and re organised (they constantly maintain but also transform themselves in a recursive manner).

THE CONDITIONS OF KNOWLEDGE

Some key ideas about knowledge from the third and fourth volumes

After exploring the physical and biological dimensions of the emergence of our human and social nature, in the third and fourth volumes of "La méthode", to which we could add the epistemological work of "Science with consciousness" (1990), Morin explores the possibilities for the emergence of human knowledge. He explores the relationships of our knowledge with reality and the possibilities, limits, constraints and resources of our ability to answer various types of questions, leading to various types of investigations. As similarly with the two first volumes, Morin uses again a circular approach. This circular approach starts in the third volume from the biological nature of knowledge, to the cognitive through the psychological and anthropological dimensions of knowledge. In the fourth volume, the approach is historical, political, sociological and finally "noological"24 . Various works are therefore put together, articulated and discussed. Here are some of these works (again, this list is not comprehensive):

-Genetic epistemology of Piaget, approaching knowledge through its biological side, -Neuro-science insights on knowledge from Maturana, Changeux, -Epistemological, philosophical and historical works on science such as of Popper, Kuhn, Lakatos, Farayebend, Hanson, Holton, Bateson … -Logic from Gödel, Tarski, Russel, Whitehead … -Philosophical works about knowledge from Kant, Husserl, Heidegger, but also Habermas, Adorno …

Concepts extracted

Some important ideas and concepts can be extracted from the discussions and developments contained in these three books25 :

1. The intrinsic difficulty of understanding knowledge because of the communication difficulties between its natural dimension [information, computing, articifical intelligence], its biological dimension [central nervous system, phylogenesis/ontogenesis of brain], its human and social dimension [linguistic, cognitive psychology, psychologies, psychoanalysis, psycho sociology, cultural anthropology, sociology of culture, sociology of knowledge, of science, history of culture, of beliefs, of ideas, of science], its philosophical side [theory of knowledge], its "in between" science and philosophy dimension [logic, epistemology]. 2. The cognitive analogical/logical duality and explanation/understanding duality of our relationship with reality, as well as a cognitive duality between a simple/complex approach of reality. 3. A strong influence of a great western paradigm, separating a philosophical thought (meant to be reflexive) and a scientific one (meant to be based on observations and experiments) 26 , although both can't be simply summarised as such. This great paradigm is also developed by Morin around the traditional oppositions of subject/object, spirit/body, mind/matter, quality/quantity, finality/causality, feeling/reason, freedom/determinism, existence/essence. 4. Although science is developed under four independent legs (empirism, rationality, verification and imagination), there is however a subjective side of the scientific objectivity, hidden for example under paradigms (Kuhn), but also schemata (Holton), which are metaphysical statements, which organise preferences and define some of the values of the scientific works 5. Knowledge is therefore a product of a biological, cognitive, psychological, historical, sociological, economical and political conditions allowing deviancies and new theories to be generated, tolerated and expressed themselves, to allow new visions. This of course can't be seen as deterministic, there is a principle of endogenous/exogenous process (micro/macro) generating novelties, that can't be predictive in terms of what will be the new scientific ways of looking at the world, and radical changes are always possible. 6. There exists systems of ideas: scientific, philosophical, ideological (the last one supported by doctrines)

where science is an extension of philosophy and where ideologies and doctrines differ from science and philosophy (offering the possibilities of debating) as they re not opened and "bio-degradable", as scientific and philosophical developments are. Science must be thought philosophically, epistemologically, but the reverse is also true, philosophy must be thought scientifically. 7. A principle of uncertainty about knowledge and reality, and the importance of the awareness about our mistakes and illusions in the process of generating knowledge, based on models that must be understood as mediations between the world and us, not a definite understanding of things, but as evolving.

COMPLEXITY, SAFETY AND SECURITY

Managing safety and security is about dealing with complexity.

The concepts extracted from Morin's work come naturally as macro-concepts for guiding, organising and thinking the problems and events related to security and safety issues.

From the Columbia explosion commission report to the 9/11 terrorists attacks reports27 , we see in both domains the ecological/systemic dimensions of theses events, but also the complex causalities/ecology of action principles as key concepts for understanding these failure of foresights at the global level28 .

Jervis (1997) has extensively used the domain of science of complexity and systemic perspectives for demonstrating this in the political and social worlds. Vaughan quoted his work for supporting her statement about the nature of complex social systems, and the nature of accidents. Our own experience in investigating accidents (e.g. Lecoze et al 2005) have shown us how people taking decisions (which can be regulatory decisions, as well as corporate decisions) "shaped the landscape in which the accident unfold" (Rasmussen and Svedung, 2000).

What can be also interesting to notice regarding this aspect is that often we find that impacts of changes and decisions (either technological or organisational) are thought through quantitative type of indicators.

Organisational performance is often dominated by quantitative indicators for managing purposes and for continuous improvement type of thinking, where referencing points are needed for following trends in improvements. The insistence on quantitative indicators can be seen as a influence of the great western paradigm as described by Morin for which all qualities tend to be shadowed, tend to disappear in favour of only quantitative dimensions. In companies, it is often that only quantifiable indicators are primary used over more qualitative ones. It is true in the accident of Challenger [START_REF] Vaughan | The challenger launch decision: risky technology, culture and deviance at NASA[END_REF] where engineers only had their intuition for arguing against the launch of the shuttle, so that in a positivist and engineering culture, these could not be used as strong enough proof.

In the report of the 9/11 we find similar type of problem regarding the way the FBI organisation was assessed: « First, performance in the Bureau was generally measured against statistics such as numbers of arrests, indictments, prosecutions, and convictions. Counterterrorism and counterintelligence work, often involving lengthy intelligence investigations that might never have positive or quantifiable results, was not career-enhancing."

There is a strong quality/quantity opposition in our paradigm of science that make qualities difficult to be expressed and taken into account as much as quantitative ones, although a lot of the dimensions of our organisations can only be expressed qualitatively, and not under quantified indicators. Hopkins (2000) has stressed in major accident also the misleading occupational health and safety indicators when it comes to major accident trends 29 . However, the task for defining suitable major accident indicators is a difficult one, as dimensions such as or example collective mindfulness [START_REF] Weick | Organising for high reliability: processes of collective mindfullness[END_REF], which can be seen as features of reliability of organisation, are difficult to put in numbers.

Principles of self-organisation and of recursivity are also key concepts for understanding that control of all organisational dynamics is an illusion 30 . Systems self-organise themselves in unpredictable ways. They create patterns sometimes sustained and detrimental to safety. But for understanding these patterns it is impossible not to open them to the context and the history of these phenomenons being revealed with the favour of hindsight. They are also the products of order/disorder/interaction/organisation principles within sociotechnical systems where "failures comes from either a loss of order, something always suspected, or from an increase in order, a newer suspicion that is consistent with what is known about phenomena such as vicious circle, excalations and anti tasks" [START_REF] Weick | Foresights of failure: an appreciation of Barry Turner[END_REF].

These patterns (such as normalisation of deviance, practical drift etc) are therefore self-organised, but also ecodependant of their contexts in which they are maintained and transformed. The paradigm of self-ecoreorganisation, is therefore useful for thinking the open, self organised and evolving nature of these patterns. These concepts extracted from Morin's ideas help visualising the dynamical aspects of safety and security.

The accidents and attacks also reveal often new worldviews 31 , a worldview that was not held possible before the events by a number of people. In that respect, the ideologies and doctrines maintained about the world, ideologies not opened to other debates, often configure the organisations into blind systems, not ready for what was thought as impossible by some, before the events. People having conflicting worldviews with others, and especially official worldviews (held by people at high position, with power) but also under cultural type of influence, and willing to express them require as much as for new scientific theories that some conditions exist for them to first express these conflicting views but secondly to be heard by the others. The "wisthle blowers" often play these roles. They appear in reports following disasters. We often find that ideas about the possibility of events can be found to have been already discussed, or even sometimes written at some points by people belonging to the organisations in charge of preventing accidents or preventing attacks. There is a need therefore to ask what are the favourable conditions 32 for these views at odd with the common beliefs (or ideologies, doctrines) to be expressed and listened to 33 . A type of requisite variety34 is required for a complex world, where possibilities, emergence of unpredicted configurations are intrinsic features.

This requisite variety face the cognitive process based on the duality of simplistic assumptions (used for action35 ) and complex ones (which are more time consuming, requiring conflicting views to be expressed but also requiring a level of expertise about problems encountered). [START_REF] Weick | Foresights of failure: an appreciation of Barry Turner[END_REF] noted that "In order to act collectively, people adopt simplifying assumptions. Simplification limits the precaution people take and the range of undesired consequences they envision. These simplifications states the stage for surprise". But the cognitive dimension is not the only one, and it is therefore a multidimensional approach that is needed, which requires articulation of various disciplinary based knowledge about safety and security, as the epistemology of comple xity suggests us.

We have started (lecoze, 2005) to try to put together such a research strategy by looking at available works about safety and accident in cognitive science, psycho-sociology, sociology, management and political perspectives. This approach can be used for accident investigation but also for offering new perspectives of auditing and designing or "engineering" (see [START_REF] Hollnagel Woods | Resilience engineering: Concepts and precepts[END_REF] the reliability or resilience of socio-technical systems.

As examples, works from -Psycho-cognitive s cientists such as [START_REF] Hollnagel | Human reliability analysis, Context and control[END_REF][START_REF] Hollnagel | Barriers and accident prevention[END_REF], [START_REF] Amalberti | La conduite des systèmes à risques, le travail humain[END_REF], [START_REF] Reason | L'erreur humaine[END_REF][START_REF] Reason | Managing the risk of organisation accident[END_REF], [START_REF] Rasmussen | Risk management in a dynamic society: a modelling problem[END_REF], Rasmussen and Svedung (2000), 31 In the terrorist attacks, the possibility of having planes crashing into towers in New York was quite a shocking and improbable scenario, a scenario difficult to imagine before the events for a lot of people. The Columbia accident report reveals also the difficulty to make sense and realise the risk potential of the foam strikes until the events occur. We find here the Turner vision of disasters (1978), that transform our worldviews, a bit similarly as science and new theories transform our worldviews at one point. 32 For Morin (1991, 52), a certain number of conditions are favourable to a weak cultural determinism and possibility of the autonomy of knowledge : sociological conditions (exchanges, commerce, social plurality, international relations, democracy or enlighten despotism…), cultural conditions (pluralities, cultural commerce -communication, exchanges -, conflicts, disorder, regulation of debate, empirico-logic verification-science, freedom -tolerated deviance…), paradigmatic crisis (revolution in principles of knowledge…). Similarly, it could be interesting to try to find out the conditions in which "whistle blowers" are taken into account, and allow risks at odd with the official views and under the weight of the cultural influences to be identified and controlled when necessary. 33 An idea in that sense is presented in [START_REF] Admonton | The recovery window: organizational learning following ambiguous threats[END_REF], with a "learning by doing" approach, as explained in the following: " Through a "probe and learn" approach that is creative and iterative in nature, exploratory experimentation seeks to "try it and see". Investigators collect and interpret feedback rapidly and then design new trials. The goal is to discover new things, to generate new hypothesis about how the world works. In contrast the formal hypothesis-testing experiments, "proof is the desired end, not discovery (…) In the challenger hearings, physicist Richard Feynman used a simple experiment to demonstrate the relationship between cold temperatures and O-ring malfunction. By submergin g a piece of O-ring rubber of iced water, Feynman revealed that the now frigid material returned to its initial shape slowly, imply that O-rings could not form and effective seal under cold launch conditions". Of course, the initial beliefs held for technical systems can be experienced but the "ideologies" regarding the way human and organisation behave is another problem. Managers can tend to see human and group as behaving a certain way until the accident reveals something else about these behaviours. These can't be experienced in the same way that technological systems behaviour can be experienced as suggested.

It is rather difficult to distinguish clearly epistemology (in the French context epistemology concerns science, and not knowledge in general) and philosophy of science(Soler,

2000). In that article we will use both terms with the idea of talking about these disciplines having a reflexive approach on the developments of scientific concepts, models, theories. The epistemology or philosophy of complexity is one of them.2 Early in 1948, Weaver in a key article « Science and complexity », suggested distinguishing simplicity from disorganised complexity and organised complexity.

Offering some ideas for scientific research strategies.

"Levels" is used here as a way to identify different type of actors (at the local level we would find operators, and managers, then authorities, market at higher levels etc). The interest is to put in light the problem of micro meso macro links, but can also lead to a graphical representation bringing some limitations (as any graphical representation does). Indeed it can bring a "vertical" vision where levels do not link directly with each other although links and influences are everywhere between actors, irrespective of the levels drawn. The diffusion of this vision of the socio -technical as been emphasised by[START_REF] Rasmussen | Risk management in a dynamic society: a modelling problem[END_REF] and then used in different works (e.g.Hopkins, 2000[START_REF] Leveson | A new accident model for engineering safer systems[END_REF]. A network of people interacting, creating systems of interactions, is probably a good alternative/complementary expression for emphasising the complexity/interactivity of these systems.

"Pattern" is an important idea in epistemology of complexity, emphasising "processes" and " shapes" rather than elements, which is a key thing as we will see in the next chapters, especially for thinking the self-organising properties of levels of reality.

We could say that there were some possibilities of emerging patterns under specific constraints (here it took the shape of a "normalisation of deviance" under the analysis of Vaughan), as Ceruti discusses about the knowledge of evolution and evolution of knowledge in his book "Constraints and possibilities"(1994). Ceruti uses the genetic epistemology of Piaget for stressing the subject/object relationship, and the possible emergence of specific pattern between a biological organisation and its environment. This pattern is not deterministic, but results

We have recently used this concept in an accident investigation for pointing out some local but also more global self-organised incremental patterns, combining themselves, undetected by the organisation, and leading toward a weakening of the organisation in terms of major hazard prevention.

Metaphors or analogies more anchored in the natural sciences have already been used for giving some images of what a major accident "could be".[START_REF] Rasmussen | Risk management in a dynamic society: a modelling problem[END_REF] suggested using the Brownian movement to stress the exploratory dimension of individuals within organisation as a source of risk. More recently[START_REF] Hollnagel | Barriers and accident prevention[END_REF][START_REF] Hollnagel Woods | Resilience engineering: Concepts and precepts[END_REF]) has used the magnetic resonance phenomenon as a source of analogy for facilitating a type of understanding related to organisations behaviours leading to accident.

Each of these dimensions should be considered before concluding on the predominance of one over the others (it is often tempting to conclude quickly that accidents are due to economical constraints).

Morin articulates knowledge from science (science of nature and life), philosophy, anthropology(Branchi, 1990), but not only (cognitive science, psychology, ethology…).

In this paper, we will only use the 4 first volumes ofMorin's work (1977Morin's work ( -1991)).

The website www.mcxapc.org dealing with the modelling of complexity is very active in that respect and freely provides a rich documentation on epistemology of complexity.

These two themes were respectively the subject s of two last special issues of a scientific journal in France ("l'énigme de l'émergence", "the enigma of emergence" 07/2005 and "Les valeurs de la science" " the values of science", 10/2005 from "Science et Avenir"). It is quite interesting to see that these are two central ideas that Morin articulates into his "complex thought".

A first attempt to link the emergence of our human culture (that led to today's societies) with our natural side is found in "le paradime perdu: la nature humaine" (1973) which was a precursor of Morin's work on his research for a method of "complex thought". That first work was the product of a series of conferences organised by Morin in 1972 in Royaumont, around the theme of "l'unité de l'homme" (The human unity). In his book Morin links works from ethology, prehistory and anthropology through the concept of self-organisation and evolution, in order to show the possibilities of articulating these pieces of works together (from different disciplines) to imagine a possible scenario of a human culture emergence. 30 years later the ideas contained in the project are still relevant and can be thought with the new

Capra (who was initially a physicist) , have recently used similar sources as Morin (cybernetics, general system theory, self organisation, ecology, quantum physics, dissipative structure autopoiësis) to reach similar conclusions on the necessity of developing an ecological and systemic type of thinking[START_REF] Capra | the web of life[END_REF][START_REF] Capra | The hidden connections integrating the sbiological, cognitive and social dimensions of life into a science of sustainability[END_REF],

In « System effects, complexity in political and social life », Jervis (1997), quoted recently in[START_REF] Vaughan | System effects: on slippery slopes, repeating negative patterns, and learning from mistake? In Organization at the limit[END_REF] and[START_REF] Roberts | The space between in space transportation: a relational analysis of the failure of STS-107[END_REF], offers -through a conceptual framework developed from science of complexity and grounded in empirical data of political events -an illustration of this type of « ecology of action » and complex causalities principle.

The ecology of ideas (as also developed for example byBateson, 1977) concept will be developed in the fourth volume of « la méthode » (1991).

Morin suggests, following Popper, Bateson, Monod, Dawkins … that ideas, theories, myths have their own autonomy, evolving as self organised entities and systems, under principles of evolution. This type of approach is currently being developed, following Dawkings book ("the selfish genes", 1976) through the field of "memetic".

As for the previous parts, these are very limited extractions of what these volumes contain!

We mention these two as they are examples of in depth investigation. Without such investigations it would be very difficult to learn, and find better ways of preventing cat astrophic events. We have made(Lecoze and Dechy, 2005), based on the 9/11 report, a comparison between safety and security in order to show the relevance of the concepts of safety for the issues of security, as they share some common system, human and organisational issues. Of course, reports can be reviewed, completed and in some cases contradicted, but they are the basis for an in -depth understanding of systemic events.

We apply these concepts (systemic/ecological, complex causalities/ecology of action, self eco re organisation…) as meta-mental frameworks for guiding accident investigation but also developing auditing(lecoze et al, 2005). These meta principles must be completed by disciplinary based works from psycho cognition, psycho sociology, socio logy, safety management. A list of some of the concepts existing in these fields is suggested in the next part.

Some have developed the ideas of requisite imagination(Westrum et al, 2003) for that purpose of thinking of the impossible but also accepting it and acting on it.

Psycho cognitive scientists, such as[START_REF] Amalberti | La conduite des systèmes à risques, le travail humain[END_REF], have shown at the individual level, how making complexity "simpler" is a metacognitive strategy used by operators for dealing with their tasks, and having suitable models (expl aining and predicting) to perform their specific tasks. Reducing complexity is a key strategy for them. It has strong implication for individual and collective actions.

We have also found similar pattern in our investigations. 30 We can suggest here a quotation from Meadow (2001) «People who were raised in th e industrial world and get enthused about system thinking are likely to make terrible mistakes. They are likely to assume that here, in system analysis, in interconnection and complication, in the power of the computer, here at last, is the key to prediction and control (…). I assumed that at first too (…), it was going to make systems work (…), but self organizing, non linear, feed back systems are inherently unpredictable. They are not controllable (…), we can't optimise (...), we can't keep track of everything (…), we can't control systems or figure them out (...)". Rasmussen has also stressed this (1997) "Often we found that attempts to improve the safety of a system from models of locals features were compensated by people adapting to the change in an unpredicted way."

-social scientists [START_REF] Weick | The collapse of sensemaking in organisation[END_REF], Weick et al (2001), [START_REF] Turner | Made-man disaster: the failure of foresight[END_REF], [START_REF] Vaughan | The challenger launch decision: risky technology, culture and deviance at NASA[END_REF]Vaughan ( , 1997[START_REF] Vaughan | System effects: on slippery slopes, repeating negative patterns, and learning from mistake? In Organization at the limit[END_REF], [START_REF] Snook | Friendly fire, the accidental shootdown of US black hawks over northern Irak[END_REF]Snook ( , 2005)), [START_REF] Perrow | Normal accident theory, living with high risk technology[END_REF], -political scientists [START_REF] Laporte | Fiabilité et légitimité soutenable[END_REF], [START_REF] Sagan | The limits of safety[END_REF][START_REF] Sagan | The Problem of Redundancy Problem: Why More Nuclear Security Forces May Produce Less Nuclear Security[END_REF] -safety engineering scientists [START_REF] Leveson | A new accident model for engineering safer systems[END_REF], 2005, Johnson, 1978), -safety management [START_REF] Hale | Assessment of safety management systems[END_REF] provide conceptual supports and need to be articulated together for a better appreciation of incremental patterns detrimental to safety and security.

These works offer interesting concepts such as incubation period, organisational learning, redundancy, system effects, power and culture 36 , to which we could add concepts of reliability of cognition, of requisite imagination, of collective mindfulness, of structurally induced inaction etc. Of course, the difficulty is to embrace an organisation within its context in one "motion", the dynamic of the system as a whole is very difficult, or impossible to capture totally. It raises empirical and methodological difficulties of collecting, but also interpreting data.

CONCLUSION

Morin's "Complex thought" strategy is a powerful instrument for approaching in a circular manner the disciplinary based knowledge and for thinking the nature of safety and security issues. In this paper, concepts extracted from Morin's work and some of them have been used for discussing the nature of disasters.

Disasters are the result of a ecological/systemic dynamics principle resulting from complex causalities/ecology of action principle, both principles leading investigation and auditing to a multidimensional and global approach. Disasters should therefore be understood as the results of biological -cognitive-social-culturalhistorical-political-economical dynamic. They require a complex approach, for which the self-eco-re organisational nature of the incremental patterns leading to them should be detected and prevented in time. This is a challenging conceptual and empirical task implying the collaboration of several disciplines together.


Lionel Perrette
email: lionel.perrette@ineris.fr

Henri Paillere
email: henri.paillere@cea.fr

Guillaume Joncquet
email: guillaume.joncquet@mpsa.com

Presentation of the French national project DRIVE: Experimental Data for the Evaluation of hydrogen Risks onboard vehicles, the Validation of numerical tools and the Edition of guidelines

Keywords: hydrogen vehicles, safety, accidental events, experiments

The everyday use of hydrogen in the transport sector requires high safety standards. Safety requirements must be addressed as a key issue for fuel cell car development. Therefore, it becomes crucial to have experimental data on hand in order to provide realistic and reliable risk assessment and to be able to really know the extent of safety margins taken. In such a context, the National Institute of Industrial Environment and Risks (INERIS) along with the French Atomic Energy Commission (CEA), the French automotive manufacturer PSA PEUGEOT CITROËN and the research Institute on unstable phenomena (IRPHE) recently started a research programme entitled DRIVE. This programme aims at providing experimental and numerical results for the safe design of hydrogen vehicles. Fields of investigation cover the whole range of phenomena that can be encountered in hydrogen accidents, from leakage to dispersion, ignition and finally combustion. The work programme and early results are presented in this article.

Programme objectives

This project which gathers together industrial expertise of the car manufacturer PSA PEUGEOT CITROËN as well as technical and scientific skills of CEA, IRPHE and the co-ordinator INERIS aims at providing experimental and numerical results to better assess hazards when handling hydrogen onboard vehicles. Results will contribute to strengthen risk assessment studies in terms of hazard quantification as well as to propose innovative solutions for the handling of hydrogen in cars compatible with public use.

The work programme is split into 4 items: the automotive system, hydrogen dispersion, hydrogen ignition and combustion and finally results dissemination. The second and the third items focus on the hazardous phenomena one would consecutively encounter when dealing with hydrogen accidents. The accidental chain is illustrated by the figure below.

Hydrogen safety onboard vehicle: point of view and expectations from the car manufacturer

Hydrogen vehicle must be as safe as conventional cars. However, the lack of hard data on hydrogen hazards onboard vehicles as well as the absence of statistically relevant data for hydrogen vehicles used by the public is a real challenge for designers who, at this stage, may be inclined to over-control hazards with constraining safety barriers.

The list below indicates some of the safety challenges that face car manufacturers:

Safe pressurised storage design (thermal insulation, use and location of pressure relief devices (PRD), enclosed or open compartment for storage…) and location of the pressurised storage in order to prevent burst due to thermal and mechanical aggressions as well as to control consequences of accidental leakage or PRD releases. Adequate control of standing flames fed by minor undetected leaks, Appropriate equipment design (choice of material and technology) and location (segregation,, enclosure,…) in order to control ignition sources whether mechanical, electrical or electrostatic in normal operations, Safe handling of hydrogen purged outside vehicle, Effective control of explosive atmospheres in confined or semi-confined spaces on-board vehicles (engine compartment) or outside the vehicle (underbody, garages…). That also includes ensuring that hydrogen will never penetrates into the passenger compartment.

Aside from the items above, one of the great challenges consists in setting an appropriate limit to segregate tolerable accidental releases versus unacceptable ones. Such a limit would then contribute to set the expected performance of the leak detection and leak interruption systems whether based on atmospheric detection or on direct measurement such as flow or pressure drops. Ideally, a vehicle should be able to run without leak detection systems having in mind that reliability of such detection system is so far moderate and that maintenance is rather constraining. Chronic leakage is also an issue since the no-leak objective does not seem to be realistic. Therefore, upper tolerable limit should also be specified for chronic leakage along with design measures to ensure that hydrogen can never accumulate to form an explosive mixture. Finally, CFD tools currently and intensively used by car manufacturers to design vehicles (aerodynamic studies for instance) should also be able to provide reliable results when computing normal or accidental release scenarios for hydrogen vehicles.

Safe design practices should finally be shared among manufacturers to promote the high safety standard expected for the public use of hydrogen.

Accidental and chronic leakage H2 build up and expansion of explosive atmosphere onboard or outside vehicle Ignition

Hydrogen jet flame Explosion

Detailed presentation of the work programme and early results

Work programme

This project started early 2006 in the framework of the first call for proposals of the National Research Agency (ANR). It will last for three years. Its work programme is made of 4 main modules: vehicle safety, hydrogen release and dispersion, hydrogen ignition and combustion (explosion or jet flame), and finally results compilation and dissemination.

The vehicle safety module includes a thorough risk assessment in order to identify hazardous situations (causes, consequences). Outputs from this module will shape the content of the experimental and modelling work in terms of hazardous situations to investigate with the objective of obtaining better quantification and therefore better risk assessment and risk control. The vehicle safety module that concentrates on hydrogen equipment and potential ignition sources onboard vehicles goes down to component level. Within the hydrogen release and dispersion module, we will then experimentally look at hydrogen component leakage in order to quantify them. Both chronic and accidental hydrogen leakages, as well as hydrogen emissions (purges, pressure relief systems) will be considered. These values will then serve as references to build the test matrix for hydrogen releases (free and impinged) on board the vehicle as well as in confined spaces.

These release experiments will be carried out with helium as well as with hydrogen. The size and location of explosive atmospheres will be monitored for various leaking rate and location. Within the third module, we will concentrate on hydrogen ignition with vehicle components as well on hydrogen combustion (flame or explosion). Ignition potentiality of car components (fans, electronic cards, electric engines, braking systems…) will be investigated through practical testing. In parallel, explosion experiments will be undertaken in order to assess the destructive potential of explosive atmospheres (in accordance with hydrogen dispersion findings) in more or less obstructed environments. In a later stage, combustion tests will take place on board vehicles. Hydrogen flames will also be considered at two different scales; on one hand, effect of large hydrogen flame resulting for instance from a PRD release and on the other hand, standing flames fed by minor leaks. For the latter point we will look at the ease with which ignition can occur as well as flame sustainability depending on upstream pressure and leaking orifice size. Excessive fire hazards due to the use of hydrogen can possibly be more critical than explosive atmospheres themselves that concentrate most of today's concerns. In the frame of the last module, experimental learning will be turned into practical graphs to facilitate risk quantification. Recommendations on best practices for vehicle design will also be drafted. Topics such as maximum allowable explosive volume, control of ignition sources and location of hydrogen components… will be addressed in final public reports. Results will be discussed during dedicated seminars. This project will not investigate the safety of high-pressure hydrogen storage in terms of potentiality for catastrophic failure when exposed to mechanical aggression or external fire. Issues such as fuse location on tanks or thermal insulation will not be looked at in the frame of this project. However, potential leaks as well as PRD releases consequences (explosive atmosphere under vehicle, jet fire) will be experimentally considered. Leakage during refuelling will not be considered either.

More detailed content and progress of some of the work themes is given below.

Work topics

Objectives, methodology, tools, basic background information and early results will be presented for each of the topics below: vehicle risk assessment, leak quantification, hydrogen dispersion on board and outside the vehicle, hydrogen ignition by vehicle components, hydrogen explosion, & hydrogen flames.

Vehicle risk assessment

Objective Risk assessment helps to evaluate and demonstrate through a systematic and consistent approach that a hydrogen vehicle whether of a prototypic or a series production type is as safe as a conventional one. Within this project this early work will help us to select hazardous situations to be studied and therefore to shape the experimental programme.

Steps

Usual risk assessment steps are the following: identify unwanted events and associated causes and consequences, evaluate their criticity, and take appropriate actions to bring risk down to an acceptable level.

Tools

Four tools are mainly used to contribute to the risk assessment studies: functional analysis preliminary risk analysis, fault trees and then Failure Mode and Effect Analysis (FMEA).

First of all, a functional analysis was undertaken. It helps to identify system functions and associated internal and external constrains. Then a preliminary risk assessment was carried out. This simple methodology helps to highlight the most unwanted events and to initiate discussions on severity and severity levels. For each vehicle mode (running, stand by, maintenance…) the following unwanted events are investigated: shift in internal system functions and system constrains, impact from the system on its environment, and then impact from the environment on the studied system.

All identified unwanted events were then ranked according to severity criteria. The severity scale consists of four levels. The highest ones 4 and 3 are those further considered in the study. Level 4 is associated with death or injury on people and level 3 means that the vehicle can no longer be used because of a break down. Level 3 and 4 unwanted events were then further investigated using the fault tree methodology. This graphical methodology helps to visualise steps and failure combinations that lead to the top unwanted event.

Finally, a failure mode and effect analysis (FMEA) was carried out. This systematic and inductive methodology helps: to assess consequences of component failures (loss or alteration of associated function) on the vehicle and its user, to identify component failure modes that can impact safety, and finally to propose corrective safety actions in the course of the design process.

A typical FMEA table similar to the one used in the project is pictured below: ….

Table 1: FMEA table used in the risk assessment process

Early results

Identified unwanted events when using hydrogen onboard vehicle include: fire onboard vehicles, explosive atmospheres and ignition wherever onboard or outside the vehicle, the burst of the pressurised tank, high pressure jets.

All the selected unwanted events are linked either with the use of hydrogen or with the handling of pressurised gas. Unwanted events associated with high voltage or other non specific hazards are not considered in this programme

Leak quantification

Objective The objective of this task consists in experimentally measuring chronic and accidental leak rates (external aggression, human error…) associated with key components of the hydrogen feed line and the hydrogen conversion system. Accidental leaking rates to be evaluated include likely situation such as bad fitting (insufficient clamping), erroneous fitting, missing or damaged sealant. Ageing will be looked at through repeated dismantling of hydrogen connections. Leak caused by organic failures of components (quality issues, internal ageing) quantification will be forwarded to component manufacturers. Design related hydrogen emissions (PEMFC purge, PRV…) will also be taken into consideration. Investigated pressures will cover the full range from the 700 bar working pressure for the high-pressure line down to few bars for the hydrogen conversion system. Both hydrogen and helium gas will be used in order to assess the appropriateness to use helium for leak quantification. These realistic and practical figures gained from these tests will serve as input parameters for further hydrogen dispersion and combustion experiments. These values will also be of a great help for risk assessment studies.

Steps

The study includes four main steps. The first one consists in extracting and referencing leak scenarios from the risk assessment study. The next one will consist in selecting components and test conditions (pressure, damage free / damaged equipment). Selection criteria include for instance likelihood and severity of leak, lack of data from manufacturers or gas component not initially designed for hydrogen use. Then, tests will be carried out with the experimental set up shown further down. Finally results will be recorded and analysed.

Background information

Literature shows that various vehicles related leak rates have been investigated in the frame of dispersion experiments. As shown in table 2, these investigated rates vary from 0.5 g/min (BMW [START_REF] Dr Fürst | Safety of Hydrogen-fueled motor vehicles with IC engines[END_REF]) up to 100 g/min (Cfcp1 [START_REF]Support facilities for hydrogen fuelled vehicles-Conceptual design and cost analysis study[END_REF]) with an average value around 10-20 g/min. It is interesting to notice that these values vary in a large domain. Besides, except for the BMW tests, there is not any obvious link between investigated cases and specific component leakage. Regarding component leakage the Cfcp document indicates that the fill up point and the pressure relief point are considered as the only way for the hydrogen tank to leak out. As far as other components are concerned, the pressure regulator, piping and fittings were considered as components able to leak out whatever the operating pressure (high-pressure and low-pressure). The value of 20 CFM (12.77g/min), referenced in this document, is based on the assumption that that the onboard computer is capable of shutting down hydrogen flow upon receiving a signal detecting a flow larger than 20 CFM when the engine is off. The Japanese regulation for hydrogen vehicle2 proposes a leak threshold of 11,8 g/min (or 131 L/min) that should not be reached in case of leakage after vehicle collision. This leakage is assumed to have the same calorific value as today's admissible value for gasoline. However, associated explosive atmosphere and consequences have not been taken into consideration. The same document indicates that helium can be used instead of hydrogen for leak tests as long as a 1.33 multiplication factor of the leak volumetric flow is used. Regarding purge management, the Japanese regulation indicates also that no purged gas in excess of 4% of hydrogen concentration shall be discharged or leaked to the atmosphere. As far as the GRPE Informal Group on Hydrogen/Fuel Cell Vehicles work is concerned [START_REF]on Hydrogen/Fuel Cell Vehicles[END_REF], no maximum allowable leakage value or leakage value to be detected is proposed. The work carried out in the framework of the DRIVE project will propose some realistic data specific to hydrogen components and hydrogen fittings. These data will enrich somehow empirical data proposed so far.

Tools

Components will be connected to pressure sources according to the figure below. Components will be placed inside a closed 2 m 3 insulated sphere inside where both pressure and temperature are monitored. Component leak rate measurement is directly linked to pressure variation inside the sphere.

Figure 1: Experimental set up for leak quantification

Early Results

At least, the following components will be tested: hydrogen connections, pressure regulator, phase separator, hydrogen pump, solenoid valve & components made of polymeric or plastic type materials.

Hydrogen Dispersion on board and outside vehicle (confined spaces) Objectives

The objectives of this study are to investigate, experimentally and numerically, different types of leaks and the dispersion of hydrogen either inside the vehicle or outside the vehicle in the most critical situation, that is when the vehicle is parked in an enclosed space such as a private garage. The mechanisms for the build-up of a potentially explosive mixture of hydrogen and air will be studied in detail, and effects of confinement and ventilation will be assessed.

Steps

The experimental programme will consist of leak and dispersion tests in a full-scale garage as well as onboard a vehicle. Both helium and hydrogen will be used. The test matrix will be elaborated from the leak quantification tests, the preliminary risk assessment study, and some pretest calculations using CFD (Computational Fluid Dynamics) codes will be performed to optimise the instrumentation set-up (location, number of sensors). After the tests have been performed, the CFD tools will be validated on a series of experiments, including some involving passive or active ventilation. Finally, the CFD tools will be used to perform parametric studies and to identify worse case scenarios and how they can be mitigated (for example by design of passive or active ventilation).

Background information

The table below summarises past hydrogen leak hypotheses and dispersion experiments in confined spaces.

Data source Experimental configuration and objectives

Leak rate proposed or investigated in g/min

Remarks

Swain garage -1998 [START_REF] Swain | Addendum to Hydrogen Vehicle Safety Report: Residential Garage Safety Assessment. Phase-1: Risks in Indoor vehicle storage[END_REF] & [START_REF] Swain | Addendum to Hydrogen Vehicle Safety Report: Residential Garage Safety Assessment. Phase-2: Risks in Indoor vehicle storage[END_REF] Assess how should existing garages be modified to make them suitable for H2 vehicles No indication given on why these data have been chosen.

Table 2: Hydrogen leak cases in confined spaces extracted from the literature

Compared with existing experiments and data, DRIVE will investigate wider leak rates and release conditions spectrum with more elaborate measurement techniques, in terms of gas concentration and velocity and turbulence measurements. The new tests will be the most detailed and finely instrumented tests for the study of hydrogen leaks. The objective is clearly to produce data both for risk assessment purpose, and to validate CFD tools, which are now well recognised to be potentially the most accurate and reliable computational tool for assessing consequences of accident scenarios.

Tools

The development of a full-scale garage and a quasi non-intrusive (due to their small size) sensor network (catharometric measurement type) is currently in progress. Mass flow controller of various ranges will be used in order to control leak flow. Hydrogen or helium concentration will be measured with the help of the catharometric sensors grid. Non intrusive velocimetry measurements will be undertaken through particle image velocimetry (PIV) and Laser Doppler Velocimetry (LDV). Transparent walls will be mounted on the garage to allow measurements. Ventilation will be managed with the help of either an extractor or a fan. The dimensions of the garage are those of a typical European garage for a single vehicle, and it is fitted with an overhead pivoting door. The garage will be fitted with vents which can provide either passive or active ventilation or extraction.

Computational Fluid Dynamics tools will be used for pre-test calculations, as well as to analyse the tests once the CFD codes have been completely validated. One of the CFD outputs that will be of most use for safety assessment is the time-evolution of the volume of explosive atmosphere (for example the volume of gas mixtures above 4% of H2). The effect of leak location, direction, impingement on nearby obstacles as well as presence or absence of ventilation on the evolution of this cloud will be investigated in detail.

Early results

The first tests are scheduled in the second semester of 2006, and will first address simple release scenarios with no obstacles and then release scenarios with a vehicle mock-up. Extensive work is under way to build and test the experimental set up, as well as to test and calibrate the sensors, both under air/helium and air/hydrogen flows.

Hydrogen ignition by vehicle components Objective

The objective of this work is to assess the ignition potential of some of the electrical and mechanical components and to identify best practices for the design and the positioning of vehicle components.

Steps

Though not applicable to vehicles, the same strategy as the one of the ATEX 94/9CE [START_REF]ATEX 99/92/EC -Equipment and protective systems intended for use in potentially explosive atmospheres[END_REF] & ATEX 99/92CE [START_REF]Minimum requirements for improving the safety and health protection of workers potentially at risk from explosive atmospheres[END_REF] is followed. Basically, it consists in demonstrating that components have no ignition potential under normal circumstances whenever an explosive atmosphere can form accidentally. The first step therefore consists in listing mechanical and electrical components in the vicinity of hydrogen systems. Then, some of them will be selected to undertake ignition tests in dedicated chambers. Based on results, recommendations will be made regarding the design and the location of the components.

Background information

In the course of this project, we have been looking at cross-experiences from natural gas vehicles (NGV) as well as from industrial vehicles that could accidentally drive into an explosive atmosphere (fork lift trucks). Regarding NGV vehicles, no recommendation at all is found regarding protection or segregation of electrical equipment [11]. As far as forklift trucks are concerned (category 3 vehicle for type 2 zone), the EN 1755 [START_REF]Safety of industrial trucks -Operation in potentially explosive atmospheres -Use in flammable gas, vapour, mist and dust[END_REF] standard gives a few hints which include: minimum distance to prevent mechanical frictions or limit speed at which friction can occur (brakes, clutch,…), bounding of all mechanical parts to ensure same electric potential, enclosing of electrical equipment to limit combustible gas ingress whenever the forklift drives through an explosive cloud, installing gas detection onboard forklift truck. A 10% LFL concentration triggers an alarm. A 25% LFL concentration stops the forklift, and also, limiting maximum surface temperatures when in use.

Now, looking at GRPE [START_REF]on Hydrogen/Fuel Cell Vehicles[END_REF] latest draft provisions, one could notice quite a few recommendations on electrical equipment. That includes: preventing hydrogen ingress into power supply connections where hydrogen leaks are possible (paragraph 14.11.4.), providing sufficient insulation of electrical components to ensure that no current passes through hydrogen containing parts (paragraph 6.5.1) & ensuring that electrical connections and components in the gas tight housing are constructed such that no sparks are generated (paragraph 14.10.3.)

External dimensions

Internal dimensions Length (m)5.845.76 Width (m)3.042.69 High (m)2.52.42 Volume (m Tools Tests will be carried out inside an explosion chamber dedicated to test electrical or mechanical equipment. The picture below features a typical test chamber.

Figure 3: Front view of a typical test chamber to test ignition potential of equipment

Early results So far, the following components have been selected for practical testing: the hydrogen compartment fan, the electric motor that drives the vehicle, the electrical converter, and the braking system.

Moreover, some non-conductive material components have been selected in order to check whether or not they can lead to an electrostatic ignition hazard.

Regarding early recommendations for the design of vehicle components in order to control ignition sources in normal use, the following can be proposed so far:

Component

State of the art design to control of ignition sources Braking system EN 1755 [START_REF]Safety of industrial trucks -Operation in potentially explosive atmospheres -Use in flammable gas, vapour, mist and dust[END_REF] -Blocks should be made of a combination of non-metallic materials and cast iron or an equivalent material. Light alloys are not allowed. Non-metallic materials should not contain more than 40% metal in weight and should be made of powder or fine wires (sizes given in standard). Blocks should be glued or pressed on brake shoes. Holes or assembly should not be found on friction surfaces, -Temperature should be monitored, -And wear should be checked.

Fans

EN 50021 [START_REF]EN 50021 : Electrical apparatus for potentially explosive atmospheres -Type of protection[END_REF] -IP10 rating on the output side and IP 20 rating on the input side, -Distances between moving and fixed parts greater than 1/100 of the fan diameter (at least between 1 and 5 mm), -3,5 J shock test without hazardous deformation (or 2 J if fans are physically protected against shocks).

Sparkless drive motors

EN 50021 [START_REF]EN 50021 : Electrical apparatus for potentially explosive atmospheres -Type of protection[END_REF] -IP 54 rating, -Dielectric strength test to ensure sufficient electric isolation, -Expectations on electrical couplings, -Minimum distance between rotor and stator to be implemented.

Table 3: State of the art design to control ignition sources for some key components

Hydrogen combustion Objective This work aims at defining maximum tolerable explosive volumes for various leakage environments and providing straightforward pressure/effect prediction rules for risk assessment. Test results will also be useful to evaluate the prediction potential of CFD tools.

Steps

This experimental programme will first investigate pressure effects caused by the ignition of moderate and calibrated explosive volumes for various levels of confinement from free environment up to congested environment similar to those we can find onboard vehicles. Pressure prediction rules will be derived from these early tests. Then explosions will be carried out onboard vehicle following leakage flows and locations consistent with those found in the earlier work programme. These tests will also help us to evaluate the destructive potential of onboard vehicle explosions.

Background information

Although not wanted, leaks will inevitably occur onboard vehicles. It is therefore a necessity to work on a maximum allowable explosive volume with tolerable associated effects. Once this limit is set, it will be a significant input to size safety barriers for leak detection and interruption. So far, the only "tolerable explosive volume" we found come from the industry. The European guide document for the implementation of ATEX 99/92CE directive [START_REF]Minimum requirements for improving the safety and health protection of workers potentially at risk from explosive atmospheres[END_REF] indicates, independently of the combustible gas considered that: an unconfined explosive atmosphere should always be considered hazardous when its volume is above 10 litres, and an explosive atmosphere in a closed room should always be considered hazardous when its volume is greater than 1/10 000 of the room volume.

Other work [START_REF]Outstanding safety questions concerning the use of gas turbines for power generation[END_REF] investigated the limit of acceptable explosive volumes in natural gas turbine casings. The recommended safety criterion is that the natural gas flammable cloud volume should be less than 0.1% of the net enclosure volume. In addition to the above condition on the allowable size of a flammable gas cloud relative to the net enclosure volume, the flammable gas cloud volume should also be less than 1 m3 in all cases, irrespective of the enclosure volume. Safety systems have to be designed (detection, ventilation) in order to insure that these limits are never exceeded. One should mention that people would not be present inside the enclosure volume but are expected to stand nearby. Proposed acceptable explosive volumes are not susceptible to cause casing rupture and blast injuries.

Examples above illustrated confined and unconfined explosions as well as explosion with and without direct exposure of people. These various cases will be taken into consideration.

Regarding existing data on explosion experiments for moderate and calibrated explosion volumes in more or less confined environment, the review has not yet started. However, similar experiments will be carried out by FZK 3 in the framework of the HySafe network. For explosion onboard vehicles, we can mention experiments carried out by the Motor Vehicle Fire Research Institute USA [START_REF]IEA Task 19 meeting[END_REF] where they investigated hydrogen leakage in the engine compartment. They investigated various release rate and ignition delay. Test showed that the maximum engine compartment overpressure was 220 mbar. This maximum overpressure that caused the hood to bend was obtained for a 64 sec release of 51 g of hydrogen. Shorter released produced overpressure of 10 mbar to 152 mbar.

Tools

These tests are planed for 2007. The experimental set up has not been designed yet. Tests will most probably be combined with those undertaken by FZK in the framework of the HySafe network.

Hydrogen flame Objective

This work aims on one hand at providing data on hydrogen flame length and on hydrogen flame radiation for some severe scenarios (significant leak under the hood, hydrogen escaping through the thermal fuse). Besides these tests, less severe cases will be investigated in order to study conditions under which a hydrogen flame cannot be sustained. Ease of ignition shall also be investigated for high and moderate pressures with various leak orifices. These latter cases address minor / non detectable leakage that do not cause any explosion hazard but could however cause a significant fire hazard whenever the vehicle is parked or driven.

Steps

The work programme includes both an experimental and a numerical part. The first step will consist in selecting a set of realistic scenarios/situations to be investigated. The experimental set up for flame length and flame radiation has not yet been designed. Regarding flame length, both free and impinged jets will be looked at. Seeding will probably be used to visualise flames. As far as micro leaks are concerned, we will look at leak orifices most probably below 1 mm for various values of pressure.

Background information

It has been established experimentally that hydrogen discharges through circular orifices larger than a critical diameter sustains stable lifted flames irrespective of the reservoir pressure driving the release. At smaller diameter however, stable burning will only be achieved at operating pressures higher than a particular, diameter-dependant threshold [START_REF] Devaud | Stability of underexpanded supersonic jet flames burning H2-CO mixtures[END_REF].

Regarding vehicle related literature contributions, we can mention two practical contributions to the topic. First of all, we can mention the experimental work from the Motor Vehicle Fire Research Institute USA [START_REF]IEA Task 19 meeting[END_REF] where jet flames in the engine compartment have been investigated. Some more data was previously released by the Japan Automobile Research Institute [START_REF] Hayashi | Hydrogen Safety for Fuel Cell Vehicles[END_REF]. JARI compared for a given leakage rate (11.8 g/min for hydrogen and 28.6 g/min for natural gas/methane) critical diameter under which a gas flame was not sustained. They found out that the methane flame became no more viable with a rather large diameter of 2.00 mm or less. On the other hand, the hydrogen flame was sustained at the leak orifice even with a nozzle diameter of 1.0 mm. Authors concluded that the favourable stability of hydrogen flames is advantageous as a means to avoid explosion. Needless to say that the 1 mm orifice considered is rather large. Much smaller leak orifice could be expected without being noticed. They could eventually cause a fire hazard. It is therefore necessary to investigate leak orifices smaller than 1 mm. The DRIVE project will investigate these situations. Moreover, this research institute also investigated the flame behaviour of hydrogen released from 350 bar hydrogen tanks. They found out that the hydrogen flame released upwards reached its maximum height of 7-8 meters in 5 to 10 seconds. This flame length is very significant and could cause severe hazards for cars occupants as well as for rescue services. It is therefore of a prime importance to provide advice on how this release should be dealt with (upward, downward under the vehicle…). The DRIVE project will also address this issue within this work programme.

Results and dissemination

The DRIVE project aims at investigating experimentally and numerically hydrogen vehicle related accidental scenarios in order to strengthen risk assessment as well as to promote safe hydrogen handling solution onboard vehicle. Three documents will be produced:

the first one will address hazard quantification results and hazard quantification tools for hydrogen vehicles. Hazardous phenomena will be explained. Issues such as flame length or explosive atmosphere volume versus pressure and diameter will be detailed, the second one will address best practices when using CFD tools to predict hydrogen behaviour when released accidentally or under normal situation, and the final one will address best practices when handling hydrogen onboard vehicles. Its content will include both generic risk assessment as well as best practices for the design of hydrogen vehicles.

These results will be presented in the course of open seminars.

Conclusions

Field of investigation covers the all range of phenomena that can be encountered in hydrogen accidents from leakage, to dispersion, ignition and finally combustion. This programme aims at providing experimental and numerical results in order to provide realistic risk assessment and to be able to specify precisely expected hydrogen vehicles safety performances. DRIVE outputs will be turned into practical graphs to facilitate risk quantification. Recommendations on best practice vehicle design will also be drafted. Actually, topics such as maximum allowable explosive volume, control of ignition sources and location of hydrogen components will be addressed.

This project has just started. However preliminary reviews of existing experimental data and guidelines have been performed, to better define the expected results of the project. These reviews and early thoughts and findings represent important contributions to the elaboration of safety guidelines for hydrogen vehicles. We can without any doubt consider today that DRIVE outputs will be of a great help for designing safe hydrogen vehicles.

Authors would like to thank the French National Research Agency ANR, and its hydrogen programme PAN-H, which financially supports this project.

Figure 2 :

 2 Figure 2: Garage skeleton (left) and garage dimensions (right)

California Fuel Cell Partnership

Attachment 100 -Technical standard for fuel systems of motor vehicles fueled by compressed hydrogen gas

)44.8841.26

Forschungszentrum Karlsruhe