Isabelle Contrucci

Emmanuelle Klein

Ngoc-Tuyen Cao

Xavier Daupley

Pascal Bigarré

Multi-parameter monitoring of a solution mining cavern collapse: first insight of precursors

Keywords: collapse, induced microseismicity, surface leveling, early warning system, environmental safety, salt cavern, near-surface geophysics effondrement, microsismicité induite, mesure de déplacement de la surface, système d'alerte précoce, sécurité environnementale, cavité saline, géophysique de surface

In order to improve our understanding of the large-scale ground failure phenomena caused by old underground mining works, a solution mine was instrumented in 2004 prior to its collapse as part of its mining scheme. A permanent monitoring system was set up, including a high-resolution microseismic network linked to a surface field-displacement measurement system. The large amount of data transmitted for on-line processing provided daily insight into the evolution of the geological system. First, microseismic activity showed upward progressive failure migration throughout 2008 without any significant surface movement. Second, after two days of intensive brine extraction, a high microseismicity and energy release rate marked the failure of a thin and very rigid bed at a depth of 120 meters. This failure occurred 24 hours before the final collapse; it was followed by transient brine pressure signals, and by acceleration of the surface subsidence rate, reaching 1 m/h in the final phase. Résumé. Pour améliorer notre compréhension des phénomènes d'effondrement minier à grande échelle, nous avons instrumenté, en 2004, une cavité saline exploitée de manière intensive par dissolution jusqu'à l'effondrement des terrains de recouvrement. Un système de surveillance permanent comprenant un réseau microsismique haute résolution et un système de mesure de déplacement de la surface a ainsi été mis en place. Le traitement en quasi-temps réel des données a permis de suivre de façon journalière l'évolution de la cavité. Durant l'année 2008, l'activité microsismique a montré une migration progressive vers le haut de la fracturation, sans mouvement significatif de la surface du sol. Puis, après deux jours d'extraction intensive de la saumure, l'importante microsismicité et l'énergie libérée ont marqué la rupture d'un banc raide de faible épaisseur situé à 120 mètres de profondeur. Cette rupture a eu lieu 24 heures avant l'effondrement généralisé ; il a été accompagné de variations de pression de saumure dans la cavité, ainsi que d'une accélération du taux de subsidence atteignant 1m/h dans la phase finale.

Introduction

In France, societal expectations for enhanced risk mitigation at hundreds of mining concessions and abandoned cavities (caused by surface subsidence or collapse, changes in surface and subsurface hydrology, water pollution, gas emission, etc.) have drastically changed since the late 1990s. The catastrophes that took place in 1996 and 1998 in a few cities affected by large-scale ground failures clearly posed a major challenge to both central and local authorities. These bodies then developed and introduced a coherent risk assessment and management strategy to deal with post-mining risks. This strategy relies on a complete step-by-step assessment of post mining risks at a national scale. Areas classified as having a high, or unacceptable, level of risk are then required to adopt a risk-reduction policy based on prohibiting construction and lowering the dangers associated with surface infrastructure and human activity. In many cases, the potential social and economic impacts require a monitoring of hazardous underground cavities. This consists of implementing early-warning systems to predict a disaster, and enable timely actions for public safety. Until now, in highrisk areas, the microseismic technique has been the most successful in providing very sensitive volumetric monitoring over extensive urbanized areas [START_REF] Couffin | Permanent real time microseismic monitoring of abandoned mines for public safety[END_REF][START_REF] Senfaute | Qualification of the microseismic monitoring technique applied to the risk of collapse or iron mines[END_REF]. However, the lack of any feedback from adequately-instrumented ground collapses has not allowed researchers to answer basic questions concerning early-warning signs and the mechanisms and dynamics of failure [START_REF] Contrucci | Management of post-mining large-scale ground failures: blast swarms field experiment for calibration of permanent microseismic early-warning systems[END_REF][START_REF] Tastet | Large-scale field experiment to calibrate microseismic source parameters applied to real-time monitoring of post-mining instabilities[END_REF], although numerical modeling approaches have provided some insights into these issues (e. g. [START_REF] Bérest | The 1873 collapse of the Saint-Maximilien panel at the Varangéville salt mine[END_REF][START_REF] Dris | Numerical modelling and mechanical behaviour analysis of ancient tunnel masonry structures[END_REF][START_REF] Heib | On numerical modeling of subsidence induced by mining[END_REF].

It is in this context that the Cerville-Buissoncourt experiment was undertaken by the partners of GISOS, a scientific consortium including the government research organizations INERIS, BRGM, and LAEGO, in collaboration with the Solvay mining company. This experiment consists of the field monitoring of a solution mine in the Lorraine salt basin, south of Nancy, France [START_REF] Mercerat | Sismicité induite et modélisation numérique de l'endommagement dans un contexte salin[END_REF][START_REF] Driad-Lebeau | Suivi d'une cavité saline jusqu'à son effondrement: analyse microsismique[END_REF].

In this article, we briefly describe the field instrumentation deployed by INERIS between 2004 and2009. This comprises a SYTGEM multi-parameter system (Klein et al., 2008a) featuring high-resolution microseismic sensors combined with ground-surface monitoring. Some preliminary results will then be presented, focusing on the complementary features of microseismic and subsidence measurements in enabling the description of the main stages of cavern development. A special emphasis on the collapse period (February 10-13, 2009) will help to identify the contributions of the multi-parameter approach to the management of ground instability. Finally, a preliminary analysis of the microseismic patterns observed before the collapse in terms of the completeness of the seismic catalogue and b-value will be presented.

Site description and geological setting

The Cerville-Buissoncourt site, in the Nancy salt basin, has been exploited by the solution mining method since 1997, using the channel and drilling technique (Figure 1-a). The field is mined by dissolution, with water injection via two parallel, aligned well casings into the base of the salt deposit at a depth of some 280 meters. A 1 kilometer-long brine channel is created, leading to extraction wells placed downstream. This channel evolves progressively into a large cavern developing upwards. Once the cavern reaches the roof of the salt deposit, generally upstream, it advances by breaking through the roof, consisting of marls, until it reaches a critical stage. The overlying ground then collapses and a large crater appears on surface, with a lateral extension adjacent to the underground cavern (Figure 1-a).

The geology of the site is characterized by a succession of sub-horizontal layers from the ground surface down to the salt deposit (Figure 1-b). Four main geological facies can be distinguished: a first series of strata comprising a succession of marls, marly limestone, sandstone, and anhydrite marls, with depths ranging from 0 to 123 meters; an unfractured, relatively thin but very rigid stratum of dolomite and anhydrite (known as the Beaumont Dolomite) from 123 to 132 meters; and poorly-consolidated anhydrite marls ranging in depth from 132 to 200 meters. Finally, the salt deposit is encountered at a depth of ~ 280 meters. In the present case, the cavern geometry, initiated during the 2000-2003 period, was first evaluated using sonar measurements obtained by Solvay. At the end of 2004 the cavern roof was located at a depth of 183.5 meters (Figure 1-b).

On one hand, the low mechanical strengths that characterize the strata overlying the Beaumont Dolomite indicate that it cannot play any significant role in the geological stability of the mine. On the other hand, the dolomite-anhydrite layer, which is characterized by a remarkable homogeneity, shows very high strengths [START_REF] Nothnagel | Modélisation des instabilités en Mécanique des Roches: application à l'exploitation de la concession de Drouville[END_REF]. It is therefore generally accepted that the stability of the overburden is primarily controlled by this very rigid layer, i.e., a general ground collapse will be triggered by the failure of the Beaumont Dolomite.

Instrumentation layout

This expected ground-failure process led to the installation, in 2004, of a high-resolution microseismic monitoring network comprising nine permanent seismic probes, including four oriented three-component sensor. All probes were equipped with subminiature omnidirectional geophones with a clean response between 40 Hz and 1 kHz and preamplifiers to ensure a high signal-to-noise ratio. They were cemented into boreholes geometrically distributed over the site for optimal azimuth coverage, at depths ranging from a few meters to 125 meters. Note that the so-called M6 station was equipped with 3 probes spread in a single vertical borehole centered directly above the cavern, with the deepest probe (M6.3) located within the dolomite layer (Figure 1-b). The 16-bit acquisition unit was set up to detect microearthquakes using a standard trigger algorithm based on the amplitudes of the incoming signals. The data were sampled at a frequency of 8 kHz per channel; they were automatically relayed to INERIS Nancy for real-time processing.

In 2008, this high resolution microseismic monitoring network was coupled to a surface leveling device comprising an automatic tacheometer linked to a line of 17 targets and a GPS-RTK (Real Time Kinematic) measurement system, as shown in Figure 1-b. The line of targets crossed the area of interest, i.e., the expected collapse area, so as to measure dynamic subsidence profiles versus time. The GPS monitoring system worked on the basis of GPS RTK measurements to precisely monitor the subsidence by employing to a high stacking rate (1 measurement per second over 20 minutes) without any off-line processing. The system comprised two receivers (Figure 1-b): one as the reference placed in a stable reference area, close to the acquisition unit, and the second positioned at the very center of the expected collapse area. The microseismic data were automatically transferred to INERIS Nancy.

Brief overview of the data processing and the precision of the measurements

The automatic on-line microseismic data processing was performed by the SYTMIS software.

It was parameterized on a routine basis included P-wave picking using an STA/LTA algorithm [START_REF] Allen | Automatic phase pickers: their present use and future prospects[END_REF] and 3-D location of events based on the non-linear inversion method [START_REF] Contrucci | Management of post-mining large-scale ground failures: blast swarms field experiment for calibration of permanent microseismic early-warning systems[END_REF][START_REF] Lomax | Fast, probabilistic earthquake location in 3D models using oct-tree importance sampling[END_REF]. In practice it was difficult to achieve reliable automatic on-line S-wave picking and thus improved 3-D location, although polarization analysis frequently demonstrated the presence of S-wave energy in the seismograms. This observation, which has already been made in other contexts [START_REF] Spillmann | Microseismic investigation of an unstable mountain slope in the Swiss Alps[END_REF], requires further investigation. Moreover, the S and P phases may overlap on seismograms, thus making the automatic S picking impossible. This means that far-field assumptions were not always valid during the experiment. In addition, some seismograms did not show any S arrivals: in such cases it was therefore necessary to define a criterion for S-waves that were not automatically picked. For these reasons we chose not to use these S phases for automatic location.

The structure of the velocity model used in the location algorithm was obtained from a seismic profile acquired on the site [START_REF] Piwakowski | High resolution seismic investigations in salt mining context[END_REF][START_REF] Suffert | Etude d'une cavité saline par méthodes sismiques[END_REF] : it comprised 3 layers, whose P-wave velocities were determined by re-locating a series of calibration blasts carried out on surface in 2005. The discrepancies between the known and calculated positions of the blasts were then minimized by considering: (1) the first series of geological strata, from 0 to 123 meters deep, with average P-wave velocity taken as 3000 m/s; (2) then from 123 to 132 meters depth, for the dolomite layer, the P-wave velocity being taken as 5000 m/s; (3) from 132 meters onwards, for the marls and salt formations, the P-wave velocity being taken as 4000 m/s. When considering P-wave arrivals as the only input data to the location algorithm, the re-location error is around 12 meters. The 3-D location error may however reach 60 meters because the geological structure overlying the cavern had dramatically changed between the beginning of the experiment and its end, undoubtedly leading to high contrasts in the seismic velocities. However, even if this paper does not attempt to provide a complete analysis of the microseismic data set, some general characteristics of the recorded events will be presented.

Finally, concerning the surface-displacement measurements, no particular data processing was necessary. In fact, the accuracy of +/-5 mm for the GPS-RTK measurements that was obtained as a consequence of the short inter-receiver distance and the high stacking rate was sufficient for a detailed analysis (see next paragraph). The data collected by the tacheometer, although strongly sensitive to meteorological variations, showed a similar precision for the closest targets when applying a simple moving average to a few measurement cycles.

Recorded data: general characteristics and temporal evolution up to the general collapse

The monitoring, which started in late 2004, showed very few microseismic events for several years, until February 2008. Only two microseismic swarms were observed, on May 8 and 31, 2007, lasting less than 24 hours, with 622 and 226 events respectively recorded [START_REF] Mercerat | Induced seismicity monitoring of an underground salt cavern prone to collapse[END_REF] (Figure 2). After March 2008 the microseismic trend was marked by several episodes of major activity (more than 10,000 events recorded in a few days) and a change in the background noise, with as many as 25 events per day (Klein et al., 2008b) (Figure 2). Moreover, the migrations of the microseismogenic zone in space and time clearly indicated a generally vertical development of the cavern dome along with an apparent lateral dissymmetry (Figure 4-a). These observations were confirmed by gamma-ray well-log readings showing that several massive (~ 500,000 m 3 ) collapses of the marl roof rocks occurred between February and May 2008 with a transverse asymmetric roof elevation (Klein et al., 2008b).

At that point, a decision was made to permanently close all surface access to the zone, even though no significant subsidence had been observed. At that time, the upper portion of the geological sequence was nevertheless showing a rather stiff elastic response. However, it was found that the cavern had reached critical size, based on numerical modeling considerations and expert advice [START_REF] Mercerat | Sismicité induite et modélisation numérique de l'endommagement dans un contexte salin[END_REF] During the first day of pumping, neither significant microseismicity nor surface subsidence could be observed. The impact of the lowering of the brine level began to take effect at the end of the second day with a sudden acceleration of the microseismic energy release rate, indicating more than 1,500 events in one hour (Figure 3-a). This microseismic swarm coincided with a dynamic rise of 9 meters in the brine level and marked a change in the subsidence regime (Figure 3-b), whose velocity then reached ~0.2 cm/h. Beyond that stage, the sustained microseismic activity increased rapidly, more steeply than during any other period. From that point on, the pumping regime was not powerful enough to compensate the rise in the brine level at the extraction wells, owing to the pressure applied to the system by the overburden. The major activity peak occurred early on the third day, when the cumulative subsidence reached ~0.40 meters, with an instantaneous velocity of 2.5 cm/h. This initially coincided with loud acoustic noises heard on site, and later on with the breakdown of the microseismic probe installed in the Beaumont dolomite layer at a depth of 125 meters. These observations, along with on-line 3-D location results show that this major activity peak is related to the overall failure of the Beaumont dolomite layer. This major peak was then followed by an acceleration in the subsidence rate, which ultimately reached 1 meter per hour. Less than 24 hours later, the ground surface collapsed, forming a crater ~ 150 meters in diameter.

More than 30,000 events were recorded during the last four days preceding the collapse. The last GPS measurements, during the ground collapse and flooding of the zone, indicated a cumulative subsidence of more than 4 meters in the center of the area (Figure 3-b).

Preliminary analysis of the microseismicity patterns observed before the collapse

The frequency-size distribution of the events, i.e., the Gutenberg-Richter [START_REF] Gutenberg | Seismicity of the Earth and Associated Phenomena[END_REF] scaling law, was estimated for a sample of the microseismic data set recorded before the first activity peak (Figure 3), as described earlier. Our general approach in this analysis follows the method used in [START_REF] Amitrano | Seismic precursory patterns before a cliff collapse and critical point phenomena[END_REF] to estimate an apparent b-value as a seismic precursor sign before a cliff collapse, in an experiment carried out by INERIS as part of the PROTECT EU Project. The following formula was then used:

N (>E) ~ E -b
(1)

where N(>E) is the number of events of energy larger than E, and b is a constant known as the b-value.

Here, to reach the maximum completeness of the catalog, the average energy recorded by two 3-D probes (M3 and M5) located about 150 m from the center of the cavern is considered.

The energy is not corrected by using the event-sensor distance to take into account nonlocalized events (a large amount of data is still being processed). The average energy at the two selected probes also helps to compensate for the attenuation effect which may produce a bias in the event-size distribution and the b-value estimation, as shown by [START_REF] Weiss | The role of attenuation on acoustic emission amplitude distributions and bvalues[END_REF].

Indeed, the same author shows that if a power-law distribution is observed on a reasonably large range of magnitudes with a b-value lower than 3, this b-value is representative of the original distribution [START_REF] Weiss | The role of attenuation on acoustic emission amplitude distributions and bvalues[END_REF]. This is the case for the data set considered here: b-values are not greater than 0.9 and all microseismic events (Figure 5-a) at two different probes. An apparent b-value can then be deduced using this approach [START_REF] Amitrano | Seismic precursory patterns before a cliff collapse and critical point phenomena[END_REF].

Variations of the apparent b-value with time were calculated using a sliding window of 100 events shifted by 10 events on a sample of 1,030 microseismic events (Figure 5 (2)

where dN(t)/dt is the event rate, and t p1 the time of the first peak. The power law obtained fits the data with a correlation coefficient of R 2 = 0.75.

Conclusion

On preliminary analysis, the complete data set recorded during the Cerville-Buissoncourt experiment made it possible to follow the main stages in the evolution of the solution mine.

Early signs of unstable development were detected by high-resolution microseismic monitoring during the spring of 2008: a shift in the microseismic background regime as well as recurrent microseismic episodes were associated with a general process of rock failure caused by the cavern growing upwards. This was accompanied by a few episodes of massive roof falls, with no ground-surface movement detected. During a second and final stage of development, which lasted three days, the cavern collapse was triggered by brine pumping.

Three main microseismic regimes were then observed, each being well correlated with changes in both the surface subsidence rate and the brine level in the cavern. The first peak of activity, once again due to massive roof falls below the Beaumont dolomite layer, also initiated the brittle rupture of this bed. The second and major peak of activity marked its rapid and high-energy failure; it also corresponded to an acceleration in the subsidence rate. The last activity peak, a few hours later and weaker in terms of number of events and energy released, marked the final collapse.

The complete dataset confirms the major role of the Beaumont dolomite layer in the site's stability. In addition, while the preliminary analysis of the microseismicity patterns immediately before the general collapse confirms that the acceleration in the microseismic activity follows a power law, it also shows that the b-value is a complex marker in such a context. Although local falls in the b-value correlate well, as expected, with local increases in the release of microseismic energy, it seems inappropriate to use it for forecasting purposes: over a short period of time, several b-value decreases are observed while a continuous pumping regime is being applied to the system. It appears that variations in the b-value do not show a clear precursor pattern, as observed in other case-studies (e.g. [START_REF] Amitrano | Seismic precursory patterns before a cliff collapse and critical point phenomena[END_REF][START_REF] Urbancic | Space-time correlations of b values with stress release[END_REF][START_REF] Scholz | The frequency-magnitude relation of microfracturing in rock and its relation to earthquake[END_REF]. Nevertheless, further investigations covering the various stages of cavern development, including the collapse period, are needed to confirm this preliminary result.

  . To trigger an accelerated collapse, Solvay decided to progressively lower the brine level. Intensive brine extraction began on the February 10, 2009 at 7 am local time and continued until the general collapse, three days later, on February 13, 2009 at 5:45 am local time. Figure 3 shows the microseismic activity recorded during that period versus: (a) brine level and (b) subsidence. This figure also illustrates the extraction regime which was divided into two main phases: 1-a first pumping stage with a decrease in the brine level of 50 meters; 2-semi-continuous pumping until the collapse, at a rate of 400 to 600 m 3 /h.

  -b) that occurred over a period of 42.5 hours before the first microseismic peak (between 00:22 UT on February 10 and 18:30 UT theFebruary 11, 2009). Each b-value was associated with the last microseismic event of the window, so the apparent b-value was calculated from the 100 events occurring before the end of the window in question. Over the entire period considered, the mean apparent b-value is 0.63 ±0.02 using the average sensor energy of the M3 and M5 probes. It is 0.60 ±0.02 when considering only the M3 probe and 0.63 ±0.01 for the M5 probe (Figure5-a). The energy recorded by the M5 probe is slightly lower than the one recorded by the M3 (Figure5-a). In the next section the apparent b-value is related, by default, to the average energy of the two probes M3 and M5.At the beginning of the period, a high b parameter is observed (Figure5-a-b), corresponding, as expected to low-energy seismic events. On Feb. 11, 2009 at 06:45 UT, i.e. 11 hours before the first microseismic peak, an abrupt change in the apparent b-value is observed, from 0.75 ±0.02 to 0.52 ±0.01 (Figure 5-a-b). It is correlated with a local increase in the microseismic sensor energy (7.2 10 -5 J) and activity (~70 events/h) and a decrease in the brine level of ~5 m (Figure 5-b). The apparent b-value then continues to decrease for four hours, reaching a minimum value of 0.45 ±0.03. After this point several apparent b-value variations are observed, directly linked to the microseismic regime (Figure 5-b): falls in the b-value are related to the occurrence of strong events (Figure 5-b). The last main drop-off in the b parameter, at 18:00 UT on Feb. 11, 2009, is correlated with the onset of the first main peak of activity (~1640 events/h, Figures 3-a and 5-b) which also corresponds to the critical point beyond which the pumping is no longer powerful enough to offset the rise in brine level (Figure 5-b). The associated microseismic surge can then be described by the following power law (Figure 5-c):dN(t)/dt ~ (t p1 -t) -1.3

Figure 1 :

 1 Figure 1: a) Layout diagram illustrating operations using channels and drill holes: (left)

Figure 1 :

 1 Figure 1: a) schéma de principe illustrant l'exploitation par pistes et sondages : (à gauche) création d'un chenal de communication à la base du gisement, (au centre) création puis

Figure 2 :

 2 Figure 2: Microseismic activity and cumulative recorded energy of the site from February

Firgure 2 :

 2 activité microsismique et énergie cumulée enregistrées sur le site de février 2008 à février 2009. Notez que la crise de mars-avril 2008 est faible comparée à la crise majeure de l'effondrement où 30 000 événements microsismiques ont été enregistrés.

Figure 3 :

 3 Figure 3: a) Number of microseismic events recorded on site and brine level measured at one

Figure 3 :

 3 Figure 3: a) nombre d'événement microsismiques enregistrés sur site et niveau de saumure mesuré au puis d'extraction (à 1 km de la cavité) entre le 10 et le 13 février 2009. Notez que

Figure 4 :

 4 Figure 4: a) View of the microseismogenic zone located over the roof of the cavern during

Figure 4 :

 4 Figure 4: a) vue de la zone microsismique au toit de la cavité saline, pendant la crise de 2008,

Figure 5 :

 5 Figure 5: a) Cumulative distribution of the seismic energy recorded by the M3 and M5

Figure 5 :

 5 Figure 5: a) distribution cumulée de l'énergie sismique enregistrée par les sondes M3 et M5

  Figure 1

Acknowledgments.

This work was undertaken with the financial support of the French Ministry of Mines, the Lorraine Region, and the Ministry of Environment. We also thank Solvay for making available the technical and human resources involved, without which this large-scale scientific experiment could not have taken place. The authors also thank their GISOS partners for their collaboration. We also wish to acknowledge all the people who have been involved in this project since 2004: L. Driad-Lebeau, G. Senfaute, C. Nadim, L. Cauvin, the AS2G team (INERIS), P. Bernard, D. Mercerat (IPGP), O. Hernandez (INERIS, now at the University of Montpellier), M. Pierson, J-L Vautrin, and H. Martin (SOLVAY). We also thank the two anonymous reviewers, and M. Campillo (editor), who made pertinent remarks that helped us to significantly improve the paper.

 c)


Clément Lenoble

Clarisse Durand

Keywords: AZF accident, probability, land-use planning, frequency, safety barrier, risk assessment, bow-tie, major accident

teaching and research institutions in France or abroad, or from public or private research centers.

INTRODUCTION OF FREQUENCY IN FRANCE FOLLOWING THE AZF ACCIDENT

Clément LENOBLE * , Clarisse DURAND **

LESSONS LEARNED FROM THE AZF ACCIDENT

The AZF accident

The AZF factory belonged to Grande Paroisse (company detained by the TotalFinaElf group). At the time of the accident, the factory had 469 employees and a turnover of 100 M€. The factory, located 3 km from the centre of Toulouse (France -750,000 people in 2001) and surrounded by a urban environment, produced fertilizers and a variety of chemical products.

The accident: On September 21, 2001, at 10:17 AM, a huge detonation occurred in the nitrates area of the factory. The explosion was felt up to 75 km and was compared with an earthquake with an intensity of 3.4 on the Richter scale. An analysis of the consequences has led to estimate a TNT equivalent between 20 and 40 tons [START_REF] Barthélémy | Usine de la société Grande Paroisse à Toulouse, Accident du 21 septembre 2001[END_REF]. Windows broke up to 7 km and more than a thousand buildings were destroyed.

After the explosion, important clouds of dust and red fumes containing oxides of nitrogen and ammonia were emitted.

Human and social consequences:

The accident left 31 people dead: 21 on the AZF site, 1 on a neighbouring factory and 9 in the vicinity of the site. Thousands of people were hospitalized (the Haute-Garonne Prefecture counted a total of 2,442 people as of 17 October 2001). The observed pathologies were mutilations, explosions of eardrums and pleura, bruises on spleen and liver, as well as fractures and wounds due to the blast wave, the falling-down of structures, broken glass or projections… For thousands of people, the AZF accident was a major traumatic experience. Approximately 5,000 people consulted their general practitioner for acute post-traumatic stress during the first few days after the disaster (INVS, 2002). According to experts, these numbers are underestimated as they only take into account the individuals who sought medical care. The explosion was responsible for psychological problems (depression, anxiety…).

Environmental consequences:

The explosion destroyed some of the tanks containing ammonium nitrate and led to nitric acid leaks. Nitrogenous and ammonia releases polluted the Garonne river and entailed a fish mortality.

Economic consequences:

The AZF plant and the neighbouring factories were destroyed. About 1,300 firms (hiring approximately 21,000 people) were severely impacted by the accident [START_REF] Dechy | Damages of the Toulouse Disaster, 21 st September 2001[END_REF]. The consequences were also dramatic on roads, and public buildings such as schools, colleges, hospitals… All in all, 25,000 dwellings were damaged, 11,180 of which severely [START_REF] Aria | Explosion in a fertilizer plant -September 21 st , 2001 -Grande Paroisse Toulouse[END_REF]. More than a thousand were completely destroyed and more than 1200 families had to be rehoused in emergency after the disaster.

Insurance companies appraised the overall economic consequences up to 2 billions € [START_REF] Aria | Explosion in a fertilizer plant -September 21 st , 2001 -Grande Paroisse Toulouse[END_REF].

Emergency response:

The external emergency plan was activated. A crisis centre was installed within the establishment. In total, 1,430 firemen and military men, 950 policemen, about 50 doctors, 32 nurses and 80 emergency medical technicians were called up [START_REF] Aria | Explosion in a fertilizer plant -September 21 st , 2001 -Grande Paroisse Toulouse[END_REF] .

A security perimeter was set up within a 500-meter radius. Many buildings and schools were evacuated. In the vicinity of the site, the air, railway and road traffic was entirely stopped.

Causes and circumstances of the accident: Downgraded nitrates were stored in the shed 221 and were transported from different parts of the factory by subcontractors. At the time of the accident, that shed held between 300 and 400 tons of ammonium nitrates. According to the final legal expert report concluded that it was a chemical accident, due to an accidental combination of sodium dichloro-isocyanurate (SDICa product used for water treatment) and ammonium nitrate, causing the explosion. The operator has always disproved this theory.

Legal action: Grande-Paroisse (as a legal entity) and the plant manager were charged with involuntary manslaughter and wounding. The investigation gathered up to 140 policemen (judicial police and forensic and technical police laboratories) and 40 legal experts and lasted more than five years. The four-month trial ended on July 1, 2009 and the verdict is due on November 19, 2009.

Deficiencies identified

A thorough analysis of the accident has led to identify some deficiencies:

-The safety report of the AZF factory did not take into account the downgraded ammonium nitrates store since it was considered as less dangerous (because of the smaller quantity stored). As a matter of fact, the safety report did not describe each possible accident scenario.

-Urbanization has considerably spread out in the vicinity of the site since the launching of the chemical activities. At the time of the accident, the chemical site was surrounded by business parks, hospitals, dwellings… -People living around the industrial site were not perfectly aware of the potential risks of such an establishment.

-The ammonium nitrate storage facilities were not directly managed by the AZF company but by a subcontractor, whose knowledge of the products and the site could sometimes be incomplete. In addition to the 469 AZF employees, 80 people regularly worked on the site and were hired by nine different subcontractors.

As a consequence, the French government clearly stated the need to reassess the whole approach of risk analysis and land-use planning and also to improve the information to the public and the consideration of subcontractors.

1.3The Law of July 30, 2003 and its mainstays

As a starting point, it is interesting to recall that in France, regulations regarding risk prevention and risk management are the result of more than 200 years of legislation, the evolution of which has often been consecutive to industrial accidents. The accident of the gunpowder factory that occurred in Paris in 1794 led to more than a thousand casualties. It brought about the imperial decree of October 15, 1810 about the factories that were sources of nuisances or risks. Three categories of factories were then defined (hazardous, insalubrious or causing inconvenience) and the first elements of land-use planning were enacted. This decree as well as the law of December 19, 1917 regarding "dangerous, unhealthy and inconvenient establishments" have established the fundamental rules for risk prevention and land-use planning in France.

The law of July 19, 1976 has modernized and updated the monitoring of classified installations according to the risks or nuisances that they generate. On the European level, the council directive 82/501/EEC on the major accident hazards of certain industrial activitiesso called the Seveso directivein 1982, laid the bases of a common policy for the prevention of major industrial accidents. The "Seveso II" directive, in 1996, introduced important changes and new concepts, such as safety management systems, emergency plans and land-use planning.

Six years after the publication of that directive and two years after the AZF accident, the law of July 30, 2003 was introduced. It does not only deal with industrial disasters but also with natural disasters, as a response to floods that happened in France (caused by the rivers Somme, Gard and Hérault).

The law of July 30, 2003 regarding the prevention and repair of the damage caused by industrial and natural disasters, along with government actions, has enabled to focus on the following priorities: -Increase of the number of inspectors and improvement of their training curriculum for a better regulation of the classified installations and for a more efficient control force: between 2001 and 2008, the number of inspectors increased by 40%. In 2009, there are approximately 1,400 inspectors in France, including 400 to 500 specialized in Seveso establishments. Since 2005, the training curriculum for inspectors has also been expanded and improved. Within the first 6 to 8 months after the taking up of the position, inspectors have to attend two one-week courses about the legislation and regulation concerning industrial plants and specific regulations regarding water and air emissions, wastes, noise nuisances… Then, over the course of the first three years, nine general courses about industrial risks, crisis management, soil contamination, etc. have to be taken. For Seveso inspectors, more specialized courses about the safety report, safety management system, land-sue planning… are highly recommended. Moreover, the inspectorate has committed to inspecting every year each of the 2,000 high priority establishments (including the Seveso establishments) and every three years each of the 8,000 establishments at stake.

-Creation of interregional units specialised in technological risks: their role is to provide assistance on the assessment of the safety reports of Seveso establishments of several départements. It allows as well to harmonize the decisions and to ensure the circulation of best practices.

-An Emergency Unit (CASU in French, standing for Cellule d'Appui aux Situations d'Urgence) has been created within France's National Institute of Industrial Environment and Risks. Experts can be mobilized 24-hour a day in case of an accident, in order to estimate the consequences and improve the emergency response.

-Development and improvement of the technological accidents database, named ARIA (on the website www.aria.developpement-durable.gouv.fr). It now makes available the details of more than 32,000 accidents and is continuously updated.

-A better information to the public about major industrial risks: The AZF accident highlighted the need of a better and more easily accessible information: The law of July 30, 2003 provides the creation of a local information and dialogue committee (in French, a CLIC, standing for Comité Local d'Information et de Concertation) around the most dangerous establishments. Their role is to promote communication about risks between the public authorities, the operators and the civil society. Besides, the permits of Seveso establishments are made available on the Internet, possibly with some publications of the results of inspections. In October 2003, France ratified the UN/EEC Convention on the transboundary effects of industrial accidents. It aims at preventing industrial accidents that can have transboundary effects, preparing for and responding to them. This convention deals with exchanges of information in case of an accident and providing a mutual assistance. Moreover, the law of July 30, 2003 lays upon sellers or landlords to inform potential purchasers or renters about the technological or the natural risks regarding the property.

-An improvement of the involvement of employees and subcontractors in risk prevention, so that each person on site gets the same level of knowledge. It is important to draw the attention to the importance of the human factor in accidents: in 2008, 61% of accidents were caused by organizational and human factors (Technological accidents inventory 2008). Under the law of July 30, 2003, all employees and subcontractors are kept informed through their representation in CLIC and in the working conditions, hygiene and safety committee (in French, CHSCT, standing for Comité d'Hygiène, de Sécurité et des Conditions de Travail).

-An improvement of the victims' compensation: The law of July 30, 2003 has described the notion of a technological disaster, that has to be inspected by official authorities. Within three months after the disaster was officially declared or after the property damages were assessed, insured people receive a compensation. As for people who are not insured against technological disasters, they get a compensation thanks to a guarantee fund.

-Complete review of the regulations regarding risk prevention: For some industrial sectors, the regulation has been made tighter (for instance, the regulation regarding silos, pyrotechnics, organic peroxides, petrol stations...). A national technical working group has been created at the end of 2008 to think about the ageing of industrial sites.

-New methodology for risk assessment and safety reports: Before 2003, risk assessment was based on the worstcase scenario. It was a deterministic approach. The law of July 30, 2003 now requires that the risk analysis takes into account the probability of occurrence, the kinetic and the gravity of potential accidents (article 4 of the law). It allows to assess precisely and objectively the acceptability of an industrial site in its environment. It can highlight the need for reducing the risks at the source, by cutting down the potientiel de danger (potential of danger), or reducing the probabilities of occurrence of the potential accidents and limiting the consequences through organizational and technical safety measures. The lessons learned from other "probabilistic" regulations (for instance, the Dutch or the British regulations, the French regulation regarding the nuclear plants...) have proven extremely useful.

Then, in order to have a consistent implementation throughout the country, the following actions have been carried out:

-21 technical working groups have been created between 2002 and 2003. They cover many industrial sectors or substances, such as ammonium nitrates, LPG, chlorine, ammonia, flammable liquids, pyrotechnics, refineries... Inspectors, policy advisers, representatives of operators and technical experts are members of these groups.

Their goal is to harmonize the practices within a same industrial sector and to share experience between the inspectors and the operators.

-A guideline describing the "General principles for the elaboration of safety reports" has been issued in 2006 (circular of [START_REF]Guidelines for Quantitative Risk Assessment-"Purple Book" CPR18E[END_REF]. It reviews all the elements that should be featured in a safety report. This circular makes also available other guidelines regarding for instance the human factor, the assessment of the gravity of an accident , BLEVE and UVCE in LPG units, etc. -France's National Institute of Industrial Environment and Risks (INERIS) has published many scientific documents about the new risk assessment methodology. They are useful tools for both inspectors and operators.

The safety report is a key element, as its results are directly used for decision making. The government has indeed developed a risk matrix for assessing the societal acceptability of the risk generated by a Seveso establishment (circular of September 29, 2005). The input data are the probabilities of major accidents and the number of people potentially exposed to their consequences. The matrix (see figure 1 below) defines three levels of accidental risk:

-Acceptable (in white the matrix): the risk is acceptable.

-Unacceptable (in red): the risk is too important.

-ALARP (As Low As Reasonably Practicable, in yellow): the risk has to be reduced in order to become "as low as reasonably practicable". New and existing establishments are distinguished:

-New establishments are authorized if there is no accident in the red zone and if the operator proves that the best available technologies for both prevention and protection are used on the site.

-For existing establishments:

-If there is one accident (or more) in the red zone, the safety must be improved in order to reduce the gravity or the probability and, as a matter of fact, translate the accident in the yellow zone. If accidents still remain in the red zone in spite of an improvement of the safety, the establishment is liable to be closed by the Conseil d'Etat1 .

-If there are accidents in the yellow zone, the operator has to add additional safety measures in order to reduce the risk as low as possible, given an acceptable cost/effectiveness ratio. -If there is no accident in the red or yellow zones, the risk is considered as moderate provided the use of the best available technologies on site.

-Moreover, the law of July 30, 2003 involves safety reports for transport infrastructures where large quantities of dangerous goods can be momentarily in presence. The intended infrastructures are the sea-and river-ports, marshalling yards and important parking lots.

-Overhauling of the land-use planning policies: the Technological Risk Prevention plan (PPRT in French, standing for Plan de Prévention des Risques Technologiques) is one of the flag-ship measures of the law of July 30, 2003. The aim of the PPRT is to protect people by acting on the existing urbanization and also by controlling the future land-use planning in the vicinity of the existing top-tier Seveso establishments.

The whole process of the PPRT elaboration is carried out in cooperation between the local authorities, the operator, the CLIC representative and the residents. The lead-time is estimated at approximately 18 months. The most important stages are the following:

-Determination of the aléa2 by combining the probability of a dangerous phenomenon and the potential intensity of its effects. Aléas are calculated for each point of the territory and for each type of effects (thermal, overpressure and toxic effects). -Analysis of the stakes in the vicinity of the establishment. The types if construction and public buildings are distinguished. -Cross-reference of the aléas and the stakes, allowing to draw a zoning map.

The PPRT process is summed up on the following figure. When the PPRT is finalized, it delineates a risk exposure perimeter, at the heart of which regulated zones are established. These zones can be either:

-"ban zones", within which future constructions are banned (red zones on the figure 2 below). Inside this zone, areas can be defined for expropriation (dark red areas on the figure 2 below) or relinquishments (dark or light red areas on the figure below).

or "limitation zones", within which protective measures on the future or existing buildings can be compulsory (blue zones on the figure 2 below). The real-estate measures (expropriation and relinquishment) and additional risk reduction measures are evaluated to approximately 3 billion €. The financing of these measures is subject to a three-way financial agreement between the State, the operator and the local authorities.

The law of July 30, 2003 has hallowed the use of probabilities and frequencies into the French legislation and regulations regarding industrial risks. The risk analysis, at the heart of the safety report, has now to take into account the probability of occurrence, along with the kinetic, the gravity of the potential accidents. Then, combined with the gravity of potential accidents, the probability allows to assess the acceptability of an industrial establishment in its environment and the demonstration of risk control. As for land-use planning, probabilities are used for the calculation of the aléas, jointly required with an analysis of the stakes, for the elaboration of the PPRT.

PROBABILISTIC ASSESSMENT METHODOLOGIES USED IN FRANCE IN COMPULSORY SAFETY REPORTS

The French safety report comprises, among other things, a risk analysis and an assessment of major accident probabilities. In this second part, we will focus on the scenario identification realized through the risk analysis, on the methodologies used for assessing the reliability of safety barriers and on those used for assessing the central event frequencies. The methodologies and data used in order to assess the dangerous phenomenon from a central event frequency will be not detailed here. This includes in particular the use of ignition probabilities and meteorological data.

Scenario identification

The use of probabilistic concepts has turned out to be very useful. All known possible scenarios are indeed identified, analysed and graded with regards to their probability of occurrence. The probability allows studying an exhaustive list of scenarios without focusing the analysis on low occurrence probability accidents that lead to large consequences.

Under the new regulation regarding risk prevention, an industrial operator has to identify all known and possible major accident scenarios, along with their prevention and mitigation barriers. Some of the risk analysis methodologies used are HAZOP, FMEA, Preliminary risk analysis... This analysis is then followed by the assessment of the major accident probability, its kinetic and its potential consequences. The French regulation does not make compulsory a specific methodology, as long as the operator justifies his or her choice. The risk analysis usually identifies the possible central events (example: loss of containment) and their consequences (dangerous phenomena), but also, the initiating events leading to them. In order to present the results of this identification process, bow-tie diagrams have proven very useful. The figure 4 presents an example of a bow tie-diagram.

Fig. 4: An example of a bow-tie diagram

The bow-tie diagram is a combination of a simplified failure tree and an event tree. It is composed by initiating even1s in the left side of the diagram. Examples of initiating events could be a human error in a filling procedure, an impact resulting of a vehicle collision, a hammer effect... These initiating events lead to a central event which is often a loss of containment. Then, the central event leads to several dangerous phenomena such as BLEVE, boilover, pool fire, toxic cloud dispersion... Safety barriers may operate in prevention (before the central event) or in protection (after the central event). In the French regulatory framework, when protection barriers are considered, both the consequences of the success and the failure have to be assessed.

The probabilistic quantification of the scenarios is an important aspect of the safety report. Nevertheless, the qualitative identification of initiating events, central events, prevention and protection safety barriers and possible consequences realized through the implementation of the bow-tie diagram has to be considered also as a major step of the safety report. In terms of safety, this step noticeably improves the quality of the safety report.

When the identification step is achieved, the ability of the barriers to prevent the occurrence of scenario or to limit the consequences has to to be evaluated.

Safety barrier evaluation

In a French safety report, the barrier analysis is a main issue for the demonstration of the risk control. For example, the permit (or the operating authorization) process introduces the ALARP (As Low As Reasonably Practicable) concept through a risk matrix (see the 2.3 part). As before-mentioned, if the risk is considered as unacceptable or ALARP, operators have the responsibility to implement additional safety measures or to bring the proof their safety system meet the ALARP requirements. Moreover, in the land use planning process, the scenarios selected in order to define land-use restriction and modifications are defined on the basis of the probability level and the barriers implemented on the facility.

Under the French regulation, three kinds of safety barriers have been identified: technical barriers, human barriers and barriers which gather both technical and human elements (see figure 5 hereunder). In order to be considered in the French regulatory framework, a safety barrier has to meet the following requirements. It has to be3 : -Independent: the safety barrier must be independent of the cause of the scenario or of the scenario itself.

-Effective: able to fulfil the safety function that it was chosen for, in its usage context, for a period of operation process independent and independent of other safety barriers. -With a response time in accordance with the kinetic of the scenario.

-Testable.

-Covered by preventive maintenance designed to guarantee that performance levels are maintained over time.

If these requirements are met, the safety barrier can be taken into account in the probabilistic quantification of a dangerous phenomenon. It reduces the occurrence frequency of a given scenario. The question is then how does the failure probability of a barrier can be assessed, and so at which extend the presence of the barrier will reduce the frequency of a scenario. Actually, there are few data about the failure probability on-demand of a specific barrier. Moreover, the available data are generally an average of failure rates and are not applicable for a specific facility, in a specific environment.

In order to assess this value, INERIS has developed a methodology described in the Ω 10 and Ω 20 reports (INERIS 2005 and2006). This methodology is illustrated by the figure 6. The assessment is based on the evaluation of each component of the barrier with regards to three criteria: effectiveness (Eff), response time (RT) and level of confidence (LC). The level of confidence is then converted into a "risk reduction factor" (RR). The risk reduction factor represents by how much the presence of a given barrier would divide the frequency of a given scenario. For example, if there is a scenario with a frequency of 1.10 -1 and a barrier with a risk reduction factor of 10 to prevent its occurrence, this means that the frequency of the event "occurrence of the scenario and failure of the barrier" is 10 -2 . In order to assess the risk reduction factor of the whole barrier, an aggregation of the data related to components is realised using a questioning process as described in the Ω 10 and Ω 20. The level of confidence, and so, the risk reduction factor of an active barrier is calculated using an extrapolation of SIL (Safety Integrity level) defined in the norms NF EN 61 508 and NF EN 61 511. The approach described in these norms has been extended to all active barriers. Concerning passive barriers and human barriers, a maximum level of confidence has been defined through literature researches. The level of confidence is then reduced on the basis of different criteria (INERIS 2005 and2006).

Most safety reports are based on this methodology in order to assess barriers. However, some other methodologies based on the use of reliability data are also used. In this last case, reliability databases such as OREDA and EIReDA are often used.

When all identified barriers are evaluated, the frequency of major accident can be assessed.

Dangerous phenomena probability

As operators are free to choose the methodology to be used in the safety report for assessing the occurrence probability of a dangerous phenomenon, the methodologies can be very different. Since 2005, two main methodologies have been used for major accident probability assessment: -Quantitative evaluation "from the central event to dangerous phenomena"; -Quantitative evaluation "from initiating events to dangerous phenomena". These two methodologies are approximately equally used.

The figure 7 presents these two methodologies. Fig. 7: The two mains methodologies used in France for the assessment of dangerous phenomena occurrence probability

In the following paragraphs, these two methodologies will be detailed together with their advantages and limits.

Quantitative evaluation "from the central event to dangerous phenomena":

This methodology is based on the quantification of event trees using Boolean algebra. The central event, which is often a loss of containment, is quantified using generic central event data. In France, data mainly comes from the Dutch "Purple book" (CPR 18 E, 1999) or from in-house operator database compiling and synthesizing generic data available in literature.

The main advantage of this methodology is its simplicity, both for the operator to set up and for the inspector to analyse. It also takes into account the activity volume of the facility (for example, for a hoses loss of containment, frequencies are expressed by hours of use) or the sizes of equipments (for example, for a pipes loss of containment, frequencies are expressed by meters).

On the other hand, this methodology has several limits. First, if the prevention of loss of containment is a major issue for the safety of an establishment, it is not taken into account into this methodology for the probabilistic assessment. Site specific aspects like specific lay-out, possible domino effects and specific environment are also neglected. Indeed, these data aim to express an average state-of-the-art of safety without consideration of local specificities. This methodology is indeed adapted to a work which focuses more specifically on limitation of consequences. Beyond limits related to the use of generic data, available generic data themselves present some imperfections: -Generic central event frequencies are an expression of an average state-of-the-art safety in a given period. However, details on this state-of-the-art (design of equipments, norms and regulation in force...) are not always available. As a result, the exact applicability field of these data is generally unknown.

-When available, the applicability field can appear to be limited. Some of the data often used in France come from quite old studies. Examples could be frequencies derived from Bush [START_REF] Bush | des risques d'accidents susceptibles de survenir dans les établissements dits[END_REF] or [START_REF] Smith | A survey of defects in pressure vessels in the UK for the period 1962-1978 and its relevance to nuclear primary circuits[END_REF] studies. It can be also underlined that many of available data come from nuclear studies. Their applicability to the case of chemical plant is often unknown.

-A generally well accepted method used to balance the non-specific characteristic of generic data is the use of "correction factors". However, an accurate quantified evaluation of these factors implies a precise knowledge of the applicability field and distribution of causes linked to the loss of containment frequency.

-Finally, data are not always available for all chemical facility equipments (example: data related to oil depot vapour treatment unit failures).

The good quality of central event occurrence data is, indeed, a major issue for the accuracy of the quantitative evaluation "from the central event to the dangerous phenomena". Unfortunately, although it has to be noticed that some data from recent studies are available for several equipments (example: oil open top floating roof tanks), good quality data are rare in the public domain.

Quantitative evaluation "from the initiating event to dangerous phenomena": This methodology is based on the use of simplified failure trees and event trees. Two main approaches are used in order to estimate the frequency of initiating events.

A first one uses reliability data, or generic frequencies obtained by using reliability data. These data can be available for failure related to equipments. However, data related to human and organizational failures are very limited. A second one, used by INERIS, is the assessment of the frequencies through a questioning process applied to a working group (which could gather for example the risk manager of the facility, people from the maintenance, operators, etc.). Each initiating event is derived by the working group. They are expressed using frequency classes (frequency ranges). The table 1 presents the scale of frequency classes usually used. Between 10 -1 and 1 per year F1

Between 10 -2 and 10 -1 per year F2

Between 10 -3 and 10 -2 per year F3

Between 10 -3 and 10 -4 per year

Initiating events leading to a common central event are combined using AND and OR operators:

-If any of the initiating event can cause the central event, an OR operator is used. In that case, the frequency class of the central event is equal to the minimum frequency class of the initiating event;

-If multiple initiating events (and the frequency of these events are below 10 -1 ) are required for the occurrence of the central event, an AND operator is used. In this case, the frequency class of the central event is equal to the sum of the frequency classes of the required initiating event;

-If a prevention barrier exists, the risk reduction factor of the barrier is added to the frequency class of the cause, which gives the frequency class of the intermediate event.

One of the more obvious advantages of this methodology is that it results from a deep analysis of the safety and of accident scenarios that could occur, their causes and barriers that prevent their occurrence. Therefore, site specific aspects (example: domino effects) and risk prevention issues are explicitly taken into account in probabilistic calculations. In this framework, operator's safety efforts are well promoted and their effectiveness is demonstrated qualitatively and quantitatively. The main possible causes of an accident are identified and graded in function of their frequency. The operator can, on this basis, target the future implementation of its prevention system.

As the methodology of the quantitative evaluation from the central event to the dangerous phenomenon, this methodology has numerous limits:

-At first, when frequency classes are used, the assessment does not aim to be as accurate as an assessment using frequency values. This implies an increase of uncertainties when there is a need for aggregating the probabilities of different dangerous phenomena; -This methodology can take longer time to carry out. The identification and the quantification of multiple initiating events is a longer task than the definition and the quantification of a unique central event.

-Some initiating events are difficult to assess. This refers mainly to rare events that the working group have not observed in their facility or in similar facilities. An example of this could be an external impact on a pressure vessel. The frequency of some human errors may also be difficult to assess: distinguishing the occurrence of an initiating event from the occurrence of an initiating event together with the failure of a human prevention barrier may be difficult. In these cases, generic data on initiating events and reliability data can be used. However, when this solution is retained, the generic characteristic of the data implies several limits already presented above. An alternative way to assess the frequency of these events is the use of expert judgements. As for the methodology from the central event to the dangerous phenomena, the good quality of input data is also a main stake of the quality of the probabilistic assessment.

This second methodology fits better with the French regulation framework. Indeed, this framework gives the possibility to exclude from the societal risk assessment (MMR matrix related to permit to operate) and the land-use planning process a number of initiating events (earthquake, pressure vessel metallurgic default, aircraft crash...) if some conditions are respected. A probabilistic quantification "from the initiating events to the dangerous phenomena" allows taking into account these exclusions more easily than a probabilistic quantification "from the central event to the dangerous phenomena".

Conclusions

In the French regulatory framework, the ministry has proposed several guidelines for risk assessment. Nevertheless, the operator has the possibility to choose a general methodology in order to assess the reliability of barriers, the occurrence frequency of events and ultimately the occurrence probability of a major accident.

The probability of an accident is estimated by taking into account safety measures (barriers). The performance of safety barriers is evaluated with regards to the following criteria: independence, effectiveness, time response, testability and preventive maintenance. A methodology used in order to assess safety measures performance is described in the Ω 10 and Ω 20 reports (INERIS 2005 and2006). Reliability analysis and data may also be used.

These performances allow to decrease the occurrence frequency of initiating events (corrosion, works nearby a pipe, etc.) or of dangerous phenomena following the occurrence of a central event (loss of containment).

Concerning the assessment of event frequencies, two main methodologies are used by French operators. As before mentioned, they present advantages, but their main limit is the lack of good quality data.

LESSONS LEARNED FROM THE USE OF PROBABILITIES

Six years after the law of July 30, 2003, a first analysis of the main challenges of the use of probabilities is proposed hereafter.

Site-specific frequency assessment

Under the law of July 30, 2003 and the regulations resulting from it, an assessment of the frequencies of events is required. As each industrial site is different, uses various types of safety barriers and can be located in a different environment, this assessment has to be site-specific. As a demonstration, two refineries could be considered:

-One refinery dating from the 1960s and located in the vicinity of the sea, -The other refinery dating from the 1990s and located in an area without any oceanic influence.

It seems pretty obvious that the frequencies of initiating events, such as for instance corrosion, can not be equivalent. Likewise, if the newest refinery has multiple barriers, the frequency should aim to reflect it. This explains why the French national authorities promote a site-specific assessment.

Nevertheless, a certain homogeneity within a same industrial sector is required. In order to face up these difficulties, the 21 technical working groups, created after 2003, have proven very useful. They allow indeed operators, inspectors and experts to share their experience, and, as a matter of fact, can help harmonizing practices.

Database gathering central event probabilities

In relation with the importance of a site-specific assessment, databases gathering central event frequencies are not scientifically satisfactory. Such databases can not help to discriminate the good sites from the bad ones: neither the prevention safety barriers are taken into account, nor the age of the facility, the safety management… As a matter of fact, it renders difficult to focus on safety improvements and to make cost-effective investments, as many informations on a given scenario are missing. That is why the French authorities do not promote such methodologies.

Low frequencies

As before mentioned, in the French frequency scale, the smallest frequency class is [0 -10 -5 ]. Frequencies lower than 10 -5 happen to be not statistically and scientifically representative. In order to adjust this deficiency, two alternatives could be identified:

-Frequencies could artificially be increased, by a precautionary approach. No scientific analysis is then considered in this process.

-The range of magnitude of frequencies could be justified by taking into account the failure rates of safety barriers.

The second alternative has been chosen in France. As an illustration in the land-use planning, the PPRT does not take into account the most improbable dangerous phenomena, provided the following conditions (Circular of October 3, 2005 regarding the implementation of PPRTs) :

-Their probability has to be lower than 10 -5 .

-In order to be sure that the probability is not intrinsic of the phenomenon, it should take into account at least two technical safety barriers.

-In case of an increase of the probability of failure on-demand of any of the safety barriers, the probability has to remain lower than 10 -5 .

If all the above mentioned criteria are met, then the dangerous phenomena will not be taken into account for the land-use planning.

CONCLUSIONS

The law of July 30, 2003 has created very powerful tools regarding risk prevention, crisis management, communication to the public, involvement of employees and subcontractors and land -use planning.

Before 2003, only the worst-case scenarios were taken into account according to a deterministic approach. The law of July 30, 2003 has introduced the use of frequencies and probabilities into the French system. The safety report has now to describe accurately the probability of occurrence, along with the kinetic, the gravity of the potential accidents. Then, combined with the gravity of potential accidents, the probability allows to assess the acceptability of an industrial establishment in its environment and the demonstration of risk control. As for land-use planning, probabilities are used for the calculation of the aléas, jointly required with an analysis of the stakes, for the elaboration of the PPRT.

Several methodologies for risk assessment can be used (operator choice), but the French authorities favour the probabilistic quantification "from the initiating events to the dangerous phenomena": safety barriers are well taken into account (and the operator efforts are then better promoted) and it is site-specific. Moreover, for the land-use planning, it can be helpful to exclude some very rare dangerous phenomena.

More precise conclusions about the benefits and the challenges brought about by the use of frequencies and probabilities in French risk prevention policies will be available at the end of the whole PPRT process.

  Fig.1: A simplified risk matrix and its input data: effects thresholds, gravity and probabilities.

Fig. 2 :

 2 Fig. 2: Simplistic scheme presenting the elaboration process of a PPRT.

Fig. 3 :

 3 Fig. 3: Simplistic scheme of the zones and areas resulting from the PPRT process.

Fig. 5 :

 5 Fig. 5: Safety barrier typology (complementing the the typology presented in the Ω 10 report (INERIS, 2005).

Fig. 6 :

 6 Fig. 6: An example of the assessment of a barrier according to the Ω 10 methodology

Table 1

 1 Frequency classes used by INERIS in order to quantify initiating events

	Frequency class	Failure frequency
	F-1	Between 1 and 10 per year
	F0

The Conseil d'Etat is the highest level of the French administrative jurisdiction.

Aléa: Probability that a dangerous phenomenon creates effects of a given intensity, and over a determined period of time at a given point of the territory.

Definitions from the Ω 10 and Ω 20 reports(INERIS, 2005 and 2006).


Stéphane Lafortune
email: stephane.lafortune@ineris.fr

Zbigniew Pokryszka

Gaëtan Bentivegna

Carine Chaduteau

Pierre Agrinier

First steps in coupling continuous carbon isotopic measurements with already proven subsurface gas monitoring methods above underground carbon dioxide storage sites

Keywords: accumulation chamber, carbon isotopic signature, CO2, gas flux measurement, gas monitoring

The main role of INERIS (French National Institute for Industrial Environment and Risks) is to assess and avert accidental and chronic risks to both people and the environment linked to industrial installations, chemical substances and underground operations. INERIS is thus involved in research consortiums for underground storages of wastes, hydrocarbons or carbon dioxide. Concerning carbon dioxide storage, INERIS works for many years on defining and testing monitoring methods. As a French expert, the institute also performs integrated risk assessment studies. This paper focuses on the last improvements concerning the monitoring methods developed or patented by INERIS. Because the institute was created from the research centre of the former French national coal mining company, it has a wellestablished know-how in monitoring gas atmospheres. Having developed monitoring methods for mining contexts, INERIS has tools to constrain gas migrations in subsurface:

1. to determine gas flux between soil and atmosphere with dynamic accumulation chambers; 2. to determine gas concentrations in unsaturated zones through integrated gas sensor systems linked to subsurface boreholes (from 0 to about 300 meters depth). Initially designed for mining context, these two methods have been tested and proven for the monitoring of CO 2 geological storage contexts. For example between 2005 and 2007, INERIS was one of the five partners involved in the "GeoCarbone MONITORING" research project. This project was funded by the French Research Agency and aims at defining methods to monitor CO 2 storage sites. Today the institute is involved in other projects studying pilot sites. In this paper we present results collected in analog contexts to CO 2 storage sites. We will discuss in which conditions the carbon isotopic signature 13 C can help to determine the possible origins of the gas analyzed in our devices and to better understand the physical and chemical processes which can have led to the studied gas compositions. We will also highlight the fact that in some cases, there is a real need of using isotopic tracing methods otherwise the identification of these different processes cannot be done easily.

Introduction

INERIS has a strong expertise on gas monitoring in mining contexts. For several decades, INERIS uses its knowhow to develop methods for the monitoring of CO 2 geological storage sites [START_REF] Battani | Geochemical study of natural CO 2 emissions in the French Massif Central: how to predict origin, processes and evolution of CO2 leakage[END_REF] [2] [START_REF] Pokryszka | Development of methods for gaseous phase geochemical monitoring on the surface and in the intermediate overburden strata of geological CO 2 storage sites[END_REF]. Two specific approaches are followed:

1. the detection and quantification of the gaseous flux of CO 2 released from the ground into the atmosphere at the soil-air interface; 2. the early detection of gas leak, based on the sampling and analysis of gas atmosphere in boreholes which are drilled into subsurface.

Gases from surface or subsurface are the results of mixing between different sources. This is for example the case for CO 2 sampled at surface. CO 2 can be atmospheric, be produced by plants respiration or come from anthropogenic emissions (industrial activities). CO 2 can also come from deeper sources such as volcanic sources, natural CO 2 deep reservoirs or CO 2 storage sites…

The analysis of the carbon isotopic signature of CO 2 ( 13 C, Fig. 1 and Fig. 2) can help to characterize the origins of samples and to better understand CO 2 production and migration processes. The identification of the origin of gas can also be done through other ways, such as the analysis of trace gas [START_REF] Lafortune | Noble gases as tools for subsurface monitoring of CO 2 leakage[END_REF]. INERIS has already used isotopic analyses (such as 15 N, 18 O or 13 C) in mining contexts to better understand underground gas migration processes. We should now focus on the feasibility of improving monitoring methods developed for CO 2 storage sites with isotopic analyses. At a first approach, the choice was made to work on the determination of the isotopic signature 13 C of CO 2 , because it seemed to be the most suitable and easiest method to perform on field in the context of new technologies based on laser diodes.

The aim of this paper is to present first results and conclusions of coupling tests between the monitoring methods developed by INERIS and isotopic measurements performed at laboratory and on field.

Coupling gas flux measurements with isotopic analyses

First coupling tests between isotopic measurements and gas monitoring methods were performed during 2008. Samples were collected during repeated gas flux measurements at the surface of a site where natural volcanic CO 2 emissions occur (Fig. 3 and Fig. 4). This site was studied as a natural analogue of future CO 2 storage sites where gas leaks would reach surface.

Gas flux measurements have been done according a method patented by INERIS [START_REF] Tauziède | Measurement of the gas flux from a surface[END_REF]. The determination of the isotopic signature 13 C has been done on gas samples collected by discrete sampling during gas flux measurements (Fig. 4). 10-mL samples were collected with a syringe and injected in Exetainer vials every minute to follow the evolution of the isotopic signature during the increase of the gas concentration inside the accumulation chamber. Two kinds of Exetainer vials were used for this study: vials pre-filled with helium and vials under vacuum. Sampled volumes were chosen deliberately low to not interfere with gas flux measurements. Because accumulation chambers must stay about three minutes on the same place to perform a measure, at least three gas samples were collected for isotopic analysis at each gas flux measurement point.

Samples have then been analyzed for 13 C of CO 2 at IPGP, using a continuous-flow isotope ratio mass spectrometer (Finnigan DeltaPLUS XP) interfaced to a Gas Bench modulus.

During gas flux measurements, the concentration of CO 2 inside the chamber increases with time (from 400 ppmv to about 7,000 ppmv). Isotopic analyses show a parallel increase of the carbon isotopic signature from an atmospheric value (about -8‰) to a higher value (about -6‰) (Fig. 5). This higher value shows that CO 2 which migrates through the soil-air interface is enriched in 13 C. For high CO 2 concentrations, values of 13 C which were determined are fully compatible with a volcanic gas origin (Fig. 2): there is a dilution process inside the chamber between the atmospheric gas and CO 2 migrating through the soil-air interface. This result was expected due to the geological context of the studied site (volcanic area). Feedback teaches us that sampling with Exetainer vials pre-filled with helium ensures a better conservation of samples during sampling operations and transport/storage before analysis at laboratory. No flush of the vials was done on field before sampling. It seems that gas tightness of septum is better when sample is over-pressured compared to the atmospheric pressure. Gas from other sites (not discussed further here) were sampled by flushing 10-mL Exetainer vials with more than 50-mL of gas. This method, that is only possible when there is a large gas source, ensures that air initially in place within the tube is entirely removed before sampling (no risk of air contamination) and that the sample is at equilibrium with the atmospheric pressure (no risk of over-or underpressured sample). According to other authors [START_REF] Tu | Using septum-capped vials with continuous-flow isotope ratio mass spectrometric analysis of atmospheric CO 2 for Keeling plot applications[END_REF] flushing is the best way to ensure a good conservation of the samples.

Results confirm that isotopic measurements provide important information to determine the origin of the gas emitted from the soil. But an accurate field-deployable method appears to be required [START_REF] Battani | Geochemical study of natural CO 2 emissions in the French Massif Central: how to predict origin, processes and evolution of CO2 leakage[END_REF] to minimize risks of air contamination or gas leaking during sampling or transport/storage of the vials, [START_REF] Gal | Surface gas geochemistry above the natural CO 2 reservoir of Montmiral (Drôme, France), source tracking and gas exchange between the soil, biosphere and atmosphere[END_REF] to reduce time between sampling on field and analysis at laboratory and (3) to increase the number of measurements.

Coupling gas monitoring in boreholes drilled in unsaturated zones with isotopic analyses

Gas monitoring in subsurface boreholes (between depths of about 5 to 100 meters) drilled in unsaturated zone shows that these systems can be quite difficult to characterize. As shown by continuous measurements, changes of the gas concentration profiles inside the boreholes can occur and be very difficult to understand.

INERIS has developed methods to sample and analyze gas in boreholes drilled from surface into intermediate cap rock strata [START_REF] Pokryszka | Development of methods for gaseous phase geochemical monitoring on the surface and in the intermediate overburden strata of geological CO 2 storage sites[END_REF]: O 2 , CO 2 , CH 4 and Rn concentrations in the atmosphere are continuously monitored by sensors (e.g.: electrochemical or infrared sensors). Detection limit for CO 2 is about 1 ppmv; for other gases it is about 0.1% and 100 Bq/m 3 for Rn. To allow easy access to boreholes for other measurements, gas sensors are put on the surface, outside the borehole. A gas sampling loop pumps the gas phase at the bottom of the boreholes or just above the water table towards surface and injects it again in the well after analysis. By recycling the analyzed gas, the system reduces risks of contamination by atmospheric air (Fig. 6). To better characterize gas concentration changes inside monitored boreholes, INERIS has sampled gas to determine isotopic signature 13 C of CO 2 . Analyses are done at laboratory on samples collected in Exetainer vials or Cali-5-Bond bags. This method leads to a discrete knowledge of the changes inside the boreholes. Thus, this method cannot be sufficient to describe correctly quick changes of the isotopic signature. When it can be implemented, a method allowing continuous isotopic measurements has to be preferred (Fig. 7).

INERIS works for one year with the PICARRO G1101-i analyzer, a cavity ring-down analyzer for measuring the isotopic signature 13 C of CO 2 . Gas is introduced into a high-finesse optical cavity and the optical absorbances of 12 CO 2 and 13 CO 2 are determined. Because the absorbance of a gas depends on the nature of the gas and its concentration inside the optical cavity, the analyzer provides concentration and isotopic ratio measurements [START_REF] Crosson | A cavity ring-down analyzer for measuring atmospheric levels of methane, carbon dioxide, and water vapor[END_REF]. Calibration of the analyzer is done by using gas mixings with known concentrations and known 13 C. We present here the results obtained during the monitoring of a subsurface borehole for 5 hours (Fig. 8). Variations with time of the CO 2 concentration and the 13 C of CO 2 inside the borehole describe a gas mixing process between two gas sources:

1. the surface atmosphere ([CO 2 ] = 400 ppmv and 13 C = -8‰); 2. an unknown CO 2 deep source enriched in 13 C. This source seems to be characterized by a CO 2 concentration up to 0.2% and a 13 C close to 0‰. First tests on field show that the use of the PICARRO G1101-i analyzer (1) simplifies field operations, by reducing numbers of gas samples to collect (but some samples are always useful to compare results between field measurements and some analyses done at laboratory); (2) increases the number of measurements; (3) reduces risks related to sampling, such as loss or contamination of samples during transport and storage before analysis at laboratory; and (4) limits the use of laboratory equipments which are free for other studies.

Conclusion

INERIS is studying the feasibility of improving surface and subsurface methods that were developed to monitor CO 2 storage sites. The aim is to determine the carbon isotopic signature 13 C of CO 2 at laboratory or on field, to better characterize gas production and migration processes above CO 2 storage sites.

Since 2008, different tests have been performed to couple isotopic measurements to the determination of gaseous flux of CO 2 or the monitoring of the gaseous atmosphere inside boreholes.

These tests are helpful to define specific sampling procedures or experiment new analyzers. They are a first step before a larger application on CO 2 storage pilot sites in the next years.

Figure 1 :

 1 Figure 1: Variations in carbon isotopic ratio are expressed as δ 13 C (in parts per thousand ‰) relative to the Peedee Belemnite standard (PDB).

Figure 2 :

 2 Figure 2: Values of δ 13 C for naturally-occurring samples (image source: www4.nau.edu). Domain of values for volcanic CO2 is in red.

Figure 3 :

 3 Figure 3: Gas flux measurement on a volcanic site. Isotopic samples are collected with a syringe and stored in Exetainer vials.

Figure 4 :

 4 Figure 4: Principle of coupling the dynamic accumulation chamber for gas flux measurements with sampling for isotopic analyses.

Figure 5 :

 5 Figure 5: Results (CO2 concentration and 13 C) and linear curve fits for isotopic samples collected during two gas flux measurements.

Figure 6 :

 6 Figure 6: Sensors system for gas monitoring in subsurface boreholes. Isotopic samples are here collected with a syringe and stored in Exetainer vials.

Figure 7 :

 7 Figure 7: Principle of coupling the sensors system for gas monitoring in subsurface boreholes with discrete or continuous isotopic analyses.

Figure 8 :

 8 Figure 8: Results (CO2 concentration and 13 C) for continuous isotopic analysis during gas monitoring in a subsurface borehole.

Acknowledgements

The authors thank Elodie Michel and Géraldine Cantor for their precious help on field and during the treatment of the results of the preliminary coupling tests.

This work was partially supported by the research project SENTINELLE funded by the French National Research Agency (ANR).