Jean-Christophe Lecoze
email: jean-christophe.lecoze@ineris.fr

Sophie Capo
email: sophie.capo@etu.univ-paris5.fr

A conceptual and methodological comparison with thé fîeld of child resilience

The label resilience has been used in thé field of child psychology and of child development to identify thé way in which children could cope with adverse events of their past, in order to live (to develop) "normal" lives. In this field, thé following définition is in use: "children resilience is a universal capacity which allows a person, group or community to prevent, minimize or overcome thé damaging effects of adversity. " (Grotberg, 1997). It is interesting to note that thé concepts as discussed in thé collective book on resilience engineering (Hollnagel, Woods & Leveson, 2006 ') share some similarities with thé methodological and theoretical developments found in thé child resilience field. Three examples of thèse similarities are discussed hère. First we discuss thé cross disciplinary nature of thé child and organisational resilience. Secondly, we discuss thé similarities between thé risk factors versus resilience factors in both fields. And finally, we introduce thé importance of thé cognitive and social construction of safety.

INTRODUCTION

What is our domain of application?

The discussions contained in this article are based on practices and researches developed mainly in thé chemical and petrochemical industry around thé questions of thé human, organisational and systemic contributions to major hazard prévention. Our researches raise several type of questions regarding our ability to model safety (and accidents). They also question our ability to create useful knowledge for practitioners, based on what is currently known about thé systemic dimension of safety and accidents in thé literature. The fields of learning from expérience, of installations and equipment design, but also thé field of auditing are concerned by thèse current developments. One question is how organisations or socio-technical Systems maintain a visibility of thé 1 Hollnagel E., Woods D.D. & Leveson N. (2006). Resilience Engineering: concepts and precepts. Aldershot, UK: Ashgate.

2 By choosing "organisation", we target thé system of actors employed by thé company and working in thé plant. By choosing "socio-technical system" we target other actors such as regulators, thé subcontractors, thé corporate, thé public. We can use thé "socio-technical System" expression for a more global perspective of thé organisation, within its context and interactions. This has strong implication for fieldwork and safety or accident modelling. In our research, we deliberately included thé organisation within a socio-technical system, so when we use "organisation" in this paper, we mean thé organisation changing conditions, and how they adapt to them? Thèse fields hâve led us to strongly stress thé importance of bringing a time and cross level dimension for modelling accident but also for modelling safety (Le Coze, 2005). It appears that thé field of resilience engineering, in 2006, opens thé way for a similar dynamical approach of safety, including a diachronic dimension by taking into account évolutions of organisation and socio-technical Systems.

What do we retain from thé engineering resilience discussions?

Two of thé main aspects that we retain from thé resilience engineering discussion for thé purpose of this paper concern first thé will to shift from thé study of thé systemic aspect of accidents to thé systemic aspect of safety, so nioving from thé systemic insight position to thé systemic foresight one [START_REF] Hollnagel | Resilience -thé Challenge of the Unstable[END_REF]. The second aspect is to be able to better grasp thé brittle versus thé resilience side of organisations, namely that if events reveal factors that played négative rôles in thé accidents genesis (thé brittleness side), thèse factors were also positive ones in achieving thé success of thé organisation as a whole. One of thé difficulty is therefore to be able to better identify when a factor that is a résilient one, becomes a brittleness one, and in which contexts.

Thèse two aspects of resilience bring epistemological questions (related for example to determinism, thé nature of causality) but also methodological and practical ones (for example how to collect data and make généralisation across various cases regarding thé factors).

Warnings

The resilience concept has been developed for some years in thé field of child resilience. We thought it could certainly provide interesting inputs regarding thé questions contained in thé current development of resilience engineering, a domain that we call organisational or socio-technical resilience in this paper. However this comparison must be understood within its limits. The field of child resilience and organisational resilience are différent and do not cover thé same phenomenâ. In that respect, thé comparison is made at a rather macro level, regarding thé epistemological and methodological levels. Some issues will certainly require much more developments in thé future if we find useful to carry on thé comparison with specialists of thé domain. It must indeed be stressed that we are not experts in thé field of child resilience (we hâve no practice in this field), and relied on thé literature to get into it. within its socio-technical System. In an approach acknowledging thé complexity of safety and accidents dynamic, such a perspective is unavoidable.

CHILD AND SOCIO-TECHNICAL RESILIENCE: FROM THE PHYSICAL TO THE BIOLOGICAL, THE HUMAN AND THE SOCIAL PHENOMENA

The limit of an analogy with thé physical world

Both approaches share their metaphor from thé physical world, from thé property of matter. The resilience is seen in physics as thé ability for a material to get back to its initial shape, following an external shock. It is also thé measurement of thé quantity of energy that is necessary to break a métal. In thé field of child resilience, it becomes thé ability to cope with adverse events. We can however wonder how much relevant thé metaphor is for biological, cognitive, psychological and social phenomena, where we feel naturally that thé processes underlying resilience are of a différent kind3 .

On one side we hâve a material behaviour, based on properties of matter, and on thé other we hâve children. The latter are living purposeful biological organisms and individuals, evolving and opened to their energetic and informational, social, cultural, environments. This différence has some conséquences on thé scientific approach of thé phenomena. As Cyrulnik, a prominent scientist in thé child resilience field, stated it (2003):

"Physics was a mode! that helped us to become scientific. We moved on from physical objects to human models and hère, I believe that thé jump is a bit perilous because in thé human realm, we constantly evolve. We belong to a specie which evolves ail thé time until death, even on thé biological side."

This type of question leads to epistemological questions regarding thé status of a définition of resilience, that is necessarily a interdisciplinary concept, from a genetic and biological perspectives of thé child to its individual (psychological and cognitive insights) through its historical, sociological and cultural dimensions.

One of thé major différences when we jump from thé physical resilience to thé child resilience is thé evolving nature of thé latter. This evolving nature implies a contextual nature of thé phenomena. The présence of a context limits considerably thé traditional scientific methods as found in physics, and in natural sciences in général. Expérimental techniques do need to isolate phenomena to generate reliable a knowledge. However, thèse conditions can't be easily met for biological, human and social Systems that are intrinsically linked with their contexts. By suppressing thé context, a huge relevant part for thé understanding of thé phenomena disappears. As Jacob said "Life is not studied in laboratories". The same applies to human and social phenomena. This problem is clearly found in thé field of child resilience but also quite clearly in thé organisational resilience. More generally, this problem is expressed in many fields dealing with open Systems.

An interdisciplinary or transdisciplinary fîeld

Récent discussions, in 2004, between Cyrulnik and Morin (a philosopher of science) hâve made explicit that looking at human natxire requires for various disciplines to be articulated. We often fmd transdisciplinarity, interdisciplinarity, multi disciplinarity or pluri disciplinarity advocated for looking at phenomena that eut through single disciplines. The différent expressions refers to différent practices, although it is sometimes not straightforward to distinguish them. It is indeed not always clear for example when thé multi or pluridisciplinarity stops and when thé interdisciplinarity starts.

• We define for this paper thé multi or pluri as thé need for adding disciplinary views on an particular event, but without spécifie effort to articulate them. • The interdisciplinarity is understood as thé process of articulating views in order to create a new point of view, that does not belong to thé input disciplines anymore, but belong to a new discipline, resulting from thé articulation of thé other disciplines. This requires for individuals to be poly-skilled. • Transdisciplinarity would define thé models and théories cutting through various domain of science, such as thé properties of System and self-organisation (that are found in physics, biology, cognition, societies and leading to thé fïeld of complexity), but also mathematics which can potentially be and hâve been applied across a wide range of domains.

Such approaches hâve been fruitful in many domains 4 .

The fields of child resilience proceed with a multidisciplinary approach and tend towards an interdisciplinary fïeld when thé emerging concepts and models create problems and solutions that can be answered only by adding disciplinary views. In his work [START_REF] Cyrulnik | Un merveilleux malheur[END_REF][START_REF] Cyrulnik | Les vilains petits canards[END_REF] articulâtes concepts, models and findings from genetics, neurosciences, ethology, psychology, psycho-sociology or socio-education in order to cover a wide range of dimensions that help to define, interpret and explain child resilience. In doing so, he brings a much richer picture of thé complex dynamical process underlying thé évolution of thé child in his or her context. Without thé inputs from thèse various fields thé interprétations would be limited to only one aspect of thé resiliehee phenomena, although it is a systemic phenomena. A similar approach is required for understanding thé organisational resilience. Psycho-cognition, psycho sociology, sociology of organisation, management, political sciences but also engineering are inputs required for an interesting description and interprétation of thé global dynamic underlying safety (but also accidents). This point is developed a bit more practically in a next part, when introducing concrète factors.

Like ergonomics, cognitive ergonomics, and others disciplines, who hâve emerged from an interdisciplinary process. But, thé use of différent sources of knowledge is a challenge that necessary hâve to share resources (people, time and thus money). This challenge seems also to be related to conceptual, theoretical, semantic and methodological characteristics of each original discipline, which hâve to meet or mix with thé others. Currently, in thé domain of major hazard prévention, we think that there is a need in this direction.

Linear causality and determinism in question

Questions related to thé type of causalities (non linear versus linear) implied by child resilience and linked with thé status of determinism ("Can we predict how a child will get résilient or not?") are also challenged when moving from thé physical to thé biological and social world. The field of child resilience started from trying to predict thé future of children from risk factors at thé genetic and psychological level (a rather endogenous level) but failed to do so [START_REF] Anaud | La resilience. Surmonter les traumatismes[END_REF]. The évolution and open nature of children lives do not allow for a prédiction to be accurate in thé long run (thé causeeffect relationships are complex). Genetic or psychological features interact with familial, social and cultural characteristics (a more exogenous level), so that children behaviour can't be predicted based on a limited set of initial factors.

A sïmilar problem is faced by organisational resilience when it cornes to predicting behaviours. Uncertainty about thé way things will evolve is intrinsic to any modelling. Some endogenous features (for example thé organisational structure) interact with exogenous features (for example market constraints). It doesn't mean that prédiction is not to be attempted and performed, but rather that sensitivity to changes in thé prédictions made should be high in order to cope with uncertainties and unexpected events shaping in a différent way what was expected.

BETWEEN BRITTLENESS AND RESILIENCE: A COMPARISON OF SAFETY AND RISK FACTORS

Child resilience scientists, as a conséquence of this cross disciplinary field, approach resilience throughout several levels of factors, addressing thèse multiple dimensions. Questions regarding thé duality of a brittleness side versus a résilient side, and a duality and combination of risk factors and protection factors are also debated [START_REF] Anaud | La resilience. Surmonter les traumatismes[END_REF]. Thé history of child resilience developments reveals that initially, only thé risk factors were looked at. However gradually, with counter examples accumulating, it appeared clearer that risk factors did not hâve full prédictive power and could not be sufficient for understanding thé child development and therefore resilience. The need for identifying protection factors pushed researchers to produce dynamical and resilience features of thé child development.

It is interesting to see how thé field of organisational resilience, has as a theoretical background similar discussions with for example thé normal accident and high reliability organisation models debates, and then with thé developments of ideas around thé bright side and dark side of organisations [START_REF] Sagan | The limits of safety[END_REF][START_REF] Vaughan | The Dark Side of Organizations: Mistake, Misconduct, and Disaster[END_REF]. To illustrate more concretely this comparison, we suggest to introduce thé factors from thé child resilience field, and then to attempt to do thé same with thé organisational resilience, and see where it gets us. [START_REF] Anaud | La resilience. Surmonter les traumatismes[END_REF], throughout her présentation of thé field of child resilience, introduces many of thé risk factors and protection factors available, and also suggests that they combine to create resilience. Hère is a table containing thèse factors (table 1). Thèse factors do not need much description, they speak for themselves at this level of discussion. But, they can't of course be used without deep knowledge of their theoretical and empirical background. We intuitively understand that thé resilience is thé resuit of a complex dynamic combining various features requiring a global perspective. The same applies to organisational resilience. We can try to put together various factors that would be extracted from various sources (see a list of thèse sources in Le Coze 2005). The methodological questions regarding thé way in which thèse factors are identified but also thé way in which they combine is in both fields a common research agenda but also a very complicated one, between generalising across cases and remaining spécifie to acknowledge diversity of each situation. It is indeed not only a list of factors or a blank check list to be used but a knowledgeable way of combining them into dynamical patterns, spécifie to thé history and thé features (technological, cognitive, social, political) of thé complex phenomena under study. This really brings to thé forth thé degree of expertise required to formulate a judgment for a spécifie situation.

HOW INTERPRETATIONS CONSTRUCT AND ENACT WHAT'S REAL

The ability to create a theory life, of what is happening to thé child by him/herself (but also with thé help of educators) has been emphasised as an important feature of child resilience. As Cyrulnik puts it "// is thé externat points of référence that give cohérence to thé flow of our internai pictures. Otherwise thé souvenirs would accumulate as tangled up images where sensé would be difficult to make (...) images are insane when you can't locate them and put them into a story". Résilient child are able to transform, or to reframe their world in order to build confident spaces where they can grow and develop self-esteem from their past expériences.

We can fïnd hère a similar phenomena in organisational resilience. Indeed, thé ability for an organisation to reflect on its success as well as on its failure (an incident or an accident), and to reframe their past, is a key process of resilience. This process is key because many interprétations are always possible, and therefore thé resulting actions will also be différent. As it has been emphasised in thé engineering resilience collective book "thé obstacles to learning from failures are nearly as complex and subite as thé circumstances that surround a failure itself Because accidents always involve multiple contributors, thé décision to focus on one or another of the set, and therefore what will be learned, is largely socially determined" [START_REF] Cook | Distancing through differencing : an obstacle to organizational learning following accidents[END_REF]. This process will dépend on thé knowledge and on thé expérience of thé individuals put together for thé investigation. A safety engineer, an operator, a human factors or an organisational factors expert or a manager will not hâve thé same viewpoints. As a conséquence, thé nature and thé scope of information collection and of their interprétations will be a construction elaborated by thé people who take part of thé process. This will be also under influences of thé tools used and of thé management choices, that will emphasise some factors and eliminate others. This sélective is not always clear when it cornes to identify thé factors that would be thé most useful for a proactive safety management. The purpose is not only to understand but to improve or maintain safety.

CONCLUSION

With thé help of thèse three items, it is believed that thé history of developments of child resilience as a scientific field provided an open window to discuss thé issues of socio-technical resilience. This first comparison helped us to highlight thé same inter disciplinary dimension of thé two fïelds, and their relationship with determinism and causalities. It also proved useful for discussing thé brittleness/resilience factors that can be identified in both field, and that can be combined in différent context. Finally, thé importance of constructing explanations out of past events is in both fïelds recognised as a core process, that can lead to différent futures.

Table 1 :

 1 Risk and protection factors

		in child resilience (summary)
		Risk factors	Protection factors
		Prématuré baby, light weight,	Active attitude, nice mentality,
	At thé individual lc\cl	cognitive defect, early maternai	high IQ, self esteem, humour,
		séparation etc	attractive for others etc
		Violence, parental séparation,
	Family configuration	alcoholism, chronicle disease of a parent, single mother or teenager mother, early death of	Parental warmth, good parental relationships etc
		parents...) etc
	Social and cmimmivniul factors	Poverty, socio economical weakness, lack of employment, migrant parents etc	A supporting social network, académie successes etc

Table 2 :

 2 Risk and protection fàctors in organisational resilience (this literature and our own practices)

			is just an attempt based on thé
		Risk factors	Protection factors
		loss of competencies, excessive
		performance ambition, tight	Sensitivity to opération,
		coupling-cpmplexity of	reluctance to simplify,
	Individual & collective level	installations, particular miss of	préoccupation with failure,
		resources, production pressure,	channelling to experts,
		limited time for discussing	redundancy,
		safety matters, burden of rules
	Organisation level	Turnover, silo culture (conflict of interests), blâme culture, unstable tradeoffs regarding safety matters at management levels, risk blind top management, production pressure, complexity of organisation (high level of outsourcing)	Organisational learning, independence, compétence and empowerment of safety départaient, group meeting with open attitude towards safety issues, safety as priority, requisite imagination (of what could go wrong)
		Overlapping of régulations	Corporate level aware of risk
		creating administrative burden,	issues and with engineering
	F -n\ ironmental level	high competitiveness on thé market, board with strong	background, quality of authority inspection on thé risk issues
		fïnancial policies, not stratégie	involved, market leadership,
		plant, poor quality of	proximity of élite

This example of migration of concepts from one field to thé other (from natural science to biological and social ones) is another example of thé tendency for metaphors and analogies to travel from one domain to thé other. History of science is rich of thèse examples of analogies becoming very useful outside their initial field.


Jean Christophe Le Coze
email: christophe.lecoze@ineris.fr

Michèle Dupré
email: michele.dupre@ish-lyon.cnrs.fr

How to prevent a Normal Accident in a High Reliable Organisation? The art of resilience, a case study in the chemical industry

The trend in France in the chemical industry following the Toulouse accident in 2001 has created a situation where some of the installations have got closer to the definition of high reliable or resilient systems. This papers based on an empirical case study elaborates on the question: can we see better with the help of an articulation of safety engineering, safety management and social concepts (extracted from the safety and accident field) some dimensions, for example the level of resilience (or reliability), that are not captured today with traditional tools? Our approach articulates two investigative modes to capture an organisational safety dynamic: a normal study approach (what's happening when nothing is happening?) with an incidental-accidental one (looking at past incidents or accidents and their organisational genesis) in order to generate assumptions regarding the presence of organisational patterns influencing safety.

INTRODUCTION

The trend in France in the chemical industry following the Toulouse accident in 2001 has created a situation where some of the installations have got closer to the definition of high reliable or resilient organisations 1 . They are indeed under pressure from the society for being very safe while also being under pressure from the market for producing in the most efficient ways, for maximising profits. Economic pressure is one of the strong trait of our capitalistic societies and a resulting effect of a global world market. Companies must be managed under strong financial and competitive pressures. Constraints also come now from the expectations and sensitivity from society regarding safety. These expectations push companies to communicate more on safety. They for example as a result sometimes open their doors for the public in order for it to visit the plants, with a goal of transparency and societal trust. The societal needs following the Toulouse disaster also led authorities, as a political measure, to increase the number of inspections by recruiting more inspectors and the relevance of the inspections, by training inspectors specifically to major hazard prevention. Some of these chemical plants have high safety performances, with only minor incidents over a 20-30 years period. Some could have therefore been considered as equivalent to high reliable organisations even before the Toulouse accident. As a result in terms of prevention, one of the difficulty becomes therefore in these type of systems to capture the potential drifts and deviancies, as shown by accidents investigations and works from scholars, in particular when they have implemented all safety management best practices existing in the industry.

The field of resilience addresses this issue, and a fruitful way of turning it is also to follow [START_REF] Snook | Friendly fire, the accidental shootdown of US black hawks over northern Irak[END_REF] with saying that the insidious accidents threatening these organisations are Normal Accident in High Reliable Organisations, so that one of the purpose of these organisations is to maintain a sense of vulnerability and an ability to be introspective enough to anticipate the "slippery slopes" [START_REF] Vaughan | System effects: on slippery slopes, repeating negative patterns, and learning from mistake? In Organization at the limit[END_REF], to be able to "dance" with the Brownian movement [START_REF] Rasmussen | Risk management a dynamic society: a modelling problem[END_REF] and to prevent a Resonance phenomena [START_REF] Hollnagel | Barriers and accident prevention[END_REF] within their installations. This perspective implies therefore not to focus solely on the technological complexity but as Snook indicated in regards with his work on what we call the organisational safety and accident dynamic: "While Perrow's emphasis was on complex technologies and demonstrating the inevitability of such accidents , mine is on uncovering their underlying behavioral and organisational dynamics (...)".

One of the question can thus be: how to provide useful auditing tools linking safety engineering, safety management practices and social concepts of organisations (Le-Coze, 2005) to help identifying these potential slippery slopes? It raises the question that everyone is asking following an accident, why couldn't we see before what seems quite clear after, with hindsight? How to design the tools to see what is obvious only after, when we know that the accidents dynamics lies in the complexities of the interactions between the technical, human and organisational dimensions?

Our current research project has three purposes and questions in that respect:

1. Can we see better with the help of an articulation of safety engineering, safety management and social concepts (extracted from the safety and accident field) some dimensions that are not captured today with traditional tools, the level of resilience (or reliability) of a chemical site?

2. Is what we see helpful for practitioners so that they can use it as a support for creating or sustaining safety in a better way that they did before, without us?

3. Can we transfer these tools to "non experts" for internal auditing purposes performed for example by safety people and safety auditors?

This paper elaborates on the first question. It is based on an empirical case study for which we attempted to connect safety engineering with safety management and social concepts. This paper is meant to be part of a reflexive step in our research process rather than a definitive conclusion to the question. The content of the paper is also very restricted, it is a rather general view that is presented here, without the details.

In a first part, we introduce the plant where we carried out the research. In a second part we discuss the strategy we followed to try to describe and interpret what we call the organisational safety dynamic and we conclude.

THE PLANT

The plant described here is an entity of a chemical company located in the USA and owner of 100 subsidiaries all over the world. The company is organised under a matrix principle. It means that certain activities are centralised either in the headquarters or in companies having specific resources for dealing with specific questions (such as salary payment), a particular production and consequently working for other plants. Through different restructurations of the production lines in the world, the plant has a leader role in its production segment, but a margin position when we consider the global production set of the whole company. It has around 350 employees, develops its production volume and have therefore to hire people while the other companies in the neighbourhood have been firing employees regularly during the last decade. The "safety culture" as they formulate it, is a great challenge for the company which tries to enhance the safety performance of the whole company through different actions and is used to communicate broadly on this topic. It has to be added that the safety manager in this French plant is responsible for safety not only in France, but in Europe, and belongs to the network of safety managers aiming to maintain the plants on a high safety level.

As mentioned, the plant can be described as a HRO [START_REF] Roberts | Some characteristics of one type of high reliability in organisation[END_REF]: it has namely a very safe production history with no accident registered in the last 22 years, the safety perception of the employees is reinforced over different tools and systems, last but not least it has very good relations to the regulators because it fits with the objectives given to the industry. The social organisation is also designed for having good work conditions, for example six shifts of five people have been introduced after the working time reduction for targeting a full team work all over the year. Nevertheless the production pressure has increased in the last years.

DESCRIBING AND INTERPRETING AN ORGANISATIONAL SAFETY DYNAMIC

Our research strategy is based on two strong principles:

1. Articulating the organisational safety dynamic on the safety barriers (technical and human) of the installations. This has now a long history, from [START_REF] Haddon | Energy Damage and the Ten Counter-Measure Strategies[END_REF] through [START_REF] Johnson | The management oversight and risk tree -MORT including systems developed by the Idaho operations office and aerojet nuclear company[END_REF] to more recent works like, [START_REF] Hollnagel | Barriers and accident prevention[END_REF] or [START_REF] Hale | Management influences on major hazard prevention: the ARAMIS audit[END_REF], [START_REF] Hale | Auditing resilience in risk control and safety management systems[END_REF]. The approach retained here is to be anchored enough in the preventive design of the system against major hazard scenarios at a micro level (technical and individual and collective) in order to link this design with higher features of the system, like meso level (organisation) and macro level (environment of the organisation). The idea is to try to put the organisation in motion. Organisations are indeed characterised by constant evolutions and stability seems rather to be the exception in these systems, than the norm.

2. Articulating two investigative modes to reveal an organisational safety dynamic: a normal study approach (what's happening when nothing is happening?) with an accidental one (looking at past incidents or accident and the organisational sides of the genesis of accident) in order to generate assumptions regarding the relevant patterns influencing safety.

Connecting with the barriers

The initial step consisted in applying the first principle introduced above and therefore in understanding the hazards and related technical and human barriers designed and implemented for controlling risks. Through this step, we identified several scenarios and finally focused on two main activities of the plant. The choice was to limit the areas to be investigated as the time available for the project would have not allowed us to look at all the activities of the plant. However by choosing a highly automated and core process of the plant with one of the most hazardous scenario, we thought that we could get quite in depth in the way the organisational safety dynamic influenced these activities.

The safety barriers are a combination of technical (hardware and software) and human tasks to be performed in order for the installation to stay within the safety limits as defined during design and risk analysis. Due to the interactions between technology and humans, some of the safety barriers are a mix of tasks to be performed as a co-ordination between technology and people (as for example an operator reacting on an alarm and consequently manually closing a valve). In this case it is possible to discriminate them by indicating the specific role that they play by decomposing each of the tasks required for the safety functions to be met2 . These tasks can be described in terms of sequences consisting in identification-diagnosis-action to be performed for reaching some defined goals. Both human and software can be described through such sequences. However some technical devices are passive hardware so that they do not integrate software, or even external source of energy, as for example a rupture disk or a dyke. Sometimes, some human tasks do not include the use of safety devices at all (such as an operator checking a quantity of product to be put in a vessel, before putting it, or an operator escaping during an emergency).

When the barriers are identified, they can be assessed in terms of their adequacies for preventing the events that they are supposed to prevent. Features such as the response time, the independence, the redundancy, the capacity to fulfil the function, the level of confidence, are to be considered. Of course technical and human tasks can't be assessed the same way (human cognition and human interactions models are for example not as accurate as those in use for man-made software and hardware), but this issue is not developed in this paper. One of the outcome of this first step can be for example a graphic representation showing in a simple way the safety barriers designed for preventing the hazardous scenario. In the case retained for this paper, the scenario identified concerns the loss of containment of toxic chemical products following an increase of pressure and leading to a rupture of the vessel (figure 1).

A set of 8 barriers have been identified. The possibility of an operator loading too much or loading incompatible product to the reaction is one first event. This is prevented by operators checking what they are supposed to put (this is carried out by two people from two different teams) but also by a software function based on value comparison of masses and expected pumping time. The heat excess and loss of agitator is backed up by first a software action linked with heat excess and an alarm in case of electric loss or agitator failure. The next barrier is the presence of a quench in case of a runaway reaction. This hardware is meant to pour water in the reaction for stopping a runaway reaction, and can be manually activated but is also programmed to be activated on high pressure threshold. The sixth one is a rupture disk designed to relieve pressure in case of runway reaction. This prevents tank collecting what is released through the relief system. The last one is a vent scrubber designed for treating atmospheric emissions in case of high pressure in the catch tank requiring release of product outside. This simplified description is meant, when we move away from the scenarios themselves to the human and social world, to guide, to focus interviews and observations, with in mind what is there to be prevented by the organisation.

A normal, non incidental-accidental study perspective

The next step consisted in putting the organisation in motion in a non incidentalaccidental perspective. To get into this normal perspective, we implemented two techniques:

1. Describing and assessing the safety management system in place, and compare it to existing good practices in the field, in a more traditional auditing approach. This consists in checking the presence and articulation of safety related activities, from risk analysis to learning from experience through training or maintenance. The specificity was to anchor questions in relation with the barriers identified. (operators, managers, executives) in an open perspective, without being guided by an underlying safety management system model, but instead having opened discussions about subjects related to safety, but also to subjects that would be relevant but not always directly related to safety (such as working conditions, team relationships, evolutions, trends in management, technologies, market etc), in a more sociological approach. The underlying and guiding models are those from the human and social sciences in general, and the ones specifically developed in the safety field. In regards with what we know from accidents (drift, deviancies and their underlying favourable conditions), it was for example, found relevant to describe the evolutions of the organisation, and interview people about the impacts of these on their work in regards with safety, about the impacts on their interaction with their working colleagues.

Interviewing people

The two techniques are complementary. It seems especially relevant when the company has a good approach of safety management and a long tradition of implementing safety management principles3 . The second approach in that case helps in identifying interesting factors. Thus, we identified important trends such as the new market and competition of China but also the changes in technology with more and more automation towards an harmonisation throughout the plant and processes. We also found useful to notice other changes located at corporate levels affecting the organisation, so that managers don't have much power anymore but only manage money and do not have strong strategic autonomy. The plant has become a profit center.

Production pressure got also more and more intense and they for example as a consequence look for alternative way of producing during holidays. This would help limiting the duration of plant stops. consequences for maintenance planning, as maintenance teams have always had so far a traditional break throughout the summer for taking the time to perform their activities. Some internal organisational changes have also recently affected the safety meetings so that people from different units do not meet in the same way that they used to anymore.

In fact, it can be revealed a situation of the plant under similar constraints of a policy of Better / Cheaper /Faster, coping with at least three sometimes antagonistic goals: safety & environment, production, quality. Some plays around the safety rules (such as "necessary violations", [START_REF] Reason | L'erreur humaine[END_REF] or adaptations such as the ETTO concept, [START_REF] Hollnagel | Barriers and accident prevention[END_REF] thanks to tacit agreements from the hierarchy do happen. Without them, the organisation would probably not run smoothly under such constraints (we have heard it, and we have seen it). Of course this picture of an organisation which gives signs of playing with its limits (Starbuck et al, 2005) can't be applied strictly to this plant as downsizing, budget restrictions or loss of expertise with departure of experienced and skilled workers is not the case at all here. It must be on the contrary balanced with good signs of resilience or reliability. For example, the expertise on safety issues by the safety department is high and time is taken for performing risk analysis, management of change but also training and learning from experience. The management of the plant has a strong experience of the chemical industry and a background of chemical engineering helping him to better conceptualise the technical safety issues. The expertise available in safety engineering throughout the group is also very high and helpful when used.

The next part introduces the incidental-accidental approach, that we used for discussing the findings of the non incidental-accidental, normal, perspective as described above. In theory, this technique is easier because it consists in describing and interpreting events by unfolding the context of these ones.

Incidental & accidental study perspective

The other strong advantages is that it shows the organisation as it really is because the incidental-accidental study reveals the true side -or the "dark side" [START_REF] Sagan | The limits of safety[END_REF][START_REF] Vaughan | The Dark Side of Organizations: Mistake, Misconduct, and Disaster[END_REF] -of the organisation. The interest in looking at the incidental-accidental perspective is to have the opportunity to describe the impact of a specific organisational design on safety. It is indeed very difficult to describe the impact of the regular evolutions and transformations of the organisational design without the help of concrete safety related events. The absence of events is also indeed in principle a strong indication that the level of safety is good, but it might also be interpreted that relevant information are not captured and analysed.

In our case study, two incidents were easily identified, and couldn't have gone unnoticed. Two runaway reactions, in the processes that we chose to study for the research, ended up in the catch tank few months ago. These two incidents were very similar, revealing a weakness in the installation design but also therefore in the way the organisation was able to identify and assess risks. However, a positive side of the event was that it also made clear that the back up design of the installations was well dimensioned for the scenario, because toxic gases were contained and only a small quantity of gas treated through the scrubber was released to the atmosphere. The incident didn't trigger any concern from the nearby towns and inhabitants.

After studying the analysis performed by the company on these events, the approach that we followed consisted in interviewing the operators involved during the incidents, in order to hear directly the chronology but also how they perceived the events, and the way it was treated internally. We then interviewed the people who participated to the analysis, so that we could understand better how it impacted their representation regarding the level of safety of the plants but also how the organisation did learn from it.

The main technical cause is linked with the agitator stopping in both cases (one for a power cut and the other for a failure of a software component) and then creating a direct path to an uncontrollable runaway reaction leading to the rupture disk to blow and then to release the content of the vessel in the catch tank. This accident sequence is quite clear when using figure 1. It is interesting to notice that the quench that was supposed to stop the runaway reaction couldn't serve this purpose when the agitator was stopped, so that in this specific scenario, it is in general inadequate.

Without going too much in the detail of this case and its analysis, it is interesting here to notice that a scenario found its way throughout to create an uncontrolled runaway reaction4 . Without questioning the outcomes of these events which definitely also proved twice the safe design of the installations, it is however an opportunity for the organisation to learn about the inability of a network of people to anticipate and to prevent the incident. Looking the events this way, some clear organisational dynamic dimensions appeared. They demonstrate how an organisation can sometimes generate its own blind spots, but also how the ability to stay updated in regards with available methods and safety technology, although available internally within the group, was not generated to identify and assess the scenario, and investing for example in a new design. Availability of time but also of resources in safety can be pointed at, all these factors diminishing the possibility of a requisite imagination [START_REF] Adamski | Requisite imagination: the fine art of anticipating what might go wrong[END_REF]. Without the expected behaviour of the barriers as designed (a proportionate design of the relief system, maintenance of catch tank), the events could have ended up in a more important incidents.

CONCLUSIONS

The aim of this paper was to introduce current findings and some discussions around the assessment of the resilience or reliability of an organisation by a team of outsiders in the chemical industry based in a case study. The paper stressed the importance for such an assessment of connecting a normal study approach (whats happening when nothing is happening?) with an accidental one (looking at past accident and the organisational sides of the genesis of accident). This helps in contrasting and also articulating them.

Regarding the question "what's happening when nothing is happening?", it is clear to us that, in a capitalistic society, a company looks for technological and organisational transformations that help creating more profits, while maintaining a reasonable perceived level of safety. There is nothing to be surprised of. Changes will affect the system probably until it is proved that the system becomes not safe anymore. The conditions of this dynamical process depends on the interaction of cognitive, psychological, social, cultural, economical and political dimensions, making of prevention a complex phenomena.

The first results of our case study indicate that the company, despite an excellent approach of safety, got surprised by a preventable scenario, demonstrating that even in organisation dedicating resources to reach the features of high reliable systems, the possibility for blind spots to develop is far from being unlikely. The trend affecting the current transformation of the organisation should be considered very carefully in regards with these recent events. Availability of time for key safety people to step back and look at the installations in light of the new available safety technologies, of the new available risk analysis methods and of the incidents from similar installations, should be ensured.

  figure 1: Barriers for loss of containment of toxic substances

By choosing "organisation", we target the actors employed by the company and working in the plant. The "socio-technical system" expression can be used to open the organisation to other actors such as the regulators, the sub-contractors, the corporate, the public. When we use "organisation" in this paper, we mean the organisation within its socio-technical system. In an approach acknowledging the complexity of safety and accidents dynamic, such a perspective is unavoidable.Lecoze & Dupré

There is probably not a single and best way of distinguishing barriers, but this simple decomposition proved heuristically valid and simple enough to be used for the purpose of our research and developments.

This comment is quite compatible with idea of the need for different safety-accident models according to the type of system investigated, from safe to ultra safe systems.

We get close here to the[START_REF] Perrow | Normal accident theory, living with high risk technology[END_REF] normal accident idea, of unplanned and hidden interactions within the installations.

Lecoze & Dupré


François Françoise Fontaine
email: francois.fontaine@ineris.fr

Sophie Abiven

Christian Tremeaud

Nelson Pelligand

Ineris Rodrigues

Major accidents scenarios used for LUP and off-site emergency planning : Importance of kinetic description

Keywords: Land Use Planning, off-site emergency planning, chemical accident scenario, kinetic

The European States, France in particular, faced with several industrial accidents, like one of the most serious one, the AZF explosion in Toulouse (France) in 2001, which created the trauma of the stakeholders concerned by the chemical risk, (industry, authorities and citizen). Learning from this experience, the French Ministry in charge of the Environment, with the help of INERIS, worked on upgrading its chemical risks knowledge and studied to improve new methods on risk assessment. In 2004, INERIS was in charge of developing a new approach to classify accidental scenarios in terms of probability, severity and response time. In this paper, INERIS proposes a prioritisation based on time of occurrence, of development of hazardous phenomena and of effects on targets. Then, INERIS shows a method enabling to integrate, as a second prioritisation criteria, the on-site and off-site response capabilities/abilities as well as the means for population protection in terms of time allowed.

Background

The European States, France in particular, faced with several industrial accidents of various causes and extent. The consequences of technological or chemical disasters such as those in Flixborough in 1971, or Seveso in 1976 (numerous casualties, major damage to the environment...), made international authorities to examine these phenomena and have especially led the European Commission to adopt legislation to prevent such events. Two consecutive Directives in 1982 [START_REF]Guide d'Intervention face au Risque Chimique[END_REF] then in 19963 gave guidance to member States to develop a prevention policy for major technological risks.

The latter Directive was transposed to French law in May 2000: the upgrading of those installations with possible major technological risks is still being continued today.

In France, the AZF accident in Toulouse, on 21 September 2001, was truly traumatic for all stakeholders concerned by chemical risk, from industries operating chemical plants to administrative decision-makers, not forgetting interest groups and the citizen.

With reference to these research, and under the scope of the Seveso II Directive, the French Ministry of the Environment4 (MEDD) set the 2003 act of Law5 on Risks concerning Technological Risk Prevention Plan (PPRT).

INERIS is the technical support for the MEDD and offers expertise to Industries. INERIS is the reference body for risk analysis, determination of means to prevent major technological risks (chemical risks) and associated means of protection for SEVESO Installations and other fixed installations. INERIS also supports for authorities and industry for transportation of hazardous substances via pipelines, road, rail, inland waters, tunnels and port areas.

These facilities are consequently covered in safety reports. They are used to devise internal and external emergency plans and for prioritising emergency equipment in the preparation of crisis situations subsequent to chemical accidents.

In 2004, INERIS was in charge of developing a new approach to classify accidental scenarios in terms of probability, severity and response time.

About response time, INERIS proposed a first prioritisation based on time of occurrence, of development of hazardous phenomena and of effects on targets. As a second prioritisation criteria, INERIS showed a method enabling to integrate, the onsite and off-site response capabilities/abilities as well as the means for population protection in terms of time allowed. This approach is compatible with the Methodology for the Identification of Major Accident Hazards (MIMAH) developed in the ARAMIS Project6 . This paper reviews scenario characteristic used to establish Land Use Planning (LUP) and off-site emergency plans. Then it identify the difficulties encountered to coordinate LUP and emergency planning. An example of an off-site emergency plan integrating response time will be presented in the seminar.

Definition and conventional analysis of accident scenario kinetic

The kinetic is one of the key elements necessary for classifying the scenarios of accidents those will be used especially for : a LUP establishment ; a Emergency Plans Elaboration.

As a preliminary, we would differentiate the notions of "time" and "duration", insofar as certain phases can be concomitant (the phases are thus not strictly successive).

Accident scenario kinetic is characterised by a pre-acci dental phase and a postaccidental phase. The latter is determined by the dangerous phenomenon dynamics and the exposure of the targets (public, environment).

The pre-accidental kinetic study, duration necessary to lead to the Critical Event (lost of containment) which corresponds to the time between the Initiating Event and the release of the potential of hazard is not study in this paper but is integrated in the Safety Report. We would focus on the characteristics of the post-accidental kinetic.

On the one hand, it is necessary to distinguish the kinetic from the phenomenon and, on the other hand, the kinetic from the exposure of the targets. Insofar as the occurrence of the effect on the targets can, according to cases', being former (for example for a fire of warehouse) or posterior (for example, for a dispersion of a toxic substance following a ruin) at the end of the development of the phenomenon. These four kinetics are thus not necessarily successive.

Hazard phenomenon kinetic is characterised by : a Occurrence Delay (di) which corresponds for example to the time needed to the formation of one inflammable cloud in the case of a VCE O The phenomenon development until its stationary state (di) : for example with the development of the fire generalised in the case of a fire of warehouse ;

With regard to the targets, the elements of kinetics are as follows :

• A time (da) necessary to the first physical effect on the target (toxic cloud displacement delay to hit the target) ; • The duration corresponding to the exposure of the targets (d4).

It is also significant to appreciate the capacity of intervention (mitigation measures, safety services...), which can influence the times previously quoted overall.

In order to improve the understanding the temporal decomposition which has been just made, we can study a representation in bow tie (which characterises the development of a scenario of accident) to carry out a conventional analysis of the kinetics of accident :

SCENARIO Current Event b Prevention

Pre-aecidental kinetic taking into account in safety report

Post-accidental kinetics to characterise within the framework of LUP and emergency planning O This illustration is generic, and must be adapted to each phenomenon ; The illustration is not on the scale. The rise to power of the phenomenon could be extremely reduced ;

a The attack of the targets and the exposure could begin from the start of the phenomenon until its development. The attack of the targets (time necessary to the appearance of an effect on the targets) could be immediate.

Accident scenario prioritization

The following definitions will be used:

a Pre-accidental phase : former to the release of the potential of danger (between the initiating event and the release of the potential of danger) ; a Post-accidental phase : posterior phase with the release of the potential of danger.

Scenario prioritisation to the pre-accidental kinetic

To illustrate this approach, the following table shows some various phenomena likely to occur on an industrial site and exposes, on the basis of lessons learned from past accident, the order of magnitude of associated times (in the order ascending of the duration).

Duration to reach the targets

The following table presents the time necessary to the emergence of a physical effect on the target :

First Conclusions

The phenomena could be characterised in several categories :

• « Very quick » phenomena : VCE & chemical decomposition ;

• « quick but delayed» phenomena : BLEVE ;

• « quick but very delayed» phenomena : BOIL-OVER ;

• long lasting phenomena but immediate effects : pool fire, jet fire, warehouse fire or confined fire, toxic release.

The case of chemical product decomposition is particular because the phenomena depends of chemical reaction conditions. It could be classified like a "very quick phenomena" or like a "quick but delayed phenomena".

Scenario prioritization taking into account safety services capabilities

The different delays for the safety services intervention could be decomposed in [2-3] :

0 Alert : delay between the release of the potential of hazard and the event knowledge (type of phenomena and location ) -a minima 10 minutes ;

© The movement of the Intervention Services on site : delay between the event knowledge and the effective arrival on the site -around 10 minutes ;

€) The Intervention at different levels : (a) To limit phenomena occurrence8 ; (b) And/or to limit its severity 1 ; (c) And/or for the "targetextraction" : (population confinement, evacuation) -a minima 15 minutes.

Three additional delays could be defined characterising the capacity of intervention of the public helps according to :

a ds : delay of the implementation of mitigation means before the phenomena occurrence ; it consists of (O + © + © a) and will be obligatorily higher than 45 minutes ; a de : delay of the implementation of mitigation means in order to limit the phenomenon severity ; it consists of (O + © + ©b) ; according to the availability of the means, it can be put in prospect in a field ranging between d2 and beyond ds ;

a dy : delay of the target extraction ; it consists of (O + © + ©c) and could begin as of the occurrence of the critical event (CE) and beyond d4 ;

Propositions to characterize the kinetic taking into account safety practices

In comparison with these elements, INERIS proposed, with regard to the kinetic, the following approach :

a Each phenomena has to be characterised according to the delay di to d4 (except the boil-over to which the pre-acci dental dynamic will be considered) ; a the justified choice of the delay ds, according to the real capacity of local intervention is likely to "downgrade" several phenomena for a value of dl higher than 45 minutes ; a the justified choice of the delay d6 is also likely to "downgrade" several phenomena in terms of severity ; a the use of d? will make it possible to differentiate the selection from the scenarios to be used for LUP or emergency planning.

Conclusion

To conclude, the knowledge of the phenomena kinetic decomposition is useful to improve the definition of :

a The safety barriers as well as them dimensioning. These barriers can be technical or organisational and depending of the local context. a The actions to decrease the targets vulnerability.

Figure 2 - 1 :

 21 Figure 2-1 : Illustration of the kinetic on the bow tie

  the speed of sound) Immediate (propagation at the speed of light) Could be long (Depends of meteorological conditions and emission duration) Depends of explosion localisation Instantaneous Phenomena duration to hours Could be long (depends of phenomena duration & chemical product characteristics) InstantaneousTable 3-1 : Time length to exposure & exposure time length of various effects

  Figure 4-1 -Delay organisation

Institut National de l'Environnement Industriel et des Risques

Council Directive 82/501/EEC of 24 June 1982 on major accident hazards of some industrial activities (Seveso I)

Council Directive 96/82 of 9 December 1996 ( Seveso H)on the controlling of dangers connected with major accidents involving dangerous substances (modified in December 2003)

Ministère de l'Ecologie et du Développement Durable -MEDD ( Ministry of Ecology and sustainable development)

Law n°2003-699 (2003, July the 30 th ) on natural & technological risk prevention

Accidental Risk Assessment Methodology for Industries -http://aramis.jrc.it/

P -overPressure ; Th -Thermal ; Tox -Toxic ; M-Missile

These last two times are around 15 minutes for the installation of the means, time for which it is necessary to add the effective time of intervention. In addition, they get along only in the absence of victims which in, all the cases will be treated in priority

Dangerous Phenomena

Initial Event

Pre-accidental duration

BLEVE Thermal flux heating the vessel

Around 10 minutes -Depends on the chemical product, conditioning, fire power, vessel resistance, etc.

Boil-over Vessel Fire Hours

Table 3-1 : Pre-accidental kinetic of the various phenomena (e.g)

Scenario prioritisation to the post-accidental kinetic

The following table presents some various phenomena likely to occur on a factory site and exposes the order of magnitude of associated times with the development of the phenomenon, its duration, and the associated effects.


Audrey Trémolières

Eliane Propeck-Zimmermann

Thierry Saint -Gerand

Major Industrial risks Discussions on territorial approach and risk mapping

Keywords: stake, vulnerability, major industrial risk, GIS, Risk-map law

The explosion of the AZF chemical plant in Toulouse, on 21 September 2001, dramatically revealed an old problem of industrialised era that is the vicinity of industrial plants and urban areas. With the 30t h My 2003 new law \ in particular with the Technological Risk Prevention Plans (TRPP)2 , stakeholders can't now ignore the importance of territory in risk assessment. The objective is to identify major stakes for the society and their vulnerability for a better land use planning. But this method needs analytical and synthetic tools, as GIS 3 . Indeed, GIS permits experts to structure the data and enables them a spatial lecture of risks. So stakeholders can see and have a concrete representation of risks on their territory, and maps become common discussion and negotiation tools. But that requires understanding in what risk space-rating and mapping need an interdisciplinary vision and a global approach of a same territory. In the context of a PhD study in collaboration with INERIS and the research laboratory GEOSYSCOM, we try to develop a methodology for major industrial risks assessment, based on map and spatial analysis allowed by GIS.

Introduction

In France, the 30 th July 2003 law states clearly the will to enforce new regulatory measures, in order to protect the populations concerned by industrial risks. Technological Risk Prevention Plans (TRPP), mostly based on a risk map, are now required. But, to realise an adequate risk map, we need to understand and define the concepts that are linked with risk assessment and management, and to create a relevant method for risk mapping in consequence. Indeed, in a context of land use planning we need to consider risk map as a real assessment and management tool. And this specific context highlights the importance of notions of territory, stakes and vulnerability, which are not enough considered in actual studies. We need a concrete knowledge of spatial and social organisations and vulnerability on a territory. Risk mapping and GIS could then help to deal with the complexity of territories and of major industrial risks. But we ask today in what measures we can assess and manage this territorial complexity, that spreads beyond boundaries and territorial traditionally used structure. Knowing that, several questions can be highlighted, in relation with the different step of our study.

First, to understand the context and the finality of our study, we need to wonder:

• What do we globally represent and what actors and stakeholders are concerned?

• How is the map understood and used by different stakeholders?

• How can we define industrial risks on a territorial point of view?

Secondly, we need to think about the approach we will use for risk assessment and the risk mapping method:

• How to represent risk on a map, what conceptual approach we have to choose?

• Does risk mapping have to be considered as an ordinary description support or as a real tool for reflection, negotiation and decision process?

Lastly, we have to think about the method and the tools:

• What are we able to produce as representations of our present complex territorialities, of which inherited forms are outmoded? • How to represent risk through pedagogic and adequate maps and symbols?

• What can GIS bring to us in the lecture and analysis of complex areas?

To try to answer to those questions, and in order to situate the role of the map, we will explicit the notion of risk, and in particular our approach of the territorial vulnerability and the pertinence of the notion of stake. Then we will demonstrate in what major industrial risk mapping is strategic, and intrinsically in relation with the notions of territory, risk space rating and complexity. Finally we will argue on the interests of an "industrial risk GIS".

The present risk mapping in France

Mapping the risk require to understand the context of its use and the message it has to communicate. As the map translates our representations of a phenomenon in a given instant, it is different if we make it in an optic of research, to divulge results, to communicate or for public participation. It is in this context that we situate the interest and the finality of risks mapping. And it is so important to define exactly what terms are relevant according to the needs and the level of details of the studies.

The map as a public information tool: simplified definitions and methods

The cartographic tool can be used in very different contexts and has a lot of languages and forms within the type of person involved. Thus, we already find industrial risk maps, in particular in local authorities services and offices. These maps are simple, pedagogic but non-dedicated to analysis either to help decision-making. We can find them in preventive information documents 4 that local authorities have to realise in case of a risk on their territory. For example, the figure bellow is from the DDRM of the Isère department and represents the industrial risk at a large scale. The figure 2 presents another example, at a different scale. It shows the perimeters of dangers of industrial plants that are considered as risk zones. These cartographic documents, interactive and available on Internet, permit the local authorities to communicate on risks in their community, and to diffuse more easily the information.

But, if these documents are for information use, They remain very incomplete for other uses, even concerning the employed notions. Indeed, these documents are called risk maps but in fact they are only danger maps, representing perimeters of danger overlapping urban spaces. So these documents are based on the simplistic approach saying that:

Risk = hazard

Moreover, these documents don't consider the territory and their characteristics, either the notions of stakes or vulnerability. These concepts will be necessary for another type of studies and mapping, as risk assessment and management tools. And in that context, there are some conceptual problems that interfere with the quality of the studies, and by extension, on the quality and the relevance of the map.

1.2. The map as an assessment and management tool: the example of the actual Risk Prevention Plans (RPP) 5In France, the Risk Prevention Plans are statutory tools that permit the local authorities to manage the risk on their territory, in the context of land use planning and risk prevention. At present, They essentially concern natural hazards and are classified by types of risks (flooding, fire, landslides, etc.). Maps define precise zones of risk and the consequences in term of urban development and management.

These RPP present three types of maps:

• The first represents hazards. Each type of hazard has a specific map. The severity of the danger defines the hazards zoning. • Another map represents the stakes on the concerned territory. It is used to know what is exactly exposed to a hazard. This map is dedicated to classify specific zones that must be protected and how they must be protected. • The last map is the crossing of both maps. This last map will be used for land use planning and represents the « reglementary zoning» that says if urban spaces can be developed or not, if we can build new urban areas or not, and if we can, in what conditions? This map is a reference for land use planning and all territorial decisions in consequence.

Then, the main difference with the information maps is that these documents take into account the notion of stake, in relation with the notion of territory. In the RPP guides, a stake is defined as what the community can lose or as persons, goods, means, and patrimony, susceptible to be affected by a phenomenon.

Risk = hazard x stake

This approach will help the decision making at a local scale and permits the stakeholders to negotiate and discuss the zones and the land use.

Map as a research tool

In risk studies, risk definitions appear more complex and require specific approaches and understandings. Each approach has its own definition and it remains difficult to adapt some of these studies to a practical need in present risk assessment.

Notions of vulnerability, stake, even risk are complex and the studies try to be very exhaustive and to go further some simplistic approaches used at present. The result is that this situation can create some incomprehension with the practical needs of local authorities, when they are informed about it. The maps that result from these works are very interesting and can be very relevant for risk assessment. But they stay inadequate to the present risk management, because they require very long analysis, a lot of data (that is not always adequate in some contexts), and overall a particular understanding of the complex concept of risk. What's more, they are often non-adapted to actors' perceptions and representations. Finally, the results of these researches are not used as they could be because they might stay disconnected from the experience and point of view of stakeholders.

Those examples highlight comprehension shortcomings between universitary and professional worlds. Both might better collaborate to take benefits of their own experiences and points of view. In our PhD study, we want to go through these problems and try to develop a method that take into account the practical needs and points of views of all stakeholders, having a scientific but practical and pedagogic approach. This requires defining exactly what is relevant in term of notions, definitions and finality.

Risk with a spatial and functional approach

In France, risk is differently defined depending on the type of hazard considered and the finality of the study.

In industrial risk assessment, risk definitions and mapping are mainly technical, focused on hazards. Risk is then considered as a product of probability and severity, determined by effect thresholds.

Risk = probability x severity

In social sciences, the definitions are based on a different approach, inspired by natural risk studies. According to that, probability and severity are only considered as hazard components, but don't define the risk in totality. This hazard is crossed with vulnerability

[1].

Risk = Vulnerability X Hazard

According to us, these definitions have to be implemented. The territory is an entire component of risk, an exposed element that have to be took into account. It can indeed be vulnerable by its intrinsic properties. What's more, we also have to consider the stakes that are concentrated in this territory and that can also be vulnerable. Thus, damages are, on the one hand, due to intrinsic characteristics of a hazard, and on the other hand, to major stakes and territory intrinsic vulnerability. It is so the product of stakes on a territory, both qualified by a degree of vulnerability, and of a hazard which creates a risk.

Risk = Territory °° x Stake °° X Hazard

But we need to define what we exactly mean using stake and vulnerability notions, and what is their role in risk assessment and management. Indeed, stake and vulnerability are used in a lot of definition and maps (as in the RPP studies). But they remain very vague and their understanding can change within the context and the stakeholders. This confusion can create problems for risk assessment and risk mapping, because the messages and the terms used are not clearly identified. These notions are very strategic if we base our studies in the precise aim of risk and crisis management, and we will argue on it.

the role of vulnerability in risk assessment

The following definitions permit us to understand what are the priorities in term of risk management and the role of all the concepts in risk assessment and risk mapping. It is since this conceptual step that we will define the finality of risk map and the adequate use of employed terms.

A strong but vague concept

Despite it current use in a lot of situations, vulnerability is still difficult to define. It is a strong concept but it remains vague because of it use in various disciplines (industrial engineering, health, geography, psychology, etc.). Then it seems necessary to clarify our position at terminological and methodological levels.

In general, vulnerability can be characterised by society's resistance and resilience capacities. In other words, it is the propensity to suffer damages, in relation with the society's capacity to face a hazard, whatever it origin.

The table 1 shows the diversity of approaches and vocabulary used to define vulnerability. It is based on an inventory of different terms employed in 40 different definitions chosen in the 2004-year publications [START_REF] Griot | terminologie en science du risque, recueil de définitions[END_REF]. This example highlights how various are the utilisation of this concept, how difficult it can be to communicate with the adequate words to different persons. Moreover, these words are likely to have different meanings according to the country or the structure involved. And this semantic detail is very important in term of communication and negotiation. To go further and to try to understand all the components of the vulnerability, we base our approach on Robert D'Ercole's studies [START_REF] D'ercole | Approches de la vulnérabilité et perspectives pour une meilleure logique de réduction des risques[END_REF]. He explains that vulnerability can be defined and analysed according to two different but strongly complementary approaches.

The first, and the most employed, is quantitative. It considers vulnerability as a rating or a percentage of loss, of damage in case of a catastrophe (human lives, goods, and various values). This damage assessment is often limited at physical aspects of vulnerability (mostly resistance of structures). For engineering purposes for example [START_REF] Undp | Disaster Management Training Programme[END_REF], vulnerability is a mathematical function defined as the degree of loss to a given element at risk. It is expressed on a scale of 0 (no damage) to 1 (total damage).

Unfortunately real damage often exceed the physical ones. Thus, if as in the case the seismic industrial engineering, we can refer to quantitative analysis to partly assess the structure vulnerability [START_REF] Trémolières | Enjeux et vulnérabilités des centres de Quito (Equateur), caractérisation et impacts à l'échelle du District Metropolitan de Quito[END_REF], we need also a qualitative assessment (social, psychological, institutional factors, etc.) to assess non-visible and non-physical damages. We must then take into account other definitions, based on a multidisciplinary approach, to evaluate major stakes and their vulnerability.

The second approach is qualitative. It is less traditional, implementing a social approach of vulnerability. It is based on structural factors or on the current economic situation which induce an intrinsic vulnerability of the society. These factors can be sociodemographic and economic (demographic growth, areas occupation, socio-economic context, etc.). They can also be socio-cultural (acquired knowledge contrasting with perceptions), technical (prevention and protection measures, network, build structures and infrastructures), and lastly institutional, politic and administrative (land use planning and urban management, etc.). The factors of vulnerability depend of the society's cohesion, characteristics and organisation. They are difficult to evaluate because of their nature, often qualitative or half -quantitative, and in relation with the education, the social and cultural inheritance, and with the populations' and stakeholders' risk perception.

This definition is very complete and quite difficult to understand without a systemic point of view. It helps to realise that a territory is made of different functions and elements that interact and are closely link. Concerning the context of our studies, we want to implement this vision with another notion, more functional. Thus, we consider that vulnerability exists through the presence on a territory of inherited elements and of intrinsic factors of vulnerability, which evolve and interact in space and time. These elements have intrinsic and functional values that contribute to communal well being, to emergency response and post-disaster recovery in particular. We call them stakes.

Considering major stakes for functional risk management

Notion of dependence

In the context of risk management and land use planning, the territory is considered as a social, economic, and spatial system, with essential elements and functions. When these elements or functions have a value for the society, we call them stakes. This value is determined by their role and weight in the society and by the consequences of their damages or loss at short, medium and long terms. The more important is the value, the more dependent is the society. This dependence of the society towards stakes makes the system vulnerable on it own territory (for example: blackout, supply places demolished, ways of communication destroyed, political and social disorganisation and conflicts, economic loss, etc.). Consequently, these essential elements and functions are called "major stakes" and have to be assessed in priority.

Strategic functions for the society

These strategic and functional choices can be misunderstood in a local scale (the society interests seem more important than the individual ones). But, at local as at global scale, the concentration of major stakes in exposed areas appears as the first factor of risk. Analysing those major stakes permits us to put forward strategic zones for the society (hospitals, commercial activities, political and administrative authorities, natural resources, etc.), homogeneous or not, and to reveal some spatial and social dynamics and weaknesses.

We can then act to reduce their vulnerability and to be more prepared to face a hazard. Indeed, a simple description of a territory and of the functions is not enough if we want to be efficient in term of risk management. Organising these functions, defining the importance of the stakes, their weight in the society and their vulnerability helps us to map the more vulnerable zones, to classify them and to visualise the spaces where a prevention or protection action is necessary. This is not possible with a simple description map, or it will take longer to identify the strategic zones. Then, we will be able to realise a major stakes map, representing their role and the function they represent (for example, political, economical, environmental, symbolic, etc.). It will be possible to see homogeneous zones and to study the eventual spatial and social interactions between different spaces and stakes, in a systemic way.

One of the first phases of risk assessment is so to qualify those major stakes. However, according to us, it still exists some confusion because of the difficulty to define it. What's more, as we saw before, notions of stake and vulnerability are often used, as in RPP, but don't have the same meaning depending on the actor and point of view. This has consequences on map message and realisation. The maps can be heterogeneous and bring confusion instead of helping to visualise and analysis spaces.

Conceptual confusions and consequences on mapping

The amalgam regularly done between the notions of stake and vulnerability testifies of the shortcomings existing in term of definition, assessment and mapping. Stake is often considered as target, exposed element, vulnerability, or even territory. But, for us, these definitions don't express the notions of value, role, weight, dependence, or either priority, that are characteristic of a stake and that make it different from a single function or element on a territory.

Then, a map that describes a territory is often qualified of "stakes map", or even "vulnerability map". As there isn't an official method for stake and vulnerability assessment, one considers that territory is synonym of vulnerability and the studies stay poor in term of spatial analysis and qualification of a territory. And as this type of map is few used in risk assessment, the hazard map being the traditional reference, we continue to act in an inadequate way. Studies on stake and vulnerability mapping are lacking. Consequently, this situation creates a distorted vision of a territory that can complicate decisions and actions. The map does not transmit anymore the initial message and the image has no value either relevance relative to the initial finality. The map becomes almost " useless " [START_REF] Debardieux | Ces territorialités qui se dessinent[END_REF].

However, the majority of experts and stakeholders know that these methods are incomplete and need to be implemented. But, in the context of RPP, and overall TRPP, time, tools, cultural and scientific references and comparison are lacking to implement studies, and to pass from territory description to stakes and vulnerability identification and analysis. This is due to a lot of social, political, economic, scientific dimensions that created this situation in time and space, and to the difficulty to take into account qualitative factors in risk assessment. It seems now necessary to implement more adapted and relevant methods, including risk mapping.

Major stake and vulnerability qualification

Context and finality

To identify the major stakes that are concentrated in a specific space, we need local stakeholders or expert point of view and knowledge. Then, to understand the context and the expectations of the stakeholders, we need to set:

• The finality of the study:

-What do they want to protect, in normal times and in critical times?

• The material, the data and their use: How to find the relevant data? Are there data inadequate? How, from the data collected and exploited, a stakeholder will understand the information and use it?

This first approach enables us:

• To realise socio-spatial models:

-To highlight places of centrality, to identify main elements and functions and their spatial dynamics. -To analyse the location and the dynamic of principals and strategic networks, and their relations with neighbouring territories.

• To develop a specific approach: -To realise a typology and a space rating of elements and functions according to different administrative and territorial scales (township, region, state, etc.). To define "major stakes" for risk assessment and management (including crisis management).

This approach needs to consider the territory as a system made of different dimensions that interact and that characterise the major stake at a society scale. The conjunction of spatial elements, of economic and political values, social practices and inherited traditions create major stakes. That's why we can't consider the territory only from a specific point of view, that would occult other possibilities. A same space has different meanings and uses depending on the approach and dimensions considered. That's why we need the stakeholders' perceptions and interests to understand their own spatial and territorial logic.

Approach and first identification

To assess for major stakes and their vulnerability, we have to consider essential dimensions that represent main dynamics that interact on a specific territory and that define stakes. Indeed, stakes are made and defined by our practices, social, economic or spatial organisation and relations. Considering these dimensions permits us to classify the major stake considering their function and role (human, economic, cultural, symbolic, political, strategic or military, environmental, etc.). These dimensions are mostly:

• Spatial. It represents all the spatial and territorial dynamics that are inherited from cultural and spatial development in history. It is the physical and material representation of a society's community, identity and way of life.

• Economic and political. This dimension is an economic translation of a society's organisation and activities. It takes into account the political power, the economic weight of the functions and the relations with other territories. • Social and cognitive. It is the more difficult dimension to consider because of the qualitative and individual aspects to consider. It represents the social perceptions and relations in a same territory and it shows that stake can also be symbolic, defined by cognitive factors sometimes difficult to understand and to consider.

This figure represents the three most important steps for stake and vulnerability assessment. First, we qualify major stakes. Then we specify factors of vulnerability that are intrinsic to the concerned territory. Lastly we specify the vulnerability of major stakes crossing both information.

Typology of territorial functions/ land use

:>• .• • • • ,
• mapping

Strategic networks (transport economic, Communication, etc.)

• .• ' . , population . ; "-'-'. Lastly, this vulnerability has to be organised into a hierarchy according to stakeholders' perspectives. We can obtain a global map representing different levels of vulnerability (see figure 4) and showing where spaces seem more vulnerable than others.

. i s. :

Global vulnerability HI Very strong HI Strong ^ Medium ^«;; ; low But the approach remains complicated because we use the experts' and stakeholders' judgements to weight the major stakes and the factors of vulnerability. And they have sometimes very different (and often divergent) interests.

Main difficulties due to factors of vulnerability assessment

In a context of studies and researches, major stakes and vulnerability assessment needs a detailed knowledge of the concerned territories. It needs to be done in a large time scale to understand all the mechanisms and dynamics of these spaces. This length of analysis and of data finding is then difficult to adapt to the stakeholders' needs and to risk management.

Understanding the factors and Finding data

Most of difficulties are closely due to the qualitative nature of data, and to the sociospatial complexity. So we have to make relevant choices about factors selection. And it is necessary to justify these choices according to the existing contexts. As it is sure that we will take into account the population density and the type of urban frame, we will also probably consider the age of the population and the accessibility of the spaces.

But this type of approach can be very restrictive and we are likely to occult important factors only because of finding and analysing difficulties. As an example, it is highly probable that we would not consider populations' risk culture or networks structure quality (water, electricity, etc.). Consequently, it seems important to take into account these shortcomings and to know that the results remain partial and perfectible.

Comparing and weighting different factors

The vulnerability is mostly expressed in a qualitative way (such as "low, medium and strong") This classification requires a referential judgement and implies to take political and ethical positions. But, objectivity remains difficult to reach because of the nature of these judgements, subjective so contestable. We must then tempt to find a consensus between all experts and stakeholders representations and interests.

When several factors of vulnerability (from different types and scales: socio-economic, political, economical, cultural, etc.) cohabit on a same territory, to compare and aggregate them can become conflicting:

• On the one hand, to aggregate different factors of vulnerability breed a significant loss of information and can be prejudicial for the analysis and the decision making. A global map representing a general level of vulnerability is not easy to exploit because we don't know the qualitative nature of the factors considered that have been aggregated. But it permits to see what spaces could be more concerned by factors of vulnerability than other, and then to concentrate the efforts and the studies on it.

• On the other hand, the multiplication of analyses and of maps creates also problems for negotiating and for space-rating the risk. Stakeholders need synthetic information and analytic maps could bring too much information without really organising it and without helping the decision making process.

In other words, considering global indexes and synthetic vulnerability maps can seem few adequate but too much information can create confusions and be inefficient. Moreover, if we can develop general and global matrixes, all factors of vulnerability are not relevant in all cases, and a selection has to be made according to the expectations and the context of the study. Stakeholders need to be helped for decisions and need to have the clearest and the most relevant information. And that point is very ambiguous.

Because the relevance of the information is difficult to define without a context and is likely to be different within the stakeholders concerned. Each choice can be contradict.

So it seems important to adapt the analysis to a specific context, in order to take into account the demands and the works to realise. That would tell that there is not one general method for risk assessment, and that each case has to be considered in particular.

If it is on a scientific aim, to be exhaustive and complete, we will need time and we will not consider practical and political questions in priority. But, if we think overall on operational and emergency aspects, we need to make choices and to concentrate our work on identification, prevention and protection of the major stakes that are vulnerable.

Risk and spatial complexity

The simple world is now behind us and, as underline Debardieux and Vanier [START_REF] Debardieux | Ces territorialités qui se dessinent[END_REF], we have entered in a territorial complexity era. We assist (and we participate) to the multiplication of practices, of exchanges, implying a combination of different areas, temporalities and territorialities. The increasing complexity of the economic, social or political functions and dynamics creates new problems for mapping.

Complexity and cartography: mapping vulnerability

complexity of a territory

The present complexity is partly due to territory evolution and to society's perception. Moreover, our inherited representations of a territory and the mapping techniques traditionally used are now inefficient to include this complexity in a map. Administrative and territorial boundaries are indeed less and less adapted to contemporary territorial dynamics. The map is then less relevant and limited by formalisms that it would perhaps be interesting to implement.

In risk management, this complexity is characterised by a multiplicity of territorial identities and of stakeholders, which are superposed and have dynamic relations What's more, the notion of " uncertainty " related to analysis and risk assessment makes also complicated the risk space rating. Thus, mapping vulnerability becomes complex because of the multitude of parameters to consider, being qualitative or quantitative. And today more than ever, risk map is a real stake for risk management being an important support of negotiation and dialogue. The political, economic and social stakes are such that the question of the map can not be occulted. We need more and more referents of our own territorialities, to understand and analyse our practices. The map represents the territory of all stakeholders and permits them to spatially confront their interests. But, if we refer to existing researches on vulnerability, particularly in geography, we notice that, beyond the density of the population, the majority of indicators are qualitative, in relation with social and individual behaviours facing danger. Vulnerability assessment needs a deepened knowledge of concerned society and territory, and can only be done in a long time scale, because of spatial, temporal and social scales (from the individual to the collective) that interact.

Complexity of representing a territory

From a technical point of view, all mapping meet obstacles, and we notice that the cartographic language can't express everything! Putting a large number of different visual components on a map has limits, in relation with the physiological incapacity of the human perception and of the simultaneous vision [START_REF] Debardieux | Ces territorialités qui se dessinent[END_REF].

To help decision and consultation, risk map has to be easily understood, or it would be useless. What's more, once realised, the map becomes a public document, arguable and contestable. It comes out of it technical context and lose the value that the authors put in it. It interpretation can then be very different from the initial message. It can create virulent reactions from local stakeholders, who trust to map extreme referential and spatial precision and temporal suggest!veness. They forget then that the map is not the reality, is subjective and is likely to evolve. Moreover, the finality of major industrial risk mapping is not the map in itself, but is the representation and the interpreting of a particular context, of spatial and social relations. It permits a particular reading of the risk on a territory, without forgetting the limits of drawn boundaries and thresholds, dependent on chosen concepts and of assessment methods. That's partly why we have technical difficulties to map this territorial complexity, overall in an adequate way.

Interest and utility of GIS.

GIS appears like an interface between concepts and stakeholders' needs. It is a powerful reflexive, analysis and communication tool that remains however complicated to use if it is not well-structured [7]. What's more, data collect, integration and processing require above all competencies of a specialist, and not these of a manager. So we have to estimate what really are the advantages of a GIS in risk management.

Coupling methods of risk assessment and a GIS enables us to advance simultaneously on several topics and on important studies for risk management. On the one hand, we contribute to the knowledge and prospective improvement in major industrial risk assessment; and on the other hand we promote and assess new working methods through GIS and spatial analysis. It means to understand how the GIS can combine, confront, associate, proceed those information for a global and synthetic vision [START_REF] Bavoux | La géographie: Objet, méthodes, débats[END_REF].

In that purpose, we need a pragmatic approach:

• Why scientists and stakeholders are they interested in GIS? What do they think GIS will bring about? • How do they perceive the utility of GIS and what do they wait from it? GIS, through the three components it offers (space, time, observable reality), is able to bring a solution to the social expectations, and to constitute a main of answer. The important on a GIS are not the quantity of data that we can collect, but it is overall the data structure that can create information and knowledge. And these results enable us to understand territorial and spatial features that can interfere with land use planning and produce particular risks. The key point is to create a logical and structured method. So, this is from the explanation of the concepts, of their use and of their relations that we will deliver a clear message using maps. But we have now to find the adequate map symbols that can be understood and assimilate for all readers ad users, knowing that they are often few sensitised to this kind of language.

conclusion

In France, major industrial risks mapping, and in particular major stakes and vulnerability representation, remains to explore. It certainly offers large possibilities for analysis, management and negotiation, in condition to respect the entire process of GIS and map conception, promotion and use. Indeed, even "bad maps" communicate and the question of what a good map is, according to cartographic conventions, is to ask how well it communicates with it users [START_REF] Ramella | Risk maps: theoretical concepts and techniques[END_REF]. The aim of our studies is to offer a tool for dialogue and communication to all stakeholders, even non-specialists, for a better land use planning. INERIS, by its technique and scientific knowledge of the industrial hazard and its methods of risk assessment, can develop a method of assessment and of mapping through GIS. The project has then a specific finality, conciliating of the industrial engineer sciences and these of social and spatial sciences. But that means to understand all the concepts and stakes inherent to risk assessment and management complexity, and overall to consider the map as a " symbolic mediation between the human and his world " (Torricelli,in [START_REF] Debardieux | Ces territorialités qui se dessinent[END_REF] p. 148).

Figure 1 .Figure 2 .

 12 Figure 1. Industrial risks in Isère issued of the DDRM (www.irma-grenoble.com)

Figure 3 .

 3 Figure 3. Simplified method for major stakes vulnerability identification

Figure 4 .

 4 Figure 4. Example of global vulnerability mapping

Table I :

 I 2004 most employed terms for vulnerability Adapted from[START_REF] Griot | terminologie en science du risque, recueil de définitions[END_REF]

	Term employed	Frequency of appearance
	resilience	1
	Weakness	6
	Degradability	1
	Fragility	2
	Damage	4
	Consequences	3
	sensitivity	3
	Severity	3
	Degree of loss	5
	susceptibility

13 2.1.2. The need of qualitative and systemic approach

In french, Plans de prévention des risques, PPR.

Dossiers Communaux Synthétiques (