Roseline Bonnard
email: roseline.bonnard@ineris.fr

COMMON ERRORS IN THE USE OF THE CALTOX MODEL TO ASSESS THE HUMAN HEALTH RISKS LINKED TO INDUSTRIAL EMISSIONS OF POLLUTANTS

Keywords: CalTOX, multimedia-modelling, exposure assessment

The French environmental regulation requires that all the facilities, works and development projects which may affect the environment should be the subject of an impact study to evaluate their consequences, including on human health. For this analysis, the risk assessment approach is used and the population's exposure is estimated with the aid of multimedia models. The CalTOX model is frequently used for this kind of study. Unfortunately, the analysis of these studies shows that the model is often badly understood and badly used. The difficulties encountered by the users, the errors and the problems met in the interpretation of results, which are the most commonly found in the human exposure assessment are listed and their consequences illustrated.

CalTOX has been shown to have a lot of advantages (adaptability, speed in carrying out calculations, transparency), but it ought not to be used as a "black box" as such a use may lead to many errors and a loss of credibility of the studies.

INTRODUCTION

In France, the law for nature protection (Law no. 76-62) requires industry to conduct an impact study for any facility and development project which may affect the environment. The law on air quality and rational use of energy (Law no. 96-1236) stipulates that one of the main objectives of the impact study is to analyse the effects for human health.

For this analysis, it is recommended to use the risk assessment approach (hazard identification, dose-response evaluation, exposure assessment and risk characterisation). To assess the exposures linked to the implementation of a new industrial facility, the following process is used: characterisation of the source of pollutants, modelling of the pollutant fate in the environment, definition of the exposure scenarios and quantification of the exposure doses.

Currently, the risk assessment studies are conducted by private consultants appointed by the manager of the facility or the people in charge of the development project and these studies are controlled by the local administration. Even if some methodological guidelines (InVS 2000;INERIS 2003) provide advice to choose the models suitable to quantify the exposure for the surrounding population, there is no obligation concerning the way to assess the exposure and no obligation concerning the model or the software to use.

Furthermore, few models applicable on a local scale are able to represent the fate of pollutants between the environmental media and to assess aggregate exposures via multiple exposure pathways. Indeed, most of the models suitable for working on the scale of a site consist of a series of linked models. They cannot address secondary pollutant movements and are seldom able to consider all the potential exposure pathways. As for truly coupled multimedia models, most of them have to be applied on a larger scale: regional, continental or global scales (SETAC 1994;[START_REF] Mckone | Tracking multiple pathways of human exposure to persistent multimedia pollutants : regional, continental, and global scale models[END_REF][START_REF] Fenner | Comparing estimates of persistence and long-term range transport potential among multimedia models[END_REF]. The review, undertaken by EPA, at the beginning of the Total Risk Integrated Methodology (TRIM) project (USEPAa, b) to identify a model able, to apply on variable scales, to consider the conservation of the pollutant mass and secondary pollutant movement presents, CalTOX as "the most promising existing model". Consequently, the French Society of Public Health chose to use CalTOX to assess the risks in the vicinity of incinerators and since this study, many consultants in France and some people in charge to assess the risks linked to incinerators in other countries also use CalTOX.

Unfortunately, the analysis of these studies shows that the model is often badly understood and badly used by risks assessors. CalTOX's developers are not responsible for the mistakes performed in the framework of applications that they could not forecast. Most of the time, the errors are simply linked to a misunderstanding of the parameters' meaning and of the model's concepts by the people in charge of the studies. As CalTOX is extensively used because of its large potentialities, it seems important to give any user the elements to fix these errors, and to recall some rules of good practices when using a model.

After a short description of CalTOX, the difficulties of assigning suitable values to the input parameters, of defining the source term and the most common misuses of CalTOX problems found in the human exposure assessment studies, are listed and their consequences illustrated on the basis of the French experience.

CALTOX DESCRIPTION

CalTOX is a multimedia, multiple pathway risk assessment model. It has been developed to assist the California Environmental Protection Agency to estimate the chemical fate and human exposure in the vicinity of hazardous waste sites. The model consists of a set of Excel spreadsheets. An initial version of the model was issued in 1993 and since this date many enhancements have been made. It is composed of two main parts: a multimedia transport and transformation model and a multiple pathway exposure model.

The multimedia transport and transformation model comprises seven environmental compartments in version 2.3 (air, ground-surface soil, root-zone soil, vadose-zone soil, plants, surface water, sediments) and eight in the later version numbered 4.0 (air, groundsurface soil, root-zone soil, vadose-zone soil, cuticle, leaf, surface water, sediments), available on the internet. It is based on a mass-balance system between gains and losses for each compartment. This system is solved as a non-steady-state model for the root-zone soil and vadose-zone soil and as a steady-state model for the other compartments. Therefore, the contaminant inventories in the first two compartments are treated as time-varying state variables, whereas the other compartments are assumed to be in a steady-state with these two soil layers.

The multiple pathway exposure model gives an estimate of the exposure media concentrations and of the exposure doses by inhalation, ingestion and dermal contact.

The model structure is presented in figure 1. For more information, the reader will have to refer to the following documents [START_REF] Mckone | A multimedia total exposure model for hazardous-waste sites[END_REF][START_REF] Mckone | CalTOX version 2.3, Description of modifications and revisions. prepared for the Department of Toxic Substances Control[END_REF]CalEPA 1993).

PROBLEMS LINKED TO THE ASSIGNMENT OF VALUES TO THE INPUT PARAMETERS

The CalTOX model is able to take into account many mass-transfer phenomena and exposure pathways, which requires a relatively large number of input parameters. But the assignment of values to the input parameters is often a critical point in the risk assessment studies, due to  some errors of interpretation concerning the accurate meaning given to the parameters or concerning their actual use in the equations,  the parameters' variability and/or uncertainty and the model sensitivity to these parameters,  the lack of scientific data for assigning values to some input parameters.

Examples of misinterpretation of some parameter meanings

Two examples of misinterpretations are the following:

The first one concerns the surface area of the body. The surface area supposed to be in contact with water or soil is sometimes used as input instead of the total area of the body which actually has to be used (as coefficients equal to 0.8 and 0.3 are present in the equations to assess the actual surface in contact with the tap water when showering or bathing and with soil respectively).

The second one concerns the flow into the surface water compartment. This parameter called "inflow" must be defined in relation to the surface of the study area. In other words, it has to be defined as the daily volume of water divided by the surface of the study area.

Although, the users of the model often assign to this parameter a value corresponding to the daily volume of water going through the section of the water body divided by the surface of this section. Nevertheless, it has to be pointed out that in most of the case studies, the model is not really sensitive to the values of these two parameters.

Examples of the impact of some parameters' variability / uncertainty on the results

A great deal of effort has been made by the developers to define default values or relationships to calculate default values for all the input parameters. In version 4.0, significant work has been made to develop an extensive database for substances and landscape parameters for several regions of the United States and most of the states [START_REF] Mckone | Tracking multiple pathways of human exposure to persistent multimedia pollutants : regional, continental, and global scale models[END_REF]. However, some parameters can be largely variable and/or uncertain and if the model is sensitive to them, large variations of the output can be generated. This is the case with some chemical properties such as the partition coefficients particle/water in soil layers or the bio-transfer coefficient plant/air and, in some applications for environmental parameters such as the "suspended sediment deposit" and the "plant dry mass inventory" (input parameters of the CalTOX version 2.3) as shown below.

The "transfer coefficient plant/air" for 2, 3, 7, 8 TCDD is estimated in the CalTOX version 4.0 as the ratio of the fugacity capacity of the leafy part of the plant on the fugacity capacity of air. By default, it is set equal to 1.0 10 4 m 3 /kg. In the scientific literature, different values can be found for this parameter ranging from 8.3 10 3 to 4.11 10 4 m 3 /kg (Mc Crady and Maggard, cited in (CalEPA 1994)). In a test simulation with an air concentration of 2, 3, 7, 8 TCDD as a pollutant source, the average exposure over the exposure duration is multiplied by 7, if the geometric mean of these two values is used instead of the default value (with all the other parameters values remaining the same).

In the CalTOX version 2.3, the default values for the environmental parameters are supposed to represent California's landscape properties. The report of the University of CalEPA (CalEPA 1996) indicates that the calculated values for the plant dry mass inventory range from 0 to 16.1kg/m 3 . In fact, the parameter value depends on the soil occupancy. By default, the value used by CalTOX is equal to 2.8kg/m 3 but for a meadow, for example, the value found in literature is equal to 0.2kg/m 2 (IPSN 1994). In another test simulation with an atmospheric pollution of 2, 3, 7, 8 TCDD and the CalTOX version 2.3, replacing the first value with the second one leads to a decrease in the average exposure by a factor of 4.5.

Thus, when the model output is sensitive to some parameters, the users should not be satisfied with the default value of parameters, even for chemical parameters. It is essential that they tailor the model with data relevant for their case study.

Examples of difficulties due to a lack of scientific data

To represent the pollutant mass-transfer between two media, CalTOX sometimes uses multiplicative coefficients. In this way, the contribution of the soil pollution to the indoor air contamination is estimated by multiplying the soil gas concentration by the factor "alpha_inair". This calculation method avoids using a complex model based on the diffusion and the advection of pollutant due to the depression in the house. However, defining this parameter appropriately, according to the building and the soil characteristics, is difficult since this parameter is highly variable and little well characterised measurement data is available. The default value in CalTOX is 1 E-4, whereas experimental values have been measured between 1 E-2 and 1 E-4 and a conservative value of 1 E-2 is, for example, recommended in (Umweltbundesamt 1999).

The "rainsplash", the "plant-air partition coefficient" (and the "fraction of irrigation water contaminants transferred to soil" in the CalTOX version 2.3) can raise the same kind of definition problems.

In specific cases, depending on the properties of the substance and the selected pathways of exposure, the model outputs can be sensitive to these parameters. In these cases it is essential that assessors check the relevance of the default values and test the variability and uncertainty of the parameters on the model outputs.

THE WRONG DEFINITION OF THE SOURCE TERM OF POLLUTION

In many of the impact studies, the source term of pollution is an atmospheric emission from a stack. Therefore, an atmospheric dispersion model is used to calculate the air pollutant concentrations and the pollutant deposit on the surface soil due to the emissions. The calculated air concentration is used to assess the population exposure by inhalation and the deposit of pollutant is entered in a multimedia model as the source term of pollution to quantify the indirect exposures by ingestion and dermal contact.

According to this practice, the parameter called "source term to ground-surface soil" is assigned the value calculated by the atmospheric dispersion model for the pollutant deposit on the surface soil and is used as the source term of pollution in most of the risk assessment studies. But, as CalTOX is a mass-balance model where the feedback loops and secondary pollutant transfers are taken into account, it is important to respect the entrance point of pollution into the system. Defining the source term of pollution as a deposit on the surface soil, whereas it is an emission in the atmosphere, leads to underestimating the pollution impact on the different environmental compartments. Indeed, in these conditions, the air compartment is supposed to be just contaminated by secondary pollutant masstransfers from the other media and the effects of the air dispersion are overestimated.

In order to take into account a source of atmospheric pollution in CalTOX, it is possible either to enter a pollutant flow into the air compartment (Sa expressed in mol/day) or a fixed air concentration by replacing the variable label Sa with Ca (in the main CalTOX spreadsheet).

However, representing the stack emission as a pollutant flow into the air compartment is not relevant for the type of applications defined above, because CalTOX is a zero dimension model. The quantity of emitted pollutant would be diluted into the volume of the study area and the concentrations calculated by the software for the environmental compartment would be inversely proportional to the study area defined by the user of the model. To assess the exposures linked to the atmospheric fallouts from an industrial stack, the assessor should use the pollutant air concentration measured or modelled above the study area.

In table 1 and in figure 2, a case study illustrates the consequences of the wrong definition of the source term on CalTOX's outputs (INERIS, 2003).

The atmospheric dispersion of a 2, 3, 7, 8 tetrachlorodibenzodioxin emission by a power plant has been modelled with a Gaussian model (ARIA Impact model from the company Aria Technologies). Then, CalTOX has been run twice to quantify the population's exposure by ingestion and by dermal contact. First, the source term of pollution has been defined as the maximal deposit on the soil calculated by the atmospheric dispersion model. Then, the source term was set as the maximal air concentration estimated by the same model. With all other input parameters unchanged, the total exposure dose is 23 times smaller in the first simulation (7.6 E-11mg/kg/j) than in the second one (1.7 E-9mg/kg/j), and the exposure distribution according to the environmental media and the pathways is very different.

CALTOX'S FEATURES AND SOME UNFITTED USES Overestimation of the surface soil concentration and imbalance of the system with version 2.3

CalTOX estimates the concentration in the air, plants, ground-surface-soil, surface water and sediments compartments as if they were in a steady-state with the root-zone soil and the vadose-zone soil layers.

Yet, in some cases, with version 2.3 of CalTOX, the pollutant residence time in the compartment called "ground-surface soil" is so long that the time needed to hold the steady-state may be longer than the exposure duration.

A test calculation was made with an atmospheric emission of lead equal to 0.1mol/d to illustrate this problem. The chemical properties used are those defined in the database of version 4.0 and the values assigned to all the other parameters are the default values supplied in version 2.3. CalTOX gives a residence time, an inventory and a concentration of lead in the ground soil equal to 129 years, 830mol and 10g/kg respectively, whereas the quantity of lead emitted is in fact equal to 547mol (number of days of emission per year x number of year of emission x daily emission flow = 365 x 15 x 0.1). Consequently, the system appears unbalanced and the concentration of lead in the surface soil is greatly overestimated. When the source term of pollution is defined as a continuous input to the air compartment, whatever the substance studied, an imbalance between the input, the output and the remaining quantities in the compartments appears because of the hypothesis of steady-state in the ground-surface soil.

If the same calculation is made with the later version of CalTOX (all the parameters defined with the default values given in the database, except the root-zone soil adjusted to 1 metre to comply with the requirements of the diffusion model in the soil layers), the residence time, the inventory and the concentration of lead in the surface soil are equal to 16 days, 0.51mol and 2.2mg/kg respectively. The reduced residence time and the low concentration obtained with this version compared to the previous one is linked to the increase of the mass transfer rate from the surface soil to the root-zone soil by diffusion. Furthermore, the conservation of the pollutant mass in the system is respected.

Since a surrogate flow to air is calculated from the air concentration, defined as pollution source term, to solve the gain and loss equation system, Caltox's later version has to be preferred if the user wants to assess the impact of a continuous emission of pollutant into the air compartment.

Estimate of the exposure linked to background concentrations in the environment

To assess the risks for populations linked to contaminants, the risk managers ask to take into account the exposure linked to the pollutant background concentration due to the geochemical and/or to the ubiquitous pollution. Therefore, in some studies an exposure calculation is performed by defining the contaminant background concentration in soil as the source term of pollution. This approach is unsuitable, since these concentrations correspond to the steady-state between the continuous gains and losses to and from the soil layers, whereas CalTOX aims to represent how the pollutant mass-inventory in the soil layers will escape with time to the other compartments.

Estimate of the exposure linked to an emission into a river

Sometimes, CalTOX is used to assess the population exposures linked to a contaminant flow into a river. In this case, CalTOX calculates the contaminant level in the terrestrial media due to the uses of the surface water (irrigation, ingestion by animals) and to the sequence of the following phenomena: pollutant diffusion from surface water to atmosphere, diffusion or deposit from atmosphere to ground-surface soil or to plants. But contrary to some users' belief, CalTOX represents neither the direct mass-transfers from the surface water or from the aquifer to the terrestrial compartments (by overflow or variation of the groundwater level), nor the direct linkage between the aquifer and the surface water compartment.

The misunderstanding of the model's ability led to some misinterpretations of the results and potentially to underestimating the risks in some geographical areas such as the zones liable to flooding. CalTOX has not been developed for such applications.

CONCLUSION

CalTOX is a multimedia, multiple pathway risk assessment model with many advantages:

 it gives information about the contaminant fate with time in the different environmental media;  it takes into account many mass transfers and exposure pathways compared to other risk assessment models;  it gives the user the ability to adapt all the parameters value to the studied case;

 it gives the user accessibility to all the equations and intermediate results. Therefore it enables the assessor to analyse the suitability of the calculations performed and of the results obtained (i.e. to perform a critical analysis of the model results), which favours the achievement of an essential objective of any risk assessment study: transparency;  it enables assessing the uncertainty due to parameters easily and rapidly by the Monte-Carlo calculation.

Due to the assets, CalTOX is an interesting first-tier model to assess human exposure in the vicinity of new industrial units. Furthermore, it offers a good balance between adaptability and speed to carry out calculations.

Nevertheless, as any model, whatever the developers' efforts to describe the algorithms, CalTOX can present some difficulties to be used correctly by some users. It has been developed to answer some situations and when used for other cases it may sometimes appear badly fitted. As a general rule, the users must not use the model as a "black box". They have to pay attention to the concepts which the model is based on and to the input parameters' definition to avoid errors and neglecting the results' uncertainty.

FigureFigure 2 :

 2 Figure 1: CalTOX scheme

ACKNOWLEDGEMENT

The author gratefully acknowledges Thomas McKone for the paper's review.


Valérie De Dianous
email: valerie.dedianous@ineris.fr

Cécile Fiévez
email: cecile.fievez@fpms.ac.be

ARAMIS project: A more explicit demonstration of risk control through the use of bow-tie diagrams and the evaluation of safety barrier performance

Keywords:

Over the last two decades a growing interest for risk analysis has been noted in the industries. The ARAMIS project has defined a methodology for risk assessment. This methodology has been built to help the industrialist to demonstrate that they have a sufficient risk control on their site.

Risk analysis consists first in the identification of all the major accidents, assuming that safety functions in place are inefficient. This step of identification of the major accidents uses bow-tie diagrams.

Secondly the safety barriers really implemented on the site are taken into account. The barriers are identified on the bow-ties. An evaluation of their performance (response time, efficiency, and level of confidence) is performed to validate that they are relevant for the expected safety function. At last the evaluation of their probability of failure enables to assess the frequency of occurrence of the accident.

The demonstration of the risk control based on a couple gravity / frequency of occurrence is also possible for all the accident scenarios.

During the risk analysis, a practical tool called risk graph is used to assess if the number and the reliability of the safety functions for a given cause are sufficient to reach a good risk control.

General introduction

Over the last two decades, a growing interest for risk analysis has been noted in the industries. Indeed, some recent technological accidents like Enschede (2000), Toulouse (2001) or Lagos (2002) have led the public to wonder or even mistrust both the industry and the regulatory authorities in their riskinformed decisions. These accidents have raised the need for more transparent decision-making processes.

Risk-based decisions of course require some reliable scientific input from risk analyses. However noteworthy variations exist in the results of different risk analysis, , what may affect any relevant and local decision. That is why emerges today the need for a methodology giving consistent rules to identify accident scenarios, to demonstrate their risk control, to select accident scenarios.

Among the different features of the ARAMIS project, this paper focuses on how the use of bow-tie diagrams and evaluation of the performance of the safety barriers can lead to a more explicit demonstration of risk control.

In a first step, all the major hazard accidents have to be identified. In the ARAMIS project, bow-tie diagrams are used for the identification of these accidents [START_REF] Delvosalle | ARAMIS Project: A comprehensive Methodology for the Identification of Reference Accident Scenarios in process industries[END_REF].

In a second step, among all the major hazard accidents identified, a demonstration that the scenarios have sufficient risk control must be performed. The demonstration is made using safety barriers as explained in this paper. The criteria for risk control is linked to the couple gravity / frequency of occurrence of the different accident scenarios. However, during the ARAMIS project, difficulties were encountered to assess frequency of occurrence of dangerous phenomena. Indeed, an inventory of the probabilistic data sources was carried out. It showed that very generic frequency ranges are usually used in these data sources, both for critical events and causes. These generic figures have to be considered very cautiously: indeed, they may have been averaged from different kinds of plants and substances, the safety systems are not clearly identified in the figures and the global level of safety of the plants considered is unknown. Eventually, the use of generic figures do not underline the efforts made by the industrialists on their specific site both in prevention and mitigation, and in their safety management system.

An alternative method was also proposed, which really takes into account the safety barriers implemented on the industrial site. Indeed, the ARAMIS project proposes the assessment of the frequency of occurrence of the accident scenarios starting from the original frequency of occurrence of the deep causes and by reducing it taking into account the probability of failure of the safety functions identified on each scenario. An evaluation of these barriers is performed to validate that they are relevant for the expected safety function and to assess their probability of failure. After the evaluation of the frequency of occurrence of the different dangerous phenomena, it is possible to define if a scenario has a sufficient, insufficient or unacceptable risk control. During the risk analysis, a practical tool called risk graph is used to assess if the number and the reliability of the safety functions for a given cause are sufficient to reach an adequate risk control.

The ARAMIS project is based on existing methodologies (IEC 61508 [START_REF]Functional safety of electrical, electronic and programmable electronic safety-related systems, parts[END_REF], IEC 61511 [START_REF]Functional safety instrumented systems for the industry sector, parts 1-3[END_REF] and LOPA [START_REF]Layer of Protection Analysis -simplified process risk assessment CCPS[END_REF]).

The developing methodology of risk assessment has been tested on different European industrial sites during the year 2004. These test cases have enabled the partners to improve the methodology by taking into account the former lacks.

Identification of the major accident hazards using bow ties

The identification of major accident hazards likely to occur on an industrial site is the first step of the risk analysis. The identification of major accident hazards is performed in the ARAMIS project by the methodology MIMAH [START_REF] Delvosalle | Aramis Project: Effect of safety systems on the definition of reference accident scenarios in SEVESO establishments[END_REF], abbreviation of Methodology for the Identification of Major Accident Hazards. Major accident hazards correspond to the worst accidents likely to occur on a site, assuming that no safety barriers are installed or that they are inefficient. The methodology is based mainly on the use of bow-tie diagrams (Figure 1), centred on a critical event and composed of a fault tree on the left and of an event tree on the right. It should be noted that a Critical Event is generally defined as a Loss of Containment (LOC) or a Loss of Physical Integrity (LPI).

The bow-tie concept is gaining in popularity and is believed to offer a good overview of the different accident scenarios considered. Indeed, all the causes and consequences of an accident are clearly identified on the bow-ties. Moreover, the bow-tie is a tool particularly adapted to represent the influence of safety systems on the evolution of accident scenarios. Safety systems, technical or organisational, can be placed on the different branches of the bow-tie. Prevention safety systems are found on the fault tree side, and mitigation systems are found on the event tree side. The bow-tie enables to quickly visualise what safety function acts on a scenario, as illustrated in Figure 2. When the evaluation of the frequencies of occurrence of each scenario is performed, the most critical cause or scenario appears clearly.

Note that in the following "dangerous phenomenon" corresponds to the last level on the right of the bow-tie, describing the nature of the accident consequences (for example a pool fire, a Vapour Cloud Explosion, a toxic cloud, etc).

Identification and evaluation of safety functions and barriers

Why taking into account safety functions and barriers?

Standard risk analysis methods propose to assess the frequency of occurrence of a major accident and to decide from this evaluation whether the risk is acceptable or not (sufficient risk control or not). The ARAMIS project has kept this principle and has based the definition of reference accident scenarios on the couple gravity / frequency of occurrence [START_REF] Delvosalle | ARAMIS Project: A comprehensive Methodology for the Identification of Reference Accident Scenarios in process industries[END_REF].

The methodology proposed by ARAMIS takes into account the safety barriers implemented on the industrial site. The principle is to assess the frequency of occurrence of the dangerous phenomena starting from the original frequency of occurrence of the deep causes of the accident and by reducing it taking into account the probability of failure of the safety functions really implemented on site. The calculations of the probabilities of failure of the safety functions are carried out according to the principles derived from the SIL concept (Safety Integrity Level) available in IEC 61508 [START_REF]Functional safety of electrical, electronic and programmable electronic safety-related systems, parts[END_REF] and IEC 61511 [START_REF]Functional safety instrumented systems for the industry sector, parts 1-3[END_REF] standards and according to the known reliability of the safety barriers.

Taking into account safety functions and barriers has three main purposes:

▪ It prompts the industrialists to invest in safety barriers (prevention or mitigation); indeed, the barriers will influence the risk level of a plant what would not be the case by using generic figures of frequency of occurrence for equipment failures; ▪ The identification of the safety functions in the bow ties is completed by the evaluation of their performance; the industrialist is encouraged to better know its safety functions, what is favourable to a better level of safety on site; ▪ The analysis with the barriers helps the industrialists to identify more clearly which scenarios have an insufficient level of risk control, as explained in section 4 of this paper.

Definition and typology of a safety function

A safety function is a technical or organisational action, and not an object or a physical system. The generic safety functions can be expressed by actions to be achieved. It is an action to be achieved in order to avoid or prevent an event or to control or to limit the occurrence of the event. This action is realised thanks to safety barriers defined in paragraph 3.3.

In the fault tree, the different possible actions of safety functions are to avoid, to prevent the occurrence of an event, to limit the size of an event or to reduce the probability of an event. In the event tree, the different possible actions of safety functions are to avoid, to prevent or to reduce the consequences of the critical event and to mitigate its effects on the surroundings of the equipment (individuals, neighbouring equipment and environment). In the fault tree, the safety functions may decrease the frequency of an event, whereas in the event tree, the safety functions may reduce the frequencies and/or the consequences of dangerous phenomena and mitigate their effects. The safety function is the "what" needed to assure, to increase and/or to promote safety.

Four main verbs of action are defined for the safety functions. Definitions for these four safety functions are presented in Table 1. It should be noted that, in these definitions, an event can be each kind of event encountered in the bow-tie, both on fault and event tree sides. For some functions ("to control" and "to limit"), a detection action is often included in the global safety function.

Definition and typology of a safety barrier

The safety barriers can be physical and engineered systems or human actions based on specific procedures or administrative controls. The safety barrier directly serves the safety function. So a safety barrier can be the action of an operator, a prevention system (layer of protection to prevent the corrosion), an emergency control system (pressure safety valve), a physical system (retention bund, wall), a safety-related system (fire extinguisher). The engineered and physical systems and the human actions are sometimes interchangeable and/or work together to maintain the effectiveness of the safety function.

The safety barriers are the "how" to implement safety functions.

Four main categories of safety barriers are defined. The categories are useful for the evaluation of the safety barrier management [START_REF] Guldenmund | The Development of an Audit Technique to Assess the Quality of Safety Barrier Management[END_REF].

▪ Passive barriers: barriers always in functioning (permanent), no need of human actions, energy sources or information sources. Passive barriers may be physical barriers (retention bund, wall…), permanent barriers (corrosion prevention systems) or inherently safe design.

▪ Activated barriers: These barriers set up preconditions that need to be met before the action can be carried out. So these barriers must be automated or activated manually to work or these barriers can be mechanical barriers that require an activation (hardware) to achieve their function. Activated barriers always require a sequence of detection -diagnosis -action. This sequence can be performed using hardware, software and/or human actions.

▪ Human actions: The effectiveness of these barriers is relied on the knowledge of the operator in order to reach the purpose. Human actions are to be interpreted broadly, including observations by all senses, communication, thinking, physical activity and also rules, guidelines, safety principles… Human actions may be part of a detection -diagnosis -action sequence.

▪ Symbolic barriers: These barriers need an interpretation by a person in order to achieve their purpose. The typical example can be passive warnings (like keeping out of prohibited areas, opening labelled pipes, refraining from smoking…)

Taking into account safety barriers in the bow-tie

For the identification of the safety barriers, the method proposed is to review systematically the fault tree and the event tree. Each event of the trees, branch per branch, must be examined and the following question should be asked: "Is there a safety barrier which avoids, prevents, controls or limits this event?". If yes, the safety barrier must be placed on the branch. The barrier will generally be placed upstream of an event if it avoids or prevents this event. If it controls or limits this event, it has to be placed downstream.

According to the typology of the safety function, the effect on the scenario will be different, as explained in the following paragraphs.

"Avoid" barriers

This kind of barrier implies that the event located just downstream is supposed impossible. For example, Figure 3 shows a part of a fault tree leading to a large breach in an equipment.

Overpressure in this equipment could occur due to temperature increase, being caused by the thermal radiation due to a domino effect (fire in the adjacent unloading unit). The safety barrier considered is the large distance between the unloading unit and the equipment, which corresponds to an "avoid" barrier. It is thus proposed to represent the barrier as shown in Figure 3.

The branch could have been completely deleted from the fault tree, but this is not recommended. Indeed, if the barrier disappears (for example here if the unloading unit is moved), the tree drawn with the method proposed in Figure 3 will always be up-to-date and the hazard due to the unloading unit will always be kept in mind. Otherwise, the deleted cause could be forgotten later if the barrier is no more relevant.

"Prevent" or "control" barriers

For these barriers, the rule is: "If the level of confidence of a barrier on a branch is equal to LC, then the frequency of the downstream event on the branch is reduced by a factor 10 -LC ". Figure 4 gives an example of a complete drawing of the tree generated by a safety barrier. Two branches are derived from the safety barrier, one in case of failure of the safety barrier, and one in case of success. In this second case, the accident corresponding to the studied critical event is stopped and thus the branch can be deleted. The practical drawing (Figure 5) is thus simpler and will only take into account the case of failure of the safety barrier. The frequency of the downstream event is thus reduced by a factor 10 LC since the barrier has a level of confidence equal to LC. It can be noted that for some barriers, the working of the barrier can lead to another type of critical event. For example, the release of a safety pressure valve will lead to a critical event called "medium" leak, compared to the critical event "catastrophic rupture" in case of the burst of the equipment due to overpressure. The working of the barrier will be a cause to the "medium" leak.

In these drawings (Figure 4 and Figure 5), the barrier is placed downstream of the event because the example considers a "control" barrier. A "prevent" barrier should have been placed upstream of the event.

"Control" barrier in the event tree

In the event tree, the "control" barriers can control, stop the evolution of a branch. It depends on the level of confidence of these barriers. An example of the influence of control barriers is shown in Figure 6, for two independent control barriers.

It can be concluded that a "control" barrier introduces a kind of OR gate in the event tree. One branch concerns the successful action of the barrier, and leads to a safe situation where the accident is under control. The other branch concerns the failure of the safety barrier, allowing the further development of the scenario. The frequency of the event on this branch is equal to the frequency of the event upstream of the barrier, multiplied by 10 -LC (where LC is the level of confidence of the barrier, explained in paragraph 3.5).

"Limit" barrier in the event tree

The limitation/mitigation barriers have an indirect influence on the transmission probabilities and they can reduce the major effects of dangerous phenomena, for example by limiting the flow rate and the release time, the pool area, the vaporisation time or in diluting the toxic/flammable concentrations,…

In the event tree, when a limitation/mitigation barrier is considered, two branches must be built, one if the barrier succeeds and an other one, if the barrier fails. Both branches have to be kept in the event tree, because they will lead to two different dangerous phenomena, one with less severe consequence but a higher frequency, and the other one with more severe consequence but a lower frequency. The frequency calculation is linked to the level of confidence of the safety barrier.

For example, in the case of a toxic dispersion, a self-closing valve coupled to a detection system can reduce the effects of the toxic cloud. We have thus two types of consequences: the one resulting from a whole toxic cloud with the probability of non-functioning of the limitation safety system, and the other with a smaller toxic cloud with mitigated effects and a smaller severity of the dangerous phenomenon (DP) (see Figure 7). The characteristics of the DP differ in terms of limitation of the effects or not, and also in terms of frequency.

Evaluation of the performance of a safety barrier

Before taking into account the safety barriers in the bow-tie as explained in section 3.4, it is necessary: ▪ To demonstrate that the given safety function and the related barriers are relevant to avoid, to prevent, to control or to mitigate the event. The assessment of the performance of the barriers is performed through the study of three criteria that are effectiveness, response time and level of confidence. If the barrier is not considered relevant, it is not kept as a barrier.

▪ To estimate the probability of failure of the safety function by decomposing the function in different barriers. The probability of failure of each barrier is linked to the level of confidence.

The different criteria are detailed in this section.

Minimal requirements for safety barriers

During risk analysis, different safety functions are identified and decomposed into several safety barriers. It is necessary to make sure that the safety barriers are relevant to perform the expected safety function. To be considered as relevant, a safety barrier must first meet the following requirements:

▪ The effectiveness of the safety barrier must be demonstrated and adapted to the scenario. The effectiveness is the ability for a technical safety barrier to perform a safety function for a duration, in a non degraded mode and in specified conditions. The effectiveness is either a percentage or a probability of the performance of the defined safety function. If the effectiveness is expressed as a percentage, it may vary during the operating time of the safety barrier. For example, a valve that would be not completely closed on safety demand would not have an effectiveness of 100%. To assess the effectiveness of a safety barrier, it is necessary to take an interest in the design of the barrier. In this way, the barrier must be designed in appliance with codes, rules... and the design must be adapted to the characteristics of the products and the environment The characteristics of its design must be in accordance with the related function. Assessment of effectiveness may be performed during risk analysis by considering data and experience from suppliers or industrialists, tests on site, norms and technical guides, calculation data sheets of the barriers.

▪ The response time must be in accordance with the kinetics of the scenario of the considered major hazard accident. The response time is the duration between the straining of the safety barrier and the complete achievement (which is equal to the effectiveness) of the safety function performed by the safety barrier. The response time can be assessed for technical barriers from data from industrialists, experience, standards and technical guides. For human barriers, the response time may depend on different criteria (training of the operator, easy diagnostic in case of an accident, access to a barrier, knowledge of the operator about what he has to do in case of an accident).

▪ The level of confidence of the barriers is linked to its reliability. The level of confidence of a safety barrier is inversely proportional to the probability of failure on demand of the barrier. It corresponds to the reliability of the barrier to perform properly a required safety function according to a given effectiveness and response time under all the stated conditions within a stated period of time. Actually, this notion is inspired from the notion of SIL (Safety Integrity Level) defined in IEC 61511 [START_REF]Functional safety instrumented systems for the industry sector, parts 1-3[END_REF] for Safety Instrumented Systems and it has been enlarged to all types of safety barriers, including human barriers, passive barriers.

However before making a quantitative estimation of the level of confidence, qualitative parameters should be studied to estimate further the level of confidence:

▪

the independence of the safety barrier with the causes and with the regulation systems (to reduce common failure mode),

▪ the architecture of the safety systems (to check if redundancy or common failure mode exist, if safety barriers are fail-safe, if it is possible to shunt a safety function), ▪ the "proven" concept of the barrier that is to say that the concept is well-known (experienced) (otherwise, it may be necessary to perform more tests on site to check the quality of the barrier),

▪ the existence of periodic tests in accordance with experience of industrialists or suppliers and the existence of a schedule of maintenance operations with the view to maintain the characteristics of the safety barrier in time.

These three different parameters (effectiveness, response time, level of confidence) are estimated for each barrier, and a combination of the different barriers is then made to assess the global characteristics of the safety function. If the safety function is not considered as relevant, it is not kept on a branch of the bow-tie.

Estimation of the level of confidence of a safety barrier

The level of confidence of a safety barrier depends on two criteria :

▪ the first one, qualitative (architectural constraints)

▪ the second one, quantitative (probability of dangerous failure).

The processing for the two criteria are made according to the principles defined in the IEC 61508 [START_REF]Functional safety of electrical, electronic and programmable electronic safety-related systems, parts[END_REF] and IEC 61511 [START_REF]Functional safety instrumented systems for the industry sector, parts 1-3[END_REF] standards.

Architectural constraint

A first estimation of the level of confidence of a barrier is made by analysis of its architecture.

According to the complexity of the subsystems composing the barrier, a class of confidence is proposed in IEC 61508 and 61511. A subsystem is a component of a safety barrier, for example a detector, a valve.

To determine the level of confidence for a subsystem, two parameters are used:

▪ The Safe Failure Fraction (SFF), which is the ratio between the frequency of failure of the component leading to a safe position to the frequency of total failures. A safe position is a failure that does not have the potential to put the safety barrier in a hazardous or fail-to-function state.

▪ The Fault Tolerance (FT) which is linked to the capacity of the barrier to keep its safety function in case of failure of one or more system composing the barrier. Fault tolerance is linked to the redundancy. For example, a fault tolerance of 1 means that if one component is defective, the safety function remains operational.

Then the class of confidence depends on the complexity of the subsystems, as defined in IEC 61508 [START_REF]Functional safety of electrical, electronic and programmable electronic safety-related systems, parts[END_REF] and IEC 61511 [START_REF]Functional safety instrumented systems for the industry sector, parts 1-3[END_REF] standards. A subsystem is simple (type A in the table 2) if the failure modes of all constituent components are well defined. It is for example mechanical devices like. A subsystem is complex (type B in the table 3) if the failure mode at least of one constituent component is not well defined. It is for example complex systems like processors, subsystems hardware.

The qualitative criteria corresponding to architectural constraints for the subsystems (type A and type B)

are respectively defined in Table 2 and Table 3. These tables are issued from the IEC 61508 standard [START_REF]Functional safety of electrical, electronic and programmable electronic safety-related systems, parts[END_REF].

3.5.2.2

Quantitative criteria for the estimation of the level of confidence

The quantitative criteria correspond to the probability of failure for the subsystems (type A and type B)

and depends on the mode of operation (low demand or continuous mode). The link between the level of confidence and the probability of dangerous failure are defined in the Table 4 and Table 5. These tables are issued from the IEC 61508 standard [START_REF]Functional safety of electrical, electronic and programmable electronic safety-related systems, parts[END_REF].

Global level of confidence of a safety function

The safety functions identified on the bow-tie have been divided in different safety subsystems (for example detection, treatment of the information, action like closing of valves…). Each subsystem is It should be noted that LC4 safety systems are nearly never encountered in process industry.

The level of confidence of the barrier is linked to a risk reduction factor as detailed in Table 6.

Demonstration of the risk control and use of risk graph

The risk analysis has the purpose to demonstrate that the site has a good level of risk control. The risk control is built on the reduction of the frequency of occurrence of the major dangerous phenomena taking into account the safety barriers, so that the dangerous phenomena are defined with an acceptable couple gravity / frequency of occurrence.

By taking into account the safety barriers on the bow-tie, ARAMIS provides an explicit demonstration of the risk control: the method is based on the existing safety barriers on the site, the criteria for assessment of the level of confidence are clear.

During a risk analysis, it is possible to define risk reduction goals for a set of barriers so that the considered scenario is expected to have a good level of risk control. This is performed thanks to a tool called the risk-graph and inspired from the IEC 61511 standards [START_REF]Functional safety instrumented systems for the industry sector, parts 1-3[END_REF]. It has been adapted to fit the purpose of the ARAMIS project. The advantage of the graph risk is that it enables to perform recommendation during risk analysis in case that some scenarios have insufficient risk control.

Principles and use of the risk graph

The purpose of the risk graph is to precise for a given scenario and a given cause, according to the expected consequences of the dangerous phenomena associated to the critical event, the level of confidence of the safety barriers required to have an good risk control. All the safety barriers on the fault or event tree have to be considered. The requirement for the level of confidence is a global level of confidence obtained by adding the levels of confidence of all the barriers.

The risk graph gives the goals on the levels of confidence of the barriers identified on a scenario to have an acceptable risk control on this scenario. The figures given in the risk graph depends on the risk matrix [START_REF] Delvosalle | ARAMIS Project: A comprehensive Methodology for the Identification of Reference Accident Scenarios in process industries[END_REF] that defines for each risk analysis the thresholds of acceptability of the couple gravity / frequency of occurrence of the accidents.

An example of risk graph is presented in Figure 8, and the main definitions of the terms used in the graph are summarised in Table 7.

The risk graph can be used in the following way: for a given bow-tie and for a given initiating event (or a whole group of initiating events linked by a "AND" gate):

▪ The consequences of the accident are assessed through the parameter C, taking into account the dangerous phenomenon with the higher consequences for the given critical event and the given initiating event and assuming that all safety barriers are inefficient. Definitions of the class of consequences are given in reference [START_REF] Delvosalle | ARAMIS Project: A comprehensive Methodology for the Identification of Reference Accident Scenarios in process industries[END_REF].

▪ The frequency of exposition of targets during the operation (F 1 or F 2 ) and the possibility or not to avoid the danger (D 1 or D 2 ) must be determined.

▪ The level of frequency of the given initiating events has to be assessed as explained in reference [START_REF] Delvosalle | ARAMIS Project: A comprehensive Methodology for the Identification of Reference Accident Scenarios in process industries[END_REF].

Thanks to these four parameters (C, F, D and P), the required level of confidence can be determined by the risk-graph. The way to assess the required level of confidence is shown in the example of the section 4.2.

Example of demonstration of risk control

This paragraph presents an example of how bow-tie and evaluation of the safety barriers lead to demonstrate risk control. A fictitious and quite simplified example has been considered. The equipment chosen here is pressure storage of toxic gas located in a high-inhabited environment.

Major accident scenario

The considered accident scenario is a large leak of toxic gas from a gas pipe. The leak may be due to two independent causes: an operator error (wrong valve opened) or a domino effect (impact due to missiles). For the sake of simplification, only two causes are considered in the examples. The accident scenario is represented in Figure 9. A very simplified bow-tie for this example is shown in Figure 10.

The downstream flow is not considered (the product being consumed in a reactor).

The safety technical function consists in a safety-instrumented system (SIS) composed with two pressure detectors (D A and D B ), one logic controller and one automatic emergency shut-down valve (ESV). Besides an additional water curtain (manual action) is at the disposal of the operator.

Identification of safety functions and safety barriers

For the example, the relevant safety functions are the following ones:

▪ to prevent operator error, ▪ to prevent impact on the pipe, ▪ to limit the gas release from pipe, ▪ to limit the gas dispersion.

In this particular case, the safety barriers shown in Table 8 achieve these safety functions.

Safety requirements

The risk graph can be used to define the requirement of the level of confidence for each cause.

Cause 1 : Error of the operator :

Due to the crowded surroundings of the plant, the assessment of the consequences for the toxic cloud leads to a consequence class C 4 . The targets are supposed exposed to the risk more than 10% of the duration of the operation. Therefore, we set F=F 2 . We consider here that the accident leads to the dispersion of a toxic cloud but that the effects of this cloud are observed after a few minutes. We assume that people have the possibility to detect this cloud and to get confined in order to avoid damage. In consequence, we set D= D 1 . To identify the safety requirements, it is then important to assess the frequency of the initiating events of the scenario. The frequency of an operator error is assessed to 10 - 1 /year that is to say, we set P = P 1 . Considering C=C 4 , F=F 2 and D=D 1 , the level of confidence is defined in line X 5 on the risk graph presented in Figure 11. For P=P 1 , the level of confidence required for the safety barriers is 3.

Cause 2 : Domino effect:

The parameters C, F and D may be the same as for the previous cause. However, the frequency of occurrence of domino effect should be assessed and should be lower than 10 -1 /year, leading to a lower requirement for level of confidence of the safety barriers. This cause is not studied any longer.

Evaluation of performances of safety functions

The previous steps have determined the required level of confidence for the considered accident scenario, the large leak of a toxic gas due to an operator error. It is then necessary to check whether the safety level on the plant meets the identified requirements.

Effectiveness and response time of safety barriers

Among the four safety functions previously identified for the two causes (see Table 8), three apply for the cause " operator error ", the function "to prevent impact on pipe" being not adapted for this cause.

After this identification, it is important to check that these barriers are relevant for the considered scenario, by considering first their response time and effectiveness:

▪ The influence of actions designed to prevent the operator error is quite clear since, if they are correctly applied, they should totally avoid the possibility of a leak. Therefore, this first barrier (training + procedures) is considered as effective if properly achieved. The effectiveness of the prevention function can be considered to 100%. The probability of operator error is included in the level of confidence of this barrier.

▪ The safety chain with the differential measure of flow rate and shut-down valves has an effectiveness sufficient to detect the leak due to the opening of a wrong valve; indeed the differential measure of flow rate can detect variation higher than 10%, which is representative of a valve kept opened. Besides, the response time is acceptable compared to the kinetics of the scenario: indeed, thanks to calculations and on-site tests, the overall response time has been assessed to 30 seconds. This response time is sufficient to completely limit the damage due to the leak.

▪ The mobile water curtains might have an influence on the dispersion of the cloud. This influence is hard to define since it depends on various parameters such as the direction of the jet, of the wind… Besides, these mobile curtains must be triggered manually and this operation takes at least a few minutes, which is too long regarding the kinetics of the scenario. Therefore, this safety barrier is not selected as relevant.

Levels of confidence of safety barriers

Following the criteria specified for the performance evaluation of safety barriers, the effectiveness, response time and level of confidence for each safety barrier are assessed as shown in Table 9.

Levels of confidence of safety functions

The levels of confidence of safety barriers allow to define the level of confidence of safety functions according to the architecture of these barriers. For training and procedures (operator answer with stress) (LC=1), it seems reasonable to consider an overall level of confidence equal to 1 for the safety function "To prevent operator error". For the safety function "To limit the gas release", it is important to consider the architecture of the safety barriers. The system is so decomposed as shown in Figure 12.

Following the criteria specified for the evaluation of the performance of safety functions, for the global safety function, a level of confidence of 1, an effectiveness of 90 % and a response time of 30 s will be considered.

Comparison of safety requirements and actual safety performances

The safety requirements for the scenario of leak due to human error are equivalent to an overall level of confidence of 3 (LC=3) according to the risk graph (see Figure 11). In the example, we only have one safety function with LC= 1 in prevention (to prevent operator error) and one safety function with LC=1 in limitation. So the sum is only two. The requirements for an acceptable risk are not reached.

This result shows that safety improvements are necessary to achieve a sufficient risk control for this accident scenario. Several improvements could be suggested:

▪ to improve the prevention of the leak thanks to training, procedures in order to increase the level of confidence,…;

▪ to improve the limitation of the gas release by adding new safety barriers or improving the existing ones. This solution will be further discussed for the architecture and the shut-down valve clearly appears as a weak point.

▪ to lower consequences thanks to heavy modifications of the process such as the use of a less toxic gas, the use of pipe with less important diameter… These modifications are sometimes difficult to achieve specially on existing plants. These measures tend to reduce risk at the source.

In this particular case, it appears more convenient to improve the safety level of the existing safety chain. This can be achieved either by using best quality valves with higher Safety Failure Fraction or to add an identical valve in order to be tolerant to the fault of one valve (redundancy). With an extra valve, the level of confidence associated to the safety chain is equal to 2 and together with the safety function of prevention (level of confidence = 1), it allows to reach the requirements targeted.

The previous result showed that with the adding of an identical shut-off valve, the performances of safety barriers were good enough to prevent the occurrence of C 4 consequences of the accident. The influence of safety barriers can be represented in the bow-tie, as indicated in Figure 13. 20/35

Checking of effectiveness and response time

However, as the response time (30 s) of the chain cannot be totally neglected, it is therefore worth checking whether the residual consequences need to be controlled or not. In this case, we assume that a 30 s release leads to C 3 consequences. Since these consequences remain quite severe, they may need to be controlled. In order to assess the safety level required for this residual scenario, we can refer to the risk graph; in this case, the safety function "To limit the gas release" is of course not taken into account since we consider in the residual scenario that the safety function works properly. The class of consequence is reduced from 4 to 3; taking into account the same parameters than for the basis scenario, the requirement of level of confidence is reduced to 2 as illustrated in Figure 14. The safety function "to prevent" does not allow to meet the requirement; additional measures are still needed. In this case additional prevention functions may be planned or a better function "to limit" may be installed, with a lower time response with the view to reduce the class of consequence from a class 3 to a class 2.

Conclusions

The risk analysis has the purpose to demonstrate that an industrial site has a good level of risk control.

The risk control is built on the reduction of the frequency of occurrence of the major dangerous phenomena by taking into account the safety barriers, so that the dangerous phenomena are defined with an acceptable couple gravity / frequency of occurrence.

The ARAMIS project proposes to use bow-ties diagrams that give a clear overview of the cause and consequences of an accident. The safety barriers are identified on the bow-ties showing precisely on what scenarios they act and how they reduce the frequency of occurrence of the major accident or how they lead to a decrease in the effects of an accident.

By taking into account the safety barriers on the bow-tie, ARAMIS provides an explicit demonstration of the risk control: the method is based on the existing safety barriers on the site and the criteria for assessment of the level of confidence are clearly defined. It offers an alternative way to the traditional risk-based and consequence-based methodologies for risk analysis using generic figures of frequency of occurrence of events or of causes.

An advantage of this methodology is that it appears clearly for the industrialists which barriers have an influence on risk control and/or have to be improved. It gives them reasons to invest in safety measures.

The necessary evaluation of the performance of the safety barriers enables the industrialist to better know their safety functions, what is favourable to a better level of safety on site. Besides, the competent authorities have comprehensive rules to assess risk control and to check more precisely the barriers involved in the reduction of the risk. Demonstration to the public is made easier.

The use of the risk graph during risk analysis enables to perform recommendations in case that some scenarios have insufficient risk control.

It must be kept in mind that prevention remains preferable to mitigation measures. It is not acceptable to have a reduced frequency of occurrence only by mitigation measures; it is better to try to prevent the critical event. However, because complete exhaustiveness in the identification of the causes is impossible, it is also preferable to have mitigation measures on a site.

Acknowledgements

The work presented in this paper has been elaborated in the frame of the EU project ARAMIS

List of tables

To avoid

To make the event impossible

In the fault tree, to avoid an impact on a vessel "To avoid" safety functions may only act upstream of any kind of event in such a way this event can never occur. The event is avoided by suppressing the intrinsic conditions that causes the event, by adding generally a passive, permanent, physical barrier. This kind of safety function cannot depend on the functioning of any other safety function.

To prevent

To hinder, to put obstacles on the way of occurrence of the event

In the fault tree, to prevent the corrosion of a vessel.

In the event tree, to prevent the vaporisation of a pool; or to prevent the ignition of a flammable cloud. "To prevent" safety functions may only act upstream of any kind of event in such a way the occurrence of this event is reduced (but not absolutely avoided). This safety function will only reduce (of one or more order of magnitude) the frequency of an event.

To control

In the fault tree, to control = to bring back the system to a "safe" state.

In the event tree, to control = to get the event under control and return to a "safe" state.

In the fault tree, to control the overfilling of a liquid storage.

In the event tree, to control the pool dispersion.

"To control" safety functions may act upstream of an event in the fault tree (in response to a drift which may lead to the event and/or in response to upstream events -feedback, control loops). "To control" safety functions may also act downstream of an event in the event tree (the event occurred but can be definitively stopped). A part of this safety function is nearly always a detection. "To limit" or "To reduce" or "To mitigate"

To limit = to limit the event in the time and/or in the space, or to reduce its magnitude, or to mitigate the effects of a dangerous phenomenon on the neighbouring equipment, on the human beings or on the environment.

In the fault tree, to reduce the overpressure in the reactor.

In the event tree, to reduce the liquid flow, to reduce the concentration of the toxic cloud, or to limit the duration of a leak, to limit liquid vaporisation. "To limit" or "to reduce" or "to mitigate" safety functions may act downstream of an event. As a matter of fact, the event must have occurred to be limited or reduced or mitigated. It provides no control. A detection is sometimes part of the "limit" safety function. These limitation functions can be of three different kinds. They can aim at limiting the amount of energy or hazardous substances or, more generally, the amplitude of dangerous phenomena constitutive of the critical event.

Safety barriers

  divided in different barriers (for example detection can be performed both by human detection and by a gas detector). For each barrier, the level of confidence is assessed by means of the criteria explained above. Then each subsystem (detection, treatment of the information, action) can be evaluated by taking also into account the architecture (potential redundancy…) and the probability of a dangerous failure of each barrier. The time response and the effectiveness of the subsystem are also a combination of the parameters of the different barriers.The global level of confidence of the safety function is then calculated from the level of confidence of the different subsystems in the same way. The level of confidence of the safety function is the smallest level of confidence of the different subsystems. The time response and the effectiveness of the safety function are also a combination of the parameters of the different subsystems.

"

  Accidental Risk Assessment Methodology for IndustrieS", co-ordinated by INERIS (F) and including EC-JRC-IPSC-MAHB (I), Faculté Polytechnique de Mons (B), Universitat Politècnica de Catalunya (E), ARMINES (F), Risø National Laboratory (D), Universita di Roma (I), Central Mining Institute (PL), Delft University of Technology (NL), European Process Safety Centre (UK), École des Mines de Paris (F), École des Mines de Saint Etienne (F), École des Mines d'Alès (F), Technical University of Ostrava (CZ) and Jozef Stefan Institute (Si). The project is funded under the Energy, Environment and Sustainable Development Programme in the 5 th Framework Programme for Science Research and Technological Development of the European Commission.

Figure 1 :Figure 2 :Figure 3 :Figure 4 :Figure 5 :Figure 6 :

 123456 Figure 1: General scheme of the bow-tie

Figure 7 :Figure 8 :Figure 9 :Figure 12 :

 78912 Figure 7: Influence of a limitation barrier on the effects of dangerous phenomena

Figure 2 :

 2 Figure 2: Complete bow-tie with identification of prevention or mitigation safety functions

Figure 6 :

 6 Figure 6: "Control" barriersinfluence on the calculation of frequencies of events in term of level of confidence

Figure 7 :Figure 8 :Figure 11 :Figure 13 :Figure 14 :

 78111314 Figure 7: Influence of a limitation barrier on the effects of dangerous phenomena

Table 1 :

 1 Typology of safety functions

Table 2 :

 2 Architectural constraints for the type A (all the failure mode are well-known)

Table 3 :

 3 Architectural constraints for the type B (all the failure mode are not known)

Table 4 :

 4 Level of confidence: failure measures for a safety function, allocated to a safety barrier operating in low demand mode of operation (from EN 61508)

Table 5 :

 5 Level of confidence: failure measures for a safety function, allocated to a safety barrier operating in high demand or continuous mode of operation (from EN 61508)

Table 6 :

 6 Definition of the Level of Confidence for barriers

Table 7 :

 7 Main definitions for the risk graph

Table 8 :

 8 Identification of safety functions and safety barriers

Table 9 :

 9 Effectiveness, response time and level of confidence of safety barriers

9 List of figures

Table 1 :

 1 Typology of safety functions

	SFF:		Fault tolerance
	Safe Failure Fraction	0	1	2
	< 60%	LC 1	LC 2	LC 3
	60% -< 90%	LC 2	LC 3	LC 4
	90% -< 99%	LC 3	LC 4	LC 4
	 99%	LC 4	LC 4	LC 4

Table 2 :

 2 Architectural constraints for the type A (all the failure modes are well-known)

	SFF:	Fault Tolerance
	Safe Failure Fraction	0	1	2
	< 60%	Non possible	LC 1	LC 2
	60% -< 90%	LC 1	LC 2	LC 3
	90% -< 99%	LC 2	LC 3	LC 4
	 99%	LC 3	LC 4	LC 4

Table 3 :

 3 Architectural constraints for the type B (all the failure modes are not known)

	Level of	Low demand mode of operation
	confidence	(Average probability of failure to perform
		its design function on demand)
	LC 4	 10 -5 to  10 -4
	LC 3	 10 -4 to  10 -3
	LC 2	 10 -3 to  10 -2
	LC 1	 10 -2 to  10 -1

Table 4 :

 4 Level of confidence: failure measures for a safety function, allocated to a safety barrier operating in low demand mode of operation (from EN 61508)

	Level of	High demand or continuous mode of
	confidence	operation
		(Probability of a dangerous failure per
		hour)
	LC 4	 10 -9 to  10 -8
	LC 3	 10 -8 to  10 -7
	LC 2	 10 -7 to  10 -6
	LC 1	 10 -6 to  10 -5

Table 5 :

 5 Level of confidence: failure measures for a safety function, allocated to a safety barrier operating in high demand or continuous mode of operation (from EN 61508)

	Level of Confidence	Risk Reduction	Equivalent Probability of	Equivalent probability of
	of a barrier	Factor	Failure on Demand (PFD)	failure per hour
	4	10 000	>10 -5 to <10 -4	>10 -9 to <10 -8
	3	1 000	>10 -4 to <10 -3	>10 -8 to <10 -7
	2	100	>10 -3 to <10 -2	>10 -7 to <10 -6
	1	10	>10 -2 to <10 -1	>10 -6 to <10 -5

Table 6 :

 6 Definition of the Level of Confidence for barriers Figure 1: General scheme of the bow-tie

	11 Figures
			C C
			O O
			N N
	C C		S S
	A A		E E
	U U		Q Q
	S S		U U
	E S E S	Critical Event Critical Event	E N E N
			C C
			E E
			S S
	Fault tree Fault tree	Event tree Event tree
		Safety barriers	C C C C
			O O O O
			N N N N
	C C C C		S S S S
	A A A A		E E E E
	U U U U		Q Q Q Q
	S S S S		U U U U
	E S E S E S E S	Critical Event Critical Event Critical Event Critical Event	E N E N E N E N
			C C C C
			E E E E
			S S S S
	Fault tree Fault tree Fault tree Fault tree	Event tree Event tree Event tree Event tree

C n

Potential consequence of the dangerous phenomena , defined by the severity of the accident and the vulnerability of the environment; C n is ranking from C 1 (low consequences) to C 4 (major consequences) Note 1: at the step of the project when risk graph is useful, C n is just estimated; no calculation of severity or vulnerability index has been made. F 1/2

Frequency of exposition of the targets during the operation : ▪ (F 1 ) for the studied operation, targets are few exposed to the risk (less than 10% of the duration of the operation) ▪ (F 2 ) for the studied operation, targets are very exposed to the risk (more than 10% of the duration of the operation)

Note: target may be environment, persons on site or outside the site. The more important the effects of the accident are, the more the number of persons involved will increase and the frequency of exposition may increase. D 1/2

Possibility to avoid damage, by intervention or evacuation ▪ (D 1 ) long kinetic and intervention /evacuation clearly defined and personnel warmed that safety barriers are not efficient. ▪ (D 2 ) in the other cases P 1/2/3/4 Frequency of the initiating event leading to a given critical event. (or a whole group of initiating events linked by a "AND" gate) P 4 (very low frequency: F<10 -4 / year) P 3 (low frequency: 10 -4 / year <F <10 -3 / year) P 2 (medium frequency 10 -3 / year <F <10 -2 / year) P 1 (high frequency:10 -2 / year <F<10 -1 / an) ---No safety requirements a

No safety requirements for safety barriers b Unacceptable situation ; there is need to redesign the process or make prevention more effective 1,2,3,4 Level of confidence of safety barriers.


A Albinet

E Leoz-Garziandia

H Budzinski

E Viilenave

Simultaneous analysis of

Keywords: Polycyclic aromatic hydrocarbons, Nitrated polycyclic aromatic hydrocarbons, Oxygenated polycyclic aromatic hydrocarbons, Standard reference material, Gas chromatographymass spectrometry, Negative ion chemical ionisation, Atmospheric pollution

Simultaneous analysis of oxygenated and nitrated polycyclic aromatic hydrocarbons on standard reference material 1649a (urban dust) and on natural ambient air samples by gas chromatography-mass spectrometry with negative ion chemical ionisation

Alexandre Albinet, Eva Leoz-Garziandia, Hélène Budzinski, Eric Villenave

To cite this version:

Alexandre Albinet, Eva Leoz-Garziandia, Hélène Budzinski, Eric Villenave. Simultaneous analysis of oxygenated and nitrated polycyclic aromatic hydrocarbons on standard reference material 1649a (urban dust) and on natural ambient air samples by gas chromatography-mass spectrometry with negative ion chemical ionisation. Journal of Chromatography A, 2006, 1121 (1), pp.106-113. 10.1016/j.chroma.2006.04.043. ineris-00961902

Introduction and objectives

PAHs (polycyclic aromatic hydrocarbons) are widespread pollutants. They are emitted in the atmosphere by all the combustion sources and they are both present in the particulate and the gas phases. They have been particularly studied due to their potential carcinogenic and/or mutagenic properties [START_REF] Viilenave | Overall evaluations of carcinogenicity an updating of IARC monographs[END_REF]. Both the United States Environment Protection Agency (EPA) and the European Environment Agency now focus on sixteen of them as priority pollutants [START_REF] Keith | [END_REF]3].

Oxidation PAHs products, such as NPAHs (nitrated PAHs) and OPAHs (oxygenated PAHs), seem to be more toxic than their related parent PAHs. NPAHs are formed either by nitration during combustion processes or, in the atmosphere, by both gas and heterogeneous phase reactions of PAHs with nitrogen oxides initiated by OH • or NO 3

• [4][5][6][7][8][9][10][START_REF]Environmental Health Criteria 229, Selected nitro-and nitro-oxy-polycyclic aromatic hydrocarbons[END_REF]. Similarly to NPAHs, OPAHs are formed either directly during combustion, or by chemical reaction (photo-oxidation) initiated by oxygenated atmospheric oxidants (OH • , O 3 …) [START_REF] Barbas | [END_REF]13]. Some of these PAHs derivatives had been identified as having a direct mutagenic potency, contrary to PAHs which require a preliminary enzymatic activation, yielding their high toxicity [14][15][16][17]. Their contribution to the mutagenicity of the ambient air particulate total extract was estimated to be about 50%, using the Ames test (mutagenicity on bacteria) [14,[START_REF] Finlayson-Pitts | Atmospheric Chemistry: Fundamental and experimental techniques[END_REF][START_REF] Finlayson-Pitts | Chemistry of the upper and lower atmosphere[END_REF]. However, up to 40% of the mutagen potential was attributed to NPAHs and more specifically to nitropyrene, dinitropyrene and nitrohydroxypyrene [14]. Even though the mutagenicity of OPAHs appear less important on human cells than B[a]P [START_REF] Durant | [END_REF]21], their relative high atmospheric concentrations (about 1 ng m -3 in the particulate phase) is of primary interest [22][23][24].

As a result of analytical time consuming and cost, only few data have been reported on the distribution of such compounds in the atmosphere. [25][26][27][28]. To our knowledge, only three articles report OPAHs concentrations for SRM 1649a (urban dust) and only for quinones [21,28,29]. No data exist for the other SRM.

The objective of this study was to develop a routine analytical method for the simultaneous quantitative determination of NPAHs and OPAHs in complex environmental matrices, using GC/NICI-MS and to apply this method to the analysis of SRM 1649a (urban dust) and natural ambient air samples (for both gaseous and particulate phases). In order to minimize interferences of polar compounds, a liquid chromatography purification procedure on SPE (solid phase extraction) cartridge was applied prior to GC/MS analysis.

Experimental

Chemicals

HPLC-grade quality solvents were used. SRM1649a, a reissue of SRM1649 with updated certified and reference concentration values, was prepared from atmospheric particulate material collected in the Washington-DC area in the late 1970s, using a baghouse collector specially designed for this purpose [START_REF]Certificate of analysis, Standard Reference Material (SRM) 1649a, Urban Dust[END_REF]. Detailed information on the sample collection and preparation have already been detailed in a previous paper [START_REF] Poster | [END_REF].

Ambient air samples come from the sampling campaigns of the French POVA program (POllution des Vallées Alpines). Details of the sampling campaigns are fully described in the reference [32]. Briefly, samples have been collected for two weeks during the Winter 2002-2003 and the Summer 2003 in two French alpine valleys (Chamonix and Maurienne valleys) after the reopening of the "Tunnel du Mont Blanc" to international traffic (which was closed during 3 years after a large accident on March 1999). Both ambient air particulate (on quartz filter) and gas (on PUF polyurethane foams) phases were sampled using modified high volume samplers equipped with PM 10 head (Megatec Digitel DA-80, 30 m 3 h -1 ) in order to determine parent PAHs and PAHs derivative concentrations. Results on PAHs concentrations and details on the analytical procedure used for their analysis (HPLC with fluorescence/UV detection) are presented elsewhere [START_REF] Albinet | preparation for Atmos. Environ[END_REF]. All samples and blanks were purified using a liquid chromatography purification procedure on SPE cartridge. This procedure was adapted from a protocol previously developed by Mazeas and Budzinski [START_REF] Mazeas | [END_REF]. Organic extracts were eluted through an alumina SPE cartridge (Extract-Clean, Alltech, Templemars, France) with 9 ml of dichloromethane in order to remove all macromolecules and polar interfering compounds. Then, a second purification on silica SPE cartridge (Extract-Clean, Alltech, Templemars, France) was performed to separate the alkane fraction from the aromatic one in order to keep a clean GC/MS injection port. Alkanes were eluted with 1 ml of n-pentane, then the aromatic compounds were collected with 9 ml of a (65/35, v/v) npentane/dichloromethane mixture. Finally, after reconcentration to dryness under an argon stream, residues were dissolved in 60 µl of dichloromethane.

Extraction and purification

Analysis

NAPHs and OPAHs were analysed by GC/MS in the NICI mode. The column used for analyses was a 5% phenyl-substituted methylpolysiloxane (DB-5MS, 30 m × 0.25 mm I.D., 0.25 µm film thickness, J&W Scientific, USA). This column was adopted because of its capacity to well separate 6-nitrobenzo[a]pyrene from 1-nitrobenzo[e]pyrene (m/z=297) [27], the first being a degradation product of benzo[a]pyrene. This latter PAHs being the reference compound used to evaluate the potential global PAHs toxicity, it is thus very important to quantify its nitrocongener, formed in the atmosphere and also perhaps during the sampling. On the other hand, it should be noted that separation of both isomers of nitrofluoranthene (2-and 3-nitrofluoranthene) will not be separated using this column. Analyses were performed using a Perkin-Elmer Clarus 500 gas chromatograph coupled to a Perkin-Elmer Turbomass Gold mass spectrometer. Program settings were as follows:

cool splitless injection mode in order to not degrade NPAHs (injector temperature from 40 °C to 320 °C), transfer line at 300 °C and constant gas flow through column of 1.2 ml min -1 . The oven temperature program was the following: initial temperature at 60 °C for 2 min; 45 °C min -1 to 150 C for 5 min; 5 °C min -1 to 300 °C for 7 min. Total run time was 46 min. The volume injected varied from 0.5 µl to 2 µl depending on the sample load. MS parameters are described below: source temperature 150 °C, electron energy 45 eV; methane was used as the reagent gas for NICI. The mass spectrometer was run in selective ion monitoring mode (inter-channel delay: 0.01 s; span: 0.1). Monitored ions and associated deuterium labelled NPAHs internal standards are shown in Table 1.

Results and discussion

Detection limits and recovery levels

A total of 17 NPAHs and 9 OPAHs were separated and identified for quantification. Analytes Finally, the mixing ratio used was the best compromise found to give acceptable recoveries for both NPAHs and OPAHs. Recoveries for the most volatile compounds (1-nitronaphtalene, 2nitronaphthalene and 1-naphthaldehyde) were relatively poor (RFs<50%). However, taking into account the lack of information for these three compounds in ambient air, results were considered as preliminary but interesting as they provide an order of magnitude of their concentrations in the reference material and in the ambient air samples.

OPAHs concentrations in air particulate reference material

The quantitative results concerning OPAHs measured by GC/NICI-MS in SRM 1649a (urban dust) are listed in Table 2. Concentrations measured for the same compounds in previous studies are also reported in the same Table . Excluding the values for 9-fluorenone and 9,10-anthraquinone from Fernandez and Bayona [28], OPAHs concentrations measured in this work are in the same order of magnitude than most previously reported studies: Values given for instance for 9,10anthraquinone by Durant et al. [21] and Cho et al. [29] are very close to those measured in this work. 1,4-anthraquinone is the only compound that has not been detected in this material and benz[a]anthracen-7,12-dione appears to be the most abundant OPAHs.

NPAHs concentrations in air particulate reference material

Results for selected NPAHs in SRM 1649a (urban dust) measured in this study and those previously reported in the literature are compared in Table 3. Concentration values measured in this study are generally in good agreement within a range of 8-45% (excluding Environment Canada data). The agreement for other compounds like 2-nitropyrene, 7-nitrobenz[a]anthracene and 6nitrochrysene, is less obvious (65-215%).

Application to ambient air samples

The proposed method was applied for the analysis of OPAHs and NPAHs in ambient air samples 4.

Among all the 17 NPAHs and 9 OPAHs measured, only the 1,4-anthraquinone was not detected in the particulate phase. Due to the very low ambient temperature during the sampling [average T°C (± 1σ)=-4.3 (±3.7)], the heaviest NPAHs (from 6-nitrochrysene to 6-nitrobenzo[a]pyrene) were not detected in the gas phase (neither 2-nitrofluorene and 1,4-anthraquinone). OPAHs and NPAHs with less than two aromatic cycles are principally present in the gas phase or partitioned between both phases (about 85% in the gas phase for 1-naphthaldehyde, 1-and 2-nitronaphthalene and about only 45% for 9-fluorenone). 9,10-Anthraquinone and 9-fluorenone are the prevalent OPAHs in the particulate phase. 9nitroanthracene is the predominant NPAHs in the particles following by the 3+2-nitrofluoranthene and the 2-nitropyrene. This latter compound is a gas-phase reaction product commonly used as a tracer of atmospheric photochemical reaction [START_REF] Ciccioli | [END_REF][37][38]. The abundance of this compound, combined with the low concentration of 1-nitropyrene (direct emissions tracer [START_REF] Ciccioli | [END_REF][37][38]), indicates a large distance from the pollution sources. Considering the site of Sollières, which is a rural site, NPAHs and OPAHs average concentration levels observed are relatively important. In the Winter period, similar levels of 9-fluorenone (6.90 ng m -3 ), found in both gas and particulate phases in Minneapolis, and of 9,10-anthraquinone (1.0 pg m -3 ), measured in particulate matter samples collected in Alger, were reported in references [39] and [40], respectively. Comparable levels of 2-nitropyrene were also reported, during the Winter period, in big urban areas like Napoli (60.0 pg m -3 ) and São Paulo (42 pg m -3 ) [START_REF] Ciccioli | [END_REF]41]. Considering the distance from combustion sources, levels of 1-nitropyrene are about 10 times lower than those measured in urban sites (Napoli: 99.0 pg m -3 , São Paulo: 99.0 pg m -3 , Firenze: 130.0 pg m -3 , Birmingham: 90.0 pg m -3 ) [START_REF] Ciccioli | [END_REF][41][42][43].

Fig. 3 shows the weekly variations of Σ PAHp, Σ OPAHp and Σ NPAHp defined as the sum of the concentrations of PAHs, OPAHs and NPAHs mainly present in the particulate phase. This may concern PAHs with more than 3 aromatic cycles (from benz[a]anthracene to indeno[1,2,3cd]pyrene) and NPAHs or OHAPs with more than 2 rings. During the sampling week, three successive meteorological events were encountered: an anticyclonic period, strong snowfalls, following by a new anticyclonic period. During anticyclonic periods, the total PAHs concentration has increased, probably due to an accumulation process. Then, the strong snowfall has induced a decrease of the total PAHs concentration by wet deposition. This hypothesis is in good agreement with the evolution of the amounts of PM 10 aerosols followed during the same period at the same site. More, variations of Σ OPAHp and Σ NPAHp are consistent with the evolution of Σ PAHp and of the PM 10 and validate the quantification method used for these compounds present at low concentrations in ambient air samples.

Conclusion

An analytical method has been especially developed for the simultaneous determination of 17

NPAHs and 9 OPAHs at very low concentration levels. Despite the large differences between the NPAHs and OPAHs concentration ranges (one to two orders of magnitude), this method is easy to apply and allows a routine quantification of ambient air NPAHs and OPAHs within a single analysis.

Studying PAHs derivatives appears very important considering their high mutagen capacity and the possible underestimation of the effect of the PAHs chosen in Europe as a reference, namely the benzo[a]pyrene, which may be potentially chemically degraded during high-volume air sampling [44,45].

The analytical procedure was applied to both gas and particulate samples collected during the POVA research program. Preliminary results obtained at Sollières show a good correlation between primarily or secondary compounds and the characteristics of the rural sampling site. Measurements obtained for both NPAHs and OPAHs and resulting from the POVA campaigns carried out after the reopening of the "Tunnel du Mont Blanc" to the international traffic (Winter 2002-2003 and Summer 2003 campaigns) will be published in a future paper. a GC/NICI-MS (5% phenyl phase), n=6.

b OPAHs values reported in [28], using GC/EI-MS (5% phenyl phase) after fractionation by GPC (gel permeation chromatography) and NP-LC (normal phase liquid chromatography), n=1.

c OPAHs values reported in [21], using GC/EI-MS (5% phenyl phase) after fractionation by gravity column chromatography and HPLC (high performance liquid chromatography), n=1 (3 injections).

d OPAHs values reported in [29], using GC/EI-MS (5% phenyl phase) after derivatization, n=12. a GC/ NICI-MS (5% phenyl phase), n=6.

b NPAHs values reported in [27], using GC/ NICI-MS (50% phenyl phase), n=3.

c NPAHs values reported in [25], using GC/HRMS (high resolution mass spectrometry) (5% phenyl phase), n=3. NPAHs values reported by NIST [START_REF] Schantz | Intercomparison exercise program for organic contaminants in PM 2.5 air particulate matter: description and results for intercomparison exercise I[END_REF] using GC/MS (50% phenyl phase), n=3.

e NPAHs values reported in [START_REF] Schantz | Intercomparison exercise program for organic contaminants in PM 2.5 air particulate matter: description and results for intercomparison exercise I[END_REF], using GC/MS (5% phenyl phase), n=3.

1 ** not detected.

Filters

  and SRM 1649a urban dust material (approximately 100 mg or 50 mg, 3 replicates of each) were extracted by pressurised liquid extraction (PLE; Dionex trade name ASE for accelerated solvent extraction) with a Dionex ASE 200 system. PUFs were extracted using Dionex ASE 300 system. In both cases, dichloromethane was used as extraction solvent. ASE 200 program parameters were: temperature at 120 °C, pressure at 140 bars, heat time at 6 min and static time at 6 min, for 3 cycles. ASE 300 program parameters were: temperature at 90 °C, pressure at 100 bars, heat time at 5 min and static time at 6 min, for 3 cycles. Extracts were evaporated under a nitrogen stream (Zymark Turbovap II) down to a volume of 500 µl and adjusted to 1 ml with dichloromethane.

  were identified by comparison of retention times using standards. Quantification of NPAHs and OPAHs was based on a daily seven-point calibration curve (r²>0.99). For instance, Figs.1 and 2present respectively, the reconstituted GC/MS total ion chromatogram for OPAHs and the GC/MS profiles of SIM of molecular ions in a particulate ambient air sample from the POVA research program.The limits of detection (LODs), defined as the lowest concentration differing significantly from zero (S/N=3), fall in the range value of 0.01-2.60 pg and of 0.03-0.07 pg for injected OPAHs (9fluorenone -1,4-anthraquinone) and injected NPAHs (3-nitrophenanthrene -6nitrobenzo[a]pyrene), respectively. The limits of quantification (LOQs), defined as the lowest concentration of the compound than can be determined (S/N=10), fall in the range values of 0.03-8.60 pg of injected OPAHs and of 0.12-0.24 pg of injected NPAHs. Recovery factors (RFs) of the entire analytical procedure (n=9) ranged, for NPAHs, from 14% for 1-nitronaphthalene to 84% for 7-nitrobenz[a]anthracene and varied, for OPAHs, from 5% for 1-naphthaldehyde to 83% for benzo[b]fluorenone. Results were corrected according to these recovery factors. Recoveries were strongly dependent on the solvent mixture used in the second step of the purification procedure.

  collected during the POVA research program. As an example, atmospheric concentrations measured during the Winter 2002-2003 (from 01/24/03 to 01/30/03) at a rural site in the Maurienne valley (at Sollières, 1373 m) are presented in Table

  Due to a lack of data in the literature, no direct comparison of the average concentration levels for all the OPAHs and NPAHs quantified in this work has been possible (same sampling season and similar sampling site characteristics). Nevertheless, concentrations of individual OPAHs and NPAHs such as 9,10-anthraquinone, 9-fluorenone, 1-and 2-nitropyrene have been compared with those measured in few previous other studies.

  d

6 -

 6 Nitrobenzo[a]pyrene 8.6 (0.0 -93.4) nd * mean concentration (min -max).

Table 1

 1 Selected ion monitoring conditions for OPAHs and NPAHs

	Compound	Monitored ions (m/z)	Dwell time (s)	Labelled NPAHs internal standard	Monitored ions (m/z)	Dwell time (s)
			OPAHs
	1-Naphthaldehyde	156	0.08	[ 2 H 9 ]1-nitronaphthalene	180	0.04
	9-Fluorenone	180	0.04	[ 2 H 9 ]1-nitronaphthalene	180	0.04
	9-Phenanthrencarboxaldehyde	206	0.08	[ 2 H 9 ]2-nitrofluorene	220	0.08
	9,10-Anthraquinone	208	0.04	[ 2 H 9 ]2-nitrofluorene	220	0.08
	1,4-Anthraquinone	208	0.04	[ 2 H 9 ]2-nitrofluorene	220	0.08
	Benzo[a]fluorenone	230	0.04	[ 2 H 9 ]3-nitrofluoranthene	256	0.08
	Benzo[b]fluorenone	230	0.04	[ 2 H 9 ]3-nitrofluoranthene	256	0.08
	Benzanthrone	230	0.04	[ 2 H 9 ]3-nitrofluoranthene	256	0.08
	Benz[a]anthracen-7,12-dione	258	0.08	[ 2 H 9 ]3-nitrofluoranthene	256	0.08
			NPAHs
	1-Nitronaphthalene	173	0.08	[ 2 H 9 ]1-nitronaphthalene	180	0.04
	2-Nitronaphthalene	173	0.08	[ 2 H 9 ]1-nitronaphthalene	180	0.04
	2-Nitrofluorene	211	0.08	[ 2 H 9 ]2-nitrofluorene	220	0.08
	9-Nitroanthracene	223	0.04	[ 2 H 9 ]2-nitrofluorene	220	0.08
	9-Nitrophenanthrene	223	0.04	[ 2 H 9 ]2-nitrofluorene	220	0.08
	3-Nitrophenanthrene	223	0.04	[ 2 H 9 ]2-nitrofluorene	220	0.08
	3+2-Nitrofluoranthene*	247	0.08	[ 2 H 9 ]3-nitrofluoranthene	256	0.08
	4-Nitropyrene	247	0.08	[ 2 H 9 ]3-nitrofluoranthene	256	0.08
	1-Nitropyrene	247	0.08	[ 2 H 9 ]3-nitrofluoranthene	256	0.08
	2-Nitropyrene	247	0.08	[ 2 H 9 ]3-nitrofluoranthene	256	0.08
	7-Nitrobenz[a]anthracene	273	0.08	[ 2 H 9 ]6-nitrochrysene	284	0.08
	6-Nitrochrysene	273	0.08	[ 2 H 9 ]6-nitrochrysene	284	0.08
	1,3-Dinitropyrene	292	0.04	[ 2 H 9 ]6-nitrochrysene	284	0.08
	1,6-Dinitropyrene	292	0.04	[ 2 H 9 ]6-nitrochrysene	284	0.08
	1,8-Dinitropyrene	292	0.04	[ 2 H 9 ]6-nitrochrysene	284	0.08
	6-Nitrobenzo[a]pyrene	297	0.08	[ 2 H 9 ]6-nitrochrysene	284	0.08
	* the separation of these two isomers could not be achieved on the 5% phenyl-substituted methylpolysiloxane phase.

Table 2

 2 OPAHs concentrations (ng g -1 ) in SRM 1649a (urban dust)

	OPAHs	This work a

Fernandez and Bayona, 1992 b Durant et al.,1998 c Cho et al., 2004 d

	1-Naphthaldehyde	199 (59)*	-	-	-
	9-Fluorenone	1110 (139)	300 (30)	1600 (110)	-
	9-Phenanthrencarboxaldehyde	247 (33)	-	-	-
	9,10-Anthraquinone	2238 (363)	220 (40)	2700 (120)	2030 (192)
	1,4-Anthraquinone	nd**	-	-	-
	Benzo[a]fluorenone	3512 (284)	1890 (300)	1900 (210)	-
	Benzo[b]fluorenone	4845 (812)	1570 (20)	5010 (470)	-
	Benzanthrone	3715 (872)	1310 (20)	4500 (340)	-
	Benz[a]anthracen-7,12-dione 8459 (797)	7465 (1100)	2400 (250)	-
	* mean concentration (standard deviation).

** not detected.

Table 3

 3 NPAHs concentrations (ng g -1 ) in SRM 1649a (urban dust)

	NPAHs	This work a Bamford et al.,2003 b	Chiu and Miles,1996 c	Intercomparison exercise study Environment NIST d Canada e
	1-Nitronaphthalene	12.5 (2.6)*	6.8 (0.3)	-	-	-
	2-Nitronaphthalene	12.0 (2.4)	10.0 (0.5)	-	-	-
	2-Nitrofluorene	<0.4	<5	<2	-	-
	9-Nitroanthracene	39.1 (4.2)	35.9 (0.6)	34.0 (1.0)	33.9 (0.9)	6.4 (0.9)
	9-Nitrophenanthrene	1.9 (0.5)	1.7 (0.1)	<2	-	-
	3-Nitrophenanthrene	34.0 (3.4)	22.0 (0.6)	-	-	-
	3+2-Nitrofluoranthene*	316.1 (47.4)	286.5 (32.8)	315.0 (29.0) 334.8 (15.8)	225.0 (20.0)
	4-Nitropyrene	6.0 (0.9)	5.5 (0.6)	-	-	-
	1-Nitropyrene	104.5 (6.4)	71.5 (5.1)	78.0 (8.0)	79.5 (3.5)	60.8 (1.1)
	2-Nitropyrene	190.0 (51.4)	24.4 (4.0)	-	-	-
	7-Nitrobenz[a]anthracene	11.1 (7.2)	35.1 (3.6)	25.0 (1.0)	29.5 (0.7)	19.3 (0.9)
	6-Nitrochrysene	1.8 (0.3)	4.4 (0.2)	3.0 (0.6)	<5	3.9 (0.1)
	1,3-Dinitropyrene	<4	<2	<10	-	-
	1,6-Dinitropyrene	<3	<4	<10	-	-
	1,8-Dinitropyrene	<4	<2	<10	-	-
	6-Nitrobenzo[a]pyrene	25.0 (6.7)	<40	<0.8	<5	122.0 (9.0)

* mean concentration (standard deviation).

Table 4

 4 Average atmospheric OPAHs (ng m -3 ) and NPAHs (pg m -3 ) concentrations at Sollières (rural site, 1373 m, Maurienne Valley, 7 sampling days of12 h, Winter 200212 h, Winter -2003, n=13) , n=13)

	Compound	Particulate phase	Gas phase
		OPAHs
	1-Naphthaldehyde	0.13 (0.00 -0.52)*	1.43 (0.00 -4.42)
	9-Fluorenone	1.38 (0.35 -4.72)	1.23 (0.00 -5.06)
	9-Phenanthrencarboxaldehyde	0.15 (0.02 -0.38)	0.00 ( 0.00 -0.00)
	9,10-Anthraquinone	2.18 (0.15 -9.93)	0.01 (0.00 -0.06)
	1,4-Anthraquinone	nd**	nd
	Benzo[a]fluorenone	0.60 (0.03 -3.69)	0.00 (0.00 -0.00)
	Benzo[b]fluorenone	0.56 (0.02 -3.58)	0.00 (0.00 -0.00)
	Benzanthrone	0.46 (0.02 -2.97)	0.00 (0.00 -0.00)
	Benz[a]anthracen-7,12-dione	0.42 (0.03 -3.

Acknowledgements

The authors wish to thank the French Ministry of Ecology and Sustainable Development (MEDD) and the ADEME agency for financial support. A.A. wishes to thank Yoann Fagault for his greeting in his laboratory, Karine Moirez for PAHs analysis, Amandine Fievet for PAHs sampling, and finally Jean-Luc Jaffrezo and all the POVA team.