M Al

Heib Ineris

A M Linkov

V V Zoubkov

On numerical modeling of subsidence induced by mining

The paper contains a new approach to calculate subsidence induced by mining. Its essence consists in combining reliable empirical data with rigorous accounting for compatibility conditions in 3D multi-layered media. The mathematical tool employed is the fast Fourier transform. It serves us for efficient solution of 3D elasticity equations for tens and even hundreds of layers. Stresses at the Earth surface are zero. At the mining levels, displacement discontinuities are considered to be proportional to the extracted thickness. Low-or no-friction contacts are presumed. Normal displacements at contacts may be continuous or include contact dilation. The layers are considered to be isotropic, homogeneous and elastic. Asymptotic formulae for high and low frequencies are used to increase accuracy and decrease the time of calculations. Layers being normally thin, the accepted presumptions do not distort the subsidence picture significantly given the boundary conditions at the mining level are prescribed in terms of displacements. This allows us to introduce necessary corrections accounting for strongly nonlinear effects discussed in the paper. The corrections are made automatically in the computer program Lay-Subsid developed by the authors. Numerical results and examples are given. They show flexibility and potential of the suggested approach for subsidence prediction and for further development of the code.

INTRODUCTION

Subsidence of the Earth surface induced by mining is a vital environmental problem in many countries including France and Russia. Extensive researches have been carried out on this subject to the date (see, e. g. recent reviews in [START_REF] Reddish | The Numerical Modeling and International Trends in Subsidence Models[END_REF][START_REF] Aissaoui | Amélioration de la prévision des affaissements dans les mines a l'aide des approches empiriques, numériques et analytiques[END_REF]). They embrace vast empirical data (e.g. [START_REF] Knothe | Observations of surface movements under influence of mining and their theoretical interpretation[END_REF][START_REF]Subsidence Engineers' Handbook[END_REF][START_REF] Proust | Etude sur les affaissements miniers dan le Bassin du Nord et du Pas-de-Calais[END_REF]), semi-empirical approaches (e.g. [START_REF] Knothe | Observations of surface movements under influence of mining and their theoretical interpretation[END_REF][START_REF] Proust | Etude sur les affaissements miniers dan le Bassin du Nord et du Pas-de-Calais[END_REF][START_REF] Akimov | Subsidence Induced by Underground Mining of Coal and Shale Deposits[END_REF][START_REF] Litwiniszyn | The theories and model research of movements of ground masses[END_REF]), mathematical interpretations and numerical tools (e.g. [START_REF] Knothe | Observations of surface movements under influence of mining and their theoretical interpretation[END_REF][START_REF] Akimov | Subsidence Induced by Underground Mining of Coal and Shale Deposits[END_REF][START_REF] Litwiniszyn | The theories and model research of movements of ground masses[END_REF][START_REF] Salamon | The influence of strata movement and control on mining development and design[END_REF][START_REF] Salamon | Deformation of stratified rock masses: a laminated model[END_REF][START_REF] Heib | Prévision d'affaissement ou de soulèvement de la surface à l'aide de SUBSID[END_REF]). Purely empirical approaches, being reliable for simple geometry, fail to provide extensions to a great variety of practical situations. Their inclusion into analytical and/or numerical frame is desired. Models employing influence functions (e.g. [START_REF] Knothe | Observations of surface movements under influence of mining and their theoretical interpretation[END_REF][START_REF] Litwiniszyn | The theories and model research of movements of ground masses[END_REF]) and the laminated model by Salamon [START_REF] Salamon | The influence of strata movement and control on mining development and design[END_REF][START_REF] Salamon | Deformation of stratified rock masses: a laminated model[END_REF] suggest such inclusion. The latter model, containing usual influence functions as a particular case, gives even values within an entire stratum. However, this model also has limitations concerning with layer thickness, mining at various levels and accounting for contact dilation, dip angle, faults, etc. There is need to develop new tools, which retaining virtues of the mentioned models, may account for the additional important factors.

In this paper, we suggest such an extension. It consists in solving numerically 3D problems for multi-layered media with displacement discontinuities on contacts and, in perspective, across layers. It employs recent advance in numerical solution of problems for layered systems [START_REF] Benitez | Three-dimensional elastostatics of a layer and a layered medium[END_REF][START_REF] Linkov | Difference equations approach to the analysis of layered systems[END_REF][START_REF] Benitez | A boundary element formulation based on the threedimensional elastostatic fundamental solution for the infinite layer: Part I -Theoretical and numerical development[END_REF][START_REF] Linkov | An effective method for multi-layered media with cracks and cavities[END_REF][START_REF] Linkov | A method to calculate stresses and deformations in 3D layered strata[END_REF]. In Sec. 1 and 2 we present essential features of its implementation for subsidence problems. A specially developed methodology to account for strongly nonlinear effects is described. Physical meaning of correction parameters is explained.

The program Lay-Subsid, developed by the authors, employs this approach. Results and examples obtained by using this program are given in Sec. 3. Conclusion contains brief summary of the results. In whole, the paper reflects the first stage in developing the suggested approach. We show that, being more flexible than existing methods, it successfully covers areas available to them.

MATHEMATICAL FORMULATION OF THE PROBLEM AND A METHOD OF SOLUTION

Bending of layers into an extracted space, being an obvious feature of subsidence process, it looks reasonable to use a model of a layered stratum. First, we suppose layers to be elastic. Necessary corrections will be made later. We consider 3D layered system with horizontal boundaries of layers.

In problems of geomechanics the upper boundary of the package is free of traction. Its lower boundary is in contact with an elastic half-space. On contacts of layers we have (i) equilibrium conditions for traction and (ii) prescribed dependence between vectors of traction and displacement discontinuities (these vectors are connected by a matrix of contact interaction). Some of contacts correspond to mining levels. We prescribe contours of mined out areas on them. Within these contours, the roof and the floor are free of traction, if they are not in contact. Otherwise, a law of interaction may be prescribed to account for particular interaction. Emphasize, however, that in subsidence problems, we are interested in displacements rather than in stresses. That is why we are trying to satisfy compatibility equations first of all. Consequently, in these problems we choose to prescribe displacement discontinuities at the mining level. They are taken equal to the extracted thickness multiplied by a coefficient which accounts for nonlinear processes in a roof.

For a pillar between mined out areas, a law of its deformation may be also prescribed. In many subsidence problems, one may assume the displacement discontinuities to be zero along a pillar.

This data completely defines mathematical formulation of a problem. To solve it, we employ the Fourier transform combined with the highly efficient method of reduction to the three-point difference equations solved by the sweep method [START_REF] Linkov | Difference equations approach to the analysis of layered systems[END_REF]. The efficiency additionally increases when employing the fast Fourier transform. Besides, we use asymptotic formulae specially derived for high and low Fourier frequencies. They allow us to increase accuracy and to decrease time spending. The code Lay-Subsid, developed by the authors, incorporates all these effective means. It allows us to solve 3D problems for tens and even hundreds of layers with tens of mined out areas. As a result, we obtain a tool to tackle the subsidence problem in a way mentioned in Introduction.

CORRECTIONS SERVING TO ACCOUNT FOR NON-LINEAR EFFECTS

The main obstacle to apply rigorous methods to subsidence prediction is that the subsidence is controlled by strongly nonlinear processes. The most obvious of them are (a) roof failure, (b) contact sliding, (c) crack growth and opening in tensile zones of layers, (d) movements along faults. Consider these factors in their sequence.

(a) The roof failure causes uncertainties in the effective thickness of an extracted layer. Consequently, this thickness should be taken in accordance with empirical data for a particular mining region. We account for it in a way used in mining industry codes: by introducing three multipliers to a real thickness to obtain an effective thickness. The latter is used as boundary condition. The first of the multipliers reflects the influence of mining technology, namely, whether and what kind of filling is used. Actually, it presents the ratio of the observed subsidence to the extracted thickness for super-critical areas of extraction 1 . The second coefficient gives the Proust correction for a depth when it exceeds 400 m [START_REF] Aissaoui | Amélioration de la prévision des affaissements dans les mines a l'aide des approches empiriques, numériques et analytiques[END_REF][START_REF] Proust | Etude sur les affaissements miniers dan le Bassin du Nord et du Pas-de-Calais[END_REF][START_REF] Heib | Prévision d'affaissement ou de soulèvement de la surface à l'aide de SUBSID[END_REF]. The third multiplier, normally taken equal to unit, enables corrections for local peculiarities when empirical data on subsidence is available.

(b) Contact sliding leaves uncertain the thickness and the number of layers which experience mutual movements on their contacts. We account for this factor by imposing no-friction conditions on the contacts of layers. The number of such layers above a mined out area is chosen so, that the width of subsidence profiles for super-critical areas agrees 1 The terms "sub-critical", "critical" and "super-critical" for extracted areas have the meaning common in publications on subsidence (see, e. g. [START_REF]Subsidence Engineers' Handbook[END_REF]). The critical area normally corresponds to W/H = 1.4. For the sub-critical area W/H <1.4; for the super-critical area W/H > 1.4.

with empirical data. Surprisingly enough, this number, being in our estimation about fourteen, is rather stable for coal seams in various countries.

In additional to the width of a subsidence profile, we adjust the position of its inflection point. Empirical data for super-critical areas show that this point is not exactly above the seam edge. According to the observations [START_REF]Subsidence Engineers' Handbook[END_REF][START_REF] Akimov | Subsidence Induced by Underground Mining of Coal and Shale Deposits[END_REF], it is at a distance d of about (0.1-0.15)H from the edge towards an opening. This shift reflects the fact that the roof is not in contact with the floor immediately at the edge of a seam. To account for this factor, one may use a smaller contour at the distance d from the edge of a seam. Naturally, 2d cannot exceed the width W of an extracted area. Consequently, for small values of the width to depth ratio (W/H < 0.6), the distance d is taken depending on this ratio. We suggest two options for choosing this dependence. One of them employs data of the British Coal Board [START_REF]Subsidence Engineers' Handbook[END_REF], the other that attributed to Proust [START_REF] Aissaoui | Amélioration de la prévision des affaissements dans les mines a l'aide des approches empiriques, numériques et analytiques[END_REF][START_REF] Proust | Etude sur les affaissements miniers dan le Bassin du Nord et du Pas-de-Calais[END_REF][START_REF] Heib | Prévision d'affaissement ou de soulèvement de la surface à l'aide de SUBSID[END_REF]. This distinction is necessary because of significant difference between the maximum subsidence observed in British and French mining regions for the same small value W/H= 0.2 [START_REF] Aissaoui | Amélioration de la prévision des affaissements dans les mines a l'aide des approches empiriques, numériques et analytiques[END_REF].

These adjustments result in profiles which are in good quantitative agreement with the generalized empirical data embraced by mining codes. They also give the maximum subsidence for sub-critical areas in agreement with measurements for long-wall mining. This provides us with an important prerequisite for extending calculations beyond the simple schemes covered by empirical data.

The other important feature, facilitating extensions, is that the numerical method employed preserves additivity. It means that the subsidence induced by a number of extracted elements is equal to the sum of their individual inputs. The additivity, being observed in field measurements, gives us a good chance to have reliable results for complicated contours composed of simple parts for which we have obtained agreement with empirical data.

(c) Opening of cracks in tensile zones of layers strongly influences the measured horizontal displacements and strains at the Earth surface. Their influence may be explained as following. Suppose we have a solid, without cracks, kernel layer that defines a profile, and slender ribs attached to its surface that experiences tension. The ribs imitate behavior of a cracked zone. The thickness of the solid kernel is 2h ker , the length of the ribs is h rib . For bending, when a cross section rotates remaining plane, the measured tangential strain is proportional to the distance from the neutral axis of the kernel. Hence, the strain measured along the upper boundary of the ribs is k strain = (h ker + h rib )/h ker fold greater than the strain on the surface of the solid kernel layer. Consequently, we need to multiply horizontal deformations resulting from the data on profiles, by a correction coefficient k strain .

Analysis of empirical data presented in [START_REF]Subsidence Engineers' Handbook[END_REF][START_REF] Akimov | Subsidence Induced by Underground Mining of Coal and Shale Deposits[END_REF] shows that the multiplier k strain varies from 2.2 to 4.5 depending on particular mining region. Its usual value is about 3. This coefficient is prescribed in our code as an input parameter to have horizontal displacements and strains in agreement with the observations for simple geometry of an extracted area.

Note that the influence of soft surface soil, having low both tensile and compressive strength, is similar to that of cracks but it includes also zones of compression. The empirical coefficient k strain reflects this influence as well. Note also that this coefficient may be taken different for tensile and compressive horizontal strains.

(d) Influence of faults may be accounted for by employing the techniques of the spectral BEM. The necessary mathematical prerequisites are given in [START_REF] Benitez | Three-dimensional elastostatics of a layer and a layered medium[END_REF][START_REF] Benitez | A boundary element formulation based on the threedimensional elastostatic fundamental solution for the infinite layer: Part I -Theoretical and numerical development[END_REF][START_REF] Linkov | An effective method for multi-layered media with cracks and cavities[END_REF]. As the techniques allow us to include boundaries not parallel to layer surfaces, it may serve to account for the influence of the dip angle as well. We hope to account for this factor in this way in future work.

Summarizing the said, four corrections are made to agree our numerical results with the reliable empirical data for super-critical areas. Specifically, (i) the displacement discontinuities at an extraction level are prescribed in a way which provides the maximum value of subsidence in agreement with the observations; (ii) the number of layers is taken in a way providing the width of a subsidence profile in agreement with the observations; (iii) the contour of a mined area is corrected to provide the observed position of the inflection point and the measured maximum subsidence for subcritical areas.

These three corrections concern with the vertical displacements and their derivatives (slopes and curvatures). The forth correction, as explained, concerns with the horizontal displacements and their derivatives (horizontal strains): (iv) the horizontal strains and displacements obtained for a calculated profile are multiplied by k strain to account for cracks and soft soil in a way providing agreement with the measured horizontal strains.

The corrections are made automatically in the computer program Lay-Subsid developed by the authors.

RESULTS AND EXAMPLES

Figures 1234illustrate relation between calculated results (solid lines) and empirical data (dashed lines). The first of them (Fig. 1) presents maximum subsidence as a function of width to depth ratio. It is compared with the SEH prediction [START_REF]Subsidence Engineers' Handbook[END_REF]. The maximum subsidence S m is normalized by its limit value S ms corresponding to a super-critical area of extraction (W/H > 1.4). For the upper pair of the curves, the length L of a mined area is great enough not to influence the results (L/W > 4). In this case, as explained in Sec. 3, the position of the inflection point is chosen to meet the empirical data. No wonder that the agreement is satisfactory. More remarkable is that the results for square mined areas, shown by the lower pair of the curves, are also in reasonable agreement. Note that analogous agreement is also reached for a so called Proust prediction [START_REF] Aissaoui | Amélioration de la prévision des affaissements dans les mines a l'aide des approches empiriques, numériques et analytiques[END_REF][START_REF] Heib | Prévision d'affaissement ou de soulèvement de la surface à l'aide de SUBSID[END_REF].

Fig. 2 presents profiles of subsidence for subcritical (L/W = 0.6), critical (L/W =1.4) and supercritical (L/W =2.0) areas. The empirical data is that of the handbook [START_REF]Subsidence Engineers' Handbook[END_REF]. Again we may see reasonably good agreement between calculated and empirical profiles. Note, that, as could be expected, for the supercritical area, the profiles simply translate along the abscissa approximately reproducing those for the critical area.

The influence of more complicated geometry is illustrated by Fig. 3,4. Fig. 3 shows an extracted area (thick line) in the mine Estaque Sud of the Provence coal district of France. The depth is 1000 m; the thickness of a mined seam is 2.85 m. Solid circles mark points along the observation path where subsidence was measured. Thin lines give the calculated isolines of subsidence for this case. In general, they follow contours of the mined area. Fig. 4 presents the measured and calculated subsidence along the path of observations. The agreement looks satisfactory.

CONCLUSION

We conclude that the method developed and the program Lay-Subsid may serve for subsidence prediction. It easily reproduces empirical data for simple geometry and it preserves additivity. This allows us to use it for complicated geometry of extracted areas.

The arguments of Sec. 2, analysis of empirical data and gained experience convince us that whatever sophisticated method to calculate subsidence may give reliable results only when employing four empirical corrections of the types mentioned above. As a matter of fact, any method successfully used in practice employed them explicitly. If such a method keeps additivity, it suggests a tool to predict subsidence for complicated geometry of mined areas. In this sense, the classical method by Knothe [START_REF] Proust | Etude sur les affaissements miniers dan le Bassin du Nord et du Pas-de-Calais[END_REF] and that by Salamon [START_REF] Salamon | The influence of strata movement and control on mining development and design[END_REF][START_REF] Salamon | Deformation of stratified rock masses: a laminated model[END_REF] are very close to our approach. The difference is in a degree of flexibility. The approach developed has greater flexibility in accounting for layered structure, contact conditions, faults and dip angle. Providing a convenient tool for subsidence prediction, it suggests also additional means for further development.

Fig. 1 .

 1 Fig. 1. Dependence of the maximum subsidence on W/H

Fig. 2 .

 2 Fig. 2. Profiles of subsidence for sub-critical (L/W=0.6), critical (L/W=1.4) and super-critical (L/W=2.0) areas


I Salvi

M Vuidart

F Caumont

Prats

Safety Management Systems in application of the Seveso 11 Directive -Lessons learnt from implementation in SMEs

The Councii Directive 96/82/EC of 9 December 1996 on the control of majoraccident hazards involving dangerous substances, known äs Seveso II directive, requires that the operators of hazardous establishments must demonstrate that they have assessed their major risks and are managing them throughout a Major Accident Prevention Policy (MAPP) and a Safety Management System (SMS).

Because of the diminution of the threshold quantities in the Seveso II directive, a lot of establishments that were not covered by the first Version of the directive must apply the requirements of the second directive. In particular, a lot of small and medium size enterprises (SMEs) that were not prepared to implement a SMS are concemed.

The paper describes first the characteristics of the SMEs which are important for the implementation of a SMS: for example the small number of employees, the difficulties to access to the new developments in technology and regulations, the multiplicity of roles for the managers... Then, the authors present the lessons leamt from Interviews with safety managers and plant managers of SMEs and describe the difficulties they apprehend for the implementation of SMS, and give some advice to overcome the weakness of SMEs. Finally, some proposal are made to facilitate the implementation of SMS.

CONTEXT

In order to anticipate the implementation of safety management Systems (SMS) in the framework of the application of the Seveso II Directive, a working group was built at INERIS. Objectives were on the one hand, to measure the industrialists' level of Information of concemed by the directive, and on the other hand, to highlight the difficulties related to the implementation of a SMS.

The overall objective was then to identify the needs in terms of tools, methodologies, information set to facilitate the implementation of the directive.

To be able to obtain the manufacturers co-operation, the working group has elaborated with Ref. l a manual with slides that were going to serve äs support to the study.

Also, this manual presents :

• Observations and objectives related to SMS implementation,

• A presentation of the contents of the Seveso II Directive,

• A brief description of the documents they have and that could be part of a safety management System based on a Plan, Do, Check, Act (PDCA) model. The manual of slides has allowed us to meet industrialists and to expose the requirement of the directive to them. These Interviews have allowed us to perceive difficulties that apprehend manufacturers, notably SMEs, for the application of the directive, in particular the definition of a Major Accident Prevention Policy (MAPP) and a Safety Management System (SMS). The working group then launched the enquiry and contacted some industrialists INERIS is working with.

Finally, the results of the described inquiry provided us with a better knowledge of the terrain and to reveal the difficulties foreseen by industrialist in the implementation of safety management Systems in compliance with the objectives of the Seveso II directive. The main results of the study are presented hereunder.

SYNTHESIS OF THE RESULTS CONCERNING DIFFICULTIES APPREHENDED BY INDUSTRIALISTS

The experience resulting from discussions with SME's operators revealed some elements that make the SMS implementation in the framework of the directive Seveso II difficult. Thus, the following observations have been made :

• The implementation of SMS is, for most SMEs, a regulatory constraint, generating a supplementary work cost ; • Available human resources for the implementation and the fünctionmg of the SMS seem often insufficient ; • It often seems to be difficult to keep oneself up-to-date about regulation and normative requirements, notably at the level of SMEs ; • Industrialists have difficulties to apprehend major hazards of the enterprise, and to use risk analysis and management methods ; • There exists often many documents or an oral safety culture but the formalisation and the Integration in a SMS seems often to be difficult ;

• The implementation of a SMS has often a great financial impact for SMEs; • The perception of what is a SMS is not evident, neither the manner to make it working ; • Enterprises have the quality reflex, sometimes health and safety but not major risk prevention ; • Enterprises having a quality System (like ISO 9000) wish to integrate the SMS, but the persons in charge of the quality system have not always a major accident prevention culture. This quick overview shows that difficulties on the terrain are real and that they result in many factors that can be regrouped in four categories:

• Difficulties of perception of maj or risk ;

• Difficulties linked to the regulation ;

• Structural difficulties specific for SME's ;

• Difficulties of SMS appropriation.

The following sub-chapters develop the origins of the difficulties mentioned above. In each paragraph, possible solutions are proposed.

Difficulties concerning the perception of major hazards

If the safety at the working place is relatively well integrated in enterprises, it is not the same for the prevention of major hazards. For a long time, the notion of protection of the worker linked to the application of the work regulations is part of the safety preoccupations in the enterprise, and this under the pressure of actors such äs unions and competent Services of the State (Work inspection).

The notion of major risk, however, is not often well assimilated among workers. The probability of occurrence of a major accident is low compared to an accident at the work place. Thereby, the major risk is occulted because it is not well perceived.

Moreover, the perception of major risk is more difficult, because industrialists don't use easily risk analysis methods. These methods allow, by studying the installations, to identify potential hazards and to evaluate technical or organisational safety devices that are installed, and to propose improvements. Operators of SMEs need to appropriate tools such äs risk analysis to rank the hazards in their establishment.

Difficulties linked to the regulation

Contrarily to the quality management system (ISO 9000 or EFQM) or to the environmental management system (ISO 14000), that are voluntary steps, the implementation of a SMS derives directiy from the application of the Seveso II directive on the control of major accident hazards involving dangerous substances.

For a number of enterprises, the SMS appears first äs a regulatory constraint and the commitment of the top management is not spontaneous. However, it is clear that a management System can efficiently fünction only if the top management is really involved in the work with a strong determination communicated to the personnel.

Need of a tool to inform and convince top management and decision-makers concerned with risk management.

Besides, in the spirit of the operators, the topics covered by the SMS overlap with the work condition regulations and the accident prevention at the work place. At the same time, a confüsion comes up between the role of Inspectors of the work condition and the Inspectors in Charge of the application of the Seveso II directive. (This problem might be specific to France).

Need to clarify interfaces between the work regulations and the environment regulations about safety.

The implementation of a SMS implies to keep oneself up-to-date about the regulatory System äs an important aspects of the management System. But often, SMEs have difficulties to follow the evolution of the regulation and to manage it with their intemal resources. Need to have tools to insure to follow the evolution of the regulation.

Organisational difficulties specific to SMEs

The implementation of a safety management System and keeping it up-todate represent an important amount of work, that asks almost füll-time human resources.

In a number of SMEs, the safety fünction is insured by the production manager or the plant manager. Only few SMEs have identified a person who is in charge of the safety management System. This fact is partly explained by the lack of financial resources, but also, äs written above, by the bad perception of major risks and the bad evaluation of the impact of a major accident on the enterprise. Commercial or productivity stakes are not well perceived, and this from a financial point of view äs well äs in terms of Image and productivity.

Need of costs /benefits evaluation tool for safety management.

Well often the role of the safety chief is merged with the fünction of the production manager, maintenance manager or even sometimes the plant manager. The top management of the enterprise has to understand that it concems a task that cannot be sustained together with others responsibilities. Implementation and reviewing SMS necessitates not only time, but also particular competence. Need to encourage SMEs to employ a safety specialist, even in time shared.

Appropriation difficulties

We have seen that the time devoted to the SMS is considerable and must be planned on the long tenn. If not, the SMS might be only a System that employees do not appropriate.

Even if a safety department exists within the enterprise, the SMS is implemented with the help of a technical support coming fi-om central Services of an industrial group, or of an extemal consultant. Because of the costs, after the short passage of the technical help, the System is in its beginning only formal, but not yet anchored in the safety culture of the enterprise and in the automatism of decision-making.

The SMS should therefore be the results of a dialogue within the enterprise and a thorough work. The choice of the System is the decision of the top management ; on the other hand, building the SMS should be the result of a collective work.

Need to explain the approach for implementation and the review of the SMS, especially by identifying and by driving collective and föderative actions in the long term.

One key for the efficiency of the SMS resides in the choice of the referential, referential that must at least take into account the requirements of the annex III of the Seveso 11 directive. But to make the SMS really efficient, it has to deal with the production process. The SMS shouldn't be a System that superposes on the activity of the production, but the SMS has to integrate the production process and to modify it if necessary. The objective is to produce safely, and not to have a production activity and a safety management activity with interfaces. This penetration of safety in production can be particularly difficult in the case of existing structures. Need to favour the Integration and the penetration of the SMS in the production activity.

Success factors

During the Interviews, success factors for the implementation and fünctioning of SMS appear clearly, especially, we can underline :

• Strong implication of the top management right fi-om the beginning ;

• Existence on the site of a Quality Management System (ISO 9000) or Environment Management System (ISO 14000) or Health and Safety Management System ; • Existence of a safety culture. Furthermore, it seems that the good fünctioning of the SMS is based on some particular points. These points should have inevitably to be tackled during the SMS implementation.

The table hereafter presents our recommendations in front of the particular points we noticed. The list is not exhaustive, but is the result of our experience.

Recommendations

The intervention has to begin with the training of the top management and the team that will work on the implementation of the SMS.

A technical support can help to show what is "major" so äs to structure the work and to increase its efficiency by going to the essential : the SMS should be proportionale to the major-accident hazards The team in charge of the SMS has to be trained to risk analysis (methods and uses). Indeed, risk analysis is both : • A tool for major hazard identification and help for the definition of the important safety elements (barriers) ; • A tool for ranking the hazards that has to be reiterated, and that constitutes the motor of the SMS. It is important to define a structure to collect and treat accidents and near-misses, and to share the lessons leamt in the enterprise

PROPOSALS

The experience from the Interviews and the Ref. 2-5 shows in a flagrant manner that it is important to communicate to operators, to inform them and to make them aware of the major accident prevention.

It is proposed to focus on the following points :

• Improving interest in major hazard prevention ;

• Involving the personnel in the MAPP ;

• Reinforcing the responsibility of the operator ;

• Using risk analysis äs a fundamental tool ;

• Taking into account the role of men in the enterprise.

Improving the interest in major hazard prevention

To improve the interest in major hazard prevention, the technical support for the SMS implementation has to convince the top management, because often the decision to put in place such a System is a regulatory requirement. Therefore, m the beginning, the managers often want to do the strict minimum to comply with the law. In that case, this can be insufficient. Some major accident case studies with heavy consequences and the presentation of statistics on disaster consequences might wake up the conscience to prevent major accidents. Major accidents are so rare nowadays, that people have forgotten what occurred in the past and think it can not happen again to them.

It can be valuable to insist on measurable and not easily measurable benefits when accident prevention is implemented :

• Reduction of financial loss in case of an accident, due to the destruction of the production equipment and the loss of production, and of market shares ; • Preserving the Image of the enterprise (media impact) ; • Diminution of insurance costs ; • Building a communication policy with the stakeholders for a best

Integration at the local level.

Involving the personal in the MAPP

The Major Accident Prevention Policy (MAPP) constitutes the foundation of all Safety Management Systems in the context of Seveso II. Indeed, it reflects, on the one hand, the commitment of the top management of the enterprise with objectives in the long term generally with a continuous improvement process, and on the other hand, it outlines the structure and the means that will be implemented to fülfil these objectives. And precisely, these are the structure and the Organisation of the means that are described in the SMS.

This idea appears clearly in the Seveso II directive. Indeed, the directive imposes that, both "high tier" and "low tier" establishments must define their MAPP and decline it in SMS.

The difference between "high tier" and "low tier" establishments is that the first have to produce a demonstrative document (safety report), that justifies the choice of the MAPP, while the second have to make the MAPP available to the competent authorities, in the form of a descriptive document.

Extract from the Seveso II directive : Articie 7 Major-accident prevention policy 1. Member States shall require the operator to draw up a document setting out his majoraccident prevention policy and to ensure that it is properly implemented. The major-accident prevention policy established by the operator shall be designed to guarantee a high level of protection for man and the environment by appropriate means, structures and management Systems, 2. The document must take account of the principles contained in Annex III and be made available to the competent authorities for the purposes of, amongst other things, implementation of Artides 5 (2) and 18. [...] Articie 9 Safety report l. Member States shall require the operator to produce a safety report for the purposes of: (a)demonstrating that a major-accident prevention policy and a safety management System for implementing it have been put into effect in accordance with the information set out in Annex III ;

The MAPP must be defined for both establishments concemed by articies 6 and 7, and by the articie 9. The MAPP must be declined in appropriate means, structures and management System. In others terms, in the two cases, the SMS materialises and structures the MAPP.

For this reason, it is important that the MAPP is the result of a thorough work on safety in the entire enterprise. Reflections leading to the definition of the MAPP should tackle the safety culture of the enterprise, and should involve all employees (for example by consulting them with questionnaires or debates).

MAPP and SMS will be establish in the enterprise only if they touch all collaborators, through common objectives. Of course, the MAPP presents objectives and general principles, but it would have to be declined each year in intermediary objective, and an annual review would allow to improve the SMS. During the annual evaluation and review of the SMS, it is important to involve again all collaborators in order that they can judge the work and efforts accomplished and thus to maintain the motivation.

Reinforcing the responsibility of the operator

For some years, SMS including self-control and continuous improvement become generalised.

It is clear that industrial Systems becoming increasingly complex and resources for the control (in particular by public authorities) being always limited, a tendency is being developed to safety self-control in the framework of SMS. This concept appears clearly in SMS based on the Plan-Do-Check-Act principle.

In an industrial establishment, the operator has the best place, on the one hand, to identify the major hazards and, on the other hand, to allocate the means to prevent them. The Seveso II directive is there to lock the System and to guarantee that the self-control fünctions are correctiy achieved.

During an inspection of the SMS, the review should be carried out with Interviews with employees, in order to perceive the safety culture and the level of co-operation between the employees, who reveal the level of appropriation of the SMS. It shouldn't be only a formal review. But the safety depends clearly on the efficiency of the SMS implemented by the operator.

Using risk analysis äs a fundamental tool

To put in place a MAPP and a SMS, such äs required by the Seveso II directive, the risk analysis is a fundamental tool.

So äs to lighten the purpose, the risk analysis can be defined äs a process that uses Information (input data) to identify potential accidents (hazards), to evaluate their likelihood and the gravity of their consequence, so äs to reduce their occurrence or their effect.

Also, for all SMS, risk analysis is both the input of the System, for hazard identification, and its motor. Indeed, risk analysis is used at the beginning of the implementation of the SMS to identify the hazards on which preventive actions will be set up. Risk analysis allows on the one hand, to create a safety culture by putting around a table different persons involved in the fünctioning of the enterprise (people involved in the conception, Operation, maintenance, quality, safety...) to exchange and imagine harmfül situations, and on the other hand, to guarantee a certain exhaustiveness and homogeneity of preventive measures. The hazard ranking that is carried out at the end of the risk analysis, allows to define priorities for actions to lead at short, medium and long term.

Then, revisions of the frequency and severity of identified accidents by taking into account preventive and protective measures (barriers) allow to build, by successive Iteration, plans to improve the safety level of the plant. Risk analysis is therefore a good tool for safety improvement, which is the goal of the SMS too.

Eventually, to the level of SMEs, the lack of information and the idea that risk analysis methods are not adapted to the small structures are the main brakes to a more widened use of these methods. Indeed, often SMEs hesitate to launch such risk analysis by fear of the heavy process and costs. The accompaniment by an extemal organism expert in these methods is often very fhiitfül.

Taking into account the role of men in the enterprise

During the implementation of a SMS, there is a great risk to superpose a formal safety System on the production System without taking account of the specific characteristics of the enterprise, that they are technical issues (specificity of the products, complexity of the installations) or human issues (history of men in the enterprise, specific activities of some personal).

If the objective of SMS is to modify (by improving it) men's behaviour to avoid that "human errors" do not lead to a major accident, it is important to know the initial state of the Organisation. Knowing the initial state consists in, on the one hand, knowing the real Situation, the daily work accomplished by men at all levels of the Organisation and, on the other hand, knowing the representation and the perception that have the workers of their work.

For a SMS, the path to cover can be traced only if the starting point is known. Furthermore, knowing the initial state allows to adapt the Speech, in according to the level of perception of each collaborator in the enterprise.

By having a good knowledge of the initial state and actions to implement, the SMS will be able to act on men's behaviour, and lead to safe production Systems (with the integration of the safety in the production process).

SMS : FROM A REACTIVE SYSTEM TO A PROACTIVE SYSTEM

The SMEs are generally structured and organised for a well precise goal: to produce.

It is not natural for a SME to anticipate means, especially when they are limited, to face drifting situations or crisis that appear only rarely. All identified difficulties show that the actions led by the operator were conceived to produce. To face the unforeseen, enterprises that have no SMS count on their reactivity : to react in order to avoid the drifting to a catastrophic Situation. The reactions are often curative. Especially, a lot of SMEs are structured without insuring their defence, äs a sportive team that would have very good attackers but poor defenders. In order that the team wins, it is necessary that all players have a good level. In the same manner for safety, it is preferable that all collaborators know the tactics of the enterprise (policy), have the level to implement it and have a capacity of anticipation to avoid even the appearance of drift Situation.

The well known message that illustrates this purpose could be the following: "Safety is the affair of everyone ". But in order that the work on safety is the most efficient, it is necessary to be capable to anticipate by constructing a proactive System. This goal required an in-depth work on the employees who are the enterprise.

PERSPECTIVES

INERIS has noticed the new occurrence of so called 'post SEVESO accidents' which involved failure of safety devices [START_REF] Lechaudel | Assessment of two accidents involving safety devices[END_REF], that suffered from non appropriate maintenance and testing, which are parts of the SMS.

Aware of the difficulties apprehended by SMEs' operators, INERIS has just launched a project with industrialists to build a methodology evaluating the efficiency of SMS. The methodology is based on the development of safety performance indicators that might be used by the operator for monitoring the safety management System in the long term. The indicators that will be developed will reflect the formal aspects of SMS äs well äs the level of appropriation link with the safety culture. The final objective is to take into account the prevention carried out by the operators in the evaluation of the risk level of an industrial establishment äs suggested in Ref. 7.

Table l

 l Recommendations on particular points

	Particular points
	Confusion between SMS with Seveso
	requirement and Health and Safety
	Management,
	and bad perception of the regulatory
	context
	Bad evaluation of the extent of the
	study
	Identification of major hazards, of
	important safety elements (safety
	barriers), risk management
	Leaming from accident and historical
	knowledge


Salvi Olivier
email: olivier.salvi@@ineris.fr

Gaston Didier

Criteria for risk decision-making process related to hazardous installation : a French experience

Keywords: decision-making, Seveso II Directive, land-use planning, risk assessment

Chemical process industry gathers critical infrastructures since chemical plants represent for the society both an instrument to generate activity and benefits (production of goods, employment, services...), and an instrument that can harm people and the environment. This paper describes the risk assessment approach led in France for licensing the hazardous installation, in particular those covered by the Seveso II directive and the implication for land-use planning. The first part explains why the French risk assessment procedure is based on the quantitative evaluation of major accident scenarios with explicit criteria, and only on qualitative analysis of the risk reduction measures without explicit criteria. The second part shows some on-going evolutions in the formal definition of criteria to make the analysis of the safety barriers.

Introduction

It can be considered that chemical process industry gathers critical infrastructures since chemical plant represents for the society both an instrument to generate activity and benefits (production of goods, employment, services...), and an instrument that can harm people and the environment.

Risk assessment and risk management are subjects of increasing importance in the chemical process industry throughout the Community. The Seveso II directive gives for the first time a requirement for the operator of hazardous industrial establishments to demonstrate "that adequate safety and reliability have been incorporated into the design, construction, operation and maintenance of any installation, storage facility, equipment and infrastructure connected with its operation which are linked to major-accident hazards inside the establishment". Hence, Seveso II explicitly encourages inclusion of risk assessment in the safety related decision-making processes of both regulatory authorities and industry.

For industry, it is important to better evaluate the risk in order to optimize the allocation of resources to prevent major accidents. In this respect, cost-benefit approaches have arisen in the industry, in particular in international industrial groups. So, in parallel to the evaluation of the cost of risk reducing measures, criteria have been developed to characterise the risk decrease.

For the regulatory authorities also, in order to insure a consistent process in risk management, it is fundamental to judge when they need to ask more risk reducing measures or when they are sufficient. Therefore, risk criteria are needed to appreciate if major accident hazards are well controlled by the operators. This paper describes the risk assessment approach led in France for licensing hazardous installations, in particular those covered by the Seveso II directive and their implication for land-use planning. The first part explains why the French risk assessment procedure is based on the quantitative evaluation of major accident scenarios with explicit criteria, and only on qualitative analysis of the risk reduction measures without explicit criteria. The second part shows some on-going evolutions in the formal definition of criteria to make the analysis of the safety barriers.

Context in France

In France, there is no explicit criteria for risk acceptance of hazardous establishments. There are only general criteria related to the tolerable consequences of accidents, or regulatory texts that define safety distances around specific hazardous establishments.

Obligation to keep the population away from the hazards

In fact, in the law related to the control of hazardous establishments (Code de l'Environnement, Livre V), the license to operate can be subordinated to a sufficient distance between the establishment and people located around. In other words, the regulatory bodies can not license new establishments that can potentially harm people in case of a major accident. This idea appeared first in a law dated 1917 on hazardous and insanitary plant, but it was clearly reinforced with the law n°76-633 dated 19/07/1976 that became the 'Code de l'Environnement' on 18 th September 2000.

Development of the French deterministic approach for risk assessment

To enhance a harmonised implementation of the philosophy of the law presented above, the French Ministry of Environment published in 1990 a guide that defined reference scenarios to be considered for determination of safety distances for land-use planning. Then, in a circular letter published in 1992, it was explained that these safety distances should be determined using the safety reports written for the licensing procedure. Consequently, to write the safety reports that aim at characterising the hazard of their plants, the operators focused on the examination of the reference scenarios described in the guide. This approach is known as the French deterministic approach.

The term deterministic means that the assessed scenarios are pre-defined (See Table 1). They are considered independently of their likelihood, which is not assessed. The underlying philosophy is based on the idea that if sufficient measures exist to protect the population from the worst accident, sufficient protection will also be available for any less serious incident.

Type of risks and facilities

Risks linked to liquefied combustible gas facilities (fixed, semi-mobile or mobile) Risks linked to vessels containing liquified or non-liquified toxic gases where the containment is not designed to resist external damage or internal reactions of products Risks linked to vessels containing toxic gases where the containment is designed to resist external damage or internal reactions of products Risks linked to large vessels containing flammable liquids

Risks linked to use or storage of explosives

Type of accident scenario

Scenario F :

Explosion of the largest mass of explosive present or explosion due to a reaction

Criteria for the evaluation of the consequences of reference scenarios

In the safety report, the criteria used to characterise the hazard are expressed only in effect thresholds. They are used to evaluate the safety distances around the establishments :

-the distance at which the first death occurs corresponding to probability of 1% fatality, -the distance at which irreversible health effects occur. The effects that are calculated with mathematical models are different according to the physical phenomenon involved in the accidental scenario. And the effect thresholds correspond to the phenomenon. A list of the thresholds is given in Table 2.

It can be noticed that, in case of fragment projection after an explosion, the maximal distance is evaluated but it is often not taken into account for the determination of the safety distance. It can be noticed that harmonised thresholds help to a coherent evaluation of the reference scenario consequences at a national level. Therefore, the French Ministry for Environment has published in 1998 a guide for the most frequently used toxic substances.

The guidance for the selection of the reference scenarios and the explicit definition of the criteria to evaluate the consequences is needed to have a consistent procedure, but at the moment we can still notice some discrepancies in the safety reports that have a great influence on the evaluation of the reference scenario consequences, in particular for toxic substances. For example, we can mention some parameters that should be more precisely defined in a guidance :

-The duration of the leak according to safety loop with quick-cut valves, -The duration of the exposure for long leakage, regarding possible response time for people evacuation or confinement. Moreover, as mentioned in the first results of the ASSURANCE project (F. [START_REF] Markert | A benchmark exercise on risk analysis of chemical installations[END_REF], not only in France, we can still notice some other discrepancies related to the models used for the consequence calculation and the assumptions made by the risk analyst.

Qualitative analysis of the safety barriers

The evaluation of the reference scenario consequences is often completed by the determination and evaluation of scenarios with preventive and mitigation devices. For this purpose, the process described in the Fig. 1 has been recently formalised, although it was already applied for some installations.

In the French safety reports, inspectors ask operators to identify the most important barriers (or lines of defences) that can prevent major accident scenarios. These specific barriers are called Safety Important Barriers SIB (in French : éléments importants pour la sécurité EIPS). The SIBs can prevent the occurrence of loss of containment of hazardous substances (preventive measures), or reduce the consequence severity of loss of containment (mitigative measures or response).

The SIBs can be constituted by safety devices (equipment) or by tasks carried out by personnel.

Safetv

4.

Figure 1 : Approach for determination of SIBs

The process to determine the SIBs is based on the following steps summarised in Figure 1 : 1. Risk analysis as part of the safety report, in order to identify and to rank the accident scenarios according to their severity and their frequency, Identification of the Major Accident Scenarios according to the severity of the consequences, and on the criteria given in the SEVESOII directive (annex VI), Association of each Major Accident Scenario with combinations of SIBs, Definition of the SIB requirements in terms of efficiency and availability (depending on the reliability and maintainability), 5. Definition of actions, part of the Safety Management System (SMS), to insure the level of efficiency and of availability in the long term.

The SMS implemented by the operator aims at organising the process presented in Figure 1, and especially on the actions described in step 5.

As a partial conclusion, risk assessment for SEVESO II establishments is based, in France, first on a deterministic approach, with the evaluation of the reference scenario consequences (M.D. [START_REF] Christou | Guidance on land-use planning as required by the council directive 96/82/EC[END_REF]. The approach applied since 10 years has led to implement concrete risk reduction measures, for example : -Moving of LPG vessels away from urban areas, -Covering of LPG vessels with earth or equivalent material, -Confining of toxic gases vessels (chlorine, hydrogen chloride, phosgene...) and installation of a scrubber.

But it can be noticed that, often, only risk reduction measures that affect the severity of the potential consequences are required by the authorities and taken into account to define safety distances used for land-use planning.

New aspects in risk assessment

In the context of an industrial development, there is a need of criteria to quantify the influence of risk reduction measures in the risk assessment procedure, in particular if the measure affects the occurrence of the potential accident and not its severity. It will allow to find a way to build new hazardous establishments, otherwise there will be no more possibility to develop the industry. Moreover, because of the application of the SEVESO II Directive, the competent authorities have to accept or refuse to give the license periodically to operators of hazardous establishment, only if the risk is low enough. These thoughts show some of the limits of the deterministic and consequence based approaches, and express the need for explicit criteria to characterise the qualities (efficiency and availability) of the reduction measures.

Need for criteria to evaluate the SIBs and the SMS

In fact, the licensing of a new hazardous establishment needs that the evaluated scenarios are not always the reference scenario, but the scenario that takes account of some risk reducing measures, otherwise the safety distances wouldn't be compatible with existing urbanisation in the vicinity of the establishment. And because of the lack of explicit criteria, the number and quality of risk reducing measures (SIBs) are not always consistent when comparing the same kind of hazardous installation in different locations.

The requirements for the SIBs should be defined in terms of efficiency and availability in a harmonised way. And operators should evaluate if their safety barriers meet the requirements that should be proportional to the hazards. This assessment of the SIBs should constitute a first level of evaluation, and should be harmonised according to a methodology for instance based on the principle of the norms IEC61508 and draft IEC61511 (Functional safety : safety instrumented systems for the process sector).

The characteristics and the qualities of SIBs depend on the organisational process, as a safety equipment should be well designed, well kept up and tested. The organisation should also learn from the use of the equipment and build an appropriate maintenance planning. If the safety barrier is a human task, this task should be described in a procedure and the field operator should be trained to this procedure. The application of the procedure should be tested with audits.

Therefore, it is clear that the safety organisation, generally a Safety Management System, has a great influence on the qualities of the SIBs from the design phase to the decommissioning.

Then it is recommended that the whole SMS should be evaluated by the operator itself or by an external auditor, as a second level of evaluation. In application of the SEVESO II directive, the inspectors check the existence of the SMS and its good functioning on particular points.

If the SIB characteristics meet the requirements associated to the severity of the potential major accident, then residual risk assessment scenarios could be defined by taking into account the SIB. The consistency of the approach is summarised in Figure 2.

Combination of Safety Important Barriers

Equipment Efficiency Availability

Humah task

' • -• • • • • • -• -• • • • • • • • • ' -ijp

Efficiency Availability

Organisational process

Residual

Risk

Assessment

Scenarios

Safety Management System

Efficiency of Safety Management System

Figure 2 : Process for residual risk assessment

Pressure of the civil society for more transparency

A second aspect is that the public and the society ask for more transparency and the industrialists ask for more consistency from the regulatory bodies in applying the law at the national level, in the different regions. This observation is applicable in a lot of industrialised countries, not only in France.

But in France, it can be observed that the law is very complex and is applied by various stakeholders concerned by risk management, depending on the categories of the installation.

Therefore, there is a need to make the decision-making process more readable and explicit, in particular by implementing a methodology recognised by all the decision-makers in charge of risk control, and by adopting criteria to assess the efficiency of the risk reduction measures implemented by the operators.

Some thoughts to improve risk assessment and decision-making process

At the moment, in particular on the European level, we can notice a major initiative related to an harmonisation in risk assessment and decision-making process (C. [START_REF] Kirchsteiger | Promotion of Technical Harmonisation on Risk-Based Decision-Making[END_REF] in different industrial sectors. But harmonisation is already needed in some given industrial sectors, for instance in the industry covered by the SEVESOII Directive.

In France, some on-going projects at INERIS, supported by the French Environment Ministry, would help to develop a consistent approach. Among these projects, we can mention first, a project on the identification of best available technologies in terms of safety devices for given process equipment and substance, according to their efficiency and their availability. This project will help to better know the qualities of the safety devices able to insure the same safety functions.

There is also a working group on the revision of the guide for land-use planning. The first thoughts lead to keep a procedure to define the safety distances based on the evaluation of the consequences of accident scenarios. But, it appears a need for explicit criteria to characterise the acceptable residual risk for the people living in the vicinity of hazardous plants.

Conclusion

Because of the French culture and history, the decision-making process related to industrial accidental risk is based on the evaluation of the consequences of major accident scenarios. No explicit criteria are used to judge the acceptability of residual risk.

With the application of the SEVESO II directive and the change of the public's expectation in terms of transparency, the procedure for risk assessment should evolve. It could need the adoption of criteria to evaluate the efficiency of risk reducing measures implemented by the operators. These criteria should be proposed at the national level and endorsed by all the stakeholders involved in risk control. If a similar evolution should happen in the decision-making process, in particular by proposing explicit criteria for residual risk acceptance, this would need a public debate in the society and some modifications in the law related to the control of hazardous establishments.

Table 1 :

 1 Reference scenarios used for land-use planning purposes

Table 2 :

 2 Thresholds for the evaluation of the consequences of the reference scenarios

	Effects studied	Criteria corresponding to	Criteria corresponding to
		probability of fatality 1%	first irreversible effects
	Thermal radiation	5 kW/m (if the exposure	. 3 kW/m 2 (if the exposure
		is more than 1 min)	is more than 1 min)
		or heat load of	or heat load of
		lOOO^kW/m 2 ) 4 ' 3 în 600 n (kW/m 2 ) 4/3 .s
		case of a short	in case of a short
		exposure duration	exposure duration
	Overpressure	140 mbar	50 mbar
	Toxic dose	Based on LC1 % and	Based on irreversible
		exposure time (passage of	effects (first injuries) and
		the cloud)	exposure time (passage of
			the cloud)

( * } : these values are commonly used, but still under discussion

Rèboii -N.

	Analysis
	Major
	Accident Scenarios Safety Important Barriers	Major consequences Certain quantity of hazardous substances Choice of SIBs according to Major Hazards
	Requirements	Efficiency, reliability,
	Efficiency	maintainability,
	Availability	response time...
	Actions Design, Maintenance,	Actions defined in Safety Management System
	Tests
	2.


R Meininghaus

N Gonzalez-Flesca

A Cicolella

E Bastin

Indoor and outdoor aldehyde concentrations in a medium-sized French town

Aldehydes are air pollutants with the potential to act as strong sensory irritants. Outdoors, these compounds play a part in the complex system of photochemical atmospheric reactions, and they are directly released by traffic and other combustion sources. Indoors, numerous emission sources have been identified, for example tobacco smoking or furniture. The objective of the present study was to measure average concentrations of selected aldehydes in typical urban environments. A pilot study was carried out in Nancy, a medium-sized town in the Northeast of France. Outdoor concentrations of seven aldehydes were measured by exposing passive samplers for two periods each lasting five days. 30 samplers were installed at background sites and at sites where people spend more of their time. Moreover, 20 volunteers were equipped with personal samplers, which they carried on them during the first five days. Concentrations were also measured in their homes and offices. The results show that the highest outdoor concentrations are found in the centre of Nancy. However, aldehyde concentrations are much higher indoors than outdoors, even when compared with a period of meteorological conditions "favouring" higher aldehyde concentrations. Office and home concentrations agree with concentrations obtained with personal samplers. It is furthermore shown that the sum of formaldehyde and acetaldehyde concentrations may be used as a tracer for the group of aldehydes studied.

Introduction

Aldehydes can be strong sensory irritants. Moreover, formaldehyde and acetaldehyde have been classified by the World Health Organisation as probably and potentially causing cancer [START_REF]Guidelines for Air Quality[END_REF], respectively. Research is therefore stimulated in order to measure concentrations of these compounds in the ambient air, and to estimate the chronic exposure to these compounds. Outdoors, aldehydes play an important role in the complex system of photochemical atmospheric reactions [START_REF] Carlier | The Chemistry of Carbonyl Compounds in the Atmosphere -A Review[END_REF], and they are directly released by traffic and other combustion sources [START_REF] Viskari | Seasonal and Diurnal Variation in Formaldehyde and Acetaldehyde Concentrations along a Highway in Eastern Finland[END_REF][START_REF] Mcdonald | Fine Particle and Gaseous Emission Rates from Residential Wood Combustion[END_REF], Indoors, personal activities (tobacco smoking or cooking) as well as material emissions (for example from furniture) result in increased concentrations [START_REF] Salthammer | Organic Indoor Air Pollutants -Occurence, Measurement, Evaluation[END_REF]. It was furthermore suggested that aldehydes might additionally be formed indoors by reactions between volatile organic compounds and atmospheric oxidants [START_REF] Weschler | Indoor Chemistry: Ozone, Volatile Organic Compounds, and Carpets[END_REF]. The first objective of the present study was to examine different urban living environments with respect to their contribution to personal aldehyde exposure. For this reason, concentrations of a number of aldehydes, averaged over several days, were obtained at numerous sites (indoors and outdoors) and with portable samplers carried by volunteers. A comparison of these results will reveal which environments may be more important with regard to personal exposure. It was also the aim of this study to find methods that may help to reduce the large amount of information that is typically available when characterising many sampling sites and numerous compounds.

Experimental

Analytical

Passive sampling devices (Radiello, Fondazione Salvatore Maugeri, Padova, Italy [START_REF] Cocheo | High Uptake Rate Radial Diffusive Sampler Suitable for Both Solvent and Thermal Desorption[END_REF]) equipped with dinitrophenyl hydrazine (DNPH) sampling cartridges and ozone scrubbers [START_REF] Bates | Atmospheric Volatile Organic Compound Monitoring. Ozone Induced Artefact Formation[END_REF], were used to quantify concentrations of the compounds listed in Table 1. Passive samplers provide average concentrations of the selected exposure time. After exposure, the sampling cartridges were extracted with 2 ml acetronitrile. The extracts were analysed with HPLC separation (KROMASIL C18 150 mm-3mm -3.5 um) and UV detection (X.=365 nm). Compounds were identified by their individual retention times. The analytical results were corrected for blanks using six non-exposed field blank sampling tubes. However, this was only necessary for formaldehyde. The sampling speed of passive samplers should be limited by the diffusive transport of molecules into the sampler. The sampling speed is usually expressed as an uptake rate in (ml/min) and depends on compound properties like the molecular mass. The sampler manufacturer provided aldehyde uptake rates for formaldehyde, acetaldehyde and acroleine. Additional uptake rates were experimentally determined for the following aldehydes: butanal, pentanal, hexanal, heptanal, octanal, nonanal, furfural and benzaldehyde. For this reason, the samplers were exposed to a defined and controlled aldehyde test atmosphere in an emission test chamber for approximately 3.5 days [START_REF] Uhde | Test report 2017/2000[END_REF]. No correlation was observed between the experimentally determined uptake rates (not presented in this paper) and theoretical values based on compound-specific diffusion coefficients in air, backing up previously published observations [START_REF] Ullrich | Indoor Air Concentrations of Aldehydes -A Field Study using DNPH Diffusive Sampling[END_REF]. This point requires further clarification, and complementary studies are underway.

Sampling protocol

The measurement campaign was carried out in Nancy, a medium-sized town (ca. 100 000 inhabitants) in the Northeast of France, in September 2000. It consisted of two parts each lasting five days. The weather conditions of the first part were characterised by rain episodes and light winds coming from various directions. During this part, 22 samplers were exposed at outdoor background sampling sites, which had been selected to cover the whole area of Nancy. In addition, samplers were installed at 8 sites where people spend more of their time (a square in front of the central station, a pedestrian zone, a small street with restaurants, etc.). All samplers were installed about 3m above ground and sheltered by aluminium boxes. During these first five days, 20 volunteers carried a personal sampler on them (within breathing zone). Half of them worked indoors (offices) and the other half outdoors (gardeners). All participants installed samplers indoors in their sleeping rooms and in their offices. After this first part, the campaign lasted for another five days, where 10 samplers were installed outdoors. This time, the weather was dry and rather sunny.

Repeatability of the sampling procedure was tested by exposing pairs of samplers simultaneously at four different outdoor sampling sites. When plotting the total amounts of all quantifiable compounds in one sampler over the total amounts found in the second sampler, a correlation coefficient of 0.89 (pO.0001 ) was obtained.

Results and Discussion

Concentrations

Table 1 presents the concentrations obtained at different environments and with the samplers carried by volunteers (median and maximum concentrations in ug/m 3 for all compounds and environments). Butanal and nonanal could not be quantified, due to the co-elution of compounds sampled together with the target molecules. Furthermore, furfural was never detected in the samples. These compounds are therefore not included in Table 1.

Two samples contained acroleine and croton aldehyde, whereas benzaldehyde was present in 12 samples. Formaldehyde and acetaldehyde concentrations showed excellent agreement with those of a previous study carried out in Nancy [7/], and good agreement with literature values was observed for the other compounds (for example [START_REF] Viskari | Seasonal and Diurnal Variation in Formaldehyde and Acetaldehyde Concentrations along a Highway in Eastern Finland[END_REF][START_REF] Ullrich | Indoor Air Concentrations of Aldehydes -A Field Study using DNPH Diffusive Sampling[END_REF][START_REF] Reiss | Measurement of Organic Acids, Aldehydes, and Ketones in Residential Environments and Their Relation to Ozone[END_REF]. The samplers carried by the participants should give a true image of the average aldehyde concentrations to which the participants were exposed during the measurement campaign. A direct comparison of median values already reveals that personal sampler concentrations were much closer to those observed indoors than to outdoor concentrations. Evidently, indoor emission sources like furniture

The outdoor sum parameter Kj; of all background sites was taken to draw isoconcentration lines, using a geostatistical interpolation procedure (kriging). Figure 1 shows that the highest sum of aldehyde background concentrations during the first part of the study was found in the centre of Nancy, close to the fixed monitoring station. This is probably due to meteorological conditions and a local topography -Nancy is partially situated in a valley basin -hampering pollution dispersion, and to higher traffic volume in the town centre.

Several data sets characterising different environments (outdoors, offices, sleeping rooms), time intervals (first and second part of the measurement campaign) and activities (working indoors and outdoors) are available. Most of these data sets showed a non-Gaussian distribution and were therefore compared by means of a non-parametric Rank Sum test. Table 2 presents the probabilities p, where p<0.05 suggests a significant difference between two data sets. The comparison is based on the sum parameters K £ . The following observations can be made when comparing the different data sets: • Rather rainy weather during the first part of the study led to low aldehyde concentrations, which is due to an abatement of these water-soluble compounds. Dry and rather sunny weather resulted in significantly higher outdoor concentrations. • However, indoor concentrations (sleeping rooms and offices) are much higher than outdoor concentrations, even when using results originating from the second part of the study. This may be explained by the presence of numerous indoor emission sources, and the fact that indoor ventilation is often poor.

•

Concentrations obtained from personal samplers show a significant difference from those outdoors. The difference is not significant when compared to indoor concentrations.

Interestingly, and in contrast to what would be expected, the difference in concentration obtained with the personal samplers carried by volunteers working indoors and those working outdoors does not seem to be significant. It may be speculated that the volunteers working outdoors, i.e. garden staff, spend some time in the proximity of outdoor emission sources like lawnmowers etc. It should be kept in mind, though, that only small sampling groups are compared.

Tracer Compounds

Another possibility to reduce the high amount of data is to identify one or a few tracers, which may then be used to indicate the concentrations of all aldehydes. Several of the studied compounds were tested as potential tracer compounds. The best results were obtained when taking the sum of formaldehyde and acetaldehyde concentrations, as is depicted in Figure 2. When plotting the total concentrations Kj over the sum of concentrations of formaldehyde and acetaldehyde for all analysed samples, a good linear correlation with a correlation coefficient r=0.95 is observed:

K z -
Formaldehyde and acetaldehyde may be used together as tracers for the group of compounds studied. This result is important from a practical point of view, since these two compounds can be easily analysed.

Conclusions

This pilot study provides results that are in good agreement with existing literature data.

Higher indoor aldehyde concentrations and the fact that people spend up to 90% of their time indoors [START_REF] Maroni | Indoor Air Quality -A Comprehensive Reference Book[END_REF] lead to the conclusion that indoor environments will in many cases be much more important in terms of a chronic aldehyde exposure than outdoor environments.

By using the sum of measured aldehyde concentrations (in analogy with the TVOC concept), the discussion of large data sets, as are typically obtained when characterising many different environments and compounds, was considerably simplified. A further simplification consists in using the sum of formaldehyde and acetaldehyde concentrations, which are tracer compounds for the group of aldehydes studied.

Table 2 :

 2 Comparison of data sets using a rank sum test Data sets Outdoor background sites part I / Outdoors Part II Indoors (sleeping rooms and offices) part I / Outdoor background sites part I Indoors (sleeping rooms and offices) part I / Outdoors Part II Samplers carried by participants part I / Outdoor background sites part I Samplers carried by participants part I / Indoors (sleeping rooms and offices) part I Samplers carried by participants working indoors / Samplers carried by participants working outdoors P

Figure 2 :

 2 Figure 2: The sum of all aldehyde concentrations of all samplers plotted over the sum of formaldehyde and acetaldehyde concentrations

Table 1 :

 1 Median and maximum concentrations of different environments, time periods and activities

		Outdoors:	Outdoors:	Outdoors:
		background sites	Frequently	Part II
		parti	visited sites
				parti
	Compound	median (ug/m 3 )	maximum (ug/m 3 )	median (ug/m 3 )	maximum (ug/m 3 )	median (ug/m 3 )	maximum (Ug/m 3 )
	formaldehyde	1.19	1.91	1.91	2.55	6.09	11.17
	acetaldehyde	2.84	3.73	3.60	8.65	5.76	8.74
	acroleine	0.00	0.00	0.00	0.00	0.00	2.11
	benzaldehyde	0.00	0.00	0.00	0.09	0.00	0.00
	pentanal	0.64	2.04	0.42	2.11	0.84	2.50
	hexanal	0.74	1.59	0.77	1.20	1.60	2.40
	heptanal	2.63	7.92	2.45	9.47	3.76	13.89
	octanal	2.07	5.15	2.12	5.99	3.12	9.58
		Indoors:	Indoors:	Samplers carried by
		sleeping rooms	offices	participants
		parti	parti	parti
	Compound	median (ug/m 3 )	maximum (ug/m 3 )	median (ug/m 3 )	maximum (ug/m 3 )	median (ug/m 3 )	maximum (ug/m 3 )
	formaldehyde	14.34	127.26	14.33	24.16	13.53	38.04
	acetaldehyde	22.84	85.56	16.35	24.26	23.27	68.04
	acroleine	0.00	0.00	0.00	0.00	0.00	0.00
	benzaldehyde	0.00	9.04	0.00	2.57	0.00	6.74
	pentanal	4.04	16.77	2.26	8.26	3.07	12.46
	hexanal	20.64	91.66	12.00	25.03	14.83	59.73
	heptanal	12.00	33.43	8.41	10.89	10.49	25.96
	octanal	9.85	28.87	6.75	9.97	9.56	24.44

Acknowledgements

Thanks are due to J.-C. Pinard and S. Bourdet for their substantial contributions to the pilot study, and to D. Granier for the analytical work and for fruitful discussions.


INERIS

INSTITUT NATIONAL DE L'ENVIRONNEMENT INDUSTRIEL ET DES RISQUES

ROAD TRANSPORTATION OF DANGEROUS GOODS QUANTITATIVE RISK ASSESSMENT AND ROUTE COMPARISON WITH QRA MODEL

P. CASSINI and N. RODRIGUES Institut National de l'Environnement Industriel et des Risques Direction des Risques Accidentels B.P.2 F-60550 Verneuil-en-Halatte

Tel: 33 3 44 55 64 95 Fax: 33 3 44 55 65 92 email: philippe.cassini@ineris.fr Transportation of Dangerous Goods (TDG) by road creates risk for the people present on and along the routes (road users and surrounding population). To minimise them is it better to have TDG going through a city or on the contrary by a longer detour through less populated areas ? The choice is not always easy. It may become very difficult when the detour goes through tunnels. There, accidents may have developments and consequences very different from what might happen on an open air route. To make the right choice it becomes necessary to use a QRA (Quantitative Risk Assessment) approach dealing with the accident Scenarios likely to occur, their probability and possible consequences. It may be useful to identify the DG (Dangerous Goods) classes which contribute most to the risk and examine the interest of non-uniform strategies i.e. different routing for certain DG.

Studies for real sites

INERIS has determined the risks due to TDG for real sites where traffic could go either through a city or an alternative route including a tunnel. To perform these studies, INERIS has devised and used a method for determining curves of yearly frequency against number of fatalities corresponding to the risks due to TDG on each route. These curves are hereafter mentioned as " F/N curves ". This method is very flexible and may be used in very various configurations.

To practically use it, it is necessary to gather, during a first stage, data concerning :

• density of population in the concerned geographical area (possibility to take into account diurnal or seasonal variations), • traffic of all vehicles and foreseeable routes (possibility to take into account diurnal or seasonal variations), • traffic of DG : nature of contents and holders, global annual traffic, foreseeable evolutions, • meteorology in the concerned geographical area,

• layout of the open-air routes (which are divided in " segments " with constant probability of occurrence of each scenario), • if it applies, dispositions taken for the design and equipment of the tunnels.

A complete risks assessment due to the TDG would require the consideration of all the possible meteorological states, all the possible accidents with all the types of vehicles completely or partially loaded. A such assessment is totally impracticable and simplifications were introduced. The model developed and used by the INERIS is based on the exam of 10 scenarios (table 1) concerning a restricted number of dangerous goods.

Two scenarios relative to fires of Heavy Goods Vehicles (HGV) and not transporting goods were used because they represent a serious risk in tunnel and because their probability of occurrence is higher than that of scenarios involving dangerous goods.

Scenario

Nr:

Determination of the occurrence probabilities and effects

The For the open air routes, models exist to calculate the physical consequences of scenarios. The consideration of possibilities of evacuation and stake under cover, and the use of equation of probit (Equation which allows to deduct the physiological consequences, from the knowledge of the physical consequences of an accident), allow to calculate the percentage of deaths and/or injuries.

In tunnel, the techniques usable with the open air route do not apply in general. So a specific processing is necessary to determine: The zones of the tunnel which are affected, the effects which overflow of the tunnel and create risks outside.

A specific tool called the "Pre-conditioner" was developed for that purpose. Because of the complexity of the treated problems and the number of possible configurations of ventilation (longitudinal, semi-transverse or transverse, tunnels containing one or two pipes), it uses a simplified modelling.

The adoption of measurements appropriate to tunnels (concerning the traffic, the drainage of flammable liquids, the capacities for the construction of the tunnel, the surveillance...) can reduce the frequency of the accidents, their gravity, the delays of detection. Some of these measures are taken into account in the Pre-conditioner and the QRA. It is so possible to investigate their influence on curves F/N.

Theses studies are very complex. It is therefore impossible to avoid simplifications. The first one being that risk level is evaluated by examination of only a limited number of scenarios corresponding to a very small number of DG. In the same way, collection and prevision of site data are sometimes roughly performed. It is for example difficult to predict 10 or 15 years in advance what will be global traffic, DG traffic and seasonal changes in surrounding population densities.

Minimising risk between several alternative routes

In case where DG may be transported by different routes, the method enables to determine the risk that would result from TDG for each route if it were the only one chosen for the DG traffic (DG traffic forbidden on the other routes). Interpretation of results relies on comparing the various F/N curves pertaining to the routes or on comparing the various associated " mathematical hopes " (Each F/N curve gives a mathematical hope which represents the area located under the F/N curve. It indicates the yearly number of fatalities when the accidents of every severity are summed up and is expressed in fatalities per year).

This comparison leads to a certain conclusion in the case of F/N curves that do not intersect (as shown on figure F1).

It is also possible to get intersecting curves, but with significantly different mathematical hopes (as shown on figure F2), and this even when uncertainties are taken into account.

Once more, a conclusion is at hand. When F/N curves intersect and lead to close mathematical hopes, the method does not help in the decision process except give indication that the comparison of risks linked with DG is not discriminating and decision might be made on other criteria.

Judging of the acceptability of risk on a route.

It is possible to judge of the acceptability of the risks due to TDG on a route by comparing the F/N curve with acceptance criteria in case such criteria are available and accepted (Figure 3 shows a fictitious use of such criteria).

Societal risk may also be judged on a local basis using iso-contours like those appearing in Figure 4 . These contours indicate for each area the statistical probability level to get fatalities. These probabilities take into account the population densities and their eventual daily and seasonal variations.

It is also possible to compare individual risk for the surrounding populations with individual risk acceptance criteria.

Conclusion

QRA of risks due to TDG helps in decision making when routes have to be chosen for DG transit and one wants to minimise resulting risks. It also enables to situate the risks due to TDG against other kind of risks (fatalities due to banal traffic accidents i.e. no DG involved for example). It requires complex studies. A method and practical tools have been produced and used for real site cases.

Nevertheless, further work has still to be carried out in order to make these evaluations easier, more accurate and indicate the magnitude of the uncertainties.

Finally, the transportation of dangerous goods can be made by different ways of transportation (railway, road...). The current researches of the INERIS, aims to develop an assessment risk model due to the transportation of dangerous goods by the railway and to create an interface common with the "road tool" and with the "railway tool" to improve the user interface and connect these two " road " and " railway " tools. The objective is to allow calculation of risk on a route, independently of the environment (tunnel or open area), and independently way of transporting (railway, road or combined road-rail transport).

List of figures :

  Organisation for Economic and Co-operation Development (OCED) and the World Association of the Road (PIARC) launched a common research program concerning the Transport of Dangerous Goods (TGD) in road tunnel. The objectives of this program are the settling of a quantitative risks assessment model (QRA model).

Figure

  Figure F1 Example of non intersecting F/N curves.

Figure

  Figure F2 Example of intersecting F/N curves with different mathematical hopes.

Figure 3

 3 Figure 3 Example of comparison of a F/N curve with an acceptance criterion.

Figure 4

 4 Figure 4 Iso-contours of societal risk due to dangerous goods traffic on an open air route (taking into account the population layout).

Fig

  Fig F1 -Example of non intersecting F/N curves

Table 1 : Main characteristics of the 10 selected scenarios

 1

		Description	Capacity	Size of	Mass flow
			of tank	breach (mm)	rate (kg/s)
	1	HGV fire 20 MW	-	-
	2	HGV fire 100 MW	-	-
	3	BLEVE of LPG in cylinder	50 kg	-
	4	Motor spirit pool fire	28 tonnes	100	20.6
	5	VCE of motor spirit	28 tonnes	100	20.6
	6	Chlorine release	20 tonnes	50	45
	7	BLEVE of LPG in bulk	18 tonnes	-
	8	VCE of LPG in bulk	18 tonnes	50	36
	9	Torch fire of LPG in bulk	18 tonnes	50	36
	10	Ammonia release	20 tonnes	50	36