Jean Poulleau
email: iean.poulleau@ineris.fr

Cécile Raventos
email: cecile.raventos@ineris.fr

Catherine Yardin
email: catherine.vardin@lne.fr

Jacques Lachenal
email: jacques.lachenal@lne.fr

Cécile Raventos Ineris

Jacques Lachenal Lne

Uncertainty attached to the results of a calibrated AMS

est destinée au dépôt

Résumé

L'étalonnage d'une méthode par comparaison avec la méthode de référence est souvent employé en métrologie. Si la méthode de référence est censée donner la valeur vraie du mesurande par convention, l'incertitude attachée aux résultats peut être plutôt élevée. Cet inconvénient peut être surmonté aisément en effectuant plusieurs mesurages successifs dans le cas où les sources d'incertitude influençant le résultat du mesurage contribuent aléatoirement à l'incertitude globale de la méthode. L'incertitude attachée à la valeur moyenne sera ainsi égale à celle d'une mesure simple divisée par un facteur 1/Vn; Cependant, si la méthode de référence n'est pas suffisamment bien définie ou les facteurs d'influence mal connus, la mise en oeuvre de la méthode peut mener à des écarts systématiques de mesurage entre laboratoires. Ainsi les essais de validation de plusieurs méthodes de référence manuelles par les groupes de travail du CEN ont conduit à des incertitudes de reproductibilité plus élevées qu'escomptées : 20% pour la méthode manuelle pour la détermination du SO 2 (en 14791). La question suivante se pose alors : l'usage de telles méthodes pour étalonner les AMS et vérifier si leur variabilité est acceptable selon les exigences de l'EN 14181, est-il pertinent? Les directives 2001/80/CEE et 2000/76/CEE fixent une incertitude maximum de 20% et 30% à la valeur limite pour la mesure par un AMS du SO 2 et des poussières respectivement... La présentation montre comment calculer l'incertitude attachée aux résultats d'un AMS étalonné sur la gamme de mesure et comment l'incertitude de la méthode de référence affecte la qualité du QAL2 et par voie de conséquence quelle pourrait être la limite acceptable d'incertitude pour la SRM.

Introduction

EN 14181, based on ISO 11095 requires using Standard Référence Methods (SRMs) to calibrate Automated Measuring Systems (AMS). To be relevant and effective, QAL2 should be carried out according to thé following conditions:

• Use a spread of data over thé whole range of thé AMS.

• The AMS repeatability is noticeably lower than thé SRM's.

Thèse two conditions are not always fulfilled: • It is difficult for an industrial process to operate in a way that provides very différent levels of concentrations; moreover a voluntary big dépréciation of thé quality of thé characteristics of thé exhaust gases is undesirable.

-General model of régression function

We start with thé common model :

where :

x ( is thé /" resuit of thé explanatory variable ; / = 1 to n ; n > 15 ; y t is thé /" resuit of thé variable to be explained ; / = 1 to n ; n £ 15 ; s i is thé déviation between y. and thé expected value; its mean value is zéro and standard déviation cr a is thé intercept of thé calibration function ; b is thé slope of thé calibration function.

This model rests in particular on thé following assumptions:

• assumption 1: x is a variable known without uncertainty • assumption 2: thé values y-, hâve thé same uncertainty on thé whole range and are not correlated,

u(y) = o et u(y r y j )=O

The estimate of this model with n couples of points (x t ,y) resulted in calculating thé 3 following parameters: a , b and s (estimate of a).

The most thé model fits thé points, thé lower s is :

An individual estimate of y for x Q with this model is :

y Q = à + b-x Q + ê Q
where ê Q equals zéro but contributes to thé uncertainty of y An average estimate of y for x Q with this model is :

y 0 = a + b-x 0
And its uncertainty is :

« CP 0 ) = u (fl + b-x o ) 2 / *. \ ". 2 / * = u («) + u ( b )' x 0
or in a more explicit way :

u 1 (y O n yç / -x 2 /=1 (x -x) "(i 5 n) = S • \ -+ " S S
where :

n-2 2 -Calibration model of thé AMS

EN 14181 uses thé model presented in thé previous paragraph: y is thé value of thé SRM, reported in thé conditions of thé AMS, x is thé value given by thé AMS, y is thé calibrated value of thé AMS. This calibrated value corresponds to an average estimate.

The results x given by thé AMS, as well as thé true values y given by thé SRM are both associated to an uncertainty. This uncertainty is made up with 2 components:

• an uncertainty resulting from random errors (lack of précision); this component can be estimated by thé repeatability standard déviation of thé method. • an uncertainty resulting from systematic errors (lack of trueness); this component is can be estimated by thé inter-laboratory standard déviation of thé method.

• We hâve to notice that, except for thé lowest part of thé range of concentrations, uncertainty is approximately proportional to thé resuit of measurement.

In thé context of stack measurements, thé requirements corresponding to thé assumptions of thé général linear model, are not often fulfilled.

This situation leads us to two important conclusions:

• thé method to be recommended to estimate thé model is not necessarily thé Ordinary Least Squares • nevertheless, if thé Ordinary Least Squares are used, it is necessary to add to thé uncertainty of thé model thé part of uncertainty of y not taken into account by thé model.

We will initially leave aside thé issue of improvement of thé method of estimation; one finds in thé statistical literature several methods (see annex) and two of them hâve been tested in this study :

• Ordinary Least Square (OLS)

• Weighted Régression Line (WRL).

Let us suppose first that we follow this second method (Ordinary Least Square). We are interested in thé propagation of thèse uncertainties to thé estimate.

• thé uncertaintv due to a lack of trueness of thé AMS. should be negligible because QAL2 consists of improving thé trueness of thé AMS via its calibration with thé SRM. Thus, this contribution to thé uncertainty is taken into account in thé uncertainty corresponding to thé trueness of thé SRM propagated with thé modelled value of thé AMS. • thé uncertaintv due to a lack of précision of thé AMS influences uncertainty s resulting from thé model.

Lastly, it is necessary to analyse thé uncertainty of thé SRM-variable y of thé model.

-Uncertaintv of thé SRM

As we said formerly, thé uncertainty of thé SRM includes 2 components: • • a component resulting from random errors estimated by u(SRM -repeatability)-• a component resulting from systematic errors estimated by u(SRM -interlab).

In thé model, thé uncertainty of thé SRM is represented by thé term s and its standard déviation a. Its estimate s arises from thé combined effects of :

• thé précision of thé results of thé SRM,

• thé précision of thé results of thé AMS,

• and how thé régression line fit to thé points.

The variation of SRM and AMS can be estimated by their repeatability, known from laboratory or field tests. This knowledge can be considered to be more robust than what is supposed to be obtained by thé model and achieved during thé QAL2 process (thé number of parallel measurement is limited). Therefore, in order to estimate thé combined uncertainty due to thé lack of fit of thé régression line and variations of results of thé SRM and AMS we will use thé term s* defined by : s = max s ; Js 2 (AMSorepeatability)+s 2 (SRMorepeatability)

1 p -= 1 = --• Y'0 > -;F) 2 --• u p-l M * 2 (SRMo repeatability) with : u 2 (SRM o repeatability) = 2/7 /=

-Uncertainty of thé calibrated AMS

The uncertainty u(y )attached to thé estimate y = à + b-x can be calculated from:

, 2 /*, W (y) = U (à) + U (b)XX + 2X Q Xu(â,b) + U (SRMo interlab)
or:

s -

(x -x) 2 O i=n T:\2 + U (SRM o int erlab) s V i=n V L -2 O (x^-x) J + U 2 (SRM o int erlab)
Thé expanded uncertainty attached to a resuit given by thé calibrated AMS is then :

U(y ) = 2x
Other sources of uncertainties t/(j) ) corresponds to thé variance on thé estimate y not yet expressed in standardised conditions (p, T, H 2 O, O 2 réf.). To be compared to thé limit value of uncertainty given by thé Directives, corrections of p, T, H 2 O, O 2r éf. must be done. The effect of corrections due to pressure and température is Iow and more significant for H 2 O (see annex B). Last but not thé least: O 2 corrections may increase greatly thé uncertainty attached to thé results given by thé calibrated AMS, especially when thé O 2 concentration is higherthan 11%. In thé example given in annex B, thé uncertainty increases:

• by 45% when thé O 2 concentration increases from 11 to 15%

• and by 117% when thé O 2 concentration increases from 11 to 17%.

--Results

In thé following examples we suppose that we are in favourable conditions:

• no correction from wet to dry conditions (thé SRM and AMS for SO 2 are supposed to give both results on a dry basis) • and O 2 concentrations very close to 11 %.

Dust

The first example is a QAL2 performed on an opacimeter measuring dust.

The use of thé weighted régression line model leads to a équation that is very similar to that given by Ordinary Least Square (OLS) :

• Y OLS = 0,903 x + 0,936 Thé non-parametric method (Theil' method) is not efficient enough to fit thé data.

• Y WR L = 0,
But what about thé other two models?

The weighted régression line WRL gives a lower value of s : SOLS = 1 ,6 mg/m 3 and SWRL = 1,2 mg/m 3 .

From EN 13284-1 we can draw thé following information at thé average concentration of 8,5 mg/m 3 and at ELV for thé SRM:

• u{SRMorepeatability) = 9,3 % and 4,2%, respectively,

• u(SRM o int erlab) = 13,3 % and 7,2%.

The excel file gives us an expanded uncertainty U(y) = 33 % at thé average concentration of 8,5 mg/m 3 .

At ELV, U(y) = 15,2%. => We fulfil thé requirement of thé Directive (U<30%).

We see in thé table that thé main contribution to thé expanded uncertainty cornes from thé effect of u{SRM o int erlab) , that is to say thé effect of laboratory.

With this example, we can study thé effect of uÇSRMorepeatability) and u(SRM ° int erlab) :

If u(SRMorepeatability) decreases from 9,3 to 4% then U(y) stays at 33 %. This is due to thé fact that thé estimate s already includes thé repeatability of thé SRM.

If u(SRM o int erlab) decreases from 13,3% to 6% then U(y) decreases from 33 % to 22,9 %. The second example is a QAL2 performed on a SO 2 NDIR analyser.

The use of thé weighted régression line leads to a équation slightiy différent from that given by Ordinary Least Square (OLS) : From EN 14791, we can draw thé foilowing information at thé average concentration of 14,4 mg/m 2 and at thé ELV for thé SRM:

• u(SRM o repeatability) =9,6 % and 6,4 % respectively,

• u(SRM o int erlab) = 12,8 % and 6,5%. -23,64 -57,74 -91,63 -68,02 -58,18 -3,14 -23,40 -58,03 -77,43 -53,76 -112,31 -14

AMS pass thé variability test

This resuit is not consistent with thé estimate of thé uncertainty at thé ELV that shows that we do not fulfil thé Directive requirement.

If we consider thé same variability test calculated with relative values, which is more relevant, because we give thé same weight to ail thé values, then thé test fails.

-Conclusion

This présentation proposes a rather comprehensive procédure to calculate thé actual uncertainty of thé calibrated AMS at thé ELV. This procédure could be a more suitable way than thé variability test to conclude on thé conformity of an AMS at thé ELV which does not give thé actual uncertainty in thé studied range and at ELV.

In thé few examples that we hâve submitted in this position paper we had thé possibiiity to vary thé concentrations on thé full range. In this propitious configuration we found that :

The resuit of uncertainty of a calibrated AMS shows that thé conclusion of thé QAL2 test dépends on thé quality of thé référence methods. A Référence method with a bad repeatability induces a rather high uncertainty s resulting from thé model. Moreover, thé variability test of thé EN 14181 does not take into account thé uncertainty coming from thé lack of trueness of thé SRM : u(SRM oint erlab), thé contribution of which should be included in a comprehensive calculation of thé uncertainty of thé calibrated AMS. Unfortunately, u(SRM oint erlab) is not always low and may create difficultés when thé laboratory performing AST is not thé same one as for QAL2. Thus thé example given with thé manual référence SO 2 method leads to thé rejection of thé AMS because of a too high uncertainty.

The variability test proposed by EN 14181 is not relevant and leads to an opposite conclusion.

O 2 corrections may increase greatly thé uncertainty attached to thé results given by thé calibrated AMS, especially when thé O 2 concentration is higher than 11%. In thèse cases thé objective of thé Directives cannot be fulfilled.

a Weighed Régression Line is more appropriate and gives a better estimate of thé true value than thé Ordinary Least Square.

INERIS-DRC-06-75779-AIRE-0059-JPO An example of calculation of uncertainty associated with measurement of a pollutant after conversion to a référence concentration of oxygen is given hereafter. For a concentration given at actual oxygen concentration, and knowing uncertainties of measurement of thé pollutant and thé oxygen concentration, we hâve calculated thé uncertainty associated with thé concentration corrected at thé référence concentration of oxygen for various oxygen concentrations measured in thé stack. The table shows that final uncertainty increases with thé oxygen concentration in thé stack, this independently of respective uncertainties of pollutant and oxygen measurements.

Uncertainty associated with thé concentration expressed on dry basis dépends on: uncertainty of thé measurement concentration of water vapour in thé stack and uncertainty associated with thé resuit of thé measurement An example of calculation of uncertainty associated with a measurement after conversion to dry basis is given hereafter. For a given concentration measured on wet basis, and knowing uncertainties of measurement of thé pollutant and water vapour, we calculate thé uncertainty associated with thé concentration corrected on dry basis for various water vapour contents measured in thé stack. The table shows that final uncertainty increases with thé water vapour content of gases, independently of thé uncertainties of measurement of thé pollutant and of water vapour. u\H2O mes ) (l00-H2O mes ) 2

•

  • Repeatability of thé AMS is often equal or lower than thé repeatability of thé SRM.Another problem occurs with thé régression model. How this model takes into account or not thé lack of précision or trueness of thé SRM.? Actually, non-automatic SRM are often characterised by rather high values of repeatability and reproducibility standard déviations (s r and s R ) : HCI, Hg, SO 2 , H 2 O...For SO 2l thé 95% confidence interval of repeatability and reproducibility for a single measurement are very close to thé maximum level of uncertainty required by thé Directives for thé AMS at thé ELV. This means that on one hand thé resuit obtained by one laboratory that has a bad repeatability may lead to reject wrongly an AMS during thé variability test. On thé second hand a bad reproducibility, due to a rather high interlaboratory standard déviation s

	measuring range
	and how thé uncertainty of thé référence method affects thé quality of thé QAL2 and consequently
	what is thé maximum acceptable uncertainty for thé SRM.

L may lead to différent calibration functions depending on whether one laboratory or another carries out thé QAL2. Furthermore, if thé team who performs QAL2 is not thé same as for AST, thé surveillance test may lead to invalidate thé previous QAL 2 calibration function. Moreover, thé expérience of INERIS in thé organisation of inter-laboratory campaigns shows that thé actual reproducibility standard déviation obtained by accredited laboratories can vary from 1 to 3 times those reached by référence laboratories during thé validation of thé standard... The following question then arises: is it still relevant to use such methods to calibrate AMS and to check if their variability is acceptable, as required by thé EN 14181? The following pages shows how to calculate thé uncertainty attached to thé results of a calibrated AMS on thé whole

  Furthermore, because s is not constant in ail thé range of concentrations studied, it is more appropriate to use repeatabilities known from field tests when we want to estimate thé uncertainty at a concentration that is outside thé range studied during thé calibration. It is thé case when we want to estimate thé uncertainty at thé ELV, when this value doesn't belong to thé studied range.

In that case, thé uncertainty of thé calibrated AMS can be estimated by a combination of u(SRM o repeatability) , u(AMS o repeatability) and u(SRM o trueness) added in a quadratic way. u(SRM o trueness) can be estimated by u(SRM ° int erlab) whose expression is given in ISO 5725-2 : u 2 (SRM o int erlab)

  The excel file gives an expanded uncertainty U(y) = 48,8 % at thé average concentration of 14,4In this example we hâve rather high différences between thé estimâtes at standard conditions j)?>and yt,R,s (see table below) : thé average of relative différence is 45 % for thé OLS Model and 28 % for thé WRL model! Our conclusion is that in this example WRL improves significantly thé estimate.

	mg/m 3 .	s D			1,574
	At ELV : U(y) = 23,6 %. => we do not fulfil thé requirement of thé Directive (20%). The main part of (J 9,184
	thé uncertainty cornes from thé OLS model.
			kv			0,9761		at x aver	atELV
					u(SRM repeatabilîty)		9,6%		6,4%
		1,574		u(SRM interlab) <		12,8% 8,964	|	6,5%
	s' 2 A M S pass thé variability test	8,994	24,166
					u 2 (AMS° repeat.)		0,005	1,440
	6.2 SO 2			u 2 (lab) u 2 total			3,416 12,410	10,563 34,729
						u(AMS)			3,52		5,89	mg/m 3
						u(AMS) %		24,4		11,8	%
						U(AMS)			7,05	11,79	mg/m 3
					U(AMS) %		48,8		23,6	%
	6 -Variability test
	6.1 Dust
	Variability	test
		/			y	t.*	y		t..	SRM VlR,s	Différence Di	Différence Di	Différence Di	Différence Di
						OLS		WRL	mg/m d	abs	rel,	abs	rel.
		1			5,27		4,65	3,76		-1,51	-40,16	-0,89
		2				4,15		3,48	2,21		-1,94	-88,18	-1,27
		3				4,79		4,08	2,13		-2,66	-124,93	-1,95
	Vanability 4	test	5,27		4,48	2,67		-2,61	-97,82	-1,81
	/	5 6			/V y	t.s 4,36 4,59	/V y	3,68 t.* 3,89	SRM 2,33 Yi,R,s 3,77	Différence -2,03 Di -0,82	Différence -87,18 Di -21,81	Différence -1,35 Di -0,12	Différence Di
	1 2 10 7 8 9		OLS 1,40 6,76 5,89 4,82 4,73 4,89	WRL 1,38 6,71 5,26 4,09 4,02 4,22	mg/nï* 1,07 6,41 4,26 2,59 2,27 2,74		abs -0,33 -0,35 -1,63 -2,23 -2,46 -2,15	rel. -31,24 -5,47 -38,23 -86,17 -108,51 -78,35	abs -0,31 -0,31 -1,00 -1,50 -1,76 -1,48	rel. -28,91 -4,78
	3 11		8,94 5,69		8,89 4,90	8,25 2,31		-0,69 -3,38	-8,35 -146,39	-0,64 -2,59	-7,72
	4 5 6 7 8 9 10 11 12 13 12 13 14 15 16 17 18 average standard déviation 6,98 10,36 1,36 10,91 7,92 6,45 14,24 12,85 15,30 2,67 6,37 5,70 3,99 19,16 27,66 58,14 71,93	6,93 10,31 1,34 10,85 7,87 6,41 14,17 12,79 15,22 2,64 5,79 5,08 3,36 19,14 27,99 59,82 74,34	5,39 11,86 2,52 10,49 8,93 8,76 18,24 12,41 13,36 2,18 5,06 9,67 9,73 24,62 34,44 52,21 67,88		-1,59 1,50 1,16 -0,42 1,01 2,31 4,00 -0,44 -1,94 -0,49 -1,31 3,97 5,74 5,46 6,78 -5,94 -4,04 -0,71 3,62	-29,41 12,63 46,05 -4,01 11,31 26,40 21,93 -3,55 -14,49 -22,71 -26,01 41,03 58,99 22,18 19,69 -11,37 -5,96 -45,51 OLS 59,64	-1,54 1,55 1,19 -0,36 1,06 2,35 4,07 -0,38 -1,86 -0,47 -0,74 4,60 6,38 5,48 6,44 -7,61 -6,46 -0,42 3,89	-28,59 13,10 47,01 -3,46 11,85 26,88 22,31 -3,03 -21,42 : -13,93
	14			8,02	7,97		6,76		-1,26	-18,66	-1,21	-17,96
	15			4,79	4,75		4,86		0,08	1,59	0,11	2,31
	average										0,17	-1,20	0,22	-0,42
	standard déviation							1,57	21,73	1,58	21,51
												OLS	WRL

OLS and WRL give similar calibration functions and relative différence between thé estimâtes at standard conditions yt,s and yt,R,s is slightly better for thé WRL (see table below) : thé average of relative différence is 1,20 % for thé OLS Model and 0,42 % for thé WRL model. Our conclusion is that in this example OLS Model improve slightly thé estimate.

Thé variability test performed on absolute values gives a positive resuit (SD < k v cr ). The same test performed on thé standard déviation calculated on thé population of thé relative values also gives a positive resuit.

Table 1 :

 1 Example of uncertainty values associated to thé concentration of pollutant after conversion at a référence concentration of oxygen.

	Concentration of pollutant C	200	mg/m at actual O 2 concentration
	type-uncertainty at actual O 2 réel u(C)	4.7	% of thé concentration
	type-uncertainty of O 2 measurement	2.5	% relative
	O 2 ref		11	% volume
	O 2mes	C1at11%0 2	u(C1)	u(C1)
		mg/m3	mg/m3	% relative
	% volume	calculation with O 2mes
	5	124,53	5,93	4,77
	6	132,89	6,39	4,81
	7	142,45	6,93	4,87
	8	153,49	7,60	4,95
	9	166,39	8,43	5,07
	10	181,65	9,50	5,23
	11	200,00	10,92	5,46
	12	222,47	12,87	5,78
	13	250,63	15,65	6,25
	14	286,96	19,84	6
	15	335,59	26,53
	16	404,08	38,06
	17	507,69	60,25
	18	682,76	110,70
	19	1042,11	265,09
	20	2200,00	1226,59

,92 7,90 9,42 11,87 16,21 25,44 55,75 • Case of thé conversion of thé concentration of thé pollutant on dry gas

		• 'hum	is thé concentration measured in stack given on wet basis
		H 2 O meas is thé water vapour concentration measured in stack
	The derivative of thé équation (7) leads to :
			dC dry dC hum			dC dry	»	(H 2 O meas )	(8)
			dC dry ÔC huml		100		(9)
			ec dry	100xC hum (100 -H 2 O meas y	(10)
	Equation (8) is équivalent to équations (11) or (12) :
	2,^	^ (	100 l00-H 2 O meas	)\ 2 ,s,	x	\H 2 O meas )
					u 2 (H 2 O meas )
	u 2 (C dfy ) = 'dry	cL	(ioo-# 2 o meas )
	Conversion to dry gas of a concentration measured on wet gas is calculated as follows:
	c dry =c	100 hum 100 -H 2 O meas			(7)
	where
			is thé concentration given on dry basis

Table 2 :

 2 Example of uncertainty values associated to thé concentration of pollutant after conversion on dry basis

	Concentration of pollutant C			150	mg/m on wet basis
	type-uncertainty of thé concentration of thé pollutant u(C) on wet basis 4 7	% of thé measured value
	type-uncertainty associated water vapour measurement u(H2O)	10	% of thé measured value
	Water vapour	C1	u(C1)	u(C1)
	% volume	mg/m 3	mg/m 3	% relative
		calculation with
	H 2 O mes	H 2 O
	1	151,52	7,12	4,70
	2	153,06	7,20	4,70
	3	154,64	7,28	4,71
	4	156,25	7,37	4,72
	5	157,89	7,47	4,73
	6	159,57	7,57	4,74
	7	161,29	7,68	4,76
	8	163,04	7,79	4,78
	9	164,84	7,92	4,80
	10	166,67	8,05	4,83
	11	168,54	8,19	4,86
	12	170,45	8,34	4,89
	13	172,41	8,50	4,93
	14	174,42	8,68	4,97
	15	176,47	8,86	5,02
	16	178,57	9,06	5,07
	17	180,72	9,27	5,13
	18	182,93	9,49	5,19
	19	185,19	9,73	5,25
	20	187,50	9,98	5,32
	21	189,87	10,25	5,40
	22	192,31	10,54	5,48
	23	194,81	10,85	5,57
	24	197,37	11,18	5,66
	25	200,00	11,52	5,76
	26	202,70	11,89	5,87
	27	205,48	12,29	5,98
	28	208,33	12,71	6,10
	29	211,27	13,16	6,23
	30	214,29	13,63	6,36
	31	217,39	14,13	6,50
	32	220,59	14,67	6,65
	33	223,88	15,24	6,81
	34	227,27	15,85	6,97
	35	230,77	16,49	7,15
	Cl = Cx

Annex A : régression methods

Non-parametrîc régression methods

Of thé non-parametric methods available, perhaps thé simplest is Theil's incomplète method. Theil's incomplète method détermines thé slope of a régression line as thé médian of thé slopes calculated from selected pairs of points: thé intercept of thé line is thé médian of thé intercept values calculated from thé slope and thé co-ordinates of thé individual points. The Theil's method has three distinct advantaqes: it does not assume that ail thé errors are onlv in thé y direction 0-e uncertaintv on x is possible) and either thé x or y direction errors are normallv distributed: and it is not affected by thé présence of outlvinq results.

The method assumes that a séries of points (x^y^ ,(x v y^, etc. is fitted by a line of thé form y = a + b-x. The first step in thé calculation involves ranking thé points in order of increasing x. If thé number of points, x, is odd, thé middle point, i.e. thé médian value of x, is deleted: thé calculation always requires an even number of points. For any pair of points (x r y) , (x .,y.), where x. > x ; ., thé slope, b., of thé line joining thé points can be calculated from : b r -----.

Slopes b., are calculated for thé pair of points (x^y,) and thé point immediately after thé médian xvalue, for (x 2 ,,y 2 )and thé second point after thé médian x-value, and so on until thé slope is calculated for thé line joining thé point immediately before thé médian x with thé last point. Thus, if thé original data contained II points, five slopes would be estimated (thé médian point having been omitted). For eight original points there would be four slope estimâtes, and so on. Thèse slope estimâtes are arranged in ascending order and their médian is thé estimated slope of thé straight line.

With this value of b, values at for thé intercept are estimated for each point with thé aid of thé équation y = a + b-x. Again thé estimâtes of a are arranged in ascending order and thé médian value is chosen as thé best estimate of thé intercept of thé line. The method is illustrated in thé example and lead to a non satisfactory régression function (underestimation for low values and overestimation for high values).

Weighed régression Method

Weiqhed régression method (WRM) is commonlv used when thé uncertainties of methods are not constant on thé whole range of concentrations.

The régression line must be calculated to give additionai weight to those points where thé uncertainty is smallest : it is more important for thé calculated line to be close to such points than to be close to thé points representing higher concentrations with thé largest uncertainties. This resuit is achieved by giving each point a weighing inversely proportional to thé corresponding variance , s .

Case of thé conversion of thé concentration of thé pollutant to a référence concentration of oxygen

The conversion of a concentration given at actual conditions of oxygen, to a référence oxygen concentration is calculated as follows: (5)

Uncertainty associated with thé concentration of thé pollutant brought back to a référence concentration of oxygen dépends on : uncertainty of thé measurement of thé pollutant thé concentration of oxygen in thé stack and of uncertainty associated with oxygen measurement


Emmanuel Fiani
email: emmanuel.fiani@ademe.fr

Rémi Perret

Claude Ferrieres

IS THE SRM FOR PCDD/F APPROPRIATE FOR PCB MEASUREMENTS

A previous work carried out between 2000 and 2002 has shown that thé use of an XAD 2 sorbent in thé case of PCB sampling tends to under-estimate PCB concentrations, specially when PCB concentrations are low (< 100 u.g/m3). The objective of this new study was to compare PCBs sampling efficiencies for several methods, at lower concentrations. First, this study consisted in thé comparison of 3 sampling methods: washing bottles filled with heptane, adsorption on XAD 2 (such as used for PCDD/F samplings according to EN 1948) and adsorption on polyurethane foam (PUF). Results hâve shown that washing bottles filled with heptane are far more efficient than XAD 2 or PUF adsorbtion. In addition, thé second objective of thé study was to optimize thé washing bottles method by comparing several solvents (isooctane, hexane and heptane) and by working at two différent températures (0°C and -20 °C).

Introduction

The toxicity of PCB compounds tends to be assimilated as thé PCDD/F ones: thé World Health Organization has proposed toxicity équivalence factors (TEF) for coplanar PCBs (or dioxin-like PCBs), with regard to thé 2-3-7-8 TCDD référence. In addition, thé European 2002/69/CE directive concerning PCB sampling in food sets a TEF value for 12 PCBs. Thèse TEFs are in thé range 0.0001-0.1 and some current official studies show clearly that thé ratio of PCB in thé TEQ value measured in food or feed tends to increase. Thus, thé need for measuring PCB concentrations emitted from industrial sources may be a matter of concern soon.

However, there are not any EU standard related to PCB measurements and EN 1948 (dioxins) standard is commonly used to measure PCB concentrations.

Still, a former work carried out by INERIS with an ADEME grant between 2000 and 2002 has

shown that thé use of an XAD 2 sorbent in thé case of PCB sampling tends to underestimate PCB concentrations, specially when PCB concentrations are low (< 100 |jg/m3). [FERRIERES, 2002].

Thèse unexpected preliminary results has led to a new study aiming at :

• For lower concentrations (between 100 ng/m3 and 40 ug/m3), comparing efficiencies between several sampling methods : XAD 2, PUF and washing bottles. • Enhancing thé washing bottle method efficiency by studying several solvents and several températures

Experiments were achieved at thé INERIS test bench which features: « Waste gas from a fuel boiter (50 kW), heated at 150°C • PCB introduced in thé gas by spraying (pyralene oil diluted in heptane) « Simultaneous sampling with thé three sampling lines

The 18 following PCBs hâve been studied and analyzed: 77-81-126-169, 105-114-118-123-156-157-167-189, 28-52-101-138-153, 180.

Comparison between several sampling methods

The XAD 2 and PUF adsorbents are used as described in thé EN 1948-1 method.

The heptane washing bottle method consists in two 500 ml washing bottles containing 250 ml of heptane. The solvent évaporation is limited by a cooling device. A cold trap is then added (-70 °C).

Results are shown on thé following figure. From this figure, it is clear that thé washing bottles are far more efficient than thé two solid adsorbents, even for Iight PCBs. The efficiency of washing bottles with hexane is 10 times higher than thé PUF one and 20 times higher than thé XAD 2 one.

Another set of experiments was carried out by using, for each of thé 3 methods, two sampling devices with two cold traps. In thé case of thé XAD 2 method for instance, thé experiment device is described in thé following figure.

Gas cooler (ice water)

XAD2 cartridge

Two cofd traps in série (-78 °C)

The resuits then obtained are summarized in thé next figure. By using two sampling devices and two cold traps together, resutts are very similar for each of thé 3 methods and for each of thé 18 PCBs, The only exception being thé lighter tri PCB where thé concentration obtained by thé washing botîle method is twice thé values obtained by thé 2 other methods.

As shown in next table, thé analysis of each part of thé whole sampling device shows strong différences between iighter (tri and tetra) and heavier (hexa and hepta) PCBs. A very poor efficiency is observed in thé case of light PCB with solid adsorbents (PUF and XAD2) and more than 70% is collected in thé cold traps. Moreover, thé XAD2 efficiency is very low for a large majority of PCBs (up to thé hexa category).

Tri

Optimization of thé washing botties method

Three différent solvents were studied, each one having a différent solubility towards PCBs: heptane, hexane and iso-octane. Experiments were carried out at two différent températures: 0°C and -20 °C. The sampling line was composed by a condensate flask, then 2 washing bottles, then 2 cold traps (-70 °C).

Results showed that sampling efficiencies for thé 3 solvents at -20 °C were very poor, for each PCB: thé mean value for iso-octane and hexane efficiencies was only 45% in thé condensate and bottles part.

At 0°C, efficiencies are quite similar for every solvent. Iso-octane is more efficient than hexane and heptane is clearly less efficient (see Thus, between 29% and 45% were collected in thé cold traps. However, it was not easy to validate thé quantitative efficiency of thèse as thé quantity of PCB contained in thé second cold trap was usually higher than thé one in thé first one.

Conclusion

The results of this work confirm those obtained in thé 2000-02 preliminary study, namely that thé EN 1948 standard is not suitable for heavy and light PCB measurements. In particular, using XAD 2 sorbents leads to a strong under-estimation of PCB concentrations.

Best results were obtained by using washing bottles containing iso-octane or hexane at 0°C and a cold trap (-70 °C).

However this method is quite difficult to implant in real operating conditions on an industrial plant and, for cold traps, thé quantitative efficiency needs to be proven more deeply.

Hence, some further work seems necessary in order to increase thé efficiency of cold traps, to study other solvents or to investigate some new solid adsorbents.

Références

  table below). Efficiencies were slightly lower for light PCBs.

	Solvent	PCB sampling efficîency (%) at 0°C
		Condensate and bottles part
		Mean value	Min	Max
	Iso-octane	71	68	74
	Hexane	65	63	68
	Heptane	55	48	64

  FERRIERES Claude, INERIS, Evaluation for several PCB sampling methods for industrial stack measurements, January 2002, ADEME grant n°9974264.

FERRIERES Claude, INERIS, Evaluation of thé efficiency of several available sampling methods for PCB measurements, june 2005, ADEME grant n°0374030


Waymel Frédéric^

Fraser-Mitchell Jeremy

) Bre

A NEW TUNNEL RISK ASSESSMENT PROCEDURE INTEGRATING SMOKE DISPERSION AND EVACUATION MODELS

Keywords: Tunnel, Fire, Risk assessment, Smoke dispersion, Evacuation, Computer model, Tenability, HVAC

This paper focuses on a new risk assessment procédure for tunnel. This procédure is based on thé coupling between smoke dispersion models and évacuation models. It has been developed inside thé UPGRADE procédure put in place in thé UPTUN project. The method is based on two heat and mass flow (HMF) models for thé calculation of tenability conditions due to a fire event: NewVendis® for thé 1D calculation and thé global equilibrium of thé tunnel network and FASIT® for thé calculation in thé vicinity of thé fire. Tenability conditions are used as input data for thé évacuation calculation carried out by thé évacuation model CRISP®. Ail results (smoke dispersion and évacuation) are then combined in tenability diagrams which are a superposition of HMF tenability conditions and users' location in thé tunnel. This kind of présentation can then be used to help understand injuries or people casualties and to take efficient safety measures to increase safety level in tunnel.

INTRODUCTION

Because tunnels are complex Systems with many interactions between ventilation equipment, atmospheric conditions, operators' and user's behaviour, it is often difficult to make a good évaluation of thé tunnel safety level. Nevertheless, over thé last few years, authorities, tunnel operators and designers hâve become aware of thé necessity to consider ail parameters such as traffic, users, management and tunnel equipment, which could affect tunnel safety .

In this context, thé Commission emphasises thé need to consider a European Directive on harmonisation of minimum safety standards to guarantee a high level of safety for thé users of tunnels, particularly those in thé Trans-European Transport Network. The UPTUN project fits in thé European Directive and is a good way to reach thé goal of safety in tunnels.

The work package 5 of UPTUN consists of developing an UPGRADE procédure for thé holistic évaluation of fire safety level and upgrading of an existing tunnel. At thé heart of thé procédure is a risk assessment model that provides thé risk profile based on thé safety features of thé tunnel under investigation. There are two levels of risk assessment:

(i) calculation of smoke conditions at différent positions and times within thé tunnel, calculation of thé toxic dose absorbed by people as they escape, and examination of thé results. For thé UPTUN project, thé smoke movement was calculated by thé models New Vendis and FASIT, and thé human response by thé model CRISP. Examination of thé results entails superimposing thé tracks x(t), made by individual people, on tenability diagrams of smoke conditions as a function of x and t. The tenability diagrams were generated by New-Vendis.

(ii) Monte-Carlo simulation, using a fully-integrated smoke movement and évacuation model (CRISP) to examine thé conséquences of différent fire sizes, locations within thé tunnel, numbers of people, etc. The outputs of this model give probability distributions, for example thé numbers of people dying given that a fire has occurred. The model can take account of thé effects of early détection and warning Systems, suppression Systems, or thé provision of emergency exits in addition to thé tunnel portais. By running simulations with différent safety Systems in place, thé expected benefits (risk réductions) can be calculated directly from thé model outputs, and used to help déterminé thé most cost-effective approaches to adopt for a particular tunnel. This paper présents détails of thé first of thèse two levels of assessment. The next section gives a short description of thé models used. This is foliowed by a section covering thé global calculation procédure and data exchange between models.

At this stage an overview of data exchanges procédure is described between New-Vendis for thé global calculation of smoke dispersion in thé entire tunnel, thé software FASIT which refînes thé calculation in thé vicinity of thé fire, and thé évacuation model CRISP. Other models which perform similar fonctions could be substituted if desired. The main objective of thé procédure is thé building of human tenability diagrams presented as a superposition of HMF tenability conditions and users' displacement in thé tunnel during thé évacuation phase.

QUICK DESCRITPION OF THE MODELS USED IN THE PROCEDURE

Smoke dispersion models : NewVendis and FASIT

The procédure is based on two différent smoke dispersion models or also called Heat and Mass Flow Models (HMFM) for thé évaluation of thé tenability conditions in thé tunnel. Thèse models are described hereafter

1D model : NewVendis®

NewVendis is a one-dimensional numerical code and is clearly thé key to improved évaluation of accidentai effects in confined location such as subway networks, tunnels and storage galleries. The effects are due to thé présence of an accidentai source like a fire and to thé influence of a général ventilation System [START_REF] Daeron | Calculations of fire smoke behaviour in long rail tunnels[END_REF][START_REF] Ruffin | Development of a numerical model for thé simulation of accident situations in underground network[END_REF].

The modeling of thé tunnel takes into account ail of thé physical effects likely to influence thé behavior of this network. Thèse influencing parameters vary over time so as to obtain data on network dynamics and on accidentai effects which are, by essence, transitory. The tunnel network is described in NewVendis by a set of galleries. Each gallery is characterised by its curvilinear length, its area and its hydraulic diameter. Internai points are then added in thé gallery to refine thé grid and calculate more accurately thé smoke dispersion. Galleries are connected each other as a set of branches as it is shown on Fig. 1.

Branches

Evacuation gallery

< §-

J>

Tunnel gallery

Internai point (a) The heat and pollutant mass transfer calculation is based on a diffusion model. Each species is driven inside thé tunnel network with thé same velocities as those calculated in thé entire network with thé Hardy-Cross algorithm.

loyer zone model : FASIT®

In FASIT [START_REF] Charters | A computer model to assess fire hazards in tunnels (FASIT)[END_REF], thé tunnel is represented as a séries of zones, each at ambient température and flow conditions. The zone positions and lengths are either input by thé user or set automatically with an exponential increase with thé distance from thé fire (see.Fig. 2). Fig. 2 : Tunnel zone / layer schematic At various times and for varying intervais, thé movement of smoke and heat from thé fire is predicted using a threelayer model. Analysis of tunnel fire expérimental température and velocity data indicated that three layers gave a good représentation. The layers can be described as hot, mixing, and cool and hâve three associated wall "layers". Thus, thé tunnel fire conditions are predicted on a multi-zone, multi-layer domain. The user spécifies thé fire heat output and mass flow, and FASIT predicts thé température, thé velocity, thé depth and concentration in each layer for each zone throughout thé tunnel.

EVACUATION MODEL: CRISP®

Thé CRISP model (Computation of Risk Indices by Simulation Procédures) is a Monte-Carlo simulation for fire risk assessment [START_REF] Fraser-Mitchell | An Object-Oriented Simulation (CRISP 2) for Fire Risk Assessment[END_REF][START_REF] Fraser-Mitchell | Risk Assessment Of Factors Relating To Fire Protection In Dwellings[END_REF][START_REF] Fraser-Mitchell | Modelling Human Behaviour within thé Fire Risk Assessment Tool CRISP[END_REF][START_REF] Fraser-Mitchell | CRISP User manual[END_REF][START_REF] Fraser-Mitchell | Human Behaviour in Tunnel Fire Incidents[END_REF]. It was originally developed to model fires in buildings, but has been adapted for tunnels. The scope of thé model is intended to cover thé entire fire scénario. The sub-models represent physical 'objects' include tunnel segments (corresponding to thé zones used for thé smoke movement calculations), escape passages, doors, detectors and alarms, suppression Systems, vehicles (fuel packages), hot and cold smoke layers, and people. The randomised aspects include starting conditions such as thé number, type (behaviour and other characteristics) and location of people within thé building, thé location of thé fire and type of burning item (car, HGV, rail coach, etc).

CRISP incorporâtes a detailed behaviour model, rather than something simpler which would run faster. The justification for this is that thé risk assessment is based on fractional effective dose (FED) and accurate FED estimâtes require accurate exposure times. Therefore thé behaviour model needs to predict where people will go, and how long they will spend in différent areas (rooms) of thé building. In a tunnel, thé FED calculations would need to know how long people spent in différent positions in thé tunnel, relative to thé fire location.

DESCRIPTION OF THÉ PROCÉDURE

Global flowchart of thé procédure

The main goal of thé risk assessment procédure developed by INERIS in collaboration with BRE is thé coupling of thé différent models described above in order to build human tenability diagrams. This concept can be represented through thé flowchart on Fig. 4. This flowchart describes thé différent steps and links towards thé prédiction of conséquences that will be experienced by tunnel users during évacuation in thé event of a fire. First, a fire scénario established by an intelligent System describes thé fire event. The heart of this intelligent System is a database, which collect ail information about thé tunnel: geometry, safety features, traffic data... By this way, ail parameters describing thé fire scénario are collected through this database.

The first link of thé procédure ( 1) is thé connection between thé intelligent System INTELLITUN and thé model New Vendis. This connection provides thé geometry characteristics of thé tunnel, thé ventilation System, traffic information and design fire scénario. Other links are more spécifie. Their description is given in thé following paragraph.

INERIS (NewVendis) 1D Heat and Mass I Flow calculation j

Compilation of NewVendis and FASIT results

INERIS

Coupling between 1D model NewVendis and zone model FASIT : link (2) and (3)

The coupling between thé two dispersion models is strongly dépendent on thé two geometrical approaches. The first step is thé calculation of thé global heat and smoke dispersion in thé entire network of thé tunnel. This calculation, made by NewVendis on a 1D geometrical base, is particularly adapted to estimate thé response time of thé global tunnel System, which can not be done with refinement models such as zone models or CFD models. This calculation provides detailed information of transient gas velocity infiuenced not only by traffic scénario during thé first minutes of thé fire event, but also by thé ventilation system a few minutes after its activation.

Nevertheless, this model does not take buoyancy effects into account. By this way, smoke stratification in thé vicinity of thé fire is not modeled. The calculation of tenability condition is then refined with thé FASIT zone model. To do this, a refinement zone is first determined after NewVendis calculation. This zone corresponds to thé estimated stratified zone. After FASIT calculation, smoke dispersion parameters are collected and a combination of HMF properties is established to prépare tenability conditions on évacuation paths. In thé non-stratified area, thé combination process makes use of 1D calculation from NewVendis. In thé stratified area, a sélection of results at head height is established from thé three layers zone model calculation. Coupling between NewVendis and évacuation model CRISP: link ( 4) and ( 5)

The coupling between thé dispersion model NewVendis and thé évacuation model CRISP is also strongly dépendent on geometrical approaches. In NewVendis, thé évacuation area is represented by évacuation paths based on thé gallery and internai point description. CRISP does not use pre-defined exit paths as described above. Evacuation paths defined in NewVendis are then transformed by a set of connected segment in which users can choose their own exit route (see Fig. 6). Three kinds of information are then provided for thé connection between NewVendis and CRISP: geometrical information of évacuation area: list of paths and internai points which define segments boundaries for CRISP, time variation of heat and mass flow properties for each segment calculated by smoke dispersion models, users locations at thé beginning of évacuation. Thèse locations dépend on traffic scénarios and are calculated by thé traffic model implemented in NewVendis.

The simulation of thé évacuation scénario also provides three kinds of parameters used by NewVendis for thé building of human tenability diagrams. Thèse parameters are (see Fig.

Description of thé test case

The basic example used to validate thé procédure is a lkm bi-directional tunnel. The fire occurs at 250 m from thé entry portai. The curve of thé design fire heat release rate corresponds to thé 100 MW Swiss curves as presented on Fig. 8. Fîg.8 : fire scénario of thé basic example A pressure différence of 15 Pa is applied between portais, which créâtes a natural longitudinal velocity from entry portai to exit portai. The traffic implemented has a density of 1000 vehicles./h per direction (70% cars, 20% HGV, 10% coaches). The vehicle speed is 70 km/h before fire event. The fire induces a traffic jam in thé two directions calculated by thé traffic model in NewVendis.

HUMAN TENABILITY DIAGRAMS

The results presented hereafter are based on heat and toxic tenability conditions calculated by thé smoke dispersion models. Evacuation scénarios are calcuiated for four options of évacuation safety features:

Thèse results show that in thé fïrst option (1), nine people downstream thé fire die. The reason is due to thé period of thé time passed when they décide to start their own évacuation. This period is influenced by their own perception of thé bad température conditions. When they start to evacuate, they can not pass through thé fire because thé température is too high. The only possibility to exit is to walk toward thé exit portai but this part of thé tunnel is rapidly covered by hot smoke because of thé longitudinal velocity from entry portai to exit portai.

The results with side exits (3) shows that thé number of death is considerably reduced. Only two persons die. Some people enter in thé refuges when they reach too bad température conditions. But this safety equipment is not sufficient because in this case, thé behaviour of people who die shows that they décide to not take refuges probably due to an under estimation of thé bad conditions.

The two case with détection and alarm ( 2) and ( 4) show that nobody die. It is also interesting to underline that people are using thé portai from préférence for thé case with side exits (4). Indeed, thé early warning from thé alarm gives them enough of a start that they do not feel so threatened from thé smoke that they hâve to change plans and use a side exit.

CONCLUSION

Thé procédure presented in this paper consists of a new integrated risk assessment method. Its specificity is based on thé démonstration of interaction between smokes and human behaviour. This procédure is well suited for tunnel application thanks to thé use of smoke dispersion models developed for this kind of application: NewVendis and FASIT.

The interaction between smoke dispersion models and thé évacuation model is ensured by a simple exchange procédure of data. The use of évacuation model CRISP gives realistic results on users' situation during thé évacuation. Indeed, in this model, people are assumed to adopt distinct behavioural rôles, either naturally or due to training. Their behavior can be described in terms of actions, which may be abandoned, and substituted by new ones.

Tenability diagrams presented on thé basic example hâve shown thé benefit of this procédure. The results presented show clearly thé interaction between smoke dispersion and subséquent human movements. Then, it becomes easier to understand thé reason why people may die. This kind of approach gives considérable help to take efficient measures to improve thé safety level of a tunnel.

Fig. 1 :

 1 Fig. 1 : tunnel network représentation in NewVendis -Before connection (a) -After connection (b)

Fig. 3 :

 3 Fig. 3 : schematic représentation of some of thé différent object types within thé CRISP model (this is thé version for a building, although thé tunnel version is very similar).

(Fig. 4 :

 4 Fig. 4 : Flowchart of thé risk assessment procédure

  Then, NewVendis provides to thé model FASIT thé following input data: geometrical characteristics of thé refinement zone, transient velocity and gas température at flow boundaries of thé refinement zone. Thèse transient parameters are those calculated by thé 1D model, Design fire curves.

Fig. 5 :

 5 Fig. 5: coupling schematic of smoke dispersion models

Fig. 6 :Fig. 7 :

 67 Fig. 6 : Schéma of thé information transfer from NewVendis to CRISP

Fig. 9 :

 9 Fig. 9 : Human tenability diagrams

ACKNOWLEDGMENT

The authors would like to thank thé UPTUN project coordinators Kees Both and Jan Mijnsbergen for their permission to publish this paper. In addition, thanks go to Eric Dannin for his contributions for thé development of thé software NewVendis.

Financial support was granted by thé European Commission in thé framework of thé 5 th PCRD and thé French Environment Ministry.


B. Debray INERIS O Saîvi
email: salvi@ineris.fr

CONVERGENCE IN RISK ASSESSMENT FOR SEVESO SITES from ASSURANCE results to ARAMIS method

INTRODUCTION

In thé SEVESO II Directive, thé objectives in terms of risk management are very clear, but thé remaining question is : How to reach them ? For example, there is no harmonisée! définition of thé scénarios that hâve to be considered for risk assessment. Typically, thé chosen scénarios (BLEVE, total loss of containment, lire in thé largest tank, explosion of thé largest mass of explosive, etc.) can be différent according to thé spécifie risk analysts and according to thé deterministic or risk-based approach of thé country applying thé Directive.

In this paper, thé authors will share with you thé main results of thé ASSURANCE project, in which 7 European organisations performed a benchmark exercise for thé risk analysis of a spécifie plant. ASSURANCE pointed out thé need for further development that were achieved in thé ARAMIS project. For this latter project, thé authors will présent thé main results and thé perspectives and how thé ARAMIS results constirute a major step forward in thé convergence of practices in risk assessment.

ASSURANCE PROJECT

Project description ASSURANCE means ASSessment of Uncertainties in Risk Analysis of Chemical

Establishments. This project was a benchmark exercise on risk analysis of chemical installations to understand discrepancies between experts. The project consisted in thé comparison of thé sélection of scénarios, thé comparison of thé estimation of thé conséquences and fïnally thé comparison of thé estimation of thé probabilities. The project lasted 3 years from 1998 to 2001. The 9 partners from 7 différent countries, représentatives of thé risk assessment approaches implemented in Europe.

Main results

The partners used various risk analysis techniques and arrived at quite différent conclusions with respect to thé sélection of thé scénarios, thé estimation of their probabilities and thé estimation of their conséquences. For example, in terms of probabilities, for a classical event which is thé "Rupture of 4 inch. pipe on a distribution line", thé most optimistic partner estimated a probability of occurrence at 3.4 . 10" 8 per year, and thé most pessimistic partner at 2.3 . lo u per year. Concerning thé conséquences of thé scénario, for a rupture in a pressurized tank, thé distance to reach thé end point 6200 ppm in a normal atmospheric condition, was estimated by thé most optimistic partner at 0,4 km and by thé most pessimistic partner at 2 km. The last comparison concerned thé iso-curves for 10' 5 / year that a person die in thé vicinity of thé plant because of an accident. There is a différence of about 800 m between thé most optimistic and thé most pessimistic partners.

Lessons learnt from ASSURANCE

Thé ASSURANCE project has shown that there are discrepancies between thé experts in thé définition of scénarios considered for risk assessment. Some assumptions are différent and this hâve a strong impact on conséquence calculations. There are also discrepancies in thé estimation of thé probabilities of some events because there is a lack of reliable and contextual data (on failure rates, reliability...). Moreover, thé project pointed out that risk curves mapping is not meaningful for local authorities and thé public (consequence-based approach countries).

ARAMIS PROJECT

Project description

The ARAMIS project built further on thé conclusions of thé ASSURANCE project and proposed a structured approach that reduces thé discrepancies in risk assessment. The main objective is to build a methodology that improves thé effectiveness of thé safety reports required by thé Seveso 2 directive. This method combines thé benefîts from risk-and consequence-based approaches. It helps operator to better demonstrate that hazards are identifïed and risks are controlled. Finally, it provides appropriate information to base riskrelated décisions like thé deliverance of permit, lands use planning and emergency planning.

The project, which lasted from 2002 to 2004, consisted in thé élaboration of a methodology giving consistent rules for thé identification of scénarios that take into account mitigation devices and safety management, and being recognised by a large number of risk experts from Compétent Authorities and from Industry, gathered in a Review Team. The methodology produces understandable information that can be represented by maps.

In ARAMIS, thé risk level of an establishment is characterised with an integrated approach where 3 independent parameters are quantified :

• thé Frequency of thé scénarios • their Severity • and thé vulnerability of thé environment

From thé risk analysis, Major Accident Scénarios are identified and then Référence Accident Scénarios that take into account thé préventive measures implemented by thé operator. The severity Sref and thé frequency Fref of thèse référence scénarios are estimated. The sélection of thé Référence Accident Scénarios is made possible thanks to thé évaluation of thé efficiency of thé safety management System : both thé formai aspect and thé safety culture within thé plant. The environment vulnerability estimation describes thé sensitivity of thé potential targets located in thé vicinity of thé SEVESO II establishments. The outputs of thé ARAMIS method are mainly represented on maps.

Main results

ARAMIS method is well structured and contents 6 major steps that are described more extensively in thé main chapters of a user guide.

-Identification of major accident hazards (MIMAH) -Identification of thé safety barriers and assessment of their performances -Evaluation of safety management efficiency to barrier rel iability . -Identification of Référence Accident Scénarios (MIRAS) -Assessment and mapping of thé risk severity of référence scénarios -Evaluation and mapping of thé vulnerability of thé plant surroundings

The main results are présentée! in thé user guide that can be downloaded at : http://aramis.jrc.it

CONCLUSIONS AND PERSPECTIVES

The ARAMIS method has answered some of thé difficulties related to risk assessment pointed out by thé ASSURANCE project.

Three project main conclusions can be drawn up. ARAMIS method is based on thé safety barrier approach. This constitutes an alternative to thé probabilistic/consequence based approaches which is well understandable by thé industry as well as by thé compétent authorities. It is didactic and pédagogie.

The safety barrier approach is also compatible with Layer Of Protection Analysis (LOPA) method and thé IEC 61508 standard, which is largely implemented in thé industry. This approach leads to constructive discussions on thé level of performance of safety barriers within thé plant and with thé authorities.

ARAMIS is a method that takes into account thé specifïcity of thé plant, its safety management System performance and its safety culture, when other methods consider only generic data.

Beside thé development of an integrated risk assessment method, ARAMIS project has achieved a tremendous exchange of practices between practitioners from more than 15 EU Member States if we consider thé consortium and thé review panel. This has led to a certain convergence among countries (partners and reviewers) in thé way of implementing risk assessment in thé framework of thé Seveso 2 directive. The project has brought éléments to fulfîl thé need to establish a method that is capable to assess thé risk level of an installation by integrating thé préventive measures implemented by thé operators. Such a method is a prerequisite in order to reach thé goals of thé SEVESO II Directive, that are to improve thé prévention linked in particular with thé safety management. The application of this method results in a more consistent risk évaluation and safety management strategy in ail European Countries This reflection has continued in thé European Working Group on Land Use Planning (EWGLUP) which aims at exchanging expérience in risk assessment and land use planning in ail Member States.

http://aramis.jrc J t (The user guide can be downloaded at this web address)

Ac knowled gem ent

Thé work presented in this paper has been elaborated in thé frame of thé EU project ARAMIS "Accidentai Risk

Assessment Methodology for Industries", co-ordinated by INERIS (F) and including EC-JRC-IPSC-MAHB (I), Faculté Polytechnique de Mons (B), Universitat Politècnica de Catalunya (E), ARMINES (F), Risa National Laboratory (D), Universita di Roma (I), Central Mining Institute (PL), Delft University of Technology (NL), European Process Safety Centre (UK), École des Mines de Paris (F), École des Mines de Saint Etienne (F), École des Mines d'Alès (F), Technical University of Ostrava (CZ) and Jozef Stefan Institute (Si). The project is co-funded under thé Energy, Environment and Sustainable Development Programme in thé 5th Framework Programme for Science Research and Technological Development of thé European Commission.


Bastien Affeltranger

Ph.D. (INERIS Emmanuel Plot

Ph.D. (INERIS Bruno Debray

Gilles Le Cardinal

« Heuristics and ontologies as keys to enter complex organisational systems: Virtual Reality (VR) applications to improve industrial safety »

Keywords: industrial safety, ontologies, virtual reality

A major issue in industrial safety is that different stakeholders, namely those involved in the generation, mitigation and monitoring of industrial risks (both occupational and of major accidents), develop different perceptions of what industrial safety is, or how it should be achieved. Because they differ, these representations generate likewise different analyses and assessments of industrial safety features and levels. When diverging, such risk perceptions can be detrimental to an optimal ownership, and hence successful implementation, of safety management systems in industrial systems (facilities, plants and organisations). It is therefore a challenge for risk managers, both within industrial facilities and from research and consultancy institutions, to adequately seize the nature of these representations, and how they materialise, both at individual (worker's, manager's) and collective (group's) level. In this respect, the involvement of these stakeholders is a major asset to understand the construction process of these representations. Ontologies of industrial activities and related risks appear as a key concept to reconstruct industrial safety in a participatory, user-based manner. Based on a the observation of real-life cases and related interview material, some of which conducted in the framework of the EU -funded VIRTHUALIS project, this communication presents a virtual reality (VR) application of the ontological approach to design interactive tools enhancing industrial safety.

Introduction

Risk and industrial safety are social constructs. While performing their daily professional tasks and duties, stakeholders within hazardous plants (namely workers, supervisors and managers) tend to develop autonomous intervention strategies. These have been developed individually and collectively, and are based on know-how and other cognitive resources. This set of resources that have been empirically developed can be described as a heuristics of production and action.

When considered from an industrial safety perspective, these stakeholders also appear to be involved in the generation, mitigation and monitoring of industrial risks -both occupational health issues and prevention of major accidents. Consequently, these stakeholders develop different perceptions of safety: what it is, an how it should be achieved. Because they differ, these representations generate likewise different analyses and assessments of industrial safety features and levels. When diverging, such risk perceptions can be detrimental to an optimal ownership, and hence successful implementation, of safety management systems in industrial systems (facilities, plants and organisations).

It is therefore a challenge for risk managers, both within industrial facilities and from research and consulting institutions, to adequately seize the nature of these representations, and how they materialise, both at individual (worker's, manager's) and collective (group's) level. In this respect, the involvement of these stakeholders is a major asset to understand the construction process of these representations. Capturing ontologies of risk therefore plays a major role in undertsanding different perceptions of risk existing in the workplace. This approach will be relied upon to "reconstruct safety", based on the original contributions from workers. The virtual reality application VIRTHUALIS is designed to contribute to that purpose.

VIRTHUALIS is an Integrated Project, in the 6 PCRD, priority 3 -New Production Processes and Devices -co-ordinated by the university Politecnico di Milano. The poject began in April 2005. The main feature of VIRTHUALIS proposal is to produce new knowledge and, as such, is answering to the undeniable need of transforming industry towards high-added value organisations, i.e., more knowledge-based ones.

VIRTHUALIS proposes the development of a new user-centred technology coupled with advanced safety methods and aspects that can be effectively applied in industrial applications handling hazardous materials. The proposal supports the life-cycle safety of industrial production systems through the aforementioned approach that will lead to a distinct minimisation of risk and therefore also of plant accidents. To support such amb itious goals and ensure their relevance and proper implementation, the project has a strong industrial participation in the Consortium. The influence from industry (objective-driven approach) is guaranteed in practice by its representatives in key positions. It is worth noting that all participating industries are subjected to Seveso II legislation. The VIRTHUALIS technology, will make it possible:

• to incorporate the most advanced HF concepts when performing the three safety actions, (System for Integration of Risk Indicators2 ), and a possible way of using it to build a virtual reality application. The paper ends with a description of lessons learned in user-based design of virtual applications for industrial safety.

I. A virtual reality application to tackle issues of representation co nstruction process

I.1 Problem to be solved

In the following section, we won't describe an existing application but our vision of a possible application to develop in Virthualis project. This description is necessary in order understand the possible use of the data conceptual model proposed in section tow.

The application we have in mind will help to tackle the complexity of a major problem in safety management. This problem is: to find the best possible ways to perform different objectives in the same time. These objectives include: production and productivity, health and safety duties, and environmental protection tasks. Teams, at plant/factory level, have to find the best possible strategies of performing their professional tasks/duties, while also taking into account that numerous risk factors likely to disturb the conditions to and means of their actions, depending on the context/situation. The analytical step of "risk analysis" helps define accidental scenarios that workers must avoid. These scenarios have implications in terms of production, health, safety and environmental issues. The safety management activities define sets of "action scenarios" of doing a given work (or performing tasks) in order to avoid accidental scenarios. We propose to consider that management activities are related to (explicitly or not, deliberately or not, realistically or not, with or without commitment) a sort of roadmap, rather than to en explicit, written strategy about the way of doing a work. Based on the sociological scheme called "individualism methodology", or of the "organisational sociology", this kind of strategy: o is the result of the aggregations of individual behaviours (more or less negotiate), o knows systemic dynamics (equilibrium, feed-back loops), o is related to organisational informal rules. Some psychological approaches to these issues propose criteria to analyse the strategies from a safety point of view. Athos follows the approach identified by the author René Amalberti3, based on the concept of cognitive compromise and on a subjective view of what risks are deemed acceptable, and what are not. It is not the purpose of the present document to go further into details, such as human sciences definitions. Rather, we would like to rise the specific sociological and psychological issues that are connected to safety management activities.

At this stage, the notion of good practices appears to be the best way of describing the issue at hand. Good practices indeed stand for an integrated roadmap and set of actions that are used by workers to carry out their daily professional duties/tasks. Despite the significant influence of explicit rules, such as regulations and procedures, this kind of "written directions for practice" appear less relied upon by workers in comparison to non-written rules. In other words, individual and collective strategies sustaining realisation processes rely on specific, cognitive compromises and subjective assessment of acceptable risks.

The management of good practices is not difficult because a high technical level is required for a specific action. Rather, it is difficult to develop procedures for managing good practices properly. This is difficult for both individual (worker-by-worker) and collective (teams of workers) activities. Purpose of this management task is to identify/design effective and efficient strategy(ies) with which workers are capable of adequately performing all barriers in the same time, taking into account the possible risk factors (degradation of the work context or reduction of resources). In that respect, the fundamental difficulty is that workers (and managers) have to perform an integration of numerous goals within one strategy of daily professional practice.

The Virthualis technology could be used to design and validate good practices and resources (both human and material ones) that are required to ensure the implementation of good practices. Here, from a safety management point of view, one of the major difficulty is related to representation construction process ( common ground elaboration), communication, needed to design and validate good practices, and resources (human and material) required. The direct consequence of a bad representation construction process is a bad commitment.

I.2 Virtual reality application

We have in mind a sort of "serious game" usable with a simple computer and an animator. This application don't specifically need data gloves, head mounted displays, haptic devices, 3D sensors, etc. The users (operators, managers, teams …) have a mission to do. They have to invest on safety solution without loosing too much time and money. The "serious game" could have four phases:

1. Users have a presentation of their mission. As it is in real life, they have documents: risk analysis, manpower planning, etc. Players can choose different positions in the team: operator (with specific task) or manager (in charge of a global control and decision making).

2. Users enter their workplace. They have to check the place. We can imagine a static scene or a dynamic one (other people are working, a catastrophic scenario is under prepare). Users have to decide: is it a safe place? does my team have adequate means to work in this context and to perform Quality, Safety and Environment objectives? If they decide that the answer i s "no", they have to propose modifications. They can propose to change: objectives, means or elements of their work context. They can say that they want to stop at this phase of the game because there is to many safety problems … and solutions are to expensive (time and money).

3. In a third phase, the work begins … but the team faces a set of pre-accidental situations.

Taking into account modifications and organisations chosen during the phase two, different accidental scenarios will take place.

4. Replay phases two and three to define best strategies and resources allocation in order to respect basic HSE rules in such situations.

Example of a possible scenario:

• During the phase two, the team working on substitution of a pipe used an explosimeter, but without checking it before. The explosimeter had fallen on floor and is now broken inside.

They did not detected potential flammable dust (see Fig. 1).

• During the phase three (during their work), there is dust in suspension in air. Then, they make a hot spot, an i gnition source. There is: dust explosion overpressures enclosure, an internal overpressure (Solid material), and a catastrophic rupture.

II. Input from INERIS: a data conceptual model

It is clear that INERIS is not able to develop such virtual reality application by itself. The whole Virthualis consortium (Human Factor Experts, Virtual Reality Expert and End-users) is needed.

What we want to present here is the specific data conceptual model proposed by INERIS to collect all necessary data needed for the application.

I.1 Problem to be solved

What are the models required by the application? At this stage of project development, the project team and authors do not have a definitive answer to that question. However, it is already clear that the application has to allow the visualisation of at least three different kind of critical safety elements:

Visualisation of objectives to be performed (as identified through risk analysis)

The objective here is to perform tasks in order to avoid production or HSE accidental scenarios.

Basically, if one cannot visualise objectives to perform, one cannot find either the best possible ways to perform it in the same time. Objectives to perform are production and HSE ones to achieve; in other words: avoiding production or HSE accidents.

• A virtual model of the plant: the model is composed of various geometrical elements with physical properties attached to them. Somehow, this model constitutes the landscape in which human beings will operate and where accidents will take place.

• A model of the functioning (or process model) of the plant: this model specifies the internal behaviour of plant components. Somehow i t is a process model. E.g.: "When button A is pressed the pump is turned on and the fluid passes into the pipe".

• A physical model that describes the phenomena that could give rise to accidental events. E.g.: "If the pressure raiser in the pipe is above 7 bar, then the pipe envelope fails, which causes leakage".

• An accidental sequence model that describes the causes of the accidental events: This model can be explicit or implicit depending on the quality of the process model and physical model. In the case of very complete models, the simulation of initial causes should lead to the final accident.

• A model of technical barriers. This model specifies the specific behaviour of technical barriers on accidental scenarios.

• A model of operating modes (human barriers): this is the sequence of operations performed in order to achieve a given production and/or HSE goal.

Visualisation of possible ambient and working conditions (variations and degradations)

• If one cannot visualise possible ambient or working conditions, one cannot see either the difficulties that need to be taken into account. • A model of ambient conditions: temperature, humidity, illumination, time of day (or night), noise, etc. These are all factors that have an impact on the well-being of the operator (depend on the operator's perception of them), hence on performance efficiency.

• A model of working conditions: workplace design, team support, co-workers, working hours, dangerous space, narrow or elevated work space.

Visualisation of resources (variations and degradations)

Without visualising resources (human -people and teams-and technical resources -tools and materials-), it is not possible to work on possible ways to perform HSE objectives taking into account variations and degradations of possible wo rking conditions. The breakthrough provided by the SIRI approach (see below for details) is to integrate data which are usually not. These data include:

• Human resources:

• Accidental scenarios and barriers of Seveso plants

• Accidental scenarios and barriers of "substitution of pipes" activities • Organizational difficulties (coordination, communication, cooperation, competence, tool and procedure) • Actor's representations and strategies

II.2 Data conceptual model proposed by INERIS

INERIS propose an approach called SIRI (System for Integration of Risk Indicator) based on:

1. ARAMIS methodology [START_REF] Haber | Safety Culture Management : The Importance of Organizational Factors[END_REF] to structure accidental scenarios and barriers data of Seveso plants and of activities like substitution of pipes. [START_REF] Haber | Safety Culture Management : The Importance of Organizational Factors[END_REF] / ARAMIS is a European method whose development was inspired by LOPA and, which proposes more advanced tools in order to take into account organisation and human factors. ARAMIS, and therefore SIRI, boast the originality of suggesting an approach by what is called " barriers " which allow to achieve the integration of technical, organisation and human factors. Please visit http://aramis.jrc.it/index.html for details.

2. A processes approach to structure organizational difficulties 3. Fact Mirror methodology to tackle actor's representations and strategies.

ARAMIS' way of structuring accidental scenarios and barriers data

ARAMIS provides:

o Generic data: type of unit on a Seveso Plant, list of hazardous equipments, generic fault trees, generic event trees, list of safety barriers, o A methodology to collect specific data.

All these elements can be used to produce virtual environments:

o Generic or specific components with hazardous properties and useful characteristics o Some scenarios must be translated into the attributes of hazardous equipments o An equipment will have the following attributes :

-Parameters involved in the hazardous scenario (pressure, temperature, strength,...) -Laws describing the evolution of internal parameters due to external events -Hazardous scenarios describing the sequences of events leading to hazardous situation -Set of probabilities of external and internal events that are not resulting from the interaction of the user with the system SIRI proposes tables of: o Some Human Errors can be supposed as preexisting in the system (attributing probabilities to some of them) o Some Human Errors can be the result of a simulated behavior of virtual agents o Some Human Errors can be the result of decisions by the user of the system.

Processes approach to structure organizational difficulties

We believe that the best way to model different stages of each action to perform in order to manage barrier's performances is the "Process approach" from ISO 9000. ISO is well known (Iso's purpose is to facilitate international trade by providing a single set of standards that people everywhere would recognise and respect … ISO 9000:2000 standards apply to all kinds of organizations in all kinds of areas).

The ISO 9000:2000 standards identify three types of processes to ensure the effectiveness and efficiency of "realization processes": -Processes for management of an organization ("Management processes"). These include processes relating to strategic planning, establishing policies, setting objectives, providing communication, ensuring availability of resources needed and management reviews.

-Processes for managing resources ("Resources processes"). These include all those processes for the provision of the resources that are needed for the processes for managing an organization, for realization, and for measurement. Examples of resources include: Human resources, Materials, Financial resources, Information.

-"Measurement, analysis and improvement processes". These include those processes needed to measure and gather data for performance analysis and improvement of effectiveness and efficiency. They include measuring, monitoring and auditing processes, corrective and preventive actions and are an integral part of the management, resource management and realization processes. This approach can be follow to define set of activities in charge of barriers. SIRI combines generic ISO processes and ARAMIS network of delivery systems. For instance, the ARAMIS delivery system of "Maintenance repair and modification" (see Fig. 2 below) is link with resources processes and "measurement analysis and improvement" processes. o The Fear of being betrayed and of suffering the consequences corresponds to the difference between the loss and the sucker's pay-off;

o The Attraction of achieving mutual co-operation because they want to succeed together corresponds to the difference between the rewards and the loss;

o The Temptation to betray the other, to benefit from the betrayal bonus corresponds to the difference between the revenues from betrayal and the reward from co-operation.

In the Fact-Mirror perspective, actor's strategies are based on estimations of the trust one can place in one's actor, often made unconsciously and resulting from the history of interactions.

These estimates are going to affect the choices made by actors, and the subsequent moves made by each by increasing or decreasing the degree of trust in one's actors. Fact-Mirror method involves evaluating these degrees of trust by the way in which the revenues of the other are taken into account during the development of the strategies of each actor.

Fear, Attraction and Temptation are not only an indicator of the quality of relationships but also a way of discovering actor's representations and strategy in a systemic perspective.

Also, the work on the sentiments of the stakeholders of a complex problem is the first step in creating a climate of trust. Fact-Mirror proposes to put these sentiments into words. Through their answers to three questions: "what are oner fears, oner attractions, and oner temptations in the interaction under study" the actors become more conscious of the stakes involved in each encounter. Increasing the interpersonal trust between participants will lower the fears and the temptations and make more realistic the attractive aspects of the situation. Also by actually lowering the fears and temptations and increasing the attraction, trust grows.

Practically speaking, the method proposes five steps:

1. Definition of project, mapping of actors involved. In the perspective of our virtual reality application, the project is linked to processes (barriers) that actors have to manage. This project allows identifying all the important interactions to work on in order to uncover actor's representations and strategies.

2. Secondly, for these important interactions the three feelings of fears, attractions, temptations are expressed in a brainstorming workshop or in individual interviews.

Dangers or a sterile discussion or insufficient justifications are avoided. What is said is legitimate which in no way stops one of the participants from making a statement, which opposes that of the rest of the group. All the points of view are taking into account. A logic of AND is substituted for a logic of OR.

3. Thirdly, each participant is invited to make an evaluation by attributing a mark, anonymously, personally and therefore subjectively, to each proposition, according to his/her consideration of its degree of importance for the best resolution of the problem.

Next, the marks of the participants are obtained for each statement taking the average of the marks obtained for each statement. This huge quantity of qualitative and quantitative information (between 200 and 1000 statements according to the problem and the time spent) collected from the participants in reply to only three questions, should next be reviewed and structured before being used by the search for solutions.

4. After stating the FAcTs, their notations, and obtaining the general classification, in a fourth phase, the group classifies the statements by affinity into 5-10 "unavoidable themes". Between 10 and different registers are opened, called the unavoidable themes of the problem.

5. The recommendations are built in a creativity workshop. The animator asks the group to consider: 1/how to suppress or reduce the fear in question, reducing the danger which it causes, 2/how to realistically obtain what was expressed as a potential attraction, 3/how to limit the temptation or make more difficult and less advantageous a betrayal (i.e., giving in to the temptation). In this way, each recommendation has a precise origin.

Following this methodology, INERIS and UTC have worked on subcontractor interventions in a Seveso plant. About 800 statements have been defined uncovering actor's representations and potential strategies of generic difficulties meet by actors (maintenance, production team, HSE team, supervisors, subcontractor teams, managers from Seveso plant and from subcontractor companies) to perform safety barriers and accidental scenarios (major and occupational hazard) they have to take into account.

Those data have been linked with eleven important processes of a subcontractor intervention:

1/Specifications elaboration, 2/Selection of subcontractor companies and business negotiations, • Productive people don't define their needs with sufficient details, so maintenance is not able to define good specifications… subcontractors are not able to well prepare their work,… and production people ask them, during the realization phase, to perform (quickly) a new task without risk assessment. • There is not enough availability of production team, so supervisors and subcontractors are really tempted to begin their work without permission … without confirmation that the wrkplace have been well prepared … without knowledge of specific risk in this workplace … • Teams have a fear of new regulations… but not of some real risk as ATEX (dust explosion or other non intuitive dangerous phenomena).

• Maintenance and production team considered that safety team have not a realistic representation of their job and impose rules to them impossible to follow… that they don't follow many times…

Conclusion

The data conceptual model of SIRI propose to link different kind of data that a good safety management system has to manage. SIRI is capable to restore these data in order to prepare virtual scene and virtual animation needed to work on representation construction process. This

  i.e., training, safety analyses (risk assessment and accident investigation), and safety management & audit; • to move from static and paper-based safety analyses, in which the goodness of outcomes is strongly dependent on assessors' imagination and interpretation, toward dynamic virtual simulations. VIRTHUALIS technology will be made up of a set of four independent tools each built and shaped to dynamically perform the three safety actions: o Risk Assessment & Accident Investigation Activities o Training activity o Safety management activity This paper is organised as follows. The first section describes the objectives of the virtual reality application we aim to build. Section two present INERIS's data conceptual model called SIRI

Fig. 1 :

 1 Fig. 1: Description of a possible scenario for a situation of threat to industrial safety.

o

  A geometrical model of human and movement model of human. o A cognitive model of human. This model describes how an operator acts in a given environment under given intentions or constraints, including a model of psycho-physical, physiological or emotional possible states, taking into account level of competencies. o A behavioural model of a team : coordination and communication modes between operators : manpower planning, process of decision making, information channels, identity build-up, commitment, level of co-operation and reciprocities in relationship, confidence level between operators or between operators and the technological system. o An interaction model of human with the plant. This model describes, for each component, the type of interaction a human being can have with the component. o A human error model which specifies how an operator can make mistakes in a given situation. Such a model should describe the types of errors that can be made with a given occurrence law. It should also specify how these mistakes can be translated into the physical and process model of the plant. • Technical resources: o A model of tools, interfaces or equipment characteristics that human can use. o A model of task instructions (procedures, written or oral prescriptions).

o-

  Scenarios: -Undesirable Events, Detail Direct Causes, Direct Causes, Necessary and Sufficient Causes, Critical Events, Secondary Critical Events, Tertiary Critical Events, Dangerous phenomena, Major Events. -SIRI propose this structure for both major hazard and occupational accidents. Of course, this is often less detail for occupational accidents (scenarios are more simples). Elements of barriers (technical or human) -Set of performance indicators of a barrier: Independence, capability to perform the safety function (taking into account kinetics of accidental scenarios), level of confidence SIRI crosses those tables in order to have links between major and occupational scenarios (when occupational scenarios create Undesirable Events), and barriers. In this approach: o Human Factors is identified as a cause in most of accidental scenarios (fifth level of the fault trees, mostly not exploited in the traditional risk analysis) o Human Factors can intervene through direct Human Error (leaving a valve open, pressing the wrong button) or indirect (error in the design phase or maintenance phase)

Fig. 2 :

 2 Fig. 2: ARAMIS view of the "Maintenance repair and modification" delivery system

3 /

 3 Program elaboration, 4/Visit and first preparation of the work to do, 5/Risk assessment (different specific document and permit), 6/Work preparation (by production people of the Seveso plant, 7/Control of entrance on the site, 8/Realization of the intervention, 9/Control, 10/Modification management, 11/Receipt of the work. The three feelings give much information about difficulties, representation and strategies meet by actors. These include for instance:

ooo

  is the breakthrough proposed by INERIS for a specific virtual reality application aiming at a work on representation construction process:• A better definition of the basics HSE rules to respect. Those rules can be explicit by: What workers must not do (never!), What workers can do under some specific conditions, What workers have to respect absolutely during their daily job, o Control check-list of potential perturbations workers have to take into account. • Necessary negotiations about strategic (or tactical) interventions and resources needed (technical, organisational and human). • Set of examples illustrating complexes boundaries between what workers have to do and have not to do.

  These links have been built in ATHOS research program which is finance by PICARDIE's region. ATHOS is a method based on ARAMIS approach. ATHOS proposed improvements on Human and Organizational Factors. -machine interface, number of simultaneous goals, available time to carry out a task, time of day, crew collaboration quality, psychological stressors (duration of stress, task speed, conflicts of motives about jobs, inconsistent cueing etc.), physiological stressors (fatigue, pain or discomfort, movement constriction, lack of physical exercise etc.). Mirror is based on an interpretation of the strategic dilemma (prisoner's dilemma) in terms of Fears Attractions and Temptation. The main idea is that revenues of interactions are difficult to calculate in mathematical terms in everyday life, but the feelings of actors submitted to such a dilemma can be easily anticipated, though they will of course be experienced in a specific way of each individual:

	Data of actor's representations and strategies
	SIRI links accidental scenarios, barriers, processes and actors with data from Fact-Mirror 6 (Fears
	Attractions Temptation in Mirror) methodology which allow tackling some critical actor's
	representations and strategies. Representations and strategies we want to work on with the virtual
	reality application.
	Fact-
	Barrier
	inventory	Risk Analysis		1. Define maintenance
				concept & plans
		2. Document	Maintenance Inspection
	Spares, tools,	equipt. & plans
	equipment
		3. Plan resources & methods
	Manpower & competence	5. Schedule maintenance/repair	4. Execute inspection & testing
	Procedures	work
		6. Execute maintenance & repair
		Isolate -check -handover -execute -check -handover -restart
				7. Report, Record, Evaluate,
				Learn

[START_REF] Hollnagel | Cognitive Reliability and Error Analysis Method (CREAM)[END_REF]

/ man

Programme Manager, « Systemic Risk Analysis », A ccidental Risks Division, INERIS (France). E -Mail : bastien.affeltranger@ineris.fr. For more information on INERIS, please visit www.ineris.fr

SIRI is one of the knowledge developed by INERIS in the European project called VITHUALIS: Virtual Reality and Human Factors Applications for improving Safety (42 partners, 14 millions euro).

Amalberti, R., 1996, La conduite des systèmes à risques, Paris: Presses Universitaires de France (PUF).

/ This methodology has been develop by Gilles Le Cardinal, Jean-François Guyonnet and Bruno Pouzoulic, and adapt to Quality Safety and Environment issues with INERIS in the ATHOS research program (finance by PICARDIE' region).

A conceptual description of the SIRI model is provided below (Fig. 3). the figure 3 above shows the input proposed by SIRI. But it shows also that it is not enough to have a demonstrator.

SIRI