G Marlair
email: guy.marlair@ineris.fr

J C Lecoze

K Woon-Hyung

E R Galea

Human Behavior as a Key Factor in Tunnel Fire Safety Issues

Recurrent disasters with multiple casualties and important property loss occurred in the last decade in all types of traffic tunnels in Europe and Asia in particular, where existing and planned new tunnels are the largest in number and important for the economy. The aftermath is a new focus on fire safety issues in tunnels on behalf of different authorities, as shown here by a brief review of the European Research and Technological Framework program currently supported by the European Commission. The paper outlines that fire safety level in a tunnel clearly depends on a variety of human factors, other than the simple behavioral aspects of tunnel users confronted to the event of a fire. This is illustrated by facts reported from a number of past accidents in traffic tunnels, including the recent tragedy that took place in the Daegu metro in February last year.

Introduction

One apparent factor explaining the number of fire disasters that occurred recently in European tunnels is the sharp increase in traffic (in particular freight traffic in road tunnels), in the relatively old tunnel European network. However, significant accidents have also occurred in more recent links (e.g. the Channel tunnel accident in 1996, despite of the numerous safety studies that are known to have significantly raised the overall costs of construction). Besides, in Europe and elsewhere, new challenges in matter of fire safety issues are going to be faced due to the impressive new projects under completion (e.g. the "big dig" project in Boston [START_REF] Fleming | The Central Artery/ Tunnel Project[END_REF], or the superimposed roadways tunnel structure for passenger cars traffic on the A86 highway nearby Paris). Moreover, there is also a sharp demand for new underground structures to facilitate transit in urban areas or for crossing geographical barriers on a worldwide basis.

Haack recently presented a picture of the tunneling activity [START_REF] Haack | Fires in traffic tunnels[END_REF] that in particular outlines the following figures :

• Operational tunnels in Europe represent more than 15,000 km in overall length • Marketing studies have led to estimating the overall potential lengths of new tunnel projects to some 2,000 km in Europe, 650 km in South America and 2,350 km in global Asia.

Is 'human behavior in fire' a real topic of interest within this background or should the fire safety engineers and authorities and other stakeholders in tunneling still rely mainly on the so-called "hard fire sciences". This is the matter on which the authors are willing to discuss here.

The current context

A recent focus on tunnel safety issues in relation with past accidents

An unexpected series of actual disasters in road and rail tunnels occurred in European countries and Asia in the last decade. These tunnel accidents have been extensively commented, on real time through the media at first and with more progressive and sound feedback in specialized technical literature. Table 1 is a summary of the major tunnel fire events that were deplored from 1995 to time of publishing. At first, when the data are analyzed over the global time scale of traffic tunneling activity, it comes out that dramatic fire accidents in tunnels are increasing in frequency. Beyond the overall death toll paid in the mentioned list of accidents, probably the worse series in a single decade period of time to date, the data in table 1, together with more comprehensive work dealing with tunnel accident database management and warehousing [START_REF]FIT European Thematic Network[END_REF][START_REF] Carvel | A history of fire incidents in tunnels[END_REF][START_REF] Work | Fires since 1945[END_REF] clearly outline basic technical features such as :

• any type of traffic tunnel is concerned (including cable rail tunnels used in ski stations),

• any type of vehicles may be involved (The Mont-blanc disaster of March 1999 alone hit 23 heavy truck vehicles, several cars, vans, emergency vehicles and even one motorbike) [START_REF] Hough | Mont-Blanc tunnel tragedy[END_REF], • other scenarios than rolling stock or road vehicles may be involved in a given fire scenario in a tunnel ; • explosion, although a rare event, is to be taken into consideration (in case of transportation of dangerous goods such as LPG, see lessons from the Palermo (Isolla del Femine) tunnel accident analysis [START_REF] Masellis | Fire Disaster in a Motorway Tunnel[END_REF] ; apart from the explosion hazard arising from flammable gases and liquids transported through tunnels, terrorism, as recently shown in the metro of Moscow early this year (more than 30 people were reported killed), is another potential cause of an explosion that may be followed by a fire scenario in traffic tunnels ; • the provision of adequate technical safety measures (emergency ventilation systems, places of safety, alarm systems...) is of essential importance ; • mass transit systems (e.g. metro tunnels) are a source of concern in the event of a big fire, due to the fact that hundreds of people are liable to be trapped in a single accident, and that particular difficulties pertain to egress, fire-fighting and rescue in such underground structures (see section 4),

If m a number of cases, technical factors (e.g. inadequate reaction-to-fire performance of materials that are used in rail carriages, problems with brakes on trucks...) largely explain the occurrence of fire events in tunnels, it must also be stated that all those worse case fire scenarios have been influenced in their course of events and consequences by many human factors affecting all stakeholders. Hopefully, the societal perception of risk due to fire in a tunnel has by now drastically been pushed ahead, and this is acting as a booster. Indeed, safety issues must now be treated in any new tunnel project as a priority, including the account of all human factors such as the appraisal of communication means in place to warn users and emergency services, suitability of emergency exits or places of safety (in terms of number, configuration and ease to locate in smoky environment by users), traffic density factors, coordination anticipation of all actors of an emergency response and so forth.

Human behavior in fires : a growing engineering science

It must be stated that no overview of fire behavior in the context of tunnel safety has been published so far, to our knowledge. However, learning on a formal basis about human behavior in fires started decades ago, essentially in the framework of conventional buildings, as recalled recently by Shields et al, in their very useful and informative review and prospective work [START_REF] Shields | The Science of Human Behavior; Past Research Endeavors, Current Developments and Fashioning a Research Agenda[END_REF] presented at the IAFSS Conference in Poitiers. Shields and Proulx depicted the 'human behavior science' as relatively well advanced in a number of topics related to fire safety issues. Human behavior in fires has now entered the area of scholarly studies in some Universities (University of Ulster, University of Greenwich in England...). The mentioned reference is a good source for a global perception of achievements about human behavior in fires versus time from the mid 50's to end of last century. Other references, like the SFPE handbook of Fire Protection Engineering [START_REF][END_REF] , or the collective work edited in the form of a SFPE guidance document compiling engineering science about 'human behavior in fires' released last year [START_REF]Human behavior in Fire[END_REF], make additional powerful resources for those needing an overview of existing global knowledge. Besides, since 1998, regular conferences have been established in Europe and overseas, focussing on the matter such as those organized by the University of Ulster (Fire-Sert) and University of Greenwich [START_REF] Schields | International Symposiums on 'Human Behavior in fires[END_REF]12] In practice, many aspects governing important safety features in relation with fires in built environment have achieved a fairly good level of understanding. This includes [START_REF]Human behavior in Fire[END_REF] :

• knowledge about : cueing, competitive behavior, impact of crowd density on movement speeds, danger perception, disorientation caused by smoke, importance and modes of awareness of building environment, importance of pre-movement time, reduced mobility, aging effects, stress factors... ; • key roles of communication schemes and incentive messages to help evacuation.

Studies about human behavior in the transportation area have concentrated so far on evacuation problems in boats and aircrafts [START_REF] Galea | World in motion[END_REF].

The current European Research framework on tunnel safety

The European Union, through its 5 t h RTD (research and technologic development) framework program is actively supporting a number of initiatives that involve, in a joint and coordinated effort, nearly all European experts having proven capabilities in tunnel engineering and associated safety aspects. The 6 t h FP is expected to support remaining effort to reach what is expected to be the acceptable level of knowledge needed for sustainable development of tunneling activity and related operational issues. Khoury in a recent paper [START_REF] Khoury | EU tunnel fire safety in action[END_REF] provided a detailed description of what is going on. No less than 7 European consortiums are working in well defined and ambitious research programs or networking activities in relation with safety issues, all of the European authors of this paper are stakeholders in one of several of these. Some data on the mentioned programs are reported in table 2 with their dedicated web sites addresses that allow, once visitors have registered, to know more, track progress of work, and even contribute in some cases as associated partners. table

: major EU sponsored R&D and networking work in progress

All of those projects are indeed considering human factors as a key element in their respective technical programs and deliverables. Other useful European initiatives have recently provided useful deliverables for taking account of human responses in fires and other type of disasters and to develop training interactive tools. These are the NEDIES project (http://nedies.irc.it/default.asp) and the A TEAM project (www.esso.co.at/A-TEAM).

The FIT activity and human behavior issues

As an example of this, the FIT (Fires In Tunnels) thematic network involves no less than 33 partners from 12 European countries, coordinated by BBRI (Belgium). It aims at establishing and promoting networking activities to optimize concerted efforts on fire safety in tunnels. The current activity essentially consists in warehousing appropriate data, sorting and organizing them into web accessible deliverables such as series of user-friendly databases about Fires in Tunnels and related matters [START_REF] Van Dessel | FIT databases, structured and consultable experience[END_REF]. Databases involve records on past accidents, computer models, testing facilities available, etc. In addition, the consortium works at the establishment of technical reports (design fires, other appropriate guidance documents). One of those guidance documents in progress is covering the emergency response management and is available for public comments. Figure 1 just illustrates part of work package 1 which consists in the establishment of a database compiling records of useful traffic tunnel accidents and incidents. Today, the short summary list of these records includes nearly 150 entries covering accidents since the beginning of the XX th century, involving tunnel fire incidents or major accidents in some 20 different countries and containing some 35 records with fatalities. The consortium encourages registered users to comment on existing entries and chiefly add missing reports. One breakthrough of this database is actually the number of entries giving sense to some statistical treatment, including on human behavior. As far as the human behavior is concerned, the database manager promoted the introduction of small incidents as well as major accidents, as the former happen sometimes to be unique sources of valuable information on human aspects, and in particular on unexpected -good or bad ! -human responses to fire incidents in traffic tunnels. From this database, other statements regarding fire safety issues in tunnels in relation with human have been identified. One of those is the fact that human factors are potential sources of failures on the whole life cycle of a tunnel, including construction phase, maintenance and refurbishment works and even 'precommissioning period' and associated inauguration days. This latter view will be developed in due time in the form of a coming presentation to the next Interflam 1 Fire Science and Engineenng conference to be held in Edinburgh [START_REF] Bodart | lessons to be learnt from incidents in tunnels[END_REF].

i*V~ & *• '• i"^*' 1 ''• & • '• '• ';)' "WOHfi «Wit.''. . • , ' i v ^ • • • • s • • '• • • • bus itecoof

The UPTUN program

UPgrading TUNnels is another impressive European collective effort to cope with the existing network of tunnels, which was earlier presented as very developed and bearing heavy traffic throughout the EU. UPTUN stands for "Cost Effective, sustainable and innovative UPgrading methods for fire safety in existing TUNnels". It is a four year research and development project with 41 partners originating from 13 different European countries The whole project indeed is concerned with human response that the Community may bring to further extent safety and reliability in existing underground rail and road structures. UPTUN promotes a holistic approach, focusing on research about human factors, and in particular on the interaction of : a) the operator, b) rescue services and emergency teams, c) tunnel users, since it was clearly proven in past accidents that survivability of people trapped in a tunnel, largely depends on adequate coordination in the behaviors and actions of the three categories of people quoted.

WP3 is entirely devoted to the study of the human response and will comprise behavioral analysis of drivers by use of a simulator and tests involving users in a real tunnel facility in which a fire situation is simulated [START_REF] Uptun | Work Package 3 : report on human behavior (Collective work of EU Research consortium[END_REF]18].

Investigations about incidents and accidents in tunnels

Major tragedies have been analyzed extensively although sometimes confronted to limitation due to the context of litigation enquiries.

At present time, some aspects coming from records of accidents in tunnels dealing with the human response are well known : e.g. :

• 'traffic lights set to red' is not enough to impede drivers to enter a tunnel portal, in the event of a fire • passenger interchanges are particularly critical areas in case of a fire emergency [START_REF] Howarth | Fire Safety Management at Passenger Interchanges[END_REF]. Further careful analysis, as made possible by above mentioned European work may teach more. For instance, keeping inside vehicles seems to be considered in many circumstances as being a safer option than moving out and evacuation to a place of safety or using an emergency exit. Smoky environment is not necessarily perceived immediately as a potential life threat.

The Channel tunnel fire (trans-Manche link between France and UK) (Nov. 1996) [START_REF] Hopes | Tunnel fire offers important lessons[END_REF] This fire was a real warning (in additional to tremendous source of concerns for the operator in terms of repairs and economical consequences), as it outlined potential problems due to inadequate communications systems and to much complicated procedures in case of an emergency. It also outlined that the worse case scenario involving several HGVs in a single fire scenario was an actual matter of concern and should have been taken into account to define appropriate mitigation measures.

The Baltimore Howard street tunnel fire. USA (July 2001) [ 191 This one involved the problem of transportation of dangerous goods through tunnels in urban areas, had significant impact in terms of surface traffic congestion, caused important concern to the fire brigades for access and fire-fighting operations

The Homer tunnel fire (Nov. 2002) in New-Zealand (Nov. 2002)

The fire affected a bus carrying some 50 passengers in a very rustic tunnel without any lighting or safety provisions. The bus driver had the brilliant idea to assist all passengers in their escape through absolute darkness due to smoke by ordering them to chain each other by their hands on their move out of the tunnel : a clear success for which we was officially awarded later on [START_REF] Carvel | A history of fire incidents in tunnels[END_REF]. [START_REF] Carvel | A history of fire incidents in tunnels[END_REF]. Further discussions about human behavior in fires following early analysis of the Daegu metro fire and some other tunnel fire incidents

The Daegu fire tragedy and first lessons to be learnt

The accident took place on the 18 th of February 2003, close to 10 a.m., at the level of the Jungangno station of line 1 linking Daegu Si to Jung Gu Namil Dong (see figure 2), comprising 30 stations in total. The concerned station spreads on some 10 000 m2 of floor area, distributed on three different underground levels : a) third basement contains the platform with access to trains, second basement is the central area with passenger interchange (to opposite platform) and the toll gate, first basement shelters retail stores and staircases. The built environment consists of reinforced concrete structure. Trains circulating in the Daegu metro have an average of about 770 passengers [START_REF] Woon-Hyung | The Daegu metro fire[END_REF].

It is reported that major important facts in the course of events are as follows : a 56 year old arsonist set fire in a first train that had stopped seconds earlier at the platfom by igniting a bottle filled with kerosene. Fire spread to arsonist's cloths and a train seat nearby inside one of the car. Then fire is reported to have spread rapidly into the first train (train 1079). Temperature and heat flux patterns were high enough to set alight a second 6 car train (train 1080) that unfortunately stopped some time after on the opposite platform.

Likely to be known by a majority of the attendees, the toll paid in this fire scenario as a result of these course of events is enormous : 196 people were killed, a majority of the fatalities being found in the second train. In addition 147 were injured, including 10 firefighters. Accordingly, property loss is also very high (figure 3). At the present time, the authors wish to keep prudent in the analysis of this drama. An obvious lesson is that nearly all went wrong, due to a series of technical defects and global inadequate human response of all parties involved.

Human response issues under investigation in technical and litigation enquiries being performed, include :

-Erroneous choices in the design phase of rolling stock (reaction to fire performance of selected components) as considered to state of the art, -Arson act (to be related to mental disability of the guy ?) at the origin of the fire, -problems relevant to the initial response given by the second train driver (stopped at the platform, took of the key, left the train doors locked that resulted in the fact that nobody escaped from train 1080), -problems relevant to emergency response management (who has to do what ? and so on...) ' -saturation of'first aid' services available at hospitals nearby -delayed information to victims relatives and related concerns with the after crisis communication and management.

But the more striking issue is indeed the unexpected behavior of most passengers, waiting strangely in smoke environment as if they were expecting instructions in case of an emergency. The view in Figure 4 is really hard to believe for a European citizen, however the picture was actually captured by one survivor who escaped the carriage before untenable conditions had been reached. Passengers' first reactions in this tragedy were confirmed from the interview of 146 survivors (see table in the right end side of figure 4) [START_REF] Woon-Hyung | The Daegu metro fire[END_REF]. Nearly one half of the survivors were reporting their first cognitive action was just waiting inside train cars. Some other 20% just called up somebody, people that at first moved to another car in the same train account for some other 16%, and eventually, only 7% of the survivors did just the proper first action that had to be done in such a situation : just leave the train ! This statement just means that people just react according to cultural context and available information that they were able to make use of, to decide what to do.

Lessons from other accidents

The next query is how far human behavior in tunnels may be positively influenced by passed disasters in tunnels ? Partial response at least may be delivered from the European scene, by comparing human reactions that were observed, on the one hand in the Mont-Blanc tunnel fire (the first of a series of dramatic fires in tunnels), in 24 th of March 1999, and in the other end during the Tauern tunnel fire, that took place in Austria about two months later. It was indeed reported that tunnel users, who were not directly hit by the initial course of event that led to the fire, in the latter accident, rushed out of their vehicles and promptly rushed out of the tunnel, though the portal was not too far from the fire scene. In Korea, a bus fire took place in the Honggimum tunnel [START_REF] Woon-Hyung | [END_REF] in Seoul that could have had dramatic consequences if other tunnel users that witnessed the situation had not made their mind to behave with altruism by starting the fire-fighting operations by themselves, making use of the fire hydrants normally at disposal for the local fire service. Still more recently, other situations involving bus fires were remarkably well handled due to extraordinary behavior of the bus drivers, there also in Europe (France, Slovenia), as well as in Oceania (New-Zealand) [START_REF] Carvel | A history of fire incidents in tunnels[END_REF], highlighting the importance of influencing 'common public' decision, when confronted to unusual unsafe environment, such a fire in a tunnel.

Memory or sound based judgment seemed thus in those cases to have influenced positively tunnel users' first response (although quite different in the tunnel fire incidents quoted). It would be dangerous of course to rely only on self education of people either from memory or due to professional background. 'Memory' driven behavioral response is just not enough, it may work in some circumstances just by chance. As a matter of facts, a more systemic approach of human factors must be promoted.

Final discussion

At the time, addressing the fire problem within tunnels is much more than considering engineering aspects in relation with time needed for evacuation, as often done in conventional buildings. More basic knowledge on human behavior in tunnel fires is to be learnt from past accidents including happy end events, that must be given the appropriate attention by the operators. The FIT network is there to help in collecting adequately the relevant information and the readers are encourage to use the FIT web site to report on useful incidents that occurred in the past or that might arise in the future. We also encourage them to use the forum organized there for open discussion on the subject.

All stakeholders in tunneling operation (from constructor to tunnel users) must understand the impact of human behavior on survivability in tunnel fires, not only the tunnel users as it was too often the case in the past. Lessons from past incidents also show that differences may anse in behavioral responses of people due to cultural background : this is also to be taken into account appropriately through adequate communication, education and training. Indeed, education is actually a key factor for a better appraisal of safety problems in relation with the event of a fire in a tunnel. Education is considered essential for all stakeholders including tunnel designers [START_REF] Fahy | Human Behavior Modeling as part of an Engineering Design[END_REF], tunnel operators and even regulators. When the question comes to educating the users, should the education of the professional drivers, i.e. rail, bus and coach drivers be a priority for tunnel users ? All of them should receive education in correct emergency behavior, but there is a question of priority to be addressed.

Further research in the field of human responses and performance in tunnel fires is obviously another main conclusive comment to be made.

To the opinion of the authors, adequate experiments, at full-scale in real tunnel environments, such as the one reported by L.C. Boer & J. van Wijngaarden [18] as well as survey interviews of survivors of tunnel fire accidents [START_REF] Hwa | An Interview of Survivors from the Daegu metro fire[END_REF] is considered essential :

• to understand and incorporate behavioral issues of people in the design and operation of all types of traffic tunnels [START_REF] Gwynne | An Investigation of the Aspects of Occupant Behaviour Required for Evacuation Modelling[END_REF][START_REF] Fahy | Human Behavior Modeling as part of an Engineering Design[END_REF] (mass transit systems should be a priority target), including differences due to culture, • to investigate improved options for communications systems within tunnel environments in order to provide instructions to tunnel fire victims, so that they can optimize the usage of evacuation routes to places of safety or emergency exits. An international interview campaign of survivors of tunnel disasters and incident would be beneficial to gain expertise from each other, and to spare time : such a work is being undertaken by University of Greenwich who are studying human behavior issues associated with the World Trade Center Tragedy.

Finally, establishing, testing and training on emergency plans for a variety of emergency scenarios during normal operations of a tunnel is also of prime importance. Major failures in the past were attributed at least partially to the fact this wasn't done properly. As a result, this has been recently made mandatory, in European countries. Regular auditing of fire safety management procedures is also to be encouraged. Harmonization of technical safety measures in addition, as far as possible on a world wide basis is another important target, not necessarily unfeasible... To summarize, humans m a whole, create problems and can solve them.

  last

Figure 2 :

 2 Figure 2: location of the fire in the city of Daegu, 3r town agglomeration of Korea

Figure 3 :Figure 4 :

 34 Figure 3 : train car bum out

Table 1 :

 1

	date	location	tunnel type	length (m)	# deaths
	Oct. 95	Baku (Azerbaijan)	Metro	na	289
	March 96	Isola del Femine (Italy)	road	150	5
	March 99	Mont-Blanc (France-It.)	road	11600	39
	May 99	Tauern tunnel (Austria)	road	6400	12
	Nov. 00	Kaprun (Austria)	rail (cable)	3400	155
	Oct. 01	St-Gotthard (Switzerland)	road	16920	11
	Feb. 03	Daegu (Korea)	metro	na	196

the last series of tragedies from tunnel fires

2001-2004 2001-2005 2002-2006 2001-2004 2001-2004 2001-2004 2003-2006 Web site address www.dartSDroiect.net www.etnfit.net www.uotun.net www.virtualfires.ora www.sirtakiproject.com www.crfDroiect-eu.ora www.safetunnel.net

Acknowledgements

The financial support of the European Commission to the projects FIT and UPTUN is gratefully acknowledged by the European authors.


J X Bouillard

F M B Mercier

L Perrette

ATEX DIRECTIVES : PRACTICAL CONCERNS

The ATEX directives 94/9/CE & 99/92/CE require the industry sector to identify and evaluate hazards and risks associated with combustion explosions of dusts, gas and mists. They require employers to assess the risks of explosions and to provide appropriate worker protection against explosions. Explosions involved in runaway reactions or solvent expansions (ex steam explosions) are not strictly speaking covered by these pieces of regulation but depend on general health & safety at work, chemical substances, or major hazard control (i.e. Seveso) regulations. As a result, workers exposure to explosions and their protection are only partially dealt within the "Explosion protection document" (99/92/CE, art 8). Practical harmonization of regulation and associated governance aspects should involve several national bodies of competent authorities with respective fields of applications. Borderlines between these fields remains somewhat fuzzy making it prone to loopholes that can have serious impacts on workers. New mitigating action is being developed by some EC members. For example, the French silo legislation aiming at regrouping the SEVESO Directive and the Explosive Atmosphere directive (ATEX 137) is being revisited. Similarly, a new piece of legislation regrouping the Chemical Dangerous Agents Directive (CAD) and the ATEX 137 directive, coined as the DSEAR legislation, is being discussed in the UK.

INTRODUCTION

The ATEX directives 94/9/CE & 99/92/CE recently required the industry sector to identify and evaluate hazards associated with combustion explosions (dust, gas and vapor combustion). Explosion phenomena involved in runaway reactions or steam expansions are indeed not covered by this new piece of regulation but depend on general health & safety at work or major hazard control regulations. As such, workers exposure to explosions and their effects is only partially dealt within the "Explosion protection document" (99/92/CE, art 8). Further, statistics show that steam explosions account for more than 5% of accidental explosions that is to say as much as dust explosions. Steam expansion accounts for about 10%. hi comparison, gas or vapor explosion accounts for about 60%.

Unfortunately, the use of water in the process industry is so common that we do not tend to consider it as a hazard. However, the effects of steam explosions also differ from those of chemical ones. Steam explosions are dependent on the confinement mode of water: explosions from enclosed pressurized water do not involve the same mechanisms as explosions caused by the pouring of a melt in cold water. Consequently the catastrophic sequences causing these events are different.

Few cases of explosion accidents are reviewed in this paper: hi particular, the sudden vaporization of water during its contact with a high temperature reactional aqueous bath, the steam explosion from a smoke tube boiler, the steam explosion in an MMWW (Molten Material With Water), small ELEVES from metallic bottles treated in incinerators. These cases are not covered by the above directives. In this sense, it is important that workers and/or their company représentants be aware that such types of explosion are not systematically addressed by the required documents mandated by the regulations. By the same token, this article is meant to warn workers/ engineers of the potential dangers they may be facing on work sites. More integrated and harmonized regulations are becoming necessary. In this perspective, new legislation development trends are illustrated in the example of the French revisited silo storage regulation.

EXPLOSIONS: BACKGROUND

Classical explosions are defined as rapid reactions where two compounds (the combustible and the comburant) mix and are subject to ignition sources. The type of ignition sources usually considered are either thermal or electrostatic sources. The most important explosion parameters are the expansion ratio and the overpressure. The commonly adopted values of the pressure, temperature or volume ratios vary between 5 and 8, while it can reach 1700 for steam explosion. Hence , the apparently innocuous use of water in a process may turn out to be very destructive in some cases, letting sometimes operators in a frantic mood when such accidents happen. An other misleading aspect of some these accidents (see below) is the time delay it can take between the contact of the water and the hot source and the pressure build-up and resulting outcome. The water needs to be first heated to produce enough vapor and pressure. The kinetics of this process is more insidious as it will not directly react to the initiating event as it is in the explosion of ATEX which take place within a few hundred milliseconds.

Similarly, we also note that rapid chemical runways with production of gases, leading to pressure build-ups are not expressly covered by the ATEX directives since they may not involve air as the comburant. They may nevertheless be the central initiating event that can trigger potential operator fatalities. analysis explained the incident as a "conjunction of generalized corrosion to many tubes in the same part, followed by erosion and intense mechanical solicitation applied to the whole weakened tubing as a chain reaction following the breakthrough or the rupture of a first tube". The boiler was severely damaged, pipes and refractories were projected around at 100 m. A worker resulted injured by one of these missiles.

• hi France (1994), the explosion of a smoke-tube boiler killed three workers and injured two others: the body of the boiler engineer was blasted at 150 m away with debris and two other people working in a neighboring plant were buried away by its downfall. Firebox and burner were thrown at 165 m on one side, while the main part of the boiler was stopped by trees at 100 m on the opposite side. Many parts of the boiler, e.g. a 1500 L. hot water tank, were projected at some tens or even hundreds meters. No overpressure damage like glass or tile breakage was reported.

Maintenance default:

reports the case of workers that added a spool in which a steam valve coming from a high pressure boiler began to leak. Since the crew left for the weekend, steam condensed inside what behaved like an enclosure. On Monday, the team began to weld without draining the spool. The welding arc heated the molten weld puddle up to 1540°C and, locally, the spool to the temperature of hot white steel. Weakened hot steel in conjunction with condensate flashed to steam drove a steam explosion that threw molten metal and steam, causing serious injuries to the welder and his helper.

5.INERIS RECENTLY TREATED ACCIDENTS:

First Example: Explosion in a metal etching tank

In this example, a rapid explosion occurred after having let the tank heated during the weekend. The bath contained an aqueous solution of salt loaded with metallic residues. After evaporation, the bath temperature reached a very high value. As the operator introduced the make-up water to compensate for the evaporated water, a strong explosion occurred three minutes after the introduction of the water. The explosion displaced the 3 ton tank, blasting away the 300 Kg cover latch and producing a 5 meter high column of hot liquid springing from the tank. . The operator was partially burnt and lost 30 % of his hearing due to the explosion pressure wave.

A schematic drawing explains what happened during this accident. The analysis of this accident led to the recommendations which consisted in replacing the obsolete temperature control system of the etching tank and in providing physical barriers (equipment, glasses, gloves) to the operator.

Second Example: Smoke Tube Boiler Explosion.

Water circuit can be seen as one of the weakest element of the boiler. Erosion in this circuit can induce enough leakage to cause a steam explosion. Yet damages resulting from steam explosion in smoke-tube boilers are to be expected greater than those for water-tube boilers, since smoke-tube boilers parts like tanks, tubing and firebox work at high pressure.

Among external aggressions, fire is the most frequent hazard and the most dangerous in term of BLEVE : fire provides an additional source of energy that is susceptible to rise the thermodynamic state of the fluid. The energy brought by fire to the container is immediately used to evaporate more liquid, and so contributes to rise the pressure inside the vapor-space. Moreover the mechanical resistance of the vessel may drop considerably when exposed to fire. The vapor-space walls are more likely to fail since the part of the wall tank in contact with the vapor phase is more likely to suffer plasticity due to the fact that gas-solid heat transfer rates are significantly smaller than solid-liquid ones. Fire exposure also induces thermal stratification within the vessel due to buoyancy. This has been shown by Birk and Cunningham to be favorable for the resistance of vessels fitted with PRD. The upper water layer is the warmest. It controls the pressure in the vapor phase and therefore controls the PRD. Thus the PRD releases for an overpressure in the vapor that corresponds to a lower overall energy level compared with a situation where the tank has a uniform temperature. If an initial crack in the shell stops before the total collapse of the container, the liquid can play a role in the destruction of the vessel. In this case, when stratified, water will be less able to drive the tank to a BLEVE. In the UK, in the steel industry, 175 tons of molten from a furnace were run into a torpedo ladle. A substantial water leak was observed coming from the furnace. The water ran down the casthouse floor and entered the torpedo ladle. The explosion ejected 90 tons of metal. Eleven workers were killed and 8 injured. The water leak was probably due to heat exchanger tube bank failures.

Fourth Example: Explosions in Incinerators

Figure 5. Side view of an incinerator Wastes are pilled up and fed through a hopper (A). As they reach the furnace interior, they are mechanically pushed onto a mobile grid (B). This grid (sliding or rotary) conveys at slow speed the bulk of combusting waste (about 50 cm thick) from one side to the other of the furnace. Furnace temperature is about 1000°C. Hot primary fresh air (from 100 to 150°C) is fed underneath the grid and passes through the layer of combusting waste. Secondary fresh air is fed directly to the side of the furnace. This secondary air is dedicated to bum out any remaining combustible gases contained within fumes. The furnace chamber is constituted with heat resistant material. This material provides inertia to the furnace through heat retrocession. Most of the combustion takes place as wastes are travelling along the first half of the grid. Ashes fall down through the grid and are collected into a set of hoppers (C). Larger size non combustible materials (metals, clinker...) fall at the end of the grid into a water flooded conveyor (D) that cools down remaining materials.

Fumes are extracted through large heat exchanger chambers (E) which walls are made up with water filled pipes (boiler circuit). Heat is recovered as fumes are cooled down from about 1000 to 200°C. As a final stage (F) fumes are chemically and mechanically treated prior to be released to the air.

Common type of explosions in incinerators are due to the lack of quality control of wastes fed into the unit. For example the use of fertilisers fed into incinerators may produce explosive combustion leading to serious damage of the unit and injuries to the operating staff. Another type of explosion can be attributed to liquid/aerosol metallic bottles run through these units. Resulting missiles effects can promote erosion of the heat exchanger tubes located in the boiler section. The bursting of these pipes may lead to steam explosion of the boiler section where casing doors have been torn and flung away.

From the accidentology of these units, it appears that erosion/corrosion of heat exchanger tubes is a recurring event for such explosions. It is therefore important to understand particulate erosion for such processes. A great effort has been made by Bouillard and his co workers for the last 10 years to understand the under lying mechanistic phenomena of particulate erosion.

Legislation in Europe and in France

Transposed Legislation in France

The analysis of explosion accidents may fall under several legislations. A summary table of European and French Legislations is shown in Figures 8 and9. These figures display the main European pieces of legislation for ATEX, pressure vessels, chemical agents, transport of dangerous goods and their correspondence with the transposed French texts.

From the inspection of these regulations, the reader can note that these texts do not cover directly the explosion scenarios discussed above, because these types of explosion are not depicted as the classical explosions defined in the ATEX Directives, nor are they specifically referred to by the chemical agents or the dangerous substances directives.

It is unfortunate that the required document (Directive ATEX 99 ) relative to the worker prevention and protection of explosions, written by the employer does not cover the early described types of explosion. It is one of the concerns of this piece of legislation. The ATEX 99 directive has been conceptually constructed and based on the premise that an explosion requires three simultaneous necessary phenomenological ingredients: 1) The presence of combustible, 2) The presence of comburant and 3) the presence of an ignition source. Unfortunately, these ingredients are not the prerequisites for the steam explosions as discussed above, and hence will not be described in the ATEX document; though such a document is meant to protect worker's lives. From the worker's point of view, it does not matter what mechanism govern the explosions, rather it is their effects on human lives that count. It is the reason why legislations should be combined or regrouped into new ones with adequate proper guidelines, so that all aspects of explosion are treated simultaneously so as to protect worker's health and safety and his environment. This new regulation aims at protecting the population (internal and external to the site) and the nearby environment from accidents stemming from large scale storage of grains, cereals, foodstuffs and all other products susceptible of yielding combustible dusts, classified under the item 2160 of the SEVESO Directive (French Nomenclature). The employer must file a safety report in which he must show that he has carried out a risk analysis that takes into account the probability of occurrence, the kinetics and gravity of potential accidents.

Furthermore, he must show that he implements adequate prevention barriers in order to reduce the probability of these accidents. The employer must nominate a site silo and safety specialist who is in charge of the site safety and in particular the safety report. The site staff must be adequately trained with the use of safety training packages that have to be regularly adapted and validated by the employer.

hi terms of technical means of prevention, the revised legislation demands the following requirements:

• Loading and unloading areas must be located outside the silo; These areas must be equipped with a dust extraction system. • Self heating of organic materials should be properly controlled • Regular installation cleaning should be performed in order to reduce the possibilities of dust cloud explosion. Permanent dust collection systems can be used to this effect. • Proper land planning is required on site. Nearby construction of buildings, roads or rails should be made outside a given perimeter from the silo. • Silo cells should allow inerting capabilities in case of the development of a fire.

hi terms of protection, subunits should be decoupled, adequate venting and/or pressure relief systems should be implemented, operation buildings (i.e. control rooms) should be explosion resistant and proper fire detection and extinguishing capabilities should exist and be in working order.

As can be seen, we observe the development of a specific ATEX regulation applied to silo storage of potentially explosible materials. This regulation is a step forward, going beyond the ATEX directive in the sense that it applies to major accidents legislation (SEVESO Directives). It is one illustration where the ATEX and SEVESO Directives are combined into a new piece of legislation. This text will tend to fill in the commonly acknowledged loophole application of the ATEX directive: This directive being often thought as one mainly concerned by the day-to-day local explosion prevention and protection in the work place without direct implications on major accidents. hi this new French piece of legislation, ATEX directives are to be fully integrated to the SEVESO directives.

Conclusions

As new regulations develop, they are increasingly becoming more harmonised, designed to integrate all aspects of explosion regulations. At the present time, past accidents have shown that seemingly innocuous water based processes can have indeed severe explosion impacts on site workers, and should therefore not be ignored.

At an European level, ATEX 99 directive requirements are being incorporated in other regulations such as the occupational health and safety (Directive 89/391) for the elaboration of the unique document . At the national French level, the ATEX 99 requirements are slowly coming forward into new pieces of legislation such as the silo storage regulation, hi the same vein, the British DSEAR regulation regrouping the Chemical Dangerous Agents Directives (CAD) and thé Explosive Atmosphère Directive ( ATEX 99) has been designed to accomplish similar goals. We undoubtedly assist at new trends and a willingness to combine, integrate and harmonise regulations in order to simplify the legislation body so as to converge towards a same purpose.

Figure 1 :Figure 2 :

 12 Figure 1 : Schematic illustrating the explosion in the etching tank

Figure 3 .

 3 Figure 3. projected piece of a smoke tube boiler after a steam explosion

Figure 4 .

 4 Figure 4. spout of a BLRB after explosion

Figure 9 . 2

 92 Figure 9. Correspondence between European and the French National Legislation for Workers Health and Safety

Figure 10

 10 Figure 10 View of the BLAYE site before the accident

REVIEW OF SOME ACCIDENTS (BARPI)4.1 Common domestic heater: Mooney reports a steam explosion of a 19 liters electrical hot water heater due to the conjunction of a defective pressure-temperature safety valve and a corroded drum. Fortunately there was no other damage than a blasted wall.4.2 Industrial Boiler:• hi France (1984), the explosion of a water-tube boiler used to produce 100 t/h of steam at 82 bar and 475°C resulted from the rupture of its tubing. Postmortem


David Hourtolou
email: david.hourtolou@ineris.fr

Olivier Salvi

ARAMIS Project: Achievement of the Integrated Methodology and Discussion about Its Usability from the Case Studies Carried Out on Real Test Seveso II Sites

Introduction

Some recent technological accidents like Enschede (2000), Toulouse (2001) or Lagos (2002) have led the public to wonder or even mistrust both the industry and the regulatory authorities in their riskinformed decisions. The communities want now to be informed and require more transparent decisionmaking processes. Risk-based decisions of course require some reliable scientific input from risk analyses. But from one risk analyst to the next, noteworthy variation exists in the results, which would affect any relevant and local decision (ASSURANCE project, 2002). That is why emerges today the need for a methodology giving consistent rules to select accident scenarios and taking into account safety management effectiveness for risk control demonstration. In the context of Seveso II directive, there is also an underlying need for a method that could reach a consensus amongst risk experts throughout Europe.

ARAMIS overall objective is to build up a new Accidental Risk Assessment Methodology for Industries that combines the strengths of both deterministic and risk-based approaches. Co-funded under the 5th EC Framework Programme, this three-year project started in January 2002. A mid-term workshop was already organised in June 2003 in Maastricht and aimed at disseminating first results and collecting comments from the audience. One year later, the basic methodology is achieved and aims at becoming a supportive tool to speed up the harmonised implementation of SEVESO II Directive in Europe. This paper intends to summarise the major features of the methodology and to show how the needs of ARAMIS potential users were addressed. In a second part, the objectives of the case studies that are presently under progress will be discussed.

Five main tests will be carried out on industrial plants, in countries with a consequence-based approach (France and Denmark) and a risk-based approach (Netherlands). The full test of the method in two future EU countries (Slovenia and Czech Republic) should also contribute to the dissemination process towards these countries, whose issues in terms of risk management can be slightly different from those of western-European countries.

Needs of potential ARAMIS users

The potential end users of ARAMIS are numerous but the most concerned are the industrialists, the competent authorities and the local authorities. If all of them have an interest in the same risk management process, their needs are slightly different. Industrialists need a method to identify, assess and reduce the risk. This method has to be accepted by the competent authorities. This method also has to bring useful information about the ways to reduce the risk and toman age it daily. The competent authorities need to be able to assess the safety level of the plant, particularly through the safety report. They need to know why scenarios have been kept for modelling of consequences. Both need to assess the influence of the management on the safety level. The industrialist to be able to improve its management to reduce the risk and the competent authority to assess a true risk level which takes into account this major influencing factor. About 80% of the major accidents have causes related with human and organisational factor, which is a sufficient reason to take these aspects specifically into account.

The local authorities are interested in land use planning issues. They need to have a clear report about the risks or hazards their population actually faces. They also want to get information that can be used as a decision-aiding tool to define priorities or choose among alternatives. Basically, their capacity is about reducing vulnerability either by limiting the number of targets exposed to the risk or by introducing obstacles between the source and these targets. They also need to trust the industrialists and competent authorities when they propose risk or consequence-based contours from scenarios.

The aim of ARAMIS was to answer all these needs. It was also to make the convergence between the deterministic approach and the probabilistic approach and to resolve some difficulties inherent to each of them. These limitations have been discussed by Christian Kirchsteiger [Kirchsteiger 99]. As far as the deterministic approach is concerned, the limit deals with the difficulty to justify the choices of the reference scenarios used for land-use planning decisions. Most of the time the selection is not about worst-case scenarios but an implicit choice is made to eliminate those which seem too improbable. For the probabilistic approach, the difficulty resides both in producing the probability data and in interpreting the results to take appropriate decisions. ARAMIS does not completely solve these difficulties but furnishes the tools and the structure to improve decision-making. It also provides a framework for the definition of further research programs as discussed in the last paragraph.

Main features of the ARAMIS methodology

ARAMIS is divided into four major steps (figure 1).

Definition of the reference scenarios • identification of the major accident hazards (MAH)

• definition of safety systems • definition of the reference accident scenarios (RAS) 2. Assessment of the management efficiency 3. Risk severity mapping from the set of Reference Accident Scenarios 4. Vulnerability mapping representing the sensitivity of one plant's surrounding environment A last step involves the crossing of this information for decision making

Identification of the major accident hazards (MAH)

MIMAH [Delvosalle 04] is the method for the identification of major accident hazards. It is based mainly on the use of bow-tie diagrams (figure 2), composed of a fault tree and an event tree. The major input of ARAMIS was to define a precise bow tie structure and to define precisely and exhaustively the list of equipment, potential critical events and their consequences. The critical events were defined to be either losses of containment for fluids or losses of physical integrity for solids. The complete list contains twelve critical events including breach, collapse, explosion, etc.

From a description of the plant including the chemical substances used, produced or stored, it is possible from MIMAH to list of all the critical events susceptible to occur in the plant. Then, for each of these critical events, MIMAH allows to identify all their consequences in terms of secondary events and dangerous phenomena.

Then, MIMAH provides the user with a set of generic fault trees, which are based on the most frequently observed causes. From these generic fault trees, the user will build specific fault trees that take into account the specificity of his plant: types of process used, presence of equipment, etc. The specific fault trees are obtained mainly by the suppression of causes and consequences which are not relevant to the context without any consideration on probability at this stage. It is important to notice that both the fault and event trees are considered without safety barriers, which will be defined in the next step of the method. This has the advantage to make an explicit distinction between hazard and risk. This first step allows the identification of hazards. The next one aims at identifying the risks which result from the hazard scenarios and the failure of safety barriers.

An alternative to classical probabilistic approaches

Standard risk analysis methods propose to assess the probability of major accident and to decide from this evaluation whether the risk is acceptable or not. But, during the ARAMIS project, this calculation of the probability was shown not to be an easy task. An inventory of the probabilistic data sources was carried out. It turned out that many of the available data are not adapted for use with the tools developed in the first steps of the methodology. Others were obtained by statistical methods in limited geographical areas like the Netherlands and are therefore not extendable to the whole Europe. Only very generic frequency ranges could be obtained for the critical events' causes, which hindered the possibility to rely solely on the probability of events.

However, one main objective of ARAMIS was to valorise through contextual frequency data the efforts realised by the operators both in prevention and mitigation. Generic frequencies of critical events are not suitable for that purpose and contextual frequency data is hardly available onsite.

An alternative method was proposed, which focuses on generic values on safety systems and clear guidelines to lower the final frequency of identified scenarios. First, it aims at helping the user with the definition of the safety requirements applying to its plant. These requirements are defined according to the initial risk level without barriers. This means that an initial coarse calculation of the probability is made and that a consequence level is assigned to the major effects independently to any vulnerability of the surroundings. Then, the method helps the user to define the safety barriers [Debray 04] by promoting the concept of safety function and by providing different possible strategies of barrier implementation for a given safety function.

The frequencies of resulting scenarios are then evaluated from the frequency of the initiating event the probabilities of failure of the different safety barriers implemented, according to principles derived from the SIL concept (Safety Integrity Level) available in IEC 61508-61511 standards. Among the scenarios, which result from the application of the safety barriers, only the phenomena that range from 10" 6 /year to 10" 8 /year (figure 2) are kept for further calculation of risk severity. These are called the Reference Accident Scenarios (RAS).

Defining the safety requirements

As it can be understood from the previous paragraph, the definition of the safety requirements is a keystone of the ARAMIS methodology. The proposed method is inspired by the IEC 61508 standard.

The idea is to guide the user in the identification of the risk reduction goal that should be associated with different scenarios (table 2). This approach has a triple interest. It helps the user improving its management of risks by defining clear targets. It helps the competent authorities checking the risk reduction for the same reasons. It provides an evaluation of the residual risks. The way it was built also reduces the stress put on the quality of probability values.

To define the safety requirements, four consequence classes were defined and associated to the major effects independently from the intensity of the considered phenomenon. For example, a fireball will always be assigned a consequence class C4 (irreversible injuries or death outside the site) whereas a jetfire could only be considered as C2 (Injuries leading to hospitalisation). The consequence classes also reflect the possibility of domino effects. In this case, the consequence class attributed to a given phenomenon is increased potentially generated by escalation.

The risk graph (IEC 61508) in figure 2 sets then the levels of confidence in the barriers which should be applied to reach the safety objective, i.e. the risk reduction goal defined in the matrix, namely to make the risk residual or even negligible. This risk graph takes also into account an exposure frequency parameter -(Ti if the targets are exposed less than 10% of the time T 2 otherwise) and a parameter linked to the capacity to avoid the consequences (kinetics is long enough and emergency measures are robust enough). The frequency classes are linked to the initiating event ofthe scenario and ranges from PA (F<10" 4 /year) toP D (F>10' 2 /year).

Once this work carried out in risk analysis, the resulting dangerous phenomena can then be ranked according to their classes of probability and consequences. The Risk Matrix in figure 3 has been devised for this purpose. The middle zone highlights the scenarios that can be selected for quantitative modelling then risk severity mapping. The upper zone means that not enough barriers have been implemented and risk cannot be tolerated. The lower zone finally states that enough layers of protection are present in order not to select the scenario for e.g. land-use planning purpose but rather emergency planning. The limits were proposed within the project from our extended review but they should be discussed in principle in each country.

Level of

Cl I C2 I C3 I C4

For any risk path (i.e. scenario) composed of a minimal cutset in the fault tree and a branch of the event tree, a couple of exposition level X j and event probability Pj can be calculated. For each of them, the risk graph proposes a value of confidence class to be reached by the entire set of barriers applied to the risk path. When several barriers are applied on a single risk path, the confidence class is the sum of the individual confidence classes of the barriers.

Frequency of the critical event : F The bow-tie diagrams turn out to be a very powerful tool to communicate about risks, in particular towards non-technicians (managers, politicians, etc.). However building-up a bow-tie could become very rapidly quite time-consuming. That is why in the context of ARAMIS, we also searched for a method to select the most appropriate equipment and critical events within an entire plant to build up bow-ties upon. This is also part of the MIRAS methodology.

Allocating risk reduction objectives and evaluating explicitly the performance of each safety barriers is a very fruitful work to be performed in risk analysis, especially for the operators. It allows to discuss directly the safety strategies onsite through the architecture and implementation of barriers. The levels of frequency derived from the SIL principles also allow to use quantified data when these exist but also qualitative estimation from work group judgement when no data is available. This allows a maximum flexibility but requires anyway at some stage a consensus about the initiating event frequencies and barrier levels of confidence in order to ensure a minimum variability in the resulting evaluation of scenario frequencies.

Assessing the influence of management and safety culture

The management has a strong influence on the capacity to control the risk. Here again, the interest of ARAMIS is to provide tools to assess the safety management system (SMS) and the safety culture and to allow their taking into account by the competent authorities as well as to help the operators identify the opportunities for improving safety management. The approach in ARAMIS [ Duijm 04] consists in devising a process-oriented audit protocol focusing on the activities relating to the life cycle of the safety barriers. This life cycle includes design, installation, use, maintenance and improvement activities. For each, ten important structural elements are evaluated as requirements for the SMS. The outcomes of the audit are then compared to the results of a safety climate questionnaire collected from employees in order to get a contextual level of confidence, in particular regarding behavioural barriers.

The questionnaire is made up of eight cultural factors that characterise a company's safety culture.

learning and willingness to report safety prioritisation, rules and compliance leadership involvement and commitment risk and human performance limitation perception felt responsibility trust and fairness work team atmosphere and support motivation, influence and involvement From paragraph 3.3, each type of barrier is given a generic level of confidence indexed on its probability of failure on demand. These indicative values require then to be adjusted from the local context where they are implemented and maintained. For instance for a behavioural barrier, we would like to adjust the generic confidence in the barrier depending on whether the operator knows the stakes of his actions, or his decisions require complex diagnosis, conflict with production. The aim of the project was also to aggregate the results from the auditing and use of questionnaires into a final score for adjusting -possibly loweringthe generic values into contextual ones.

This link and the whole scoring process is obviously an ambitious goal and still needs to be worked out in the project. The case studies already help getting some benchmark between different types of management and will allow eventually to propose a set of "minimum requirements" for both the culture and management system in order to anchor a first scoring scale. This remains however an important area of research.

Risk severity assessment and mapping

Each reference accident scenario (RAS) is defined by an initiating event that leads to a critical event, which can potentially lead to different dangerous phenomena. For each phenomenon, a specific severity index has been defined [Planas 04]. The aim is to measure and compare the severity of any dangerous effect with a single scale ranging from 0 to 100. This should allow the comparison of risks of different nature. Depending on the phenomenon, different severity levels were associated to different amplitudes of the considered phenomenon. One major difference between ARAMIS and usual quantitative risk assessment is our purpose to study separately the vulnerability and the severity from the potential accident scenarios. In this respect, we could not use any Probit function to quantify the severity but had to define thresholds for each phenomenon (table 3) in order to characterise intensity. Even though these thresholds can sometimes be derived from Probit functions (thermal load and toxic load), they above all require consensus first from the competent authorities of the Member States, which we do not have for the moment.

For each RAS, a risk severity map is then produced. Risk severity is defined for one scenario as the combination of the level of frequency with the intensity of the effects. The combination of risk severity with the vulnerability of the targets produces the actual risk. Risk severity can be represented for each scenario in a geographical way, as a function SRAS(D) of the distance from the source term.

>RASV U 7-

In this equation n is the total number of dangerous phenomena (DP) associated to the RAS; PDPÎ is the probability of occurrence of each DP ( ; and S opi (d) is the specific severity index associated to the DP f .

The final mapping of risk severity is then obtained by multiplying the frequency of each RAS with its specific risk severity index:

Eq -2
Where n is the total number of dangerous phenomena considered taking into account all the RAS corresponding to the installation. More elaborated formulas were proposed for anisotropic risks. Risk severity mapping as it is defined makes sense and gives very useful information to a decisionmaker to elaborate relative priorities for land-use or emergency planning purposes. It also makes sense to disconnect the vulnerability study from the hazardous installation for the same reasons. However, the range of values obtained with such an approach still requires to be interpreted. We now rely on the case studies to help characterize the magnitude of this value and eventually define some references for the global risk severity index by the end of the project.

Assessing the vulnerability

The last innovative attempt from ARAMIS is to address the vulnerability of the environment independently of the hazardous site [Tixier 04]. This has the fundamental interest of allowing the local authorities to take useful decisions to reduce the global risk level by reducing the vulnerability whereas the industrialist only can act on the potential hazard or risk of the installation.

The vulnerability is calculated on the basis of a multicriteria decision-aiding approach (AHP, Saaty). With the development of new ways of governance involving local population in risk-informed decisions, the main interest of this approach is to base the vulnerability study on any stakeholder risk perception through expert judgement elicitation. On a given spot of the environment, the vulnerability is thus characterised by the number of potential targets and their relative vulnerability to different phenomena. The global vulnerability is a linear combination of each target's own vulnerability.

V global = a.V H + p.V E + y.V M Eq. 3

Then, each type of vulnerability is a linear combination of the vulnerability to each type of effect.

V H = a,.V H surp + a 2 .V / + a 3 .V H tox + a 4 .V H po11
Eq. 4

For each effect, the vulnerability is a linear combination of vulnerabilities on different types of impact (health, economical, psychological impact).

V H SUfP =X, H .VH surp ' san + y i ".VH swp>ec°+ ZI H .VH surp ' psy Eq. 5

For each type of impact, the vulnerability is also a linear combination of the numbers of different types of target components. For example, the human target is composed of staff onsite (Hi), local population (H 2 ), population in an establishment receiving public (H 3 ), users of transportation ways (H 4 ).

V surp,san = H surp,san H surp.san H surp.san H surp.san -

H -"1 • • '• • '• 1 ' "l • * L 2 ' M • -**3 • w l • "4
The quantification factors Hi are normalised to fit into a 0 to 1 scale.

The application of the methodology has generated a questionnaire that can be used or adapted very locally to elicit from any stakeholder judgement their own perception of vulnerability. The equations have been then interfaced to GIS1 tools (Maplnfo, Arc View and Geoconcept) for easiness of target inventory and quantification. The GIS allow a very quick mapping of felt vulnerability (figure 5).

Figure 5: human vulnerability map (right) obtained from the land cover information (left)

The tool is very flexible and offers a large range of available maps considering the type of decisions to be taken: per type of target, per type of effect or overall maps. The figure 5 shows an example of human vulnerability drawn from the available land-cover information.

Even though it is interesting to base the vulnerability study from the stakeholders risk perception, the outcomes (i.e. the quantification factors) can be discussed. For a relevant discussion, a sensitivity study should have been carried out within the project. The case studies will be used to some extent for that purpose but will not be developed in-depth enough to get precise answers during the project.

4

Cases studies

ARAMIS has now reached a certain degree of completeness, which allows to consider its test through different case studies. These are now under progress in different countries of the European Union. The following paragraphs make a summary of what is expected from these case studies and how they will be carried out.

Objectives of the case studies:

The case studies have several complementary objectives. The first one seems obvious. It is to check the applicability of the method. This will be done by addressing the following issues: a Is the global method understood by the users ? The different modules of ARAMIS were developed by partners of different European countries and different scientific or industrial cultures. It is now a big challenge that the global method be understood and applied by industrialists, competent authorities and local authorities, a Are the data needed by the method easily available ? A particular focus will be put on frequencies of events for which it was very difficult to obtain trustable generic data and on data about the confidence levels of safety barriers. But the same can be true with the geographical information required for the evaluation of the vulnerability, or even information on the process needed for the calculation of consequences. a Are the links between the different ARAMIS modules easy ? Different partners developed the modules of the method and, despite a good communication during the development process, only the case studies can give the evidence that the outputs of one module really are an input to the next module. No doubt that some adjustments will be made after the case studies.

Beyond the applicability, the case studies will also consider the efficiency and the relevance of the whole methodology: a Is the method as efficient as already existing risk analysis methods ? This question will be answered by comparing the results obtained by using ARAMIS with the results obtained by methods such as H AZOF or FMEA. Even if no other method has the same level of integration as ARAMIS, which treats in a consistent way all the process of risk management from the source to the vulnerable environment, it is important to check that basic needs covered by traditional tools are also well addressed by ARAMIS. • Does the method answer the needs of its end users? Can the results be easily exploited? This question is of course a major one. As mentioned in the introduction, ARAMIS has several potential users with different needs. Now a key aspect of the methodology is to answer these different needs with a unique method because all actors need to be able to communicate and discuss on common results and information. To answer satisfactorily this question, the case studies take place in different national and industrial contexts. In each situation, the expectations of the local actors were characterised. These will be discussed in the next paragraph. a Is the method adapted to different types of industries, different sizes of plants ? SEVESO II sites can have very diverse activities and configurations. The composition of the case study set aims at reproducing this diversity. a Is the method adapted to different national contexts? As a European Methodology, ARAMIS must comply with the requirements and uses of all the countries of the European Union. A particular focus is put on the Newly integrated countries where industrial risk issues may differ from those in the western part of Europe.

Sites and contexts of the case studies

Five establishments were chosen in five different countries: Czech Republic, Denmark, France, The Netherlands and Slovenia. Each of these countries has its own culture for risk assessment and risk management and faces particular stakes in prospect of a convergent European methodology. France and Denmark have a rather deterministic approach, which has shown some limits, particularly in France with the Toulouse accident. The approach does not allow for flexibility and does not give the opportunity to enforce land-use planning regulations appropriately. The Netherlands is in a different situation. The country has been for a long time a pioneer of the risk-based approach. But the outputs of risk assessment (risk contours or F-N curves) are difficult to visualise then to communicate upon towards decision-makers. For both countries, a barrier-based approach and a distinct mapping of risk severity vs. vulnerability is easier to communicate and structure local negotiation among stakeholders. Czech Republic and Slovenia joined the European Union in May and will face different challenges in applying the Seveso II directive.

The industrial sites are also of different kinds:

• A refinery, where fire and explosion hazards will prevail.

• A chemical plant, with hazardous reactions and storage of chlorine and phosgene.

• A chemical plant using ethylene with polymerisation hazards as well as fire hazards.

• A paper mill, with explosion and toxic hazards.

• A hydrocarbon storage facility, with fire and VCE hazards but simple process.

These case studies are only a first step to assess the exhaustiveness of the method by checking whether it can apply to different types of activities and industrial cultures. It will also show to a limited extent the capacity of the method to answer different local needs such as competent authority control or land use planning. From a scientific point of view, the validation process should be much longer and wider but unfortunately cannot extended within the framework of the project.

Research issues emerging from the ARAMIS project

The risk assessment method described in this paper, ARAMIS, is the result of a voluntary step towards a harmonised approach of risk analysis on SEVESO II industrial sites. ARAMIS has the ambition to solve some of the difficulties encountered with traditional approaches by providing very practical tools in an integrated methodology. Of course, everything is not completely consolidated yet. Some aspects of the methodology will be clearer after the case studies. But the ARAMIS project already points out the need for an increased research effort in a series of specific fields.

The first of them is linked to the difficulty to find reliable data for the calculation of accident probabilities. Even if the solution proposed in ARAMIS, the barrier approach, reduces the consequences of such a lack, a lot could be done by unifying the efforts of the industry and research institutions to build accessible databases containing useful information that would be complementary to traditional reliability databases. The quantification of the influence of management on the probability of accidents is also a key question, which will not be resolved in the course of the project.

A third field of research relates to the evaluation of vulnerability. ARAMIS already proposes an interesting definition of vulnerability and a set of screening tools to build vulnerability maps. A next interesting result could be to provide more detailed tools to help decision-makers identify what can be done explicitly to reduce the vulnerability.

Other questions were raised by the project such as the definition of the unique risk severity index, which implies to be able to compare different types of effects among them. Suggestions were made in the framework of ARAMIS. But the project also highlights the remaining questions and lack of common agreement on many effect thresholds. The interest of ARAMIS is also to provide the right frame to define both requirements and means of valorisation for this future research.

Conclusion

The ARAMIS methodology was briefly described in this paper. It aims at offering an alternative way to the traditional risk-based and consequence-based methodologies for risk analysis by providing a series of integrated tools. These were designed to answer the specific needs of potential ARAMIS users who are industry, competent authorities and the local authorities. They were also elaborated to solve some of the difficulties raised by the lack of reliable data, namely concerning the accident frequencies. By promoting the barrier approach, ARAMIS helps the users define the safety requirements, which apply to its plant, and therefore helps the competent authorities verify the explicit control of risk by the operator. This approach also allows an easy and explicit identification of the reference accident scenarios, making the communication between the stakeholders easier or at least more straightforward and structured. The same should be true with the approaches of the severity and the vulnerability, which are exploited through a clearly understandable graphical representation.

The case studies, which are now under progress, will confirm the achievement of these goals and help resolve some of the difficulties, which remain for a complete integration of the method. They will take place in five European industrial sites. These were chosen to reflect the cultural and industrial diversity that can be encountered now in the newly expanded European Union.

Eventually, ARAMIS also sets the framework and the objectives of future research on diverse specific fields among which are the production of reliable accident frequency data, the quantification of the influence of management on the accident probability, the vulnerability reduction options or the effect threshold definition.

Figure 1 :

 1 Figure 1: Summary diagram of the ARAMIS methodology

Figure 2 :

 2 Risk graph. It determines the required LCs (Levels of Confidence) to make risk acceptable as shown in figure 3 LC requirement to make the risk acceptable 2 1 a -Resulting probability of danger, phenomenon 10 °10 3LC requirement to make the risk acceptable 3

  path considered for use in the risk graph. Barriers can apply either on the lefthand side (prevention) or the right-hand side (mitigation) of the bow-tie

Table 2 : Definition ofthe Levels of Confidence in the barriers

 2

	Confidence	Risk	Reduction	Equivalent	Probability	of	Equivalent probability of
	in a barrier	Factor		Failure on Demand (PFD)		failure per hour
	4		10 000	>10-5 to <\VT		>10-9 to<10' 8
	3		1000	>Kr*to<l(r 3		>10 -8 to<10' 7
	2		100	>10' 3 to<10-2		>10-7 to <10' 6
	1		10	>10-2to<10''		>10-6 to<10' 5

year Figure 3: Risk matrix used for ranking the dangerous phenomena and selecting the Reference Accident scenarios for the risk severity mapping

Table 3

 3 presents an example of severity values associated with intensities of dangerous phenomena. The user is free to use any model he considers relevant for modelling intensity along distance.

	SDPI	Overpressure (mbar)	Radiation (W/m 2 )
	0	0	1
	25	30	1800
	50	50	3000
	75	140	5000
	100	250	8000

Table 3 : Severity levels associated with different intensities of effects

 3

GIS : Geographical Information System

ACKNOWLEDGEMENTS

The work presented in this paper has been elaborated in the frame of the EU project ARAMIS "Accidental Risk Assessment Methodology for Industries", co-ordinated by INERIS (F) and including EC-JRC-IPSC-MAHB (I), Faculté Polytechnique de Mons (B), Universitat Politècnica de Catalunya (E), ARMINES (F), Ris0 National Laboratory (D), Universita di Roma (I), Central Mining Institute (PL), Delft University of Technology (NL), European Process Safety Centre (UK), École des Mines de Paris (F), École des Mines de Saint Etienne (F), École des Mines d'Alès (F), Technical University of Ostrava (CZ) and Jozef Stefan Institute (Si). The project is funded under the Energy, Environment and Sustainable Development Programme in the 5 th Framework Programme for Science Research and Technological Development of the European Commission.