Romuald Salmon

INERIS Marie Degas

Rémy Gobillot

Mine shafts in Nord -Pas-de-Calais coalfield (France) Risk assessment and Treatment technique

In France, coal concessions abandonment is fixed by legal procedures that lead the owner to achieve studies for the identification and the assessment of residual risks associated with underground mine workings. If necessary, treatment techniques must be defined in these studies in order to mitigate the associated risks for the population and future land planning.

The multiplicity of mine shafts in coal mining areas have created many present-day problems. The main risks associated with mine shafts are the sudden collapse of their column and gas explosion, asphyxiation and/or intoxication.

The Nord and Pas-de-Calais coalfield extends 100 km from East to West and 15 km from North to South. Coal exploitation induced the sinking of more than 600 shafts from 1716 to 1960 widespread over 41 concessions.

The paper describes the work accomplished by INERIS and Charbonnages de France for mine shafts vicinity security :

• Part 1 : Risk assessment methodology : The aim of this part is to identify and evaluate risks associated with mine shafts. A methodology has been developed by INERIS to ease this analysis because of the great number of shafts ;

» Part 2 : Treatment techniques in Nord -Pas-de-Calais coalfield : The scope of this part is to describe the techniques involved in the treatment of mine shafts. The treatment technique must be adapted to the nature of risk as identified thanks to part 1 as well as the surface occupation.

Introduction

The multiplicity of old mine shafts in coal mining areas have created many present-day problems, particularly when the existence or location of shafts is not known. Many European countries are concerned about the assessment of risks issued from the presence of old mining shafts.

Protection of threatened population is an important worry from States and concerned local authorities. Therefore, it is of great importance to improve diagnostic tools and modelling as well as to enhance techniques for location, prevention, protection and treatment of risks.

The aim of this paper is to adress the state of the art in terms of risk analysis relating to mine shafts in Nord and Pas-de-Calais coalfield.

Context of shafts in Nord and Pas-de-Calais coalfield

General presentation

The Nord and Pas-de-Calais coalfield (France) extends 100 km from East to West and 15 km from North to South. The eastern limit of the basin superimposes with Belgian boundary (figure 1). The southern limit of the basin is underlined by the presence of the hills of Artois, Cambrésis and Hainaut. In this zone, altitudes vary from +80 to +180 NGF. Then, general topographic surface goes down gradually, in direction of North, towards the low zones of the area of Béthune (Western), of the area of the North of Lens and the basin of Orchies (centre) as of the junction the Escaut -Scarpe where the average altitude is +30 meters approximately.

The coalfield counts a significant number of inhabitants. Some zones, in the centre of the basin, have a strong density of population induced by many mining cities and industrial parks related to past mining activity.

Geological context

Over all the extent of the basin, the carboniferous is covered, in discordance, by grounds dating from the secondary to the quaternary era, called "morts-terrains" (overburden). From older to most recent, one can find (Figure 2):

• Wealden: these are clays and sands deposited in discontinuous pockets in the sectors of Anzin and Denain ;

• Albian: this formation deposited only very locally, in the western and extreme eastern parts, at the beginning of the cretaceous transgression. In western part, this formation is characterised by thin plastic clays (less than 10 meters). On the other hand, in eastern part, these are more or less clayey sandstones that may be 50 meters thick;

• Cenomanian formations: these are more or less marly formations whose thickness increases from East toward West from 10 to 40 meters approximately, overlying Tourtia, conglomerate;

• marls of Turonian: theses are formed by the blue ones (30 meters average thickness) and green very clayey ones (35 meters average thickness);

» the seno-turonian chalk: this chalk thickness is variable -60 meters on average, but locally reaching 150 meters (Saint-Aybert) or only 30 meters (Saint-Amand) ;

• the Landenian layers: this formation only appears in the northern edge of the coalfield where its thickness reaches 30 meters. These series begin with several meters of clay of Louvil, on which settled sands of Ostricourt. By places, those are overlaid by clays of Flandres.

In the sector of Valenciennes, Landenian is rather sandy.

alluvia: these are silts dating from the Quaternary era.

Hydrogeological situation

The overburden described previously has variable hydrogeological characteristics:

» the sand pockets of Wealden are fully saturated and gave place locally, during shaft sinking, to very strong flows, known by the minors under the name of "Torrent d'Anzin";

• in western part of the coalfield, Albian plastic clays form a water tight stratum between aquiferous chalky Cenomanian and the Carboniferous subjacent one. Toward East the sandy formations can represent a secondary permeable reservoir;

<» being given the variations of the Cenomanian deposits faciès from East to West, this level plays a water tight role in the centre of the basin and East whereas it is subject to water flow West;

« the Turonian marls form the wall of the Chalk aquifer and behave as a semi-permeable material with respect to vertical water circulations between the Chalk aquifer and the deeper aquifers;

• the seno-turonian chalk constitutes the large regional aquifer of the Chalk which provides more than 80% of the drinkable and industrial water;

« clays of Louvil (Landenian) support an aquifer of poor characteristics flowing in sands of Ostricourt. On the other hand, in the area of Valenciennes, this formation is naturally not very permeable. Clays of Flandres, which finish the tertiary series in North, constitute thanks to their thickness a quasi impermeable overburden of the sandy aquifer.

As far as the carboniferous grounds are concerned, these formations are not aquiferous in their natural state. The rare water circulations which affect them are according to the fractures network or located in the altered subsurface levels. During exploitation, the mining void spaces induce the fracturing of the grounds in their vicinity. The open fractures play the role of drains, thus conferring the affected volume permeability characteristics much higher than those of the virgin sectors. Water thus infiltrates in workings and after water pumping stoppage, zones influenced by the exploitation are subject to a progressive filling by infiltrating water, leading to the creation of an aquifer. The level of this water table goes up until it gradually reaches its equilibrium level.

Mine gas emission in Nord and Pas-de-Calais coalfield

In the coalfield of North and Pas-de-Calais, as for any carboniferous layer, one is confronted with the problem of firedamp. Indeed, firedamp is naturally adsorbed by coal. During exploitation, firedamp is desorbed but the gas outburst continues after exploitation stoppage, even if the layer is not very gassy. This release will be stopped at the latest after a complete and effective submergence of the coal seams, that is once water will have gone up at least a few tens of meters above the emitting sources.

Knowledge about the basin of North and Pas-de-Calais indicate a firedamp primarily composed in great proportion of methane, in a small but usual proportion of alkane and in a very weak proportion of carbon dioxide and other gases. In the areas of Lens and Courrières in particular, but in other areas of the basin as well, one measured significant coal gas concentrations, around 10 m 3 /t.

Moreover, specific releases were calculated for a score of exploitation plants between 1974 and 1987 and gave values varying between 40 and 60 m 3 /t of CH4 from extracted coal.

On the whole, one should underline the great diversity of the basin of North and Pas-de-Calais which was known to be a not very gassy to very gassy coalfield, according to areas.

Since 1978, the companies Gazonor then Méthamine exploit gas produced by desorption in old mining work, thanks to five collecting sites spread over the basin. These various pumpings thus put currently in depression the totality or the quasi totality of the coalfield which is not drowned yet.

In addition, 30 boreholes reaching the old workings were set up, in order to create preferential ways of evacuation for the firedamp and to control the pressures of the layer over the whole basin (boreholes for decompression). This device, supplemented by 23 shafts accessible for measurement, makes it possible to precisely follow the evolution of the pressures in the reservoir. According to sites, the pressure measured is included between 40 and 70 kPa, that is in obvious depression compared to the atmospheric pressure.

Characteristics of mining shafts in North and Pas-de-Calais coalfield

Coal exploitation in North and Pas-de-Calais required the sinking of more than 600 shafts. These shafts were sinked between 1716 and 1960 and are distributed over 41 mining concessions (figure 3). One should notice a very strong concentration of these shafts in the area of the concessions of Fresnes-sur-Escaut and Vieux-Condé, as well as in the vicinity of Valenciennes whereas they are uniformly distributed over the other concessions. Among these shafts, only around two thrid of them are precisely localised, and thus treated (backfilled, closed). As far as the other third is concerned, their Lambert co-ordinates are roughly known, with an uncertainty of 15 meters around, and thus their state of closing (backfill, flagstone...) is not known.

A shaft is a vertical excavation, of diameter varying from 1 to 6.5 meters and which can be in North and Pas-de-Calais more than 1000 meters deep. The inner wall of the shaft is covered by a supporting structure (lining) that avoids grounds collapse. Firstly constituted by a masonry or bricks, the technique evolved to a concrete covering.

In aquifers, in order to avoid water inflow in the shaft, a lining (watertight support) is set up. Originally, at the beginning of the XVIII th century, this one consisted of pieces of wood which were assembled vertically and round-off. Then, this process being not very effective, the beams are then laid out horizontally and form a square shaft not exceeding two meters side. At the beginning of the XIX th century, the need for increasing shafts diameter led to increase the number of sides of the lining. One thus can find, at that time, of octagonal linings then decagonal. Next, a lining consisting of 16 sides which suits practically the circular shape of the shaft was chosen.

At the end of the XIX th century, wood has been given up for cast iron which has a higher mechanical strength. Lastly, during XX th century, thanks to the evolution of the techniques of cementing and injection, it became possible to sink round shafts of large diameter, with a monolithic lining made of concrete. The concrete is used the most, because it can be mended more easily in case of failure. These linings having to resist very strong pressures are prolonged with a score of meters in the non aquiferous grounds, in order to establish a tight joint against water.

Circular shafts, less practical than rectangular shafts for the installation of the equipment (cages, guidance, pipes...) have the advantage to stand very high ground pressures (case of the deep shafts).

Usually, a network of galleries develops from the shaft. These can be galleries close to surface, usually being useful for the service or installation of the ventilator. Other galleries, called shaft landings, are on the principal floors and allow to access workings.

These shafts had various uses:

<» the haulage shafts, in which a cage was installed and was used to descend the men and the hardware and to go up the extracted products;

» the ventilating shafts: to allow the fresh air to enter the workings, it is necessary to have a downcast shaft and an upcast shaft, eventually equipped with a ventilator, if that were necessary. For this reason, it is not rare to observe two or three very close shafts, which belong to the same pit. The haulage shaft can be used as a ventilating shaft.

Among the shafts, one may distinguish 81 blind shafts, localised on the map shown in figure 3. These are shafts that have not been used for exploitation purposes. One can distinguish those having reached Carboniferous and those having been stopped in the overburden, In particular concerning the firedamp risk.

All these shafts were gradually closed until the closing of the last shaft in December 1990. Following its closing, each shaft is backfilled then sealed.

With time, the backfilling technique evolved. Various kinds of filling material can be distinguished:

» the schist backfill whose grain size is less than 150 mm; « a water and gas proof plug made of cohesiveless ashes or clay, set up at the level of the base of the lining; « concrete plugs in the form of a mine dam either right at shaft landings or just above shaft landings. This technique was used for the last closed shafts.

The plugging of a shaft is achieved in two different ways:

• most of the wells are plugged by a reinforced concrete slab;

• since 1990, shafts are plugged by a concrete dam anchored in grounds or not in one or more galleries. If it is well designed, this plug makes it possible to ensure the security of the shaft head.

The majority of the shafts is equipped at the head with an observation hole that enables to control the level of the backfill and if required to carry out control measurements with respect to gas.

From a hydrogeological view point, the carboniferous reservoir constituted by exploited zones is not flooded. As a consequence, a great number of shafts are not flooded yet. They will be filled gradually until 2150 around.

Risks associated with mining shafts

Abandoned shafts, still open or only covered by a flagstone, can present risks for the populations and the activities located in their vicinity. Shafts that have been backfilled in a way that is not satisfactory can also, in certain specific configurations, undergo a brutal remobilization of the filling material that may affect the stability of ground level. To facilitate the identification of the various likely scenarios of failure that may affect an old mining opening, a systematic analysis of the risks associated with their presence has been carried out for the shafts in the Nord and Pas-de-Calais coalfield.

Hazardous entry

An accidental fall in a shaft that has not been backfilled can result in serious wounds and even the death of the person. The drownings are also to fear when the shaft is filled of water.

Subsidence

It is sometimes observed, in the vicinity of a mining opening, a slow and progressive remobilization of the surface layer (shaft backfilling material, low cohesive overburden material).

For example, a time differed subsidence of the filled column in a shaft not protected on top by a concrete plug or flag can lead to a slow and progressive remobilization of the surface in the vicinity of the shaft. This remobilization can, if it reaches sufficient amplitude, damage some of the structures in the area of the shaft. Several causes are likely to lead to these instabilities of the ground level (NCB, 1982):

» an overload on the surface, in the immediate surroundings of the head of the shaft (storage of exploited material, heavy vehicles, construction of structures...) ;

» some vibrations generated by explosions or blastings near the shaft head or by an intense circulation of very heavy vehicles ; a loss of stability due to water influence (buoyancy of the base of the filling material column when mine water raises or water saturation of the filling materials and loading of the column resulting from water circulation coming from higher galleries or surface).

Surface collapse

Less frequent than subsidence, collapses can present more serious consequences when happening in high vulnerability zones. Collapses of shaft generally materialise by sudden subsidence hole whose diameter varies from few meters to a few tens of meters. In an exceptional configuration (presence of non cohesive sandy grounds located near surface), a particular case of rupture of well led to the creation on the surface of a sinkhole whose diameter reached 100 meters (R. POIROT, 1992).

The collapse of the surface which surrounds a mining opening can result from :

» a collapse of the filling material column (brutal and dynamic remobilization of the filling materials which goes down abruptly and in the shaft galleries and old workings, thus generating a collapse of surface);

» rupture of the shaft head closing structure. Some old shafts had been sealed by techniques not presenting any guarantee of long life expectancy;

» rupture of the shaft lining (fatigue of the lining and/or increase of the surrounding grounds thrust);

» rupture of the surrounding grounds.

Risks associated with mine gas emission

Many mining vacuums present high concentrations gases that may be harmful or explosive.

In addition to the risks related to inflammability of firedamp (CHU), one should note the dangers of asphyxia when atmosphere presents an oxygen deficit (naturally or from an accumulation of CH4 or CO2) and the intoxication risks in case of inhalation of gas such as CO or H2S in too high contents.

The principal risks appear when the gases asphyxiating, toxic or flammable which accumulated in the residual vacuums of underground exploitation migrate towards surface and accumulate in non-ventilated vacuums close to surface (hollow, sewers).

Risks associated with water presence

Stoppage of mining exploitation can generate some problems in terms of quality and regime of water. Taking into account respective volumes, the alteration of the quality of water due to old workings is definitely higher than that causes by shafts or galleries.

One should note nevertheless that the use of abandoned shafts as wild discharge can be enough to make a water unfit for consumption when toxic waste is located in the vicinity of aquifer flow.

Mechanisms leading to surface collapse

The aim of this part is to describe and evaluate, in terms of probability of occurrence and amplitude, the steps that lead to a surface instability near a shaft. Each constitutive element of a shaft is studied, from the pit bottom to the head.

Deep structures

Shaft landings closure : galleries that connect shafts between them or with mining works may have been closed before shaft backfilling in order to avoid the backfilling material to spread in the gallery. Closings generally consist of walls in hollow blocks, metal dams, or concrete plugs, but the design and the exact nature of materials constituting these structures are seldom available. When checking the stability of these structures is not possible (in particular, in terms of resistance with respect to the water column which is likely to apply on them in the future), it is not possible to guarantee a long-term stability of the shaft.

Concrete structures within the shaft column : one can divide the various structures types in two large subsets: those which lean on the coating of the shaft and those which lean on the solid ground itself. One should note that water resulting from Carboniferous, with a high concentration of sulphates, constitutes a recognised case of aggression with respect to the structures made of steel or concrete that are in the shafts. The calcium sulphate combines with aluminates of cement to form a salt, ettringite, whose crystallisation induces a volume expansion that causes the cracking of the concrete. It facilitates the penetration of the aggressive agents to the reinforcements which are, in their turn, attacked. The stability of deep concrete structures is thus based, initially, on the taking into account of this phenomenon in the choice of materials constitutive of the structure (Technical Collection CIMBETON, 1997 andBulletin of Cement, 1995).

Settlement and collapse of filling materials

Settlement of filling materials : the backfill of shaft column is generally followed by a settlement of the column of fill under the action of its own weight.

During the increase of the water level in the shaft, some extra settlements are possible.

An experimental study carried out on samples of filling materials made of schists or sandstones and whose coarsest elements are lower than 13 cm, showed that under a low confining pressure of 0.6 MPa, water saturation induced a settle of 12 % approximately for the schists and 5 % for sandstones (EGRETLI and SINGH, 1988). Settlement during saturation represents less than 4 % when the schists are formerly confined to 6 MPa and is already lower than 2 % for a 2MPa confining pressure. The results show, moreover, that the share of settlement related to water does not exceed 45 % of total settlement for samples formerly confined under a low confining stress and decreases with less than 25 % when initial confining pressure, before saturation, is higher.

These experimental results show that the share of settlement of a filling material induced by its own weight remains dominant. In the case of the shafts, the flooding takes place a long time after the backfill. Consequently, settlement of backfilling material related to its own weight took already place. Its amplitude was greater with shaft depth. Thus, starting from the above mentioned experimental results (in laboratory and especially on site), one can consider that the potential extra settlement related to the increase of water table during flooding will be in all the cases lower than 1 % and could be neglected insofar as the filling materials used in the French coal basins have a grain size sufficiently high to make them, in our view, less sensitive to the possible readjustments of the structure of the filling materials with water.

One should bear in mind that a small proportion of shafts have been subject to a partial flying ashes backfill. This particular material is likely to experience some shrinkage that may affect the stability of the inner column.

Backfilling material collapse : unlike settlement, one calls collapse of the column of fill, a brutal and dynamic remobilization of the backfilling materials which go down abruptly and spread in the shaft landings and old workings, if those are not correctly closed before the backfill process. The principal difference between settlement and collapse results in the fact that the equilibrium changes are not anymore, in the second case, progressive and continuous but, on the opposite, brutal and instantaneous. This dynamic character can result from a dynamic request itself or contrary to quasi-static variations which evolve to a limit equilibrium state before giving place to a sudden collapse.

Dynamic loads resulting from vibrations on surface close to shaft head seem to be able to be enough to generate brutal remobilizations of the backfilled column. However no case of collapse, to our knowledge, has clearly been identified like having resulted from such a phenomenon in Nord and Pas-de-Calais coalfield.

Many cases denote on the other hand sudden arrival of water into the backfill, either by the rupture of a surface pipe, or by the blow out of a part of the shaft lining that was suddenly under pressure or resulting from a progressive deterioration from its wall. Water which flows in the shaft structure then soaks quickly the backfilling materials, weighs down them and can often modify the equilibrium within the column and thus generate a remobilization of this one.

Some backfilling materials collapses also result from the formation of vacuums within the column during the backfill process. These vacuums can be induced by the blocking of materials at the level of certain convergences of the shaft. Bridges or vaults then form with francs vacuums in the subjacent levels.

The collapse of backfill has not for only effect to violently decrease the level of the column. Important suction phenomena then air back blow can result from it. These stresses can sometimes contribute to alter or destroy the lining, the plug or the concrete slab, or the surrounding grounds. The structures at the head of the column hence must be designed to resist the stresses of suction such a collapse stripping could generate.

Taking into account the dynamic character of the phenomenon, it is difficult to evaluate the vacuum amplitude generated on the surface.

Coating failing or rupture

Most frequent ruptures of a shaft lining come from a decrease of the coating strength and/or the increase of surrounding ground pressure. When the first does not manage any more to contain the second, the coating (constituted of bricks, concrete or cast iron) becomes deformed and ends up breaking. If the shaft is empty (not backfilled or having been subject to a backfilling materials collapse), the coating collapse and with it whole or part of the surrounding grounds.

The decrease of the mechanical properties of the shaft lining is an inescapable phenomenon resulting from the progressive fatigue of the materials which constitute it. Some external agents, like water, accelerate this fatigue.

The increase of the surrounding rock pressure can result from the construction of structures on the surface. A building construction may apply an overload on the grounds on which it is founded. If the shaft is located in the vicinity of the foundations, its lining may experience a considerable increase in load.

Materials behaviour surrounding the shaft

Shaft surrounding grounds behaviour is closely related to the state of the shaft lining. If this one has suddenly broken and the shaft is empty, nothing retain the surrounding grounds anymore. Reciprocally, the rupture of the surrounding grounds may generate high pressures in the lining and occasionally its rupture. The shaft sinking induces a redistribution of stresses within rock massif. According to the nature and strength properties of the material crossed by the shaft, the extend of the zone affected by the shaft and the behaviour of material may vary.

In the basin of North and Pas-de-Calais, the main materials crossed by the shafts are:

• Wealden and Albian : during the sinking of particular shafts, water bearing strata were locally crossed before the carboniferous layer and sometimes caused water blows. These pockets correspond respectively either to sands of Wealden, or to the green sandstones of Albian. The very localised characteristic of such faciès induced particular study for the concerned shaft;

• marls : marls have an elasto-plastic behaviour. Numerical models to evaluate the impact of a circular empty shaft on surrounding marls show that, in the particular case of Nord and Pas-de-Calais coalfield, plastic zone may develop within marls on a radius equal to 3 times the shaft radius from the lining of the shaft; chalk : chalk is more or less fissured. According to its state (saturated or dry), it has different strength properties. The compressive strength of dry chalk is around 10 MPa. This value can be divided by 2, even by 3, for a saturated chalk. Dry chalk has a behaviour of the elasto-fragile type whereas saturated chalk presents a progressive rupture type behaviour. The analysis of the effect of a shaft sinking on chalk concludes that, in the case of an empty shaft without lining, no plasticity develops within sound chalk for a depth less than 100 m (main case). The analysis also notices that a thickness of 30 m of sound chalk is sufficient to counteract the plasticity developed in marls (figure 4). It is difficult to propose such a rule in the case of a damaged chalk. The case of Maries shaft n° 2 shows that the collapse reached surface despite a thickness of very fractured chalk of 34 m; cohesiveless and sandy surface materials : surface grounds can consist of fill, clay, sands or chalk weakened by water infiltration. If the lining of the shaft breaks and the shaft is empty, nothing retains these types of material which may collapse in the shaft and form a cone which angle is 45° approximately. Sands, in particular, are materials of very low cohesion to null, and their main stability characteristic is the friction angle. Sands are very sensitive to water because of their great permeability which allows an impregnation then a fast circulation of water between grains in the event of hydraulic overload. Some sands with fine granulometry may adopt a quick sand behavior water. It is the case with Landenian sands whose grain size lies between 0.2 mm and 0.08 mm.

Securing measures

Table 1 summarises previous mechanisms and evaluates, depending on the shaft configuration, the possibility of each mechanism and, finally, surface collapse potentiality.

For shafts that induce an identified risk for the surface, different securing measures may be taken depending mostly on the surface vulnerability.

Radius of safety

The evaluation of the radius of safety relies on the definition of the geological context of the shaft and on the analysis as described previously. The radius resulting from this evaluation can, in some cases, be limited by that resulting from a simple volumetric approach -that is the volume of material likely to collapse cannot be greater than the volume of void in the shaft. If a shaft crosses the deep formations of Wealden or Albian sands, a specific study is necessary.

A statistical study carried out by the "Charbonnages de France" made it possible to determine the difference between archives co-ordinates and actual co-ordinates of shafts onces localised in situ. This analysis shows that the error on archives co-ordinates is less than 15 m. It will thus be appropriate to add 15 m for the radius of safety for a not localised shaft. Any modification of the shaft characteristics (backfill...) modifies the risk evaluation and the value of the radius of safety with respect to the geotechnical risk associated with this well. The radius of safety is defined starting from the centre of the shaft. It defines a perimeter which delimits a constructible circular zone under condition of taking into account the identified geotechnical risk of collapse.

Recommendation of radius of safety relating to gas:

• if the risk of backfilling material collapse is identified: taking into account the risk of massive gas outburst, a radius of safety related to the gas risk of 15 m is applicable until the end of shaft flooding (not before 2150);

• if the risk of backfilling material collapse is excluded: the radius of safety related to the gas risk of 15 m is applicable until the flooding of the highest landing.

Self-supporting plugs

Self-supporting plugs lean on the shaft lining to ensure their own stability. They have a cylindrical body which follow the various imperfections of the lining. They generally consist of concrete or materials with which a hydraulic binder is associated.

These structures reinforce the surrounding grounds and avoid lining and surrounding grounds to collapse in the shaft, on all their height. Concrete plugs are worked on the surface of a filling material column or on a platform anchored in the solid rocks, at the level of a shaft landing.

The preliminary backfill of the shaft remains the most commonly used method. It allows the re-use of sterile stored at the pithead and consolidates the whole lining.

Self-supporting plugs must be able to ensure their own stability under the overlying backfill load without being tributary of the presence of backfill or a support platform beneath. When these plugs are correctly designed and produced, the settlement of backfilling materials is not harmful to the stability of the structure. Hence the closing of all the galleries located under the plug is not essential. On the other hand, the plug will have to resist the stresses induced by suction likely to result from a brutal backfilled column collapse.

Generally speaking the workings can be achieved in many ways (columns of jet -grouting, injection of backfilling materials, partial excavation of backfilling materials up to the surface when the shaft is already backfilled...).

The variations of the section of the shaft along a profile ensures the stability of the plug by facilitating the phenomena of blocking in case of déstabilisation of the structure (HARTMANN and al, on 1978). Taking into account the difficulty to quantify this type of heterogeneity, and considering not enough information about the shaft profile is available, one design plug generally with arguing in term of side friction against the inner wall of the shaft. The effect of shape will add so in the safety margin characterising the stability of the work.

The more the height of the plug will be important and the more the contribution of the effect of shape will be sensitive. One can consider that this one becomes really significant when the size of the plug is superior or equal to twice the diameter of the shaft.

Fig. 2 :

 2 Fig. 2 : Typical stratigraphie log in Nord and Pas-de-Calais coalfield

Conclusion

The principles developed previously have to be adapted to the context of each shaft and, in particular, according to their surface state. For example, the constitution of a plug in a shaft in urban area raises many technical difficulties that are out of the framework of this paper.

Considering the great quantity of shafts still to be treated in Nord and Pas-de-Calais, a methodology is currently under development to classify shafts in terms of likelihood of backfilling material collapse. The aim of this study is to plan the treatment of shafts in order to schedule workings in a way as sensible as possible.

DIDIER C, 1997

Guide méthodologique pour l'arrêt définitif des anciennes exploitations minières souterraines. Rapport intermédiaire de recherche INERIS pour le Ministère de l'Industrie. Référence INERIS-SSE-CDi/CS-97-22EP46/R04 daté du 30/01/1997.

EGRETLIL, SINGH R.N., 1988

A laboratory investigation into the effects of air void and water saturation on the collapse settlement of opencast mine backfill. Min. Sci. Technol,7,.

HURST J.L., THOMAS G.K., 1986

The treatment of disused coal mine shafts -some case studies. Min. Engr., 3, Apr., p. 89-100.

NCB, 1982

The treatment of disused shafts and adits. NCB library, 88 p.

LEPRTNCE-RINGUET

VAN VLIET-LANOE B., 1999

Evolution morphotectonique récente du bassin houiller Nord Pas-de-Calais dans le cadre de l'Europe de l'Ouest. Rapport d'étude USTL pour Charbonnages de France.

VINKLERF., 1999

Couplages hydromécaniques dans les massifs rocheux : du stockage de déchets radioactifs à la stabilité des mines abandonnées. Thèse INPL présentée en octobre 1999.


Sandrine Descourriere Emmanuel Bernuchon

Patrick Oliviersalvi

Bonnet

IMPROVEMENT OF THE HAZARD IDENTIFICATION AND ASSESSMENT IN APPLICATION OF THE SEVESO II DIRECTIVE (PART II) AMELIORATION DE L'IDENTIFICATION ET DE L'EVALUATION DES DANGERS DANS LE CADRE DE LA DIRECTIVE SEVESO II (DEUXIEME PARTIE)

, and since the choices and hypothesis to define the RAS are arbitrary, there is a need to reach a consensus among all the stakeholders to limit the discrepancy in the decision and improve the transparency.

Résumé

La Directive européenne 96/82/EC du 9 Décembre 1982 sur le contrôle des accidents majeurs impliquant des substances dangereuses, connue également sous le nom de Directive Seveso II, a pour objectif la prévention des accidents majeurs dans les sites industriels à hauts risques, et la limitation de leurs conséquences pour les populations et l'environnement. Bien que les règles soient bien établies pour l'identification du risque potentiel, il n'y a pas de méthode reconnue pour la prise en compte, dans l'évaluation du potentiel maximal de danger, des dispositifs de sécurité et des systèmes de gestion de la sécurité mis en oeuvre par les exploitants. Cet article traite de la seconde étape d'une méthodologie générale, qui vise à mieux évaluer les améliorations apportées par les dispositifs de sécurité et des systèmes de gestion de la sécurité, à travers la sélection des scénarios d'accidents. La méthode présentée dans cet article permet aux évaluateurs du risque ainsi qu'aux autorités compétentes d'identifier les Scénarios Accidentels de Référence, qui prennent en compte l'influence de certaines barrières de sécurité, en accord avec les exigences de la Directive Seveso II. Cette méthode pourrait aider les parties prenantes impliquées dans le processus décisionnel de gestion publique basé sur les risques, afin d'évaluer le niveau de sécurité des établissements à hauts risques. Comme les décisions de gestion des risques sont basées sur l'évaluation des risques, et comme les choix et les hypothèses pour définir les Scénarios Accidentels de Référence sont arbitraires, il est nécessaire d'obtenir un consensus parmi les parties prenantes, afin de limiter les divergences dans les décisions et améliorer la transparence.

INTRODUCTION

Context

In several European countries, hazard potential around high-risk industries is often deducted from effect distances, as results of the evaluation of gravity and likelihood of major accident scenarios. Therefore, the identification of accident scenarios appears as a critical point in the risk analysis process, that should take into account measures related to "state of art" and philosophy of the SEVESO II Directive.

The Directive gives the rules to identify high-risk potential establishments with a precise criterion, which is the amount of hazardous substances handled.

The lessons learnt from the control of hazardous installations and improvement of the state of the art lead more and more to integrate the hazard reduction directly at the conception level, with the concepts of inherent safety. Therefore, often the choices of some alternatives in the control of the installation reduce significantly the hazard (size of the vessels, distance between two units or storage). It appears then clearly that the only consideration of the amount of hazardous substances handled on the site is too rough.

There is a need to take into account some more representative criteria in complement with the amount of substances.

Because of a lack of methodology, it is now particularly difficult to point out the influence of risk reducing measures, especially when determining accident scenarios. This difficulty is particularly relevant in France, where a deterministic approach is adopted [1]-

The underlying philosophy of this approach is based on the idea that measures implemented to protect people from worst cases accidents will also protect them in case of an accident of less gravity, regardless of any probabilistic matters.

Proposition of an overall methodology

Regarding the considerations developed in the previous paragraph, an overall approach has been developed in order to valorise the positive results of safety devices and safety management systems, in an industrial group or in an industrial activity. The method, in a deterministic context, emphasises:

-The hazard potential inherent to an industrial plant, by the definition of Maximum Physically Possible Scenarios (MPPS) ; -The influence of risk reducing measures described for example in standards, regulations, by the definition of the Reference Accident Scenarios (RAS) ; -The benefits brought by safety devices and safety management systems, by the definition of Residual Risk Assessment Scenarios (RRAS).

These three stages of the general method are illustrated by {Fig 1).

Scenario Identification

Lessons learnt from accidents

Risk Analysis

Algorithm _ The following paragraphs deal with:

': Maximum

-a brief recall about the identification method of Maximum Physically Possible Scenarios, which is the topic of a paper presented at the 2001 ESREL Conference [START_REF] Bemuchon | Improvement of the hazard identification and assessment in application of the Seveso // Directive[END_REF] ; -safety barriers and their influence, through the identification of Reference Accident Scenarios (RAS) and Residual Risk Assessment Scenarios (RRAS).

Throughout the description of the methodology, some illustrations by a practical example will be given, based in particular on the study of a pressurised vessel of liquid chlorine at ambient temperature. These elements of illustration are referred to in the text by the symbol "X"-

FIRST STEP: DETERMINATION OF MAXIMUM PHYSICALLY POSSIBLE SCENARIOS (MPPS)

The method to identify Maximum Physically Possible Scenarios (MPPS) is described in the paper presented at the 2001 ESREL Conference [START_REF] Bemuchon | Improvement of the hazard identification and assessment in application of the Seveso // Directive[END_REF]. The following paragraphs summarise the method.

Definitions and Hypothesis

MPPS identification is regarded as an attempt to quantity maximum hazard potential in industrial establishments, following an specific algorithm.

This algorithm is based on the labelling of the substances (Directive 67/548/EEC and Seveso II Directive), the conditions of their use (pressure, temperature, solutions...) and the type of containment.

As stated in the introduction, Maximum Physically Possible Scenarios characterise the hazard potential inherent to high-risk establishments. In a simpler way, it can be noticed that these scenarios determine the worst situations that could physically occur.

Generally, a scenario is assimilated as a succession of events presented in (Fig 2), which is inspired from the bow-tie approach presented in [START_REF] Bellamy | Hazard Management: Technical-Management Links and the AVRIM2 Method, in Seveso[END_REF].

SCENARIO Fault Tree

Figure 2: Accident Scenario Identification At this stage, the methodology will enable to quantify the hazard potential of a unit by the definition of Maximum Physically Possible Scenarios (MPPS). For this purpose, it is important to identify the worst cases that could possibly occur, regardless of any probabilistic matters.

In consequence, the following hypothesis can be reasonably made to determine MPPS:

-the eventual prevention and protection barriers are supposed to be inoperative, -there is no need to determine the possible causes of the accident. The MPPS must be representative of the worst cases. As a matter of fact, such scenarios are most of the time justified by external aggressions such as natural catastrophes (earthquakes,...) or domino effects.

Thus, in a deterministic approach, a MPPS depends only on the nature and the properties of the dangerous substance, and the characteristics of the equipment involved. Therefore, MPPS is fully determined by the following triplet:

-the Critical Event (CE), which is determined by the physical state of the substance handled, -the Secondary Critical Events (SCE), that can be completely defined by the type of equipment and the conditions of use of the substance, -the Dangerous Phenomena (DP), that are linked to the physical state and the hazards of the substance, regardless of the type of equipment involved.

Methodology for MPPS identification 2.2.1 First step: definition of Critical Events and Secondary Critical Events

The first step of the methodology consists in determining the Critical Event. Clearly, this Critical Event is closely linked to the physical state of the substance involved.

X For a pressurised vessel of chlorine, the Critical Event is a loss of containment.

Once the critical event is characterised, it is possible to deduce the possible Secondary Critical Events (SCE) from the type of equipment, by using a classification of industrial equipment, based upon the work performed by the Major Risk Research Centre (Faculté Polytechnique de Mons, Belgium) on domino effects [START_REF] Delvosalle | Development of a methodology for the identification of potential domino effects in "SEVESO"industries[END_REF][START_REF] Delvosalle | A Methodology for the Identification of Potential Domino Effects in "SEVESO" Industries and an Application Tool[END_REF].

Practically, a matrix, called SCE matrix, is available for each equipment category and defines the Secondary Critical Events, according to the operating conditions of use of the hazardous substance [START_REF] Bemuchon | Improvement of the hazard identification and assessment in application of the Seveso // Directive[END_REF].

For a pressurised vessel, follows [START_REF] Bemuchon | Improvement of the hazard identification and assessment in application of the Seveso // Directive[END_REF]:

the SCE matrix is described as

1.ln case of a substance handled under pressure above boiling point (two-phase equilibrium), the SCE are:

-For a catastrophic rupture: puff (including aerosols), missiles and overpressure; -For a breach or pipe rupture: gas release, two-phase release (jet) and pool formation.

2. In case of a substance handled below boiling point with inert gas (liquid state), the SCE are:

-For a catastrophic rupture: missiles and overpressure; -For a breach or pipe rupture: pool formation.

3. In case of a substance handled in a purely gaseous state, the SCE are:

-For a catastrophic rupture: gas puff, missiles and overpressure; -Fora breach or pipe rupture: gas release.

Second step: definition of Dangerous Phenomena (DP)

In order to complete the definition of Maximum Physically Possible Scenarios, the Dangerous Phenomena (DP) must be identified. In a similar way as in step 1, the definition of the Dangerous Phenomena is realised, regardless of the type of equipment, considering only the properties of the substances (hazards and physical state).

To classify the hazardous substances, the methodology relies on the Council Directive 67/548/EC on the classification, labelling and packaging of dangerous substances, and more precisely, on the definition of the risk phrases.

X Chlorine is classified as a toxic substance (risk phrase: R23).

The only Dangerous Phenomenon to consider is then toxic gas dispersion.

Third step: checking the consistence between DP and SCE

Finally, it is necessary to ensure that SCE identified may actually lead to the DP regarded. For this purpose, the methodology suggests the use of a matrix, called the SCE/DP matrix. In most cases, the consistence between SCE and DP is immediate.

X In the practical case of a pressurised chlorine vessel, the consistence of SCE and DP is immediate.

It is now possible to completely define the MPPS in order to build the following tree (fig 3). The identification of the possible scenarios according to the combination of the equipment and hazardous substance results of a systematic algorithmic approach.

SCE

This method applies to most frequently met cases in high-risk industries and follows a deterministic approach.

MPPS identification should not be regarded as a final goal, but as an attempt to quantify maximum hazard potential in industrial establishments.

It is of interest to carry on the hazard assessment that has to be implemented in accordance with the requirements of the Seveso II Directive.

FURTHER DEVELOPMENTS: SAFETY BARRIERS. IDENTIFICATION OF REFERENCE ACCIDENT SCENARIOS (RAS) AND RESIDUAL RISK ASSESSMENT SCENARIOS (RRAS)

The present chapter aims at presenting the method for identification of Reference Accident Scenarios (RAS), and Residual Risk Assessment Scenarios (RRAS). The method had been developed in a project supported by the French Ministry of Environment. The approach is described in a draft document [START_REF] Descourrière | Propositions pour la révision du Guide de Maîtrise de l'urbanisation[END_REF] and was applied in five "Seveso II" establishments in France [START_REF] Descourrière | Avis d'expert sur la détermination des zones de sécurité pour la maîtrise de l'urbanisation autour de 5 établissements à risques dans la région Midi-Pyrénées -Volet I-INERIS[END_REF].

RAS and RRAS are based on MPPS, completed with the influence of safety barriers.

In this chapter, the first paragraph presents some preliminary considerations about safety barriers.

The second paragraph deals with the identification method of RAS, from theory to practical examples.

In the third paragraph, some preliminary considerations are given about identification method of RRAS, which is currently in progress.

Safety barriers

A safety barrier can be defined as a specific safety element, which aims at achieving a safety function. This paragraph presents:

-A definition of safety functions, -A method for identification and classification of the safety barriers, -An illustration of the method by some case studies.

Definition of safety functions

The bow-tie approach adapted from [START_REF] Bellamy | Hazard Management: Technical-Management Links and the AVRIM2 Method, in Seveso[END_REF] and presented in Fig. 2 describes accident scenarios as succession and / or a combination of events. The transition from one event to another more catastrophic can be controlled by safety functions. A safety function can be achieved either by intrinsic or inherent safety, included in the design of equipment, or by additional safety barriers.

The safety level of an installation depends on the reliability of the safety functions, achieved by the quality of safety barriers [START_REF] Gaston | Criteria for risk decision-making process related to hazardous installation: a French experience[END_REF].

X For a pressurised vessel of chlorine, some relevant safety functions are:

-prevent an overpressure, -prevent an overflow, -prevent from corrosion, -protect from mechanical shocks, -protect from thermal effects,

Method for identification and classification of the safety barriers

When studying an industrial case, a step of the risk management consists in identifying the safety barriers that achieve the safety functions identified in the risk analysis. One or several safety barriers can achieve a safety function.

In order to identify the safety barriers, information can be found in national and international standards and regulations, which present safety requirements for design and operation of industrial unit. The current practices or "state of the art" for a given unit may also provide a range of safety elements, which are often implemented in high-risk industries.

Legal and normative requirements, as current practices, are generally resulting of lessons learnt from passed major accidents.

The identified safety barriers can be classified, according to several criteria.

A first obvious classification consists in distinguishing prevention, and mitigation / protection barriers. Several detailed classification methods have been analysed in the reference [START_REF] Bouchet | Analyse des Risques et prévention des accidents majeurs (DRA-07) -Rapport intermédiaire d'opérations -Prise en compte de l'influence des barrières de sécurité dans l'évaluation des risques -Présentation des méthodes d'inspection TRAM[END_REF]. From this analysis, it is proposed to classify the safety barriers as follows:

-inherent safety barriers: barriers related to the design of the equipment, -additional passive barriers: barriers that don't require an external power source for its successful operation, -additional automatic barriers: safety system with full automatic actions from detection to the return to a safe state, -additional manual barriers: safety system that requires manual actions by an operator to the return to a safe state.

X For a pressurised vessel of chlorine, one of the relevant safety functions is the prevention of an internal overpressure. It can be achieved: -by designing the vessel for the maximum possible pressure (inherent safety barrier), -by pressure relief valve (additional passive barrier), -by detection and automatic subsequent actions (automatic safety system), -by detection and manual actions (manual safety system).

The implementation of this classification is quite simple and is of relevance to highlight the inherent and passive safety barriers that contribute to the risk control with often a high availability. When identified, they can be mentioned in the safety report required by the Seveso II Directive. This approach can be completed with an assessment of the quality of the barriers according to the following criteria [START_REF] Bouchet | Analyse des Risques et prévention des accidents majeurs (DRA-07) -Rapport intermédiaire d'opérations -Prise en compte de l'influence des barrières de sécurité dans l'évaluation des risques -Présentation des méthodes d'inspection TRAM[END_REF]: -efficiency, -availability (reliability and maintainability), -other criteria related to the practical use of the barriers (response time, operational in given range of ambient conditions like temperature, pressure, relative humidity, frost, corrosive atmosphere...).

The inherent and passive safety barriers are obviously characterised by a high level of performance regarding these criteria.

Case studies

Some current Initiating Events, Critical Events and Dangerous Phenomena are listed here below, and for each event, several safety barriers are proposed (non-exhaustive). The category of the safety barrier is specified as follows:

1.inherent safety barriers,

Identification of Reference Accident Scenarios

Theoretical method development

In the framework of the Seveso II Directive, there is a need to assess the hazard potential and demonstrate its control. The ASSURANCE project [ 11 ] shows the discrepancies between the assessment of the risk experts, particularly for the definition of accidents scenarios.

This result is due to the numerous parameters involved in the definition of a scenario, and the arbitrary choices made by the experts for these parameters.

In the approach, it is proposed to define more precisely Reference Accident Scenarios that can be compared to the current concept of "credible scenarios" or "realistic scenarios".

These RAS are deterministic scenarios, but they are not representative of the "worst case scenarios".

RAS are based on MPPS, completed with the influence of some supplementary risk reducing measures selected among all existing barriers. One of the main difficulties is the choice of the relevant barriers for the definition of the RAS.

It is proposed to select them according to the criteria mentioned in paragraph 3.1.2 (efficiency, availability and specific quality criteria): first, the inherent and passive safety barriers and second, some additional active and manual safety barriers that fit the criteria.

This selection reflects the current practice in risk assessment and are consistent with the lessons learnt from past accidents or emergency exercises.

In this paper, only the general approach is described as a framework to lead the risk assessment, which has to be completed by a more detailed risk analysis.

Case studies

In this paragraph, some case studies are proposed. They are related to a pressun'sed vessel of chlorine and linked pipelines.

X For a pressurised vessel of chlorine and linked pipelines, MPPS are defined in the first chapter:

-the Critical Event is a loss of containment ; -the MPPS are catastrophic rupture of the vessel, and breach or pipe rupture.

French national regulation requires several safety elements for a pressurised vessel of chlorine and linked pipelines. Among them:

-The vessel has to be located in a containment room, -The containment room has to be equipped with ventilation and treatment systems, -External pipelines have to be in pipe-in-pipe configuration. a) Definition of RAS for the catastrophic rupture of a pressurised vessel of toxic (liquefied) gas Consequences of a catastrophic rupture depends mainly on:

-Stored mass, -Internal pressure when accident occurs.

The stored mass is assumed to be the maximal capacity of tank, in accordance with operating conditions.

Storage pressure may be assumed to be: 1. normal operation conditions, 2. saturation pressure at ambient temperature (due to a failure of heating or cooling system if different of 1 ), 3. maximum pressure (not precisely defined: in a range of 1 to 3 times the proof test pressure).

In a conservative approach, for toxic (liquefied) gas such as chlorine, the most stringent case will be defined, according to pressure, meteorological conditions and toxicity thresholds, and in accordance with risk analysis.

X First assumption:

The vessel is located outside, without any containment room. So, catastrophic rupture of the vessel can be regarded as a Reference Accident Scenario.

X Second assumption:

The vessel is located in a containment room, protected from thermal effects and mechanical shocks. It is in conformity with pressure design codes and it is equipped of automatic safety system for overpressure and overflow. So, the catastrophic rupture of the vessel will not be regarded as a Reference Accident Scenario.

b) Definition of RAS from breach or pipe rupture of toxic (liquefied) gas Even protected by containment room or pipe-in-pipe configuration, pipe rupture can be regarded as a Reference Accident Scenario.

Consequences of a breach or a pipe rupture depends mainly on: -Leakage location, -Release flow rate, -Release duration.

The leak location is assumed to be on the highest diameter pipe (maximum flow rate). The direction and the height of jet depend on leakage location, as well as the release flow rate. The flow rate assessment takes into account upstream capacities, pipe and downstream capacities volumes, and also non-return valves.

For a rupture located downstream of pumps, compressors, or boiling vessels, the nominal flow rate of these equipment can be used.

The release duration is linked to safety barriers and their response time.

X First assumption:

The pipe is located outside, downstream of pumps, without any particular safety element. So, the duration of the leakage following the pipe rupture will be high for the Reference Accident Scenario (almost 30 minutes), because of a quite long time for detection by operator and manual shutdown action.

X Second assumption:

The pipe is located in a containment room, equipped with permanent ventilation and treatment systems. So, the duration of the leakage following the pipe rupture will be smaller for the Reference Accident Scenario (almost 10 minutes), because of an immediate detection and a quite short manual shutdown action. The ventilation and treatment systems will be taken into account in consequence assessment.

X Third assumption:

The pipe is used for loading or unloading operations, under surveillance, with emergency stops. So, the duration of the leakage following the pipe rupture will be low for the Reference Accident Scenario (almost 2 minutes), because of an immediate manual shutdown action.

Next steps

The work on the RAS is still going on with a working group involving risk assessors and Competent Authorities. It is intended to generalise the above-described examples to define a general and systematic approach based on clear principles.

When achieved, this approach will be shared with the other stakeholders involved in the risk decision-making process (industrialists, the public, public authorities, elected representatives...).

Since the risk management decisions are based on the risk assessment [12], and since the choices and hypothesis to define the RAS are arbitrary, there is a need to reach a consensus among all the stakeholders to limit the discrepancy in the decision and improve the transparency.

Scenarios 3.3 Identification of Residual Risk Assessment (RRAS): preliminary considerations

In this paragraph, some preliminary considerations are given about the definition of RRAS, which is currently in progress.

RRAS is based on RAS, completed by the influence of specific technical and organisational risk-reducing measures.

The specific technical measures are generally similar to additional automatic barriers (for example emergency shutdown valves activated by gas detection).

The specific organisational measures, included in the safety management systems, are generally similar to additional manual barriers (for example emergency intervention procedures).

Thus, additional automatic and manual safety barriers are regarded for the definition of Residual Risk Assessment Scenarios.

However, they have to fit some safety requirements, related to their availability and reliability. These requirements and criteria will be defined in the next step of our works.

CONCLUSION

The methodology presented in this paper enables risk assessors and competent authorities to identify Reference Accidents Scenarios (RAS), by taking into account the influence of some safety barriers, in accordance with the Seveso II Directive requirements.

This method applies to most frequently met cases in high-risk industries and pursues a deterministic approach.

It is the second stage of an overall approach in order to better assess benefits and reliability of preventing and protecting measures, either technical or organisational, thanks to more detailed analysis, but without using any probabilistic method.

The first step of the methodology aims to highlight maximum hazard potential in industrial establishments, by the definition of Maximum Physically Possible Scenarios (MPPS).

The third and final stage of the methodology will enable to take into account specific technical and organisational measures, in the definition of Residual Risk Assessment Scenarios (RRAS).

The overall approach described in this paper represents an effort of rationalisation and harmonisation of the current practices to identify major industrial accidents. So as to achieve a level of full harmonisation, this method should be completed by the development of guidelines for the consequences modelling.

This method could help stakeholders in the public risk based decision-making process to evaluate the safety level of high-risk establishments: MPPS could be selected for emergency and intervention planning with emergency services, RAS could be selected for land use planning around hazardous installations, RRAS could be selected by an industrial operator for the demonstration of his efficient management of majoraccidents hazards.

DP~Figure 3 :

 3 Figure 3: MPPS fora pressurised vessel of chlorine

2 .

 2 additional passive barriers, 3.additional automatic barriers, 4.additional manual barriers. a) Safety barriers on Initiating Events -Overpressure, overflow, under-pressure: quality of materials (1), steel thickness (1), rupture disk, vent (2); -External or internal corrosion: quality of materials (1 ), steel thickness (1), cladding (2), painting (2), coating (2), cathodic protection (2), inspection (4), tests (4); -Human error: operation(s) requiring specific qualification and training (4); -Mechanical shock: quality of materials (1 ), steel thickness (1), double containment (2), wire netting (2), pipe-in-pipe configuration (2); -Thermal effects: fire wall (2), foam systems (3), water curtains (3). b) Safety barriers on Critical Events -Ignition: requirements of hazardous classification areas (3); -Pool: bound (2); -Puff: containment room (2); -Gas, liquid or two-phase release: reduced pipe diameter (1), non-return valve (2). c) Safety barriers on Dangerous Phenomena -Toxic gas dispersion: ventilation and treatment system (2); -BLEVE (Boiling Liquid Expanding Vapour Explosion) and Boil Over: deluge systems (3).

ACKNOWLEDGEMENTS

This paper was partly supported by a project funded by the French Ministry of Environment dealing with the major accident prevention in the framework of the Seveso II Directive.


L E Coze

F Ineris

Risk analysis method integrating both technical and organisational factors

Keywords:

Context

Safety Management Systems (SMS) are now required in a lot of establishments handling hazardous substances in Europe in application of the council directive 96/82/EC of 9th December 1996 on the control of major-accident hazards involving dangerous substances, known as SEVESO 2 Directive.

The Human Factors play obviously an important part in the effectiveness of those safety management systems. Indeed the system depends on the involvement of the people in charge of applying it.

Considering the Human Factors from this angle leads the risk analyst to look at the organisation also through its social aspect. The question raised becomes therefore how the relationships, the power plays between workers, the cultural influences can interact with the intended prevention goals of the SMS. The idea would be to allow the risk analyst to foresee the creation mechanisms of the organisational shortcomings at the origin of the major accident.

In this paper the author describes the development of a risk analysis approach that creates a focus on the link between the major accident hazards and the activities of the SMS, taking into account the real activities operated for the prevention process. This is a new approach where the individual is not the focus point, like traditionally in the formal Human Error or Human Factor approaches. The individual is considered in the context of the organisation, in its relation with others, in its relation with the processes of the organisation.

Method

First of all, the organisation is seen as the interaction of three elements, the technical (tools, equipment...), the system (activities, processes, procedures) and the people. The safety management system is described as the structural aspect of the organisation, in other words, the traceability of the prevention system in place, called the formal side (top-down approach related). The sociological aspect, integrating power plays and cultural influences of the organisation, represents the informal side of the organisation, because what truly happens between people and the way they behave is obviously not written in a safety management system (bottom-up approach related). It is interesting to note that several types of organisations can be characterised according to the two informal and formal components.

If we consider the positive assumption that the various types of organisations can reach a high level of prevention efficiency, then we can represent them on a scale taking into account the dimensions of the formal and informal components:

-The quantity of informal prevention related activities (1) happening everyday on site for the major accident prevention and the quantity of formal activities described in the SMS. In the case of the European Directive SEVESO 2, the regulation requires that the formal side meets at least the SMS specifications described in the annexe 3 of the directive. The minimum balance between the formal and the informal would be therefore to meet those specifications and to be able to demonstrate (paper focused) that the system exists and performs.

-The informal activities must be the effective support of a real working formal structure (2). Indeed as the oil in an engine, the informal side must support the effective implementation and operability of the structure. If the oil is not appropriate, even with a good engine, the chance to reach high motor performance is low. It is the same with an appropriate oil used for a bad designed engine. Somehow, a balance is required between a good formal activity (meeting the requirements of a good safety management system) and an informal activity (meeting the requirements of a sociological definition of the organisational effectiveness) toward a high standard prevention system.

Based on this model, INERIS has developed a risk analysis method integrating both technical and organisational factors. This method is called ATOS (Analysis of technical and organisational safety). The ATOS method is based on the concept of the organisation that integrates the formal and the informal components associated with the two dimensions -( 1) and ( 2) -and the idea of balance.

ATOS is firstly concerned by the major accident prevention. It means that it focuses on the activities which give support to the major accident prevention. It implies therefore an identification of these activities.

The inputs needed for ATOS methodology application are the information concerning the major accident. The information can be represented according to the Bow Tie approach. The risk analyst needs to know the potential scenarios and the corresponding Line of Defence ( L.O.D) in place against the occurrence of the scenario from the initiating events to its consequences.

Two alternatives are then possible:

-trying to work on the causes of the initiating events which is quite a hard task as the experience do not allow us (fortunately) to find the whole organisational shortcomings creating the event condition, -or, better in that case, trying to work specifically on the Line of Defence (L.O.D), and see how the organisation can assure the effectiveness of them.

Thus, the method is based on the determination of the L.O.D in order to identify the organisational activities required for the effectiveness assurance of the L.O.D.

Once those activities are identified, the risk analyst must check the presence of the structural mechanisms allowing the prevention (formal side which is paper focused, first dimension of the relationship between formal and informal ) and then assess the informal side with the idea of the second dimension described.

Practically the analysis is operated like following:

-a classical technical risk analysis, -an identification of the activities required to be assured for the effectiveness of the line of defence identified through the risk analysis, -an assessment through a quality based system audit of the management structure describing the processes of those activities is, -a sociological analysis. The latter is carried out using the tool called "strategic analysis", that aims at assessing the organisation effectiveness. It is used in order to assess what happens, beyond what is written, to find out what could badly interact with the intended prevention structure.

In its late development, the aim of ATOS is to build a score board for the safety managers. The methodology indeed is foreseen to be transferable to the safety managers, according to the principle "you cannot manage if you cannot measure".

Results

At the moment, the concept is developed and is intended to be applied in the forthcoming months with industrialists, particularly SMEs, working is chemical industries.


J C A S Le-Coze

O Vince

F Salvi

E Plot Prats

Development of the ATOS concept, analysis of technical and organisational safety

ATOS is an experimental project based on 3 simple guiding principles aimed at integrating several disciplines for a risk analysis. The three guiding principles are: -a vision of the organisation with a balance between an formal (centralised, or what is written) and an informal (decentralised, or unwritten rules) part, -"you do not manage what you cannot measure", -a focus on the quality of the barriers for the risk control. The disciplines involved in this project are, respectively to these principles, the organisational sociology, quality management and engineering. In this paper, the approach is explained and the result of a first application is presented. ATOS is designed to be a transferable tool for managers who have in charge the management of major hazard prevention.

Introduction

The ATOS project, Analysis of Technical and Organisational Safety, has been developed following the European Council Directive 96/82/EC of 9 December 1996 on the control of major-accident hazards involving dangerous substances. Indeed, the directive contains a specific requirement in its annexe 3 for the risk control through the implementation of a safety management system (SMS). This SMS spécification has been included in accordance with the high rates of organisational root causes admitted to be at the origins of the accidents [START_REF] Papadakis | Guidance on inspections as required by article 18 of the council directive 96/82/EC (SEVESO II)[END_REF].

This new requirement of the directive introduces a dynamic dimension of prevention. The risk analysis is therefore not anymore a static approach (like a photograph) of the installation that includes only the safety design of it, but includes also now the interaction with its environment. The people and groups of people working on it constitute its direct environment, within the limits of the plants.

Thus, the new SMS requirement raises directly the question about the impact of this environment on the technical system. These people and group of people, within the limits of the plants, are ruled in their activities by management systems (like does a SMS) but as well as by the interactions they have each other. This complex environment within the boundary of the plant needs to be addressed and introduced in the risk analysis.

This document describes an attempt to create a method integrating this dynamic dimension between technical and organisational issues. One question raised is therefore how can the link between the technical and the organisational approach be made explicit.

ATOS objectives and associated concepts

The project ATOS has several objectives:

2.1

Creating a frame where people from different disciplines could integrate their knowledge.

An objective of ATOS is to allow people with different background to work together. It means that these people must share a common understanding of the risk analysis and risk control; and the role they play in that analysis. This requirement can be met through a common vocabulary and concepts associated with it, and with a model of the approach that can bring a shared vision of the project. These steps are the elementary phases of the process of disciplines integration for a common objective.

The common objective here is indeed to include a dynamic dimension to the risk analysis. For that, three competencies are integrated in ATOS:

-Engineering, for the technical risk analysis of the installation (engineering science), -quality auditing for the SMS structure (management science), -organisational sociology for the study of interactions between people within a defined system (social science).

ATOS is really an experimental project because the dimensions, the concepts, the ideas that each discipline brings in the project do not match immediately. A lot of working-group work has to be done to start to apply specific tools from the different approaches in a common frame, where they can all "fit". This is what we could call a process of integration of disciplines (figure 1).

2.2

Integrating a human approach in the SMS through the organisational sociology angle.

The ATOS concept is based on the SMS specifications described in the annexe 3 of the SEVESO II [2]. This is therefore the starting point of the approach.

A SMS is seen as a structure of the organisation that rules the work processes of different levels of people working in chemical plants for the major hazard prevention; from the director, to the manager to the operator. The SMS is traceable, in the sense where an auditor can check the activities through formal documents (formal is defined as something written). This traceability is the support of the principle of assurance.

Assurance implies that you can proof through tangible traces that things are carried out against defined rules. It can be therefore a procedure, a record of an action performed against a procedure, a work maintenance planning etc...The directive gives 7 main chapters that must be implemented through these principles of assurance and traceability.

It is argued that this approach has its limits. A description of two obvious limits is presented here. open-minded attitude of the participants commitment, highly interested participants basics concepts of disciplines understood by everybody through books and presentations agreed common vocabulary appropriate modelling of the system studied Figure 1 : Process of integration from pluri to interdisciplinary approach 2.2.1

Pluridisciplinary project

Everything can't be written First of all, everything (in relation with the risk control) can't be written. All situations can't be foreseen and described in procedures.

That point has been identified as an important feature in organisational approaches in general. Centralisation (everything has to be written) versus decentralisation (everything has not to be written) is a core concept which has been widely issued. James Reason [START_REF] Reason | Managing the risks of organizational accidents[END_REF] identified two types of organisations:

"Administrative controls range from the mainly prescriptive to the largely discretionary. The former depend primarily upon external procedures, while the latter are provided by internalised knowledge and experience-orin a word, training. Between the two are various blends and mixtures. "

Here the terms prescriptive -discretionary are used. James Reason imagined a continuum on which organisations would move along, depending on their style, more prescriptive, or more discretionary. This is an interesting concept. C.Perrow in his "Normal Accident" book [START_REF] Perrow | Normal accidents, Living with High-Risk technologies[END_REF] wrote about this idea of the organisation position between centralised (prescriptive) and decentralised (discretionary) style, when participating in some discussions about nuclear power plants organisation:

"we cycled endlessly through the problem of insuring rapid, unquestioning response to orders from high (or orders in the procedures manual), and at the same time allowing discretion to operators. Regarding discretion, the operators would have the latitude to make unique diagnoses of the problem and disregarded the manual, and be free of orders from remote authorities who did not have hands-on daily experience with the system. We could recognise the need for both, we could not find a way to have both" This is an issue that needs to be explicitly questioned. What sort of organisation could comply with both needs? How to measure that position along the Reason's imaginary continuum. Centralisation (everything under formal activities) is necessary but not sufficient, because of the unpredictable. The unpredictable implies decentralisation to cope accordingly and independently in real time with a situation of potential disaster, individually but also within a group. How to describe this balance is a key issue (figure 2).

During the daily life of an organisation, they are things done in relation with the prevention of major hazard which are not formal. These things are an organisational answer to unpredicted events, in the sense where they are not and won't be covered by any procedures. These situations arise under constraints and changes of the technical environment (the installation and technical system itself that designers can't totally cover) but as well as changes and constraints of the organisation itself (people interactions, changes in the organisation structure etc...). That will always be the case, there will be always unpredicted situations. So rather than expecting of a system to write everything, it is important to consider right from the start that everything won't be written. That is important to integrate the aspects in the SMS assessment approach.

2.2.2

Everything can't be tangible through paper traceability

The SMS features covers 7 areas of management, most of them directly safety related: These chapters and their implementations becomes formal and therefore tangible aspect of the organisation, related to safety. They are "written rules" that shape the structure of the organisation. It is not a discovery for anybody to say that some "unwritten rules" do exist too [START_REF] Scott-Morgan | The unwritten rules of the game[END_REF]. They are actually never explicitly mentioned in any management system because they are the result of interactions between people [6], [START_REF] Friedberg | Le pouvoir et la règle[END_REF]. These unwritten rules are developing as a result of interaction between people at several levels of the organisation.

These unwritten rules have an impact on features of the organisation like communication, co-ordination, leadership, decision making, learning... These organisational features are not explicitly formulated in the SMS but they are acknowledged to be important characteristics of an effective organisation, according to a sociological perspective.

It is actually understandable that no formal traces exist of these features. How could you rely on paper to say that you have a good leadership in the company? How could rely on paper to assure that you have an appropriate co-operation? It is suggested in ATOS that the two approaches will be used for the risk analysis. The problem of their interface is therefore clearly raised.

Creating a set of safety indicators

based on this specific approach.

2.2.3

Consequence for the ATOS concept.

As a consequence, the concept acknowledges two dimensions of the organisation. There is a formal side described as a written part of the organisation, covered by a management system, and there is an informal described as the not written part of the company.

It is argued in ATOS that both an auditing technique 1 (assessment of the formal side of the organisation in relation to the major hazard prevention) and a sociological approach of the organisation (assessment of informal features of the organisation) must be complementary. This sociological approach is based on the strategic analysis 2 . Together, these two approaches must give a more comprehensive picture of the organisation (figure 3).

The technique of auditing consists of checking compliance against formal standards and records, through the auditing loop including for steps: asking, looking, checking and recording.

2 The stategic analysis [START_REF] Crozier | L'acteur et le système : Les contraintes de l'action collective[END_REF] is aimed at understanding the unwritten rules, the underlying structure of an organisation, using a system approach based on the power, bounded rationality and culture to define the relationships between the actors of the organisation. This allows to give a more dynamic picture of the organisation and is a good tool for driving the change if necessary.

2.3.1

The SMS performance measurement system A SMS is based on the principle that "you do not manage what you cannot measure". For that a performance measurement system is built within the SMS. This system is based on indicators.

These indicators give a picture of the state of the SMS. The indicators must be therefore closely related to the prevention of the major hazard. Two alternatives are possible at this stage: trying to eliminate all initiating events and therefore put some indicators on these practices or trying to assess the defences that prevent the risk [2], [8].

The later proposition is more relevant since the complexity of the systems (a chemical plants) make the search for the initiating event a rather difficult task [START_REF] Perrow | Normal accidents, Living with High-Risk technologies[END_REF].

It is suggested in ATOS that the performance measurement system must show how the risk control is assured bya high quality of the barriers, or in other words, in accordance to the quality approach, by the assurance of the barriers effectiveness.

Basically, these line of defences can be described as technical equipment (a pressure valve system) or as a human operation (an operator who must shut down the installation under defined criteria).

The seven chapters of the annexe 3 of the SEVESO II directive describing the SMS are the organisational mechanisms that give support to the quality of the barrier. For example, the management of change is implemented in order to assure that any technical modifications on the installation will be assessed in terms of its impact on the safety on the installation, and therefore on its impact on the effectiveness of the barriers. The organisation and personnel chapter will assure that the people (at any levels) will receive the appropriate training terms of safety issues related to their work...etc... So in terms of indicators there are outcome indicators which describe the level of assurance of the barriers and the activities indicators which describes how the organisational mechanisms are working and implemented. Both can be checked through the auditing technique (see figure 4).

It is the easiest way to create tangible indicators that anybody can ask for to check the compliance (subjectivity is eliminated-it is here or it is nor here). Does the record of the last preventive maintenance on this equipment according to the maintenance plan exist? Yes or No? This is a good example of tangible indicator (that can be even use for quantification).

Sometimes however a judgement is required too. For example, there is an emergency procedure for an unusual situation at work during the process. How do you know if that emergency procedure is relevant for other unusual situation that may arise (see 2.2.1 everything can't be written)? These more intangible indicators of compliance need to be clearly address when it comes to audit a system at the operational level. Often the solution is to rank the judgement on a semi-quantitative scale from bad to good.

2.3.2

Adding the informal part in the performance measurement system The auditing technique is based on the traceability, every questions related to the system must found its justification on paper.

FORMAL INFORMAL

This measurement performance system is therefore based on a formal aspect of the organisation. What is suggested here is to add the informal features described earlier (see 2.2.2 everything can't be tangible through paper traceability), through the same indicators classification between tangible and intangible. This work would be done through a different approach of the organisation than the auditing one, a sociological approach. This sociological approach will be based on the strategic analysis [START_REF] Crozier | L'acteur et le système : Les contraintes de l'action collective[END_REF],

This figure (figure 5) includes the informal aspect of the organisation in the safety performance measurement system of the SMS described previously:

"written rules" "unwritten rules"

Safety Management

Site tests

Methodology

For the site experimentation, the following steps have been applied.

First a technical risk analysis that allows to identify the scenarios and the banners for the risk control. These barriers are technical equipment as well as human operations.

Secondly all the formal aspects that could be related through the assurance of this barriers is checked through the audit technique with the 7 points of the SMS.

And finally the sociological approach is carried out.

In certain cases, the company does not have a formal SMS. In that situation an initial review is carried out to identify the practices linked to the major hazard prevention as a starting point, and therefore can address the formal activities that need to be written. The sociological assessment evaluates how to implement as best as possible the formal SMS based on the initial review, to map the informal features of the organisation.

These three steps are represented in figure 6.

First tests

The first application of this method is currently carried on a SME chemical plant.

Conclusion

The ATOS method is an innovative concept trying to merge different relevant approaches for the risk assessment. The angles selected for that assessment, namely engineering, management and sociology, have been integrated in ATOS. This integrative process led to the interdisciplinarity, where different specialists can communicate and build a common frame for the risk assessment.

The ATOS method consists in three steps: a technical risk analysis, an audit of a formal SMS and a sociological approach revealing the informal side of the organisation.

The application of that method on site showed the difficulty for one person to encompass the whole method, and it is definitely a complementary work between specialists that has to be done for the moment. The quality of the link between the technical analysis and the organisation assessment depends on this.

Finally, to be transferable to managers, the method must be further described and worked out, particularly through the development of a set of appropriate indicators.

Figure 3 :

 3 Figure 3: 2 complementary approaches of the organisatior

Figure 4 .

 4 Figure 4. Representation of a safety performance measurement system SMPS

Figure 5 .

 5 Figure 5. Adding the informal dimension to the representation of SPMS

Figure 6 .

 6 Figure 6. ATOS method


L Malherbe

C Hulot

Z Pokryszka

L Rouïl

CHARACTERIZING SOIL-TO-AIR EMISSIONS FROM A CONTAMINATED SITE

-Introduction

Inhalation of volatile chemicals emitted from a contaminated soil might form a major exposure route for people living on site and in the surroundings. It is essential then to quantify ambient air concentrations for characterizing such exposure and assessing the risks for human health.

Two approaches are commonly used : Direct ambient air monitoring only supplies punctual information which is strongly dependent on the prevailing meteorological conditions. Furthermore, concentrations lying below the analytical detection limits cannot be measured whereas they may be harmful to health, especially in the case of a long term exposure. Some exposure models include transfer functions which derive concentrations in the atmosphere from those measured in soil or in the soil pore-air. Such functions are based on simplified hypothesis and can ignore site characteristics likely to influence atmospheric dispersion.

To overcome the limitations of both methods FNERIS has examined the possibility of using atmospheric dispersion models. According to a preliminary modelling study [1], they might be useful tools to produce quantitative maps of short term worst case or long term concentrations, making it possible to delimit the impact area of the emissions from the soil. However, the reliability of the model predictions largely depend on the precision of the input data. In particular the pollution source should be defined very carefully. This is why INERIS has devised a strategy for getting a quantitative spatial representation of soil-to-air fluxes : it combines emission measurements with an original monitoring device and interpolation between the measured values using geostatistical techniques.

-Description of the measurement technique

The measurement system was originally designed to monitor methane flows on mining or landfill sites.

It is made of an accumulation chamber connected with an analyser (see Figure 1). Gases emitted from the site within an elementary surface (50 cm x 50 cm) are pumped, sent to the analyser and reinjected into the chamber, creating a recirculating flow. In that way, the atmosphere enclosed in the chamber is enriched with pollutant. The local flux can be easily deduced from the measurement of the atmosphere enrichment as a function of time.

The chamber was tested, validated and calibrated on a test, bench and evaluated during a collaborative sampling trial 1 . Field experiments conducted on different sites confirmed the efficiency of the method.

This sampling trial was managed by the French Agency for the Environment and Energy Resource (ADEME). The flux chamber More recently, developments have been undertaken to adapt the analyser to a wider range of pollutants 2 . Two categories of sensors are used :

a FID sensor to measure total hydrocarbons fluxes ; PID and semiconductor sensors to measure emissions of different product families, such as BTEX or chlorinated solvents. Their performance was checked in laboratory for several organic compounds, on a real contaminated industrial site for BTEX and on an experimental site (IFARE, Strasbourg) for tri-and tetrachloroethylene [2]. Those field tests have shown the capacity of the measurement system for detecting fluxes as low as 10 ~3 cm 3 /(min.m 2 ). New evaluation experimentations should be carried out this year. In addition to its technical performance the flux chamber presents practical advantages : it is handy and the measuring time at a given point does not exceed a few minutes, which permits to cover a large area in a relatively short time (a couple of days).

-Method of emission mapping

The geostatistical kriging technique is a method for interpolating between the measured values with respect to the spatial correlation structure of the studied phenomenon. In our case, the use of such technique is favoured by the dense regular sampling that the measurement system allows to achieve (see previous paragraph). Thus kriging is performed on the emission data to map the estimated soil-toair fluxes. A source term based on this quantitative representation can be defined and introduced into an atmospheric dispersion model. Furthermore, the kriging variance map provides information about the possible dispersion of the real fluxes around the kriged values, which is useful for estimating uncertainty and conducting a relevant sensitivity analysis.

-Conclusion and discussion

In the context of human health risk assessment, a methodology has been worked out for estimating gaseous fluxes from soil to ambient air when volatile compounds are present on site. Successful applications to contaminated areas have demonstrated the feasibility of this approach and enlightened several advantages in terms of performance and costs :

1. The monitoring device has proved reliable and sensitive. Low emission rates can be detected. 2. The flux chamber is handy and the time needed for a single measurement is quite short : so the transport of equipment is not a concern neither the time spent on site. Only one or two days are usually sufficient for characterizing gaseous emissions from a contaminated soil.

Thanks to a plotter linked to the recorder, the raw results of the measurements can be visualized simultaneously. According to the recorder response the assessor can adjust the location of the next sampling points and modify sampling density if necessary.

The methodology developed by INERIS can supply the assessor with a good estimate of the emission area. Provided that all other input data are properly defined, this information may be introduced into an atmospheric dispersion model to map ambient air concentrations over the studied region.

The results of emission monitoring may help the assessor to formulate a soil sampling strategy and select borehole locations.

Some aspects of the methodology have to be examined further. This will be done as part of a research programme starting in 2002 :

-The selectivity of the PID and semiconductor sensors needs being improved. This is very important as in most cases, the flux released by a contaminated soil contains several gases. -The seasonal variations of soil-to-air emissions should be considered when assessing long term exposure. -Inhalation of chemicals emitted from soil to indoor air may also constitute a significant exposure pathway. This is why the performance of the flux chamber inside buildings located on contaminated soils will be evaluated.

  Figure 1The flux chamber

  -Grasset F., Bonnet P., Girardeau Y., Jamois D., Pokryszka Z., Rouïl L., 2000. Estimating atmospheric transfers from contaminated sites, Consoil2000, Leipzig, octobre 2000, 727-733. 2. Pokryszka Z., 2001. Mesures du flux gazeux de composés organochlorés sur le site expérimental de VIF ARE à Strasbourg. Rapport INERIS, nov. 2001.