Raphaël Defert

A new risk assessment tool for multimodal transport of Dangerous Goods

At present time, future alpine railway crossings are under construction that will go through long tunnels, namely between France and Italy, the Modane base tunnel, and, in Switzerland, the Gotthard and Lôtschberg base tunnels. Crossing large mountainous areas such as the Alps and the Pyrenees means a lot of difficulties to solve. Security issues in those long tunnels have to be dealt with. Other security issues are to be addressed when Dangerous Goods go through densely populated areas, others where different means of transport (route, rail, ...) are interfaced.

These evolutions will generate modifications in the means of transporting goods and also in the routes pattern. It is thus important to be able to evaluate the risks due to some goods, some means of transport on the routes. The present paper shows the INERIS ongoing research project relative to the assessment of the risk induced by the transport of Dangerous Goods by road, by rail, and by their combined means of transport. In this paper, the main features and models involved in the future multimodal QRA tool are presented.

Introduction

A tool, enabling to assess risks due to road transport, already exists. Within the framework of a research project earned out for both the Organisation for Economic Co-operation and Development (OECD) and the PIARC (World Road Association), INERIS has already developed a model of Quantitative Risk Assessment (QRA) relative to the transport of Dangerous Goods on roads including tunnel sections. This work has led to an operational tool for the road transport. At present time, this tool is recommended in the French regulation and used to realise comparative risk studies for roads eventually including tunnels, crossing more or less populated areas, with a more or less dense traffic.

The ongoing project will extend the risk assessment capabilities for multimodal means of transport. The future new tool will integrate a Geographical Information System in order to achieve comparative risk assessments for complex and long routes.

In this paper, the main features and models involved in the multimodal QRA model are presented.

In order to assess in a general way the risks relative to the transport of Dangerous Goods, it appears necessary to have a tool dedicated to the rail transport whether it is operated in the traditional way (wagons) or with rail-road transport.

General approach

The QRA Model

The main purpose of the QRA model is to assess the risks relative to the transport of Dangerous Goods in a quantitative way. The model evaluates simultaneously the consequences and the frequencies of occurrence of possible scenarios. This makes it possible to assess quantitatively the societal risk (if the distribution of the people liable to be exposed is at hand) and the individual risk.

A complete assessment of the risks due to Dangerous Goods would require to consider all the possible weather situations, all kinds of accidents with all types of vehicle partially or fully loaded, etc. Such an evaluation is completely impossible and some simplifications have to be introduced. The QRA model is based on the following steps:

• Choice of a restricted number of Dangerous Goods. » Choice of some representative accidental scenarios implying those Dangerous Goods with their usual packagings. • Identification of physical effects of those scenarios for an open air or a tunnel section.

• Evaluation of their physiological effects on road or rail users and local population.

• Taking into account of the possibilities of escape/sheltering. • Determination of the yearly frequency of occurrence for each scenario.

F/N curve

F/N curves and their expected values are the major outputs of the QRA model. They are defined as follows:

Frequencies / Gravity curves (F/N curves): stand for the annual frequency of occurrence F to have a scenario likely to cause an effect (generally, the number of fatalities) equal to or higher than N.

Expected value (EV): number of fatalities per year, obtained by integration of a F/N curve The risk is characterised by two main aspects: frequency of occurrence and consequences. Consequences can be expressed by a number of fatalities, of injuries, structure and building destruction, damages to the environment. The number of fatalities can be considered as the main criteria to quantify risks. Injuries can also be calculated. In order to determinate the societal risk, F/N curves are built. Structure damages are evaluated through a semiquantitative way and environmental damages through a fully qualitative way.

Road QRA Model

The QRA model for the road is the origin of the multimodal QRA model because it was developed first and because even if there are significant differences, other tools will be based on the same underlying approach. Therefore an initial presentation of the Road QRA model enables to understand how the whole multimodai QRA model will be elaborated.

Integrated scenarios

The numbers of scenarios and of Dangerous Goods involved had to be very restricted for simplification purpose, but nevertheless be representative of the Dangerous Goods Transport. This challenge was met with a panel of 10 scenarios which have been developed in the QRA and are listed below: Two scenarios relative to fires of Heavy Goods Vehicles not transporting Dangerous Goods were used because they represent a non negligible danger in tunnel and because their frequency of occurrence is far higher than that of scenarios involving Dangerous Goods.

In the open air, consequences of physical phenomena can be calculated by existing dedicated models. Consequences are calculated using percentages of lethality and/or injuries, using probit equations (Equation which allows to deduct the physiological consequences from the exposure to physical consequences of a phenomenon) and considering the possibility to escape or to get shelter.

Usually, open air models calculating consequences of scenarios can not be used in tunnels and a specific development has been made (with the collaboration of WS. Atkins, UK) to determinate:

• The tunnel zones which can be affected by the scenario,

• Effects that can overflow out of the tunnel and which can generate effects in the open air outside the tunnel.

The complexity of problems to deal with and the number of possibilities of equipment and ventilation system (longitudinal, transversal or semi-transversal ventilation, one or two tubes...) in the tunnels lead to use simplifications.

Adoption of appropriate measures to the tunnels (traffic management, flammable liquids drainage, construction dispositions, monitoring, etc.) can reduce the frequency of the accidents and their severity. Some of them have been taken into account in the sub-module dedicated to the tunnels and in the QRA model. Therefore, it is possible to assess their influence on the F/N curves and on risk levels and to make more relevant decisions to reduce the risks.

QRA model Use

The main use of the QRA model is to compare the risks due to transport of Dangerous Goods on various routes. Typically, for a route including a tunnel, there could be other routes called alternatives routes, which are usually longer or going through urban centres. The method enables to assess the risks due to the Dangerous Goods traffic on each route. A comparison based on F/N curves and expected values becomes then possible.

When displayed on the same graph, if the curves of the various routes do not intersect, the riskier route is the one whose F/N curve is above the other curves.

If the curves intersect, the difference between the expected values has to be analysed. If they are significantly different, a conclusion is possible, else other decision criteria may be taken into account.

In order to use the model, data must be collected concerning:

• Tunnel: its geometry, its ventilation, its equipment • Traffic of vehicles according to estimations or observations (Dangerous Goods, heavy goods vehicle, light vehicles, bus and coaches) » Rate of accidents for each route • Populations outside of the tunnel » Meteorological conditions • Planned exploitation procedures in case of accident and time to implement them An accurate description of the traffics on each route is a key factor for a good use of the QRA model.

Multimodal QRA Model

General approach

In order to be able to apprehend in a general way the risks due to the transport of Dangerous Goods, it appears necessary to have a tool dedicated to the rail transport and a tool which can include the various means of transport on a given route. For the rail transport, it is necessary to distinguish the "ferroutage" (HGVs loaded on carrier wagons) and the traditional rail transport.

Thus the project presently under development has two principal aims:

• Develop a model of Quantitative Risk Assessment relative to the transport by rai I of Dangerous Goods dealing with "ferroutage" as well as traditional rail transport. The exposed populations are the populations located in the vicinity of the railroads (sedentary people or moving people in the case of routes skirting and/or crossing the railways) and the travellers aboard trains. In this last case, it may be people aboard freight trains (it is typically the case of HGV drivers, in the case of ferroutage) or in passenger trains. The case of the long tunnels, where several trains (including eventually passenger trains) can a priori be simultaneously present will be treated. » Create a common interface for the assessment of road and railway risks with the help of a Geographical Information System (GIS) to allow calculations of risks on a route independently of the means of transport, rail or road, open area or tunnel.

These developments will be integrated with the road QRA model into a global tool : the multimodal QRA model. This global model will make it possible to study complex and realistic routes regarding the road and rail transport of Dangerous Goods.

The notion of route

Transport of Dangerous Goods in France may be done by various modes:

» road transport, » traditional railway transport,

• intermodal transport, either combined transport (using containers which may be loaded on specifically road trailers or rail wagons) or "ferroutage".

A route linking 2 point A and B is a succession of installations, ways or roads between those 2 points. For modelling purpose, it is considered these elements are separated by nodes which may be inter or intra-modal nodes. Points A and B are, most of the time, industries or industrial zones.

Rail Road

Point A Point B Route 3 MY: marshalling yard IP: intermodal platform Route 1 : Intermodal. On the route from an intermodal platform to another one, there can be marshallmg yards. Route 2: Rail transport. There can be some marshelling yards. Route: Road transport.

Figure 2: Example of alternative routes

For rail freight, the unit of transport is the train, whereas the unit of loading is the wagon. If a company sends a sufficient number of wagons, it can constitute a whole train. A whole train goes directly from the shipper to the consignee without treatment by marshalling yards.

The transport of isolated wagons or of railboxes from intermodal transport requires the formation of trains. In order to form trains, wagons or railboxes are regrouped from the sending zones. These operations require to sort the wagons and recombine them in trains accordingly to their destination.

These operations are performed accordingly to the modes in:

The intermodal platforms (interface between rail and road or road and rail),

The marshalling yards (rail transport).

The concentration (geographical close vicinity of a large number) of railboxes raises the question of the potential "domino" effects: an explosion and/or a fire can damage the wagons or the railboxes which are close. If they contain Dangerous Goods, the damage caused by the first event can trigger an explosion, a fire or a toxic release on a second tank, and this propagation may go on. It is what is meant by domino effects.

Sources of danger relative to intermodal platforms are: the handling, which can results in falls and deteriorations of the railboxes, and the simultaneous presence of the road and railway, with manoeuvrings of trucks and trains. Dangerous Goods spillage or release due to overloads and bad weight distribution of loadings are the main causes of danger on these platforms.

Between the marshalling yards and the platforms, points of junction of routes and sometimes of parking for trains are to be found. They present particular characteristics either in term ol accidentology, or in term of consequences of a dreaded event, and are called "singular points on line".

The singular points in lines are:

The railway crossings,

The switching zones (rail),

The passenger railway stations,

The deep cuttings railroad,

The bridges (rail and road),

The tunnels (rail and road).

Integration of a GIS

"GIS" stands for "Geographical Information System". Geographical information is the representation of a portion of area, either by a diagram (geometrical figure), or an image. This representation is georeferenced, i.e. all the data are localised in the same frame of reference.

The major part of the data handled by the QRA (input and output data) has a geographical component. Replacing them in their context gives them a full dimension. The cartographic approach will optimise the exploitation of the QRA by widening its range and its fields of use. Also it will simplify the data collection needed for the risk assessment, i.e. the routes data and their environment, essentially the populations liable to be exposed. This cartography will make it possible to represent in a synthetic way analyses implying many variables. It is possible to juxtapose multiple levels of information (densities of population, traffic, characteristics of the road or way (presence of tunnel or not, etc), scenarios considered, etc.) on a map. This cartographic approach may be a real help in decision-making.

General approach

The rail QRA model will be elaborated using an approach similar to the one used for the road QRA model. But it will require the development of new "sub-modules", specific to the railway routes. On certain aspects, a direct adaptation from the Road QRA model is not possible. For instance road traffic, constituted by a large number of vehicles may be described as continuous. On the other hand, rail traffic constituted by trains appears as essentially discontinuous.

In the model, three different modes have to be considered:

« The traditional Rail Transport

The goods are transported in tanks for the liquids or the gases under pressure especially designed for the rail transport, which constitute full wagons. Their capacity is higher than that of the tardes used for combined transport or road transport.

• Combined transport

With this type of transport, the freight, during its conveyance from an origin point towards a destination, uses several means of transport (maritime, road, railway). These changes of means of transport imply the use of Intermodal Units of Transport (IUT) which are sorts of specifically designed containers. The IUTs are loaded and unloading from one mean of transport to the other, either in intermodal platforms (railroad) or in harbours (sea-rail or sea-road).

• The ferroutage

The ferroutage is an intermodal transport between rail and road. The whole HGV (trailer + tractor) is loaded on the wagon, contrary to the combined transport. In France it is used only for Transmanche transport (Channel tunnel), but is destined to develop in the future (for example the future Lyon-Turin rail link).

Conclusions

The project started in 2001 and will be achieved in 2003. At present time, the rail QRA model and the GIS approach for the road QRA model are under development.

All this work, supported by the French Ministry of Land Use Planning and Environment, and by the French Ministry of Transport, will lead to a new tool for the multimodal Quantitative Risk Assessment for the transport of Dangerous Goods.

Present developments will broaden the possibilities and the scope of the already existing road QRA model. In the fields of Risk Assessment relative to the Dangerous Goods transport. comparisons between different routes and means of transport will become possible.

Figure 1 :

 1 Figure 1 : Example of F/N curves

4. 4

 4 Figure 3: Structure of the future Multimodal QRA model

Table 1 :

 1 Scenarios of the road QRA Model


J P Pineau

Risk analysis for equipment and protective systems intended for use in potentially explosive atmospheres

Keywords: risk assessment, explosive atmospheres, equipment, protective systems

EU Directives 98/37/EC (machinery directive) and 94/9/EC (ATEX 100A) have to be applied by manufacturers of equipment and protective systems intended for use in potentially explosive atmospheres. These Directives include Essential Safety Requirements and place an onus on manufacturers to carry out a risk assessment for the intended use of their equipment. In order to help manufacturers in this task, the European Standards organization, CEN, TC 305 has mandated its WG 4 (terminology and methodology) to write a standard on the risk assessment of equipment and protective systems intended for use in potentially explosive atmospheres. The RASE project was set up as a prenormative research work to define the requirements for developing such a standard as specified in the dedicated call of the European Commission's Standards Measurement and Testing programme concerned with subjects relating to the standardization activities of CEN -Explosive atmospheres -risk assessment of unit operations and equipment. The project (December 1997-May 2000) was co-ordinated by INBUREX with the participation of FSA Germany, INERIS France, HSE England, NIRO Denmark and CMR Norway. Since March 2000, WG 4 (TC 305) is actively involved in preparing the final draft of this standard. This paper describes the objectives and the results obtained to date in RASE project and in WG4. An outline is given of the contents of the standard being developed for the risk assessment of equipment and protection systems intended for use in potentially explosive atmospheres.

INTRODUCTION

The Essential Safety Requirements relating to EU Directives 98/37/EC (machinery directive) and 94/9/EC2 (ATEX 100A) are to be applied by manufacturers of equipment and protective systems intended for use in potentially explosive atmospheres. Current standards (e.g. EN1127-1) only consider the basic concepts and methodology dealing with explosion prevention and protection for group II equipment. There is a lack of a common methodology which can be used by manufacturers facing the design of the wide variety of equipment and protective systems (both electrical and non-electrical) intended for use in explosive atmospheres.

CEN/TC305 has mandated (December 1994) its working group 4 (terminology and methodology) to write a specific European standard dealing with risk assessment of equipment for use in potentially explosive atmospheres before end 2001. This means that there is an urgent need for a standard on risk assessment.

In order for manufacturers to meet the Essential Safety Requirements, it is necessary that they carry out a risk assessment of their products including its intended use. Current Risk Assessment Methodology standards, for example EN 1050, provide a good general overview of the techniques and the concepts involved for application of the machinery directive. However they need to be extensively and clearly extended to cover the specific situation and problems associated with risk assessment of equipment and protective systems intended for use in potentially explosive atmospheres.

Thus it is necessary to develop a flexible and comprehensive unified methodology that will assess the process parameters including those of equipment and protective systems to identify the hazardous situations and evaluate the risks. This methodology needs to provide a link between the risk, its severity and probability of occurrence and the consequences whilst allowing the evaluation of mitigating effects arising from both the design and construction of the equipment and also the provision of additional protective systems (risk reduction), the 'RASE' project objectives

The RASE project was set up to meet the requirements for developing such a standard as specified in the dedicated call of the European Commission's Standards Measurement and Testing programme concerned with subjects relating to the standardization activities of CEN -Explosive atmospheres -risk assessment of unit operations and equipment.

The objective of this project is to develop a comprehensive flexible Risk Assessment Methodology for identifying potential hazardous situations in equipment such as reactors, dryers, mixers, storage systems intended for use in potentially explosive atmospheres in various industries (chemical, oil, food and provender, metallurgy etc.).

The developed Risk Assessment Methodology will help manufacturers of such equipment fulfil their obligations under the ATEX100A (Equipment for use in potentially explosive atmospheres, 94/9/EC) Directive, i.e. it will be related to the equipment groups and categories defined in this Directive and will be produced in a form that can be readily discussed as an input for a European Standard. The project has been developed to ensure a close relationship with the work performed in CEN/TC305 and CENELEC/TC31, the European Standards bodies concerned with this topic.

As a consequence of this scientific objective, the following technical objectives will be achieved :

• harmonization of a comprehensive approach of hazardous situations between manufacturers, consultants, competent authorities and users. • The user should consider the safety in operational conditions on the basis of risk assessment performed at the design stage by the manufacturer. • estimation of the residual risk (if any) • improvement of the choice of equipment referring to safe operating conditions • reduction of production losses during operation (including malfunction) of the equipment and total loss of equipment from an accidental explosion • use of the results of the application of the risk assessment for the training of operators of equipment.

As the proposed project has been planned to be accomplished in close co-operation with CEN/TC305 and CENELEC/TC31, the end result will be a methodology that can be used as an input for the work to be performed by CEN/TC305/WG4 which will enable manufacturers to simply and quickly assess the risks associated with the intended use of their products, thus contributing to the improvement of Health, Safety and Environment in Europe.

The work (WI 00305061) mandated to WG 4 in TC 305 is concerning a methodology for risk assessment of equipment and protective systems for intended use in potentially explosive atmospheres.

The proposed scope is the following :

This standard will give guidance on risk assessment related to dangerous (hazardous) situations arising from potentially explosive atmospheres.

This includes :

• The evaluation of the likelihood and consequences of an explosion • The mitigation of explosion effects • The selection of equipment and/or protective systems (including components)

• The information for safe use and maintenance.

I WORK PROGRESS IN RASE PROJECT (December 1999-May 2000)

A draft version of a risk assessment methodology which can be used by manufacturers of equipment designed for use in potentially explosive atmospheres was produced in May 2000. This methodology was established as an end product after completion of four discrete work packages :

• Inquiry on Current Experience from Manufacturers • Development of Risk assessment methodology • Application of the methodology for various types of equipment and protective systems • Final definition of the methodology.

Inquiry on Current Experience from Manufacturers

The starting point has been the existing experience of manufacturers. An inquiry was carried out through questionnaires. Included in this questionnaire were aspects such as the intended use, the level of training of operators, the degree of automation of the equipment, the choice of safety measures used, the severity of harm, the probability of occurrence of hazardous situations, the reliability data of equipment and safety measures, the efficacy of the safety measures, the maintenance, the lessons learnt from accidents, the existing national regulations, standards and codes of practice, the safety rules specified in the instructions for use and whether and how manufacturers currently carry out risk assessments.

A questionnaire was also adapted to users.

These questionnaires were translated into French, German, Danish and Norwegian and sent to firms in England, Ireland, France, Belgium, Germany, Switzerland, Austria, Denmark, Sweden and Norway. The distribution was mainly to manufacturers (mainly non-electrical but also some electrical) as well as to some users of equipment for use in both gas and dust explosive atmospheres. Both large and small companies were approached as well as Engineering Contractors. Unfortunately due the time constraints of the project, it was not possible to cover Southern European countries.

Approximately 200 responses were received and the results reported using an Excel spread sheet specially developed to aid with the evaluation of the results. The main conclusions that can be drawn from this survey were :

• most respondees have little awareness of the European Directives themselves, however the majority are aware of national legislation in this field • in many instances, manufacturers do not consider that it is their responsibility to define hazardous zones and assess risks, however customers specifications are taken into account. They do not seem to use the results of any risk assessment which would appear to contradict the response that the majority consider 'intended use'. • the risk of occurrence of explosive atmospheres are assessed by Users with a large diversity of methods. Both potential gas/vapor and dust explosive atmospheres are taken into account. For this risk assessment, topics such as flammability and explosivity characteristics of products, hazardous areas classification, protective and preventive methods are considered. • 1/3 of manufacturers are aware of accidental explosions involving their equipment.

• 1/2 of users had had explosions in their plant -protective systems were present in the majority of these incidents. • a large variety of safety measures were used by users however surprisingly such safety measures were chosen as a result of a risk assessment in only 50% of the cases. • with respect to efficacy, there were a lot of standards used by manufacturers either related to the equipment in general and for specific protective measures but only 50% of the users said that they received such information. • ca. 85% of the users consider reliability of equipment and protective systems as a part of their risk assessment whereas only ca. 50% of manufacturers consider this aspect.

The questionnaires identified that both manufacturers and users are still looking for suitable tools to use for risk assessment.

Additionally, incident data have been collected and evaluated to determine relevant aspects which would have a bearing on the proposed risk assessment methodology. The review included approximately 750 dust explosion accidents and 20 gas explosion accidents.

The investigation revealed the following with respect to the cause and effects of dust explosions :

• 26 % of the accidents are caused by human action (based on German records, UK records indicate that only 7 % of the accidents are caused by human action) • 28 % of the accidents are caused by poor design • 12-14 % of the accidents is caused by poor maintenance • 2-7 % of the consequences of the accidents were worsened due to human action • in 19-21 % of the accidents poor design can be pointed out as a factor for worsening the effects.

It was found that in almost all cases knowledge of ignition properties of the respective dusts would not have been able to prevent the accidents from happening. Explosion protection was applied in many cases but worked satisfactory in only a fraction of the cases that it was applied.

With respect to the causes of gas explosions it was found that :

• 33-67 % of the accidents can be attributed to human action (respectively offshore and onshore) • both offshore and onshore design errors are responsible for approximately 33 % of the accidents • poor maintenance appears to be responsible for 11 and 17 % of the accidents occurring offshore and onshore respectively however, 46 % of the accidents concerned mechanical failure.

In all investigated gas explosion accidents the design was too poor to withstand the gas explosion effects.

Overall the review showed that important issues in risk analysis are: human factor, plant design and maintenance and that these factors should be taken into account in the development of the risk assessment methodology.

Development of Risk Assessment Methodology

According to the responses to the questionnaires and the types of equipment involved, a review was carried out of existing methodologies for risk assessment which will enable a methodology to be developed so that it is flexible enough to be simply applied to the equipment considered but comprehensive enough to deal with the above mentioned aspects.

The objective is the development of integrated explosion safety through the choice of reliable and effective safety measures.

The review of existing methodologies considers not only current European standards but also national standards, guidelines and current practices. In addition accident literature was reviewed to ensure that any lessons to be learnt are incorporated in the methodology. The scope of the risk assessment methodology was based on the requirements identified from the responses to the questionnaire.

The results of the review of existing methodologies for risk assessment together with the responses from the questionnaire and the review of gas and dust explosion incidents that have occurred allowed to develop a methodology which is flexible enough to be simply applied to the equipment considered but comprehensive enough to cover all aspects required by the Directives.

The scope of the methodology has been extensively discussed by the project partners. In particular, the intended breadth of application of the methodology i.e. whether it is intended just for simple pieces of equipment or also for more complex assemblies of apparatus was a difficult point to resolve. On the one hand limiting the scope of application to simple single items of equipment has the advantage that the resulting methodology would be relatively simple to describe, however, this is unlikely to meet the requirements of the project which specifically states that the methodology should be applicable to all equipment and unit operations which fall under the ATEX 100A directive. At present the methodology attempts to cover all equipment covered by the ATEX 100A Directive. It is primarily targeted at manufacturers however it also covers aspects of use to ensure a common format/language between the two aspects. Often the severity/consequences of an incident can only be defined by the user and a link is needed between these aspects.

The methodology concentrates on risk analysis i.e. hazard identification, risk estimation and risk evaluation, and also includes details of the relevant tools/techniques which can be used.

In addition, ways to identify possible deviations have also be included. Risk reduction, which is not a part of risk assessment has not be included, however, a section on risk reduction options analysis has been included to ensure that the risk assessment considers the effect of any risk reduction measures that were taken. An extensive list of existing risk assessment techniques has been included with a short description of each and reference to more detailed information.

It became apparent that a critical stage in the process of risk assessment was the definition of the scope of the intended use of the equipment being studied. The methodology includes a novel procedure for the preparation of an 'Equipment/Process Flow Diagram' to ensure that the intended use of the equipment is correctly defined. This procedure helps specify the conditions within the equipment during its use by the inclusion of energy (i.e. temperatures pressures etc.) levels for each phase of the equipment's operation which are then used to consider/define the status of the materials being handled and the equipment itself. Such a flow diagram not only helps to define the intended use but is also used as the key part of the iterative risk assessment process.

A large amount of effort has been expended in trying to achieve both a clear logic flow through the risk assessment procedure and also the arrangement of information in a structured way. Logic diagrams have been included to make the methodology more useable. Flow charts for deciding which data/tests are required for gas/vapor flammability properties and for the explosibility of dusts have been developed and included.

The methodology provides ways to consider the risk of damage to people, the environment and property and a separate section has been included discussing residual risk. In order to help the user of the methodology, tables with a prescribed format have been included for recording the results of the hazard identification step and also the new 'Function/State Analysis' step. These also help achieve one of the aims of the methodology i.e transparency between manufacturer and user. Although quality assurance is not felt to be a part of the methodology, the specific requirements for documentation which have been included would allow an audit of the results to be carried out where necessary.

It is intended that the final document will contain examples of the use of the methodology and will include information to help manufacturers classify their equipment as defined in the Directive.

Contents of the proposed standard

The proposed methodology has been written in the format of a standard and its contents are shown in Table 1.

The Introduction outlines the requirements of both the Machinery and ATEXIOOA Directives in terms of producing a safe machine and describes the applicability of each Directive. Thus in order to comply with the Essential Health and Safety Requirement of the Machinery Directive, it is necessary to comply with the ATEX Directive. If there is an explosion risk which is outside of the scope of the ATEX Directive then the original Machinery Directive will apply. Following a brief description of explosion risk and the influencing factors in section 4, the main body of the proposed standard is contained in section 5 which describes the proposed risk assessment methodology. • What is the chain of events which could lead to harm?

• Can we tolerate the potential consequences at the estimated likelihood? • What are the benefits and costs of alternative technologies?

For the purpose of the proposed standard, risk assessment comprises in principle four steps following the determination of intended use and the methodology proposed follows this sequential approach: • Determination of intended use (Functional / State-Analysis) • Identification of hazards, hazardous situations and hazardous events • Risk estimation of consequences / likelihood • Risk evaluation • Risk reduction option analysis.

The first three steps of risk assessment (determination, identification, estimation) are often referred to collectively as risk analysis. Risk assessment is an iterative process. If, after risk has been evaluated, the decision is made that the risk needs to be reduced it is necessary to reestimate the risk. A decision can then be made as to whether the measures taken have reduced the risk to an acceptable level. It is also essential to check that the measures used to reduce risk have not themselves introduced any new hazards. Therefore a feedback loop from Risk Reduction Option Analysis to Hazard Identification has to be made.

Determination of intended use (Functional / State-Analysis)

As mentioned above, the trials of the methodology with manufacturers showed that this aspect was often poorly defined particularly in terms of nature of the explosive atmosphere that may be present. A functional state analysis procedure has therefore been developed by the project team and included in the proposed standard. In this respect it is an advantage to establish an Equipment / Process Flow Diagram in the light of a Functional / State-Analysis with the inclusion of energy levels (i.e. temperatures, pressures etc.) for each phase of the equipment's operation. Such a diagram helps the assessor to consider and/or to define the status of the materials being handled and the status of equipment itself, see Figure 1.

In addition, such a flow diagram not only helps to define the intended use but also can be used as the key part of the iterative risk assessment process. It refers the ATEX product characteristics to energies involved and/or the operating state as well as the physical state of the substance. Thus the analyst is able to determine what, why and how things can happen, especially when dealing with complete machines or more complex products. The diagram is based on the fact, that any ATEX product has limits to its functionality and to its use, especially the intended use, its lifetime and space it occupies (configuration). These limits form part of constituent elements or parameters which need to be taken into account in any phase of the Functional/State-Analysis. These constituent elements could serve as a screen to register, for example,

• phases of equipment life • limits in terms of use, time, space • accurate definition of the function • selection of material used to construct • combustion properties When defining those limits, the following items have an important impact, for example, in terms of use, time and space :

Identification of hazards, hazardous situations and hazardous events

There is rarely, if ever, a single cause of a hazardous situation or hazardous event. Although the immediate cause may be a simple hardware failure or operator error, other events will have also occurred which contribute to the development of the accident. Such events include undetected failure of protective systems, ergonomie problems or an organization in which safety is not given priority.

In many ways, hazard identification is the most important part of any risk assessment. In order to successfully carry out this step the previous step must have accurately defined the equipment in sufficient detail. Once a hazard has been identified, the design can be changed to minimize it, even though the degree of risk may not have been estimated, however unless the hazard is recognized it cannot be addressed during the design phase. A full understanding of the equipment intended use and foreseeable misuse is of prime importance during this step.

A project or a process has an acceptable safety design when one judges that adequate preventive or protective measures have been taken. The term "adequate measures", refers to generally accepted safety, engineering, scientific, production, operational, and maintenance procedures with view to the location in which the risk might occur.

The main aim of hazard identification is that all possible hazards are found and none are missed. This may be facilitated by the use of more than one method and/or technique. The main output from the hazard identification stage is a numbered listing of hazardous events recorded as in Figure 2, which could result from the unit operations and equipment involved and is used as an input to the risk estimation stage.

Hazard identification can also produce subsidiary outputs, for example, a list of possible protective measures against the hazards which have been identified. Such lists can then be used in the risk evaluation and risk reduction steps of the risk assessment.

In the assessment of the combustion properties and the likelihood of occurrence of a hazardous explosive atmosphere logic diagrams are useful tools and several have been included in the proposed standard, for example, for flammability limits or relevant data characterizing the behavior of the explosive atmosphere, and for the exclusion of ignition sources. The ignition capability of the ignition sources should be compared with the ignition properties of the flammable substances. The likelihood of occurrence of the effective ignition sources is assessed following EN 1127-1 taking into account those that can be introduced e.g. by maintenance and cleaning activities.

Risk Estimation

In principle, Risk Estimation shall be carried out for each explosion hazard or every hazard event in turn by determining the elements of risk after Hazard Identification. The risk associated with a complete machine or process is derived from a combination of these individual risks. Risk in terms of explosion safety is fundamentally made up of two elements: the severity of the possible harm and the probability of occurrence of that harm.

The severity or consequence of an explosion can often be adequately characterized however the probability of its occurrence is usually more difficult to quantify.

Risk is usually expressed in one of 3 ways :

• Qualitatively for example as high, medium, low tolerable, intolerable, acceptable;

• Quantitatively by calculating the frequency or probability of some determined event occurring; • Semi-quantitatively where elements of risk such as consequence, exposure and likelihood are given a numerical score which are then combined in some way to give a pseudoquantitative value of risk which allows risks to be ranked one against another.

In many situations it is not possible to exactly determine all the factors that effect risk, in particular those which contribute to the likelihood of a specified event occurring. Thus risk is often expressed in a qualitative rather than a quantitative way. Severity can be expressed as defined levels, one or more of which can result from each hazardous event. Thus in terms of injuries, damage to health or system damage severity can be expressed as shown in Table 2.

In order to estimate the frequency of each severity level a screening technique can first be applied to determine the probability of each hazardous event in terms of both the occurrence of an ignition source and the explosive atmosphere. The frequency of occurrence can be qualitatively expressed as shown in Less than minor injury, occupational illness, or system damage.

Table 2 : Definition of severity levels

In order to estimate the frequency of each severity level a screening technique can first be applied to determine the probability of each hazardous event in terms of both the occurrence of an ignition source and the explosive atmosphere. The frequency of occurrence can be qualitatively expressed as shown in Table 3 Following the estimation of the risk, Risk Evaluation is carried out to determine if Risk Reduction is required or whether the required degree of safety has been achieved. It is evident that if the risk estimation results in a risk level of A, the risk is so high as to be intolerable and additional risk reduction measures are required. Similarly a risk level of D can be considered to be acceptable and no further risk reduction is required. Thus the risk can be described either as 'Intolerable' -if the risk falls into this ranking then appropriate safety measures must be taken to reduce the risk, or as 'Acceptable' -if the risk falls into this category then no Risk Reduction is required and the Risk Assessment is complete.

Risk levels B and C are intermediate levels and will normally require some form of risk reduction measures to make the risk acceptable. However, the degree of these measures will be smaller and in the case of a risk level C, organizational risk reduction measures will often be sufficient.

Alternatively the process of Risk Evaluation can be carried out by comparing the explosion risks associated with equipment and unit operations with those of similar equipment. In this case it is essential that the following are comparable :

• hazards and elements of risk • type of equipment, its technology and operational limits • intended use and the conditions of use.

The application of the comparison method does not preclude the need for conducting a Risk Assessment for the specific conditions of use.

Risk Reduction Option Analysis

Risk can seldom in practice be reduced to zero except by eliminating the activities, however, risks can often be further reduced. Options which address the hazardous events that make the greatest contributions to the total risk have the greatest potential to reduce risk. Effectiveness in reducing risk always starts with changes to the design concept, i.e. an inherently safe design.

Once the risk has been estimated and evaluated the risk reduction option analysis leads to the final decision as to whether or not the solution found reduces the risk to an acceptable level. This decision includes both the technological and economical point of view based on an appropriate classification of equipment category. If not, the iterative process has to repeated after amending the safety concept. It is necessary to deal with residual risks after all measures have been taken to reduce the probability and consequence of a specific hazardous event. The residual risks are those against which risk reduction by design and safeguarding techniques are not, or not totally, effective.

The user of the equipment must be informed about residual risks. Instructions and warnings, for example, prescribe the operating modes and procedures to overcome the relevant hazards.

In many cases, it is unlikely that any one risk reduction option will be a complete solution for a particular problem. Often Risk Assessment of Unit Operations and Equipment will benefit substantially by a combination of options.

1.2.8 Methods and/or techniques that could favorably be applied

The proposed standard also includes a section describing the different methods that are available for risk assessment and their applicability to different situations. There is no golden rale as to which method and / or technique ought to be adopted. Figure 3 gives some typical consideration in selecting type of analysis and depth of the study.

By using more than one technique the possibility of overlooking any relevant hazards is minimized. However, the additional time employed in using more than one technique needs to be balanced against the increased confidence in the results.

Vhi l I is the phu'k; of ihr Ar, there-.'.vi^u-.r-.v j i con', vie!ua' requ'>»; ^..'rtls?

APPLICATION OF THE METHODOLOGY FOR VARIOUS TYPES OF EQUIPMENT AND PROTECTIVE SYSTEMS

Six examples were extensively developed :

• exhaust system of gas engine • paint spray booth • oil seed extraction unit • protective system : an explosion venting door.

• pneumatic powder transfer system • spray Dryer for milk.

During these trials many manufacturers found that the document contains a great deal of useful information but from a practical point of view it was difficult to navigate. It was not easy to read, too extensive, doesn't spell out in word of one syllable what manufacturers have to do, what is link between methodology and directives etc. In applying the methodology it was found that the sections on risk estimation and evaluation were not consistent and required further development.

However following the application of the methodology with the help of the project partners, it was found that the use of the proposed proformas helped to clearly summarize the results. Similarly, the methodology provided a good framework to pull together existing safety studies forcing the consideration of the intended use / limitations of the machines.

It was clear from the trials that had been carried out that most manufacturers found the methodology difficult to use. This in part reflects the complexity of the subject but also because the manufacturers have little idea what is involved in carrying out a risk assessment and what they have to do to meet the requirements of the Directive. When guided through the process by a project participants -it was clear that the methodology produced a satisfactory risk assessment with the advantage of the results being transparent.

COMPARISON OF RESULTS, REVISION OF METHODOLOGY AND FINAL DEFINITION

The above mentioned trials have shown that the basic framework of the developed methodology is suitable and that when the suggested proformas are used for recording the results, the risk assessment which has been carried out can be clearly followed. However it is clear from the trials that manufacturers have extreme difficulty in applying the methodology. This is partly to be expected as the subject of risk assessment is extremely complex and it is unlikely that someone without experience in the field can simply take the proposed draft and directly apply it to their problem.

In order to improve the 'usability' of the methodology the project team has decided to develop and include a 'User-Guide' which will contain detailed examples of the use of the methodology for assessing the risk associated with different types of equipment and unit operations. Once this is completed, the revised draft will be considered as the input for CEN TC305.

II WORK PROGRESS ON RISK ASSESSMENT METHODOLOGY IN CENTC305,WG4

After a call for experts through national standardization bodies, three meetings were held until now with the active participation of representatives of the following countries : France, Germany, Sweden, United Kingdom, after a call for experts. Unfortunately, with the exception of one expert, members of the RASE project were unable to attend the meetings of working group four.

A rearrangement of the existing RASE project was proposed by experts to have the basic methodology as one part and examples and users guide as a second part.

The existing document should be adapted to be aligned with ISO/IEC guide N 51 " Safety aspects. Guidelines for their inclusion in standards.

The standard will follow the iterative process of risk assessment as given in EN 1050 used for the requirements of machinery directive (and used in the RASE project).

Revisions of the various parts were proposed and are to be discussed on the basis of an existing document in a meeting to be held in London on October 23 and 24 th 2001.

Ill CONCLUSIONS

The RASE project is finished since May 2000 and has successfully achieved its objectives. A methodology for the risk assessment of equipment and unit operations intended for use in potentially explosive atmospheres has been developed. It is based on the results of a review of existing methodologies for risk assessment together with the responses from a questionnaire of manufacturers and users on their current experiences and a review of gas and dust explosion incidents that have occurred. The draft methodology has been tested with selected manufacturers of equipment and the results from these trials have been used to produce a methodology which is flexible enough to be simply applied to the equipment considered but comprehensive enough to cover all aspects required by the Directives. As the project is being carried out in close co-operation with CEN/TC305 and CENELEC/TC31, the end methodology is now an input for the work under progress by CEN/TC305/WG4 which will enable manufacturers to simply and quickly assess the risks associated with the intended use of their products, thus contributing to the improvement of Health, Safety and Environment in Europe.

Figure 1 :

 1 Figure 1 : Functional Analysis of Unit Operations

Table 1 :

 1 Contents of proposed standard on Risk assessment of equipment 1.2.2 Risk Assessment procedure A risk assessment methodology needs to consider all risk factors including unexpected parameters. The methodology needs to answer the following basic questions : • What do we know? What is the risk? • Do we have an incident waiting to happen? • What action can we take? • What can go wrong? What are the potential consequences? • How likely is it to happen?

		Introduction
		Scope
		Normative references
		Definitions
		Aspects on how to influence explosion risks
		Risk assessment procedure
		Determination of intended use (Functional / State-Analysis)
		Hazard Identification
		Risk Estimation
		Risk Evaluation
		Risk Reduction Option Analysis
		Methods and/or techniques that could favorably be applied
	Informative Annexes
	Annex I	Equipment characteristics
	Annex II	Operational aspects and influences
	Annex III	Human factors and organizational aspects
	Annex IV	Risk estimation and evaluation
	Annex V	List of risk assessment techniques
	Annex VI	Examples: Application of risk assessment methods

Table 3 :

 3

	SEVERITY LEVELS	Definition
	CATASTROPHIC	DEATH OR SYSTEM LOSS.
	MAJOR	SEVERE	INJURY,	SEVERE
		OCCUPATIONAL ILLNESS, OR MAJOR
		SYSTEM DAMAGE.
	MINOR	MINOR	INJURY,	MINOR
		OCCUPATIONAL ILLNESS, OR MINOR
		SYSTEM DAMAGE.
	NEGLIGIBLE

Table 3 :

 3 : Qualitative Description of FrequencyThe risk levels represent a ranking of the risk which enables an evaluation of what further actions are needed if any. Four risk levels are used ranging from 'A' representing a high risk level to 'D' a low risk level. The matrix linking frequency and severity is shown in Table4 :

	FREQUENCY	Specific Individual Item	Inventory
		(ignition source)	(explosive
			atmosphere)
	FREQUENT	Likely to occur frequently	Continuously present
	PROBABLE	Will occur several times in Will occur frequently
		life of an item
	OCCASIONAL	Likely to occur sometime in Will occur several times
		life of an item
	REMOTE	Unlikely but possible to occur Unlikely but can reasonably
		in life of an item	be expected to occur
	IMPROBABLE	So unlikely, it can be assumed Unlikely to occur, but
		occurrence will not be possible
		experienced

Table 4 :

 4 Frequency-Severity Matrix relating to risk levels 1.2.6 Risk Evaluation

by the coordinator of the RASE project and by those participating in this project namely, FSA Germany, HSE England, NIRO Denmark and CMR Norway without whom this project would not have been possible• by the members of CEN,TC 305WG4/subgroup 3

Acknowledgements

The work described in this paper was partly funded by the European Commission under contract number SMT4-CT97-2169. The author acknowledge the contributions :


DEVELOPMENT OF A RISK ASSESSMENT METHODOLOGY FOR SEVESO n ESTABLISHMENTS

In the aim to prevent and manage major accidents on an industrial site, many methoäologies and directives have been developed. But, in France no formalised methodology has been proposed to competent authorities to determine a risk level o/ an industrial site. A first work of methodologies' synthesis permitted to propose some basis of a new methodology. This one will be based on the industrial site, the environment and the safety management. To reach this aim, four Indexes are developed; the ßrst one concerning the hazard source (the establishment), the second one the ßux (the vector of propagation of accident considering the specißc environment), the third one the vulnerability of targets (human, environmental or equipment), and ßnally the fourth one concerning the safety management (prevention and protection actions). This new approach will provide a cartography of risk level for an industrial site and its vicinity to bring a decision help for risk managers and competent authorities.

INTRODUCTION

The SEVESO II directive [l] aims at preventing major accident that can härm people and the environment around industrial establishment. In France, the Competent Authorities in Charge of the application of the SEVESO II directive have no formalised methodology to assess the risk related to major accident. A consequence of the lack of a formalised methodology is that safety measures to prevent major accident are not always taken into aecount in a consistent manner for the determination of the safety zones.

And generally speaking, in France, the safety zones are determined on the basis of potential hazard, caiculated without taking into aecount neither all safety devices nor the efficiency of the safety management [START_REF] Lagadec | Politique, risque et processus de developpement : Le risque technologique majeur[END_REF]. In order to better understand the problem, we can take an example : two similar establishments, with the same products, the same process, and with equivalent quantities. The first establishment has a high level of safety, while the second implements only the strict minimum to face up major accidents. At the moment, considering only the potential of hazard, the safety zones associated to the two establishments could be at the best the same. Indeed, because of the lack of formalized method, it is impossible to compare in an unambiguous way the level of risk between two establishments.

The objectives of this study are to propose a risk assessment methodology allowing a first diagnosis by focusing on major accidents and by taking into account all the actions aiming at improving safety. This method brings out the efforts carried out by the operators to maintain the establishment at a high level of safety. This paper presents the first development of the methodology.

STATE OF THE ART

Thanks to a bibliographical review of risk analysis methodologies, we identified and studied 62 of them. The analysis of these methodologies leads us to highlight some essential features of an operational method :

• Ranking criteria : the method should allow to rank the hazard and the other Parameters that contribute to define a risk level, the sensitivity of the environment, the efficiency of the safety management.

• A global approach : the method should allow a global analysis and should be applicable for various industry types.

• Simplicity of use : the basis of the method should be clear and simple for two reasons :

• To allow the dialogue between risk experts and the operators ;

• To allow that the operator continue to use the method without the expert help.

Among these sixty-two methodologies, some positive points can be extracted in order to assess the risk level. The main points are :

-the industrial site (äs in a classical approach)

-the distribution way of accident -the exposure level of the environment -the safety management None of the methodologies has really taken into consideration all the four points above. Generally, whether methods are so general to provide an effective help decision or so specific to only a part of the studied site.

METHODOLOGY

This section describes the methodology which is being developed. It is based on the determination of 4 Indexes to characterise the risk level of an industrial Installation in its environment.

System schematisation

If we bring these considerations in the context of the SEVESO II directive, the following points can be added :

• Bringing out the safety measures organized in the safety management System against the major accidents [3],

• The need of harmonization,

• The integration of domino effects [START_REF] Delvosalle | Development of a methodology for the identification of potential domino effects in «Seveso » industries[END_REF].

Finally, we propose to build up a new methodology based on the following features :

• The use of risk index (ranking method) like Avrim2 method [START_REF] Harn | Experiences with a safety report according to Seveso II : a pilot project in the Netherlands[END_REF] or Risk Level Indicators method [START_REF] Oien | development of risk level indicators for petroleum production platform[END_REF] • The integration of the vumerability of the Environment (human, environmental natural and material) [START_REF] Griot | SIGRISC Project. Geogaphical Information System for vulnerability assessment. Application to the risk of transport of dangerous goods[END_REF] based on multi-criteria decision analysis with SAATY's method [START_REF] Th | The analytic Hierarchy Process[END_REF],

• The use of an analysis of the safety management system [START_REF] Harn | Experiences with a safety report according to Seveso II : a pilot project in the Netherlands[END_REF].

The figure l hereunder explains the functioning of the method.

Safety management

From the zone of study, one can extract four dominating elements :

• hazard source (the establishment)

• hazard flow (the vector of propagation)

• target, located in the vicinity of the establishment

• safety management, implemented by the operators.

Each of these elements allows to defme four Indexes, that after integration, constitute a fünction of risk level. Actually, the used data are mainly located in safety reports and their processing gives a risk level quantification. Finally this permits inspectors to assess the safety management level for the industrial site.

The method mcludes two main phases.

• The first phase consists in estimating :

. The severity index S, considering the major accident hazards generated by the source.

. The flow index F, characterising the vector of propagarion with the notion of exposition level.

. The vulnerability index V, characterising the environment including various targets types (human, natural environment, material) by means of methods of multt-criteria decision.

• The second phase characterizes the efficiency of safety management.

. The safety management index M takes into account the various types of barriers (technical and human Operation) on the hazard source and the hazard flow, äs well äs the intervention capacity of the intemal / extemal emergency Services.

. The objective is to highlight actions led by operators to decrease the risks on their establishments.

Index definition

Hazard source : Severity index S

The industrial establishment is characterised by the severity index S. The potential hazard should allow to take into account and to quantify the level of risk of each critical area of the industrial establishment studied.

The study of the industrial site is based on a fimctional scheme of the site and on safety reports [START_REF] Suh | An expert System for automated hazard analysis base on multimodel approach[END_REF]. The first phase consist in identifying critical areas. A critical area is a part of the site which is likely to generate a major accident. For each critical area, an event tree is developed from initial events to the undesirable event leading to major accident [START_REF] Perilhon | Elements methodiques[END_REF].

To characterise major accident and the potential hazard, we must identify all parameters describing the accidental phenomena. The physical effects [11] generated by the source are overpressure, thermal flux, toxic gas dispersion, and liquid pollution.

Two type of major accident can be identified a sequence of events leading to one major accident only, or a sequence of events leading to more than one major accident (domino effect). Then two variables of potential hazards (PH) may be determined :

• direct PH,

• indirect PH or domino effect PH.

P H direct is function of Dangerous good used or stored and processes implies. It is very important to consider stored products and goods' flux.

Specific criteria for dangerous goods are quantities of product likely to be involved in a major accident and some chemical or physical characteristics in function of considered physical effect :

• overpressure : chemical features (Lower and Upper Explosion Limit...),

• thermal flux : chemical features (heat of combustion, emissivity...),

• toxic gas dispersion : toxic threshold, effect generated on health,

• liquid pollution : toxic threshold, effect generated on health or environment.

Specific criteria for processes are considered like aggravation factors. In function of conditions of process some penalties are attributed to the variable P H. A list of hazard process [START_REF] Perilhon | Elements methodiques[END_REF] is : The combining of process and dangerous goods parameters will provide the direct Potential Hazard. The mdirect P H or the domino effect P H highiights major accidents implying domino effects and a correction factor is attributed to the direct PH in function of the severity of the final accident. The combining of PH direct and PH indirect will allow to caiculate the Severity index of the source.

Propagation vector : Flo\v index F

The propagation vector will allow a description of the accident modes of transfer according to the physical environment of propagation to characterize the level of target exposure [START_REF] Marshall | An anatomy of hazard Systems and its application to acute process hazards[END_REF].

In function of considered physical effect, the mode of transfer increases or decreases the Potential hazard of the major accident.

The propagation vector index F is function of the distances between targets and source of hazard, the environmental features, and the kinetics of accident propagation.

For example, to take into account :

• a toxic gas dispersion : a distribution of wind must be considered.

• a fire or explosion : it will be interesting to consider or not the presence of natural barriers.

• liquid pollution : it will be interesting to consider the propagation speed äs a function of target distance.

Vulnerability : Vulnerability index V

To assess the vulnerability of targets in an industrial establishment, we must considered the accidental phenomena issued frorn the site and identified some criteria described the sensitivity of targets [START_REF] Griot | SIGRISC Project. Geogaphical Information System for vulnerability assessment. Application to the risk of transport of dangerous goods[END_REF].

The notion of impact must be taken into account to characterize the sensibility of targets into environment. In fact, major accident leads to a physical effect that generated several types of impacts on targets. Four kinds of physical effect can be considered for characterising the sensitivity the overpressure, the thermal flux, the toxic gas dispersion, the liquid pollution.

All these physical effects induce impacts which can be ranked in three categories :

• sanitary/environmental/integrity impact,

• economic impact,

• psychological impact.

It is important to consider that impacts, generated by physical effects, have a direct influence on targets and that is not the physical effect itself. But the importance of impact depends on the considered physical effect. Indeed, for an overpressure the economic impact may be more important that for a toxic gas dispersion.

The sanitary/environmental/integrity impact provides information carried on the target sensitivity in front of physical effects conceming the fünctioning preservation of target. The economic impact provides a characterisation of the whole cost induced by major accident. The psychological impact characterises the human sensitivity from the effect on the different types of targets.

In this first part, only the physical effect and impact were being described and not targets. Targets correspond at human, environmental, or equipment targets which have a sensibility in front of major accident. It must be interesting to separate targets in three classes (human, environmental and equipment) in the aim to distinguish three values of vulnerability. Each class of targets will be described in five categories, in this manner the whole targets can be taking into account.

• Human class [13] is composed of the following categories :

-industrial establishment worker, -rural and semi urban settlement (low and medium density of population),

-urban settlement (strong density of population),

-establishment public receiver ( like passenger Station, hopping centre, structure linked to spare-time activities, general knowledge, health Services and public Services),

-large communication way (motorway, railway, road way with high density).

• Environmental class [13] is composed of the following categories :

-agricultural activities with a high market value (market gardening, vineyard)

-agricultural activities with medium market value (wheat, colza) -Vegetation (forest, environment with herbaceous or bushing Vegetation, zone without Vegetation like beach)

-specific natural site ( conservation area, nature reserve, national and country park)

-expanse of water (sea, swamp, lake, pond, river, water spring, aquaculture area).

• Equipment class [13] is composed of the following categories :

-industrial establishment, -public structure (safety Services, communication network, gas and electricity network, rail and road network, bridge, tunnel, airport), -equipment implied in drinking water ( storage, treatment, distribution and hamessing equipment), -living quarter (house and building),

-public building (administration, school, university, church, monument, museum, leisure equipment, market area).

A value of vulnerability will be caiculated for the whole categories of targets in fünction of a physical effect and impact too.

The characterisation of the environment was being presented previously, but it is necessary to rank the sensitivity of target according to the major accident. To reach this aim, a nulttcriteria analysis method is used : the SAATY's method [START_REF] Th | The analytic Hierarchy Process[END_REF]. This methodology is based on expert judgement which provides a rank of the sensitivity of each target sustaining an impact

6-

due to a physical effect.

To solve this problem, SAATY's method is used at 3 consecutive levels :

-l 8 ' level : The determination of sensitivity of a target in front of each physical effect is realised.

-2 °d level : For each physical effect, the importance of impact is ranked in fimction of each type of targets.

-3 rd level : For a physical effect given and a type of target given tob, the sensitivity of target categories is ranked in fünction of impacts.

The whole matrix caiculation will give a value of vulnerability for each category of target sustaining an impact due to a given physical effect

For the application of the methodology, the studied area is cut into meshes. In each mesh, the first phase is to make a census of whole targets and so the determination of the vulnerability value of this mesh will be able.

The combination of severity and flow and vulnerability Index characterises the potential hazard of the System.

In second part of the work that will be carried out, a Control/Management parameter will be establish to evaluate the global risk level.

Control/Management : Safety Management Index M

The Control/Management parameter will allow to take into account the different types of technological barriers [START_REF] Perilhon | Elements methodiques[END_REF] (prevention, protection and Intervention) and to assess the influence of the Safety Management System.

The combination of Potential Hazard of the system and the safety management index allow to caiculate the level risk index.

CONCLUSION

The methodology proposed in this paper deal with the assessment of the risk level of an industrial establishment by taking into account safety devices and safety management. Indeed, the first phase of the methodology, presented here, provides the characterisation of a potential hazard. The potential hazard allows to assess dangerousness of the site (process and dangerous goods) and to take into account, on the one hand, the propagation vector of major accident toward the environment and, on the other hand, the environment vulnerability.

The second phase will integrate all safety devices to modulate the potential hazard. The combination of the four parameters will provide a risk level to characterise the risk generated by an installation in its environment. The proposed methodology provides a global approach of the level risk determination. This application allows to assess the risk level and ways to decrease it and to highlight actions of prevention. This methodology should help decisionmaking to manage safety on industrial sites.

Figure

  Figure l : schematisation of the method

•

  A : System source of hazard of mechanical origin • B : System source of hazard of chemical origin • C : System source of hazard of electric origin • D : System source of danger of fire development