Chapter 7
Safety measures for a road tunnel

Let us look back at the problem introduced in Section 1.3.1. A risk analysis is to be carried out to predict the effect of various alternative safety measures for a road tunnel. The analysis, together with other relevant information, will be used as the basis for the decision-making concerning what measure(s) to implement.

7.1 Planning

7.1.1 Problem definition

What are the consequences of a ventilation system not being able to handle a 100-MW fire? The aim of the fire ventilation system is to ensure that the smoke gases are forced away from the fire site and directed further inwards into the tunnel section, in the direction of traffic flow. For a dual carriageway tunnel, this is advantageous as the drivers situated downstream of (past) the fire site will exit the tunnel without even being aware of the existence of the fire. The cars that are located upstream of (before) the fire site will have to stop when they encounter the fire or smoke, thus forming a queue. In such a situation, it is important to force the smoke gases further inwards into the tunnel and thus avoid the situation whereby the drivers stationary in the queue upstream of the fire are exposed to smoke gases before they can evacuate on foot out of the tunnel or through the cross galleries (emergencyexits).

The case is based on a tunnel that is almost horizontal. There is a slight rise in one carriageway and a slight fall in the other carriageway. Because warm air is lighter than cold air, the hot fire gases will create updraft forces, which will cause the smoke to rise. In the upward-sloping tunnel carriageway, this does not represent a problem as the updraft forces will draw the smoke in the desirable direction. However, in the downward-sloping tunnel carriageway, the smoke will tend to move in the wrong direction. In such cases, it is the job of the fire ventilation system to ‘force’ the smoke gases downwards in the carriageway and away from the fire site, in the direction of traffic flow. The actual ventilation system in the tunnel example is designed to blow the smoke gases in the right direction in the event of a 20-MW fire, but not in the case of a 100-MW fire.

The objective of the risk analysis is to address the following questions:

• What will be the safety-related effect of an upgrade of the fire ventilation system to be able to handle a 100-MW fire?
• What will be the safety-related effect of other compensating measures?

The speed at which the smoke will spread in the wrong direction and the consequences this will have for drivers will be studied in the risk analysis (see Section 7.2.3).

The risk description covers using the notation from Chapter 2. In this case, the focus will be placed on vulnerability, that is, the possible consequences, along with the associated uncertainty, if a fire or some other hazardous situation occurs in the tunnel.

7.1.2 Selection of analysis method

A coarse risk analysis method, based on expert meetings, was first applied. In this method, possible safety measures were identified and the effects of these were qualitatively described. In the meetings, the risk analysts were joined by experts in the fields of road tunnels, ventilation and fires. The problem required considerable technical competence in these fields. On the basis of the qualitative analysis, the risk analysts carried out a quantitative risk analysis, expressing the effect of suggested safety measures on risk. The results are presented along with the assumptions and suppositions made. The risk analysis method can be regarded as a simple form of model-based risk analysis, adapted to the problem being considered.

The analysis is relatively simple and basic. A more sophisticated method, for example, based on Bayesian networks could have also been used. In that case, we could have described, in a more nuanced manner, the relationship between the various variables (traffic volume, smoke, fire, fatalities, etc.). However, carrying out this type of analysis would have been more resource demanding. The method selected is deemed to be sufficient for the objectives defined. The main point is to identify and describe the main features of the risks and vulnerabilities.

7.2 Risk assessment

7.2.1 Identification of initiating events

The aim of the hazard identification is to determine which undesirable events are influenced by the fact that the fire ventilation system is dimensioned for a 20-MW fire, and not for a 100-MW one, as is required by the present regulations.

The analysis begins with a listing of the common undesirable events related to road tunnels as shown in Table 7.1 (based on Norwegian Public Roads Administration, 2007).

Table 7.1 List of typical undesirable events at different specification levels

Traffic accidents		Light vehicles
	Head-on collisions	Light vs. heavy vehicles
		Heavy vehicles
	Rear-end crash	Light vehicles
		Light vehicle struck by heavy vehicle
	Crashes involving non-motorists	Following vehicle breakdown, for example
	Driving off the road	Wall, verge, ramps, etc.
	Lane-changing accidents
Fire	Small fire (5 MW)	Fire in light vehicles
	Large fire (20 MW)	Fire in heavy vehicles
Leakage of hazardous	Petrol
goods	Toxic substances
Vehicle stoppage	Light vehicles
	Heavy vehicles
Overturn	Buses Other heavy vehicles	Especially tall buses, house trailers and tractor trailers with a high centre of gravity

The analysis group also considers other possible undesirable events. The group concluded that

The design of the fire ventilation system has importance only for the undesirable event—fire.

The fire event can, however, lead to a large spectrum of different scenarios. A fire near a tunnel opening will be completely different from a fire midway in the tunnel. Likewise, the consequences of a fire in the downward-sloping tunnel carriageway will, as mentioned earlier, be more serious than a similar fire in the upward-sloping carriageway. In order to reflect this spectrum, the analysis group chooses to differentiate between the following scenarios:

• Scenario 1: Fire approximately midway in the tunnel, carriageway with uphill slope.
• Scenario 2: Fire approximately midway in the tunnel, carriageway with downhill slope.
• Scenario 3: Fire approximately midway in carriageway with downhill slope; queue present in the entire carriageway. before fire breaks out
• Scenario 4: Fire 200 m into the tunnel, carriageway with uphill slope.
• Scenario 5: Fire 200 m before the end of the tunnel, carriageway with downhill slope.

Scenario 3 reflects the fact that sometimes there may be a queue present when the fire breaks out. In such situations, there will be queues in the tunnel both upstream and downstream of the fire. This means that the ventilation system will blow smoke against those who are waiting in the queue just past the fire site.

During the expert meetings, the effect of the various alternative safety measures was assessed qualitatively. The following measures were assessed:

• Upgrading of the ventilation system in accordance with the regulatory requirements.
• Installation of a fire detection cable in the ceiling of the tunnel. This is a system that sends a message to the road traffic central notifying them of a fire in the tunnel when the ceiling temperature reaches 67 °C. The central could then take measures to close off the tunnel with a barrier across the entrance, start up the fire ventilation system and alert the local fire department that there is a fire in the tunnel.
• Installation of event detection equipment inside the tunnel. This may be a video camera–based system that automatically senses changes in the traffic situation and sounds an alarm at the road traffic central and automatically ‘freezes’ the video picture. In this way, the operator can clearly see what is happening in the tunnel and can initiate measures such as closing down the tunnel, closing off a lane, reducing the speed limit and sending out a call for intervention personnel. Examples of events that are automatically detected are fire, vehicle breakdown (stationary vehicle), objects on the roadway, animals or pedestrians in the tunnel and traffic accidents.

7.2.2 Cause analysis

The risk analysis focuses on risk-reducing measures, assuming a fire of 100 MW. Fire is defined as the undesirable event. Hence, the analysis focuses attention on the vulnerabilities related to such an event, that is, the consequence side of Figure 1.1. There is no need for a cause analysis to provide decision-making support for this decision problem. This does not mean that the cause side is not important when it comes to risk reduction. One would, of course, take every precaution so that fires and other undesirable events do not occur in the tunnel. However, for the present decision-making problem, this is not the main issue. The requirement for the new regulations assumes the occurrence of a fire of 100 MW.

7.2.3 Consequence analysis

The consequence analysis is the most important part of the risk analysis process. What will happen if a 100-MW fire breaks out at a given site in the tunnel? In order to answer this question, detailed consequence simulations are carried out, using a computer software tool based on CFD modelling. The simulations show how a fire in the tunnel evolves into a 100-MW fire (assuming a realistic sequence of events).

Next, we need to take into account the number of people in the tunnel, where they are situated, evacuation time and so on. A large number of scenarios are possible. There is normally less traffic at night than during the day, and it is conceivable that the fire occurs when a bus full of wheel-chair users just happen to be on the scene. In practice, however, we cannot take all such situations into account. Simplifications must be made. The analysis must select dimensioning events and scenarios, and it will be based on a variety of conditions and assumptions. Five main scenarios are considered as mentioned in Section 7.2.1.

The people in the tunnel are categorised as shown in Figure 7.1. In the case of a fire in the tunnel, the people in the cars situated downstream of the fire (Group 1 in the figure) will normally drive out of the tunnel without being aware of what has happened. This assumes that there is no queue in the tunnel when the fire breaks out. If there is a queue in the tunnel when the fire breaks out, it is possible that Group 1 will have to leave their cars and evacuate by means of the cross gallery between the two carriageways. In order to differentiate between these situations, it may be appropriate to subdivide Group 1 into subgroups: G1W (walking) and G1D (driving). Since the tunnel cannot be closed before the road traffic central is aware that there is a fire, there will normally be many cars entering the tunnel upstream of the fire. These cars will form a queue upstream of the fire site. Those near the fire site (Group 2) will see the fire and will therefore evacuate on their own accord, except for those who are stuck within the vehicles. Those who are farther away from the fire site (Group 3) will normally not evacuate before they are requested to do so or before they see the smoke coming towards them, as they are not aware that the queue is being caused by a fire. As far as the ventilation is concerned, the groups have different requirements:

• Group 1: For this group, it is desirable, in principle, to have as little ventilation as possible. This is particularly the case if there is a queue present in the tunnel when the event occurs because the groups must then evacuate on foot.
• Group 2: For this group, it is desirable to have enough ventilation to provide good visibility for the evacuation. Maximum distance to the first cross gallery is 250 m. It normally takes 4 minutes to cover this distance and the time taken to make the decision to evacuate.
• Group 3: This group is not really affected by the event (but the ventilation affects the size of Group 2 compared to Group 3). If they do not evacuate, they can also be exposed to smoke after a while.

Figure 7.1 Categorisation of people in the tunnel.

What influences the spread of smoke?

The following conditions affect the blowing force of the ventilation system:

• Headwind: This means that the wind is blowing in the direction opposite to the traffic flow and, because of this, has a braking effect on the air flow in the tunnel.
• Queue: Stationary cars. A queue affects the ventilation rate in that stationary traffic creates a certain amount of drag on the air flow created through the tunnel by the ventilation system. This applies regardless of whether the queue is situated upstream or downstream from the fire. This means that queues affect not only the number that are exposed to smoke but also the way the smoke spreads.
• Fire in downward slopes/upward slopes: Fire gases are hot and create an updraft. In uphill slopes, this produces the so-called chimney effect. In downhill slopes, this effect applies in a negative sense and results in a braking action on the air flow.
• Number of fans in operation: It is likely that a large fire will put the fans out of operation. This will reduce the blowing force. Based on an assessment of fire simulation results and the distance between fan units in the tunnel, it is likely that up to three fan units will fail in the event of a 100-MW fire. In the worst case, six fan units can be affected. This is because there are common cable runs that may become exposed during a fire in two zones of 300 m. However, the cables are of a type that can withstand 750 °C for 90 minutes.

Based on the CFD simulations and assessments carried out by experts in ventilation and fire technology, a gross blowing force for ventilation systems of 13.1 kN is calculated in the case of a 100-MW fire. There are, however, a number of conditions that can contribute to a reduction in this blowing force. The most important contributing factor is related to stationary vehicles because they create drag friction for the air-flow stream. The next most important contributor is the fire itself if it occurs in the carriageway having a slight downhill slope. In a 100-MW fire, the effect of the fire on the ventilation is equal to that of a 50% queue. If there is a100% queue, this would affect the blowing force twice as much as the fire itself. The fire also affects the number of fans in operation (in that they can be put out of operation), and this contributes in a negative way to the blowing force.

To summarise, a queue in the tunnel has a greater effect on the blowing force of the ventilation system than the fire itself, assuming a fire of 100 MW. This is an important observation—it means that measures that lead to rapid closing of the tunnel can be more effective, insofar as the blowing force is concerned, than upgrading of the ventilation system. A rapid closure results in a smaller queue. Fires introduce vulnerability, in that it is likely that two to three fans will fail. However, this applies regardless of whether the fans are upgraded or not.

The above consequence analysis addresses the physical conditions in the tunnel in the event of a fire. What are the consequences then in terms of fatalities and severely injured?

Based on the expert meetings and the knowledge obtained from the above studies, the risk analysts assess each scenario for all the alternative safety measures. Using event detection equipment, it will be possible to close the tunnel quickly since the event is being monitored from the road traffic central. Quick closure would lead to fewer vehicles entering the tunnel, which would in turn reduce the queue upstream of the fire. This would also affect the ventilation rate and thus the development of the smoke dispersion. The result is likely to be a reduced number of fatalities and severely injured, in comparison to the status quo. The risk analysts conclude that event detection equipment will be more effective than fire detection cables, since the operator monitoring the event detection equipment in the road traffic central will receive an immediate, automatic alarm and would be able to look at once at the video screens that show what is happening. Thus, he/she would be able to make a decision immediately to initiate the closure. In the case of fire detection cables, the message to the operator is more ambiguous, which can lead to more time being taken to clarify the situation and thus a longer time before closure. This leads to more vehicles in the queue upstream of the fire and thus reduced blowing force, compared with using event detection equipment.

Table 7.2 shows an example of the result of these assessments for the scenario in which no additional safety measures are implemented. Note that retaining the tunnel as it was originally planned is not acceptable with regard to the regulatory requirements, but we still analyse the ‘status quo’ in the risk analysis to be able to compare the effect of the various safety measures.

Table 7.2 Examples of assumptions made in the risk analysis

Expected number of fatalities or severely injured—no additional risk-reducing measures	G1W	G1D	G2	G3	Comments
Scenario 2: fire approximately midway in carriageway with downhill slope, no queue present when fire breaks out.	0	0	10	1	G1: no fatalities or severe injuries as it is assumed that all cars could drive out. G2: 10 fatalities or severely injured. People stuck in vehicles taken into account. Also taken into account the fact that some people did not understand the seriousness of the situation before it was too late. G3: smoke will travel at a quick walking pace. One person in this zone is assumed to be killed or severely injured.

The analysis in this case is relatively crude. Average figures are used for a number of quantities included in the analysis, for example, traffic volume. Furthermore, conditions that can cause large deviations between the expected values and the actual number of fatalities and injured are discussed. Let us look at examples related to Scenario 3: fire approximately midway in tunnel, queue in entire tunnel (before fire breaks out).

In this case, the expected number of fatalities and severely injured is 100, assuming the ventilation system is upgraded. The actual number in such a scenario can, however, be both much higher and much lower. If the fire knocks out a number of fans, and there is, in addition, a large number of people in the tunnel, for example, as a result of a number of buses with tourists being in the tunnel, the number of persons impacted can be much greater than 100. The uncertainties in the number of fatalities are significant.

7.2.4 Risk picture

Table 7.3 shows the main results obtained for the various scenarios expressed as the expected number of fatalities and severely injured in the event of a large fire.

Table 7.3 Results from the risk analysis

Expected number of fatalities or severely injured in a 100-MW fire	Without any measures taken	Upgrading of fire ventilation system	Event detection system	Fire detection cable
Scenario 1: midway in tunnel, carriageway with uphill slope	3.0	3.0	2.5	3.0
Scenario 2: midway in tunnel, carriageway with downhill slope	11	3.0	3.5	10
Scenario 3: midway in tunnel, queue in entire tunnel (before fire breaks out)	91	100	77	85
Scenario 4: close to the entrance (200 m inside)	2.5	2.5	2.3	2.5
Scenario 5: close to the exit (200 m before exit)	11	3.0	6.5	10

The results also highlight the factors contributing to the risk and key assumptions made in the analysis. In addition, factors that can cause large deviations compared to the expected values are discussed. This relates, for example, to the number of fatalities. What type of scenarios could lead to high number of fatalities, and how likely is it that these scenarios would occur? Furthermore, sensitivities are presented showing the effect of changes in the assumptions. Strength of knowledge assessment could have been conducted in line with the ideas presented in Section 2.4.

7.3 Risk treatment

7.3.1 Comparison of alternatives

Based on the overall risk picture obtained, it is concluded that event detection would be the best measure and that this measure is much better than upgrading of the fire ventilation system (which is now required by regulations). The event detection will facilitate quick closing of the tunnel, thus ensuring that few vehicles could then enter. In this way, the queue upstream of the fire is reduced, which is favourable from a ventilation point of view. In general, this measure results in the lowest expected number of fatalities and severely injured. In addition, the uncertainty factors are in favour of such a measure. Furthermore, the measure will reduce the probability of traffic accidents as the tunnel or the driving lane can be closed and the speed limit lowered in the case of breakdowns, objects on the roadway and so on.

7.3.2 Management review and decision

Based on the results from the risk analysis and a more comprehensive assessment of the costs and the consequences the various measures have with respect to temporary closure of the tunnel, the tunnel owner chooses to install event detection equipment in the tunnel as an alternative to upgrading the ventilation system. The analysis is used as formal documentation to demonstrate that this measure will provide considerably greater risk reduction than the regulation-imposed measure. The authorities pose a number of critical questions regarding the risk assessment and its basis (assumptions and suppositions). The process ends with the authorities concluding the judgement of the risk analysis being reasonable and accepting the deviation from the regulations.

The example shows that risk analysis is used in supporting the decision-making. Event detection was deemed to be the best measure overall, when the advantages and disadvantages of the alternative measures were assessed. Following this, a decision was made to choose this measure, despite the fact that the regulation requirement was that another measure should be implemented.