تأملاتی در مدل شبکه های بیزی برای طراحی ایمنی تونل جاده: یک مطالعه موردی از نروژ

Directive 2004/54/EC from the European Parliament states that all EU member states should have well defined methodologies for risk analysis. This means that decisions regarding the design of road tunnels must be supported by risk information. TRANSIT, a Bayesian Network (BN) model for conducting quantitative road tunnel risk assessments has been developed to comply with the requirements. The developers of TRANSIT claim that their model represents best practice for risk assessments of road tunnels. This article explores the foundation for this claim. Furthermore, we assess TRANSIT as a tool for decision support regarding the design of new and novel road tunnel designs. The interactions between TRANSIT and the engineering environment and between risk analysts and responsible decision makers are studied by analyzing the engineering process of the 25 km Rogfast subsea road tunnel project in Norway. Our analysis shows that TRANSIT could be a useful tool in combination with other risk assessment activities. We also find that the model has severe limitations, especially when used for novel tunnel design projects such as Rogfast. First, the model applies a definition of risk that in most cases fails to provide an adequate risk picture, and hence fails to communicate risk to important stakeholders. Second, both data and models are rigid and presented to the users as a “black box”. This poses challenges with regard to the ownership of the analysis results and the responsibility for decisions made on the basis of the model, i.e., the relationship between the developer/owner and the analysts. Third, a standardized model will lead to standardized problems and solutions, which means that the results obtained from TRANSIT will be predictable when some experience with the model is gathered. In this way the model will preserve existing design and not promote innovation with regards to traffic safety designs. Fourth, the model emphasizes key performance indicators such as average annual daily traffic (AADT), tunnel length and curvature, while causes found in accident reports such as driving behavior, latent conditions and organizational and managerial factors may be neglected in the design process.

1.1. Requirements for risk analyses in road tunnels The European directive 2004/54/EC on minimum safety requirements for tunnels in the Trans-European Road Network (TERN) has had a major influence on work to improve tunnel safety in Europe during the past decade. The directive specifies minimum requirements for European road tunnels longer than 500 m. It is a traditional prescriptive legislation regime. However, the directive allows for exceptions from the requirements, for instance when it is not technically feasible to adhere to the requirements, or where it is only possible to fulfill the requirements at a disproportionate cost (EU, 2004:46). In such cases, the prescribed safety measures may be substituted for alternative safety arrangements if it can be shown that the alternative solution provides a safety level that is at least equal to or higher than the demands in the TERN requirements. In order to evaluate the safety level in such cases, the directive uses the concept of risk. According to the directive, a “risk analysis is an analysis of risks for a given tunnel, taking into account all design factors and traffic conditions that affect safety, …” ( EU, 2004:54). Furthermore, the directive states that risk analyses shall be conducted for tunnels showing special characteristics with respect to design parameters. Examples of such parameters are: tunnel length, vertical and horizontal alignment, access time for emergency services, and proportion of heavy goods vehicles ( EU, 2004:59). Since 2004, a large number of risk analyses have been conducted as part of Norwegian road tunnel projects. The Norwegian Public Road Administration (NPRA) has adopted risk assessment techniques for road tunnel design problems and experiences have been gathered and evaluated (Njå et al., 2013). Most of the risk assessments have been based on qualitative or semi-quantitative techniques. 1.2. Developing a new quantitative Bayesian Network model In 2009 the Federal Road Office (FEDRO) in Switzerland and the NPRA initiated “ASTRA 2009/001” an international research project in cooperation with Matrisk GmbH and HOJ Consulting GmbH. The project resulted in the development of a risk assessment software tool, TRANSIT, which is based on Bayesian Network (BN) methodology (Schubert et al., 2011, Schubert et al., 2012 and Brandt et al., 2012). TRANSIT developers claim that the model can be adapted to all road tunnel systems, providing accurate and reliable risk results. TRANSIT is based on a BN structure with a Microsoft Excel-based interface. A BN is a directed acyclic graph that consists of variables, depicted by nodes and directed arcs (links) that reflect the probabilistic dependencies between the nodes (Jensen, 2001). The structure of nodes and arcs provides qualitative information by illustrating the variables in the system and how the different variables interact. Quantitative information is obtained through the system structure and conditional probability tables. A major advantage of the Bayesian Network methodology is its ability to make “direct representations of the world, not of reasoning processes” (Pearl and Russel, 2001). This has led to the BN methodology being used for a wide range of risk assessment problems (Chen and Pollino, 2012 and Wang and Mosleh, 2010), including transportation sectors such as air (e.g., Luxhøj and Coit, 2006 and Call and Gonsalves, 2006), maritime (e.g., Antão et al., 2009) and road tunnels (e.g., Holický and Šajtar, 2005 and Cárdenas et al., 2012). The main objective of the TRANSIT project was to provide a “best practice” methodology for risk assessments, constructed by reviewing historical data, expert judgment and scientific studies. It is claimed that the approach is so promising that it should be established as the “preferred tool for simple and detailed risk analyses” (Schubert et al., 2011:119). Furthermore, it is argued that the method represents the current state of the art in the fields of risk-based decision making and traffic engineering, especially in modeling traffic accident frequencies and the consequences of accidents in road tunnels. The method is applicable to all road tunnels, but the current version specifically takes into account the needs, regulatory requirements and tunnel layouts that have been identified as relevant for Switzerland and Norway. How the developers validate this assumption is not clear. Furthermore it is claimed that the TRANSIT project can “form the framework and precondition for an efficient, transparent and communicable treatment of risks and they facilitate that risks from different sources are treated in the same manner and assessed on the same basis so that they are comparable, may be aggregated and transparently documented and communicated” ( Schubert et al., 2011:17). To adapt the generic model to a specific project, the user specifies key characteristics of the tunnel (evidence in the BN-model) in a set of pre-determined input nodes/variables. The entire TRANSIT model is included in Appendix A. Below we present the accident modification factor (AMF). It consists of 11 indicators assumed to represent all factors influencing the relevant rates (accident, injury and fatality). According to Brandt et al. (2012:44), “the AMF represents the difference of the accident rate in a specific segment from the mean value of all existing segments in the entire road network” and may take on values in the interval [0, ∞]. TRANSIT builds on research studies whose results show that accidents are not uniformly distributed over the whole length of tunnels, but that certain zones, e.g., the tunnel entrance, are overexposed compared to the average national background accident rate (Amundsen and Ranes, 2000). TRANSIT requires the user to specify tunnel characteristics in terms of a set of homogeneous segments that are located in the predefined tunnel zones (zone 1: outside, zone 2 and 3: entrance/exit and zone 4: mid zone). TRANSIT calculates a modification factor for the background accident rate for each segment. Other inputs, such as horizontal and vertical gradient, AADT, speed limit are also important in the model. The TRANSIT methodology also consists of the following premises and assumptions: • Prior distributions are embedded in the model, which makes risk assessments possible also when limited information is available. • It is possible to specify “hard acceptance criteria” for risk-based decision making. However, the developers recommend managerial review and decision making based on a broader foundation than TRANSIT calculations alone (Schubert et al., 2011:106). • The background rates are given for each of the seven zones in the tunnel (see Appendix B). The basis for the background rates are statistics from 1992 to 2006 (Amundsen and Engebretsen, 2008 and Amundsen and Melvær, 1997). • The major aims of the methodology are to (Schubert et al., 2011:11–17): • Support decisions regarding the planning, operation and maintenance of road tunnels. o Meet minimum safety requirements (EU directive). o Optimize available resources. o Provide transparent documentation of the assessments of risk. o Predict observable consequences. 1.3. Introducing the Rogfast tunnel project Subsea road tunnels are a solution to the problem of how to build roads that must cross numerous fjords along the western coast of Norway. However, the Norwegian topography and traditional way of designing subsea road tunnels often do not comply with requirements in the EU directive 2004/54/EC and national regulation regimes. Subsea tunnels usually have a distinct V-form because of the steep fjords. According to the directive, no new tunnels with a longitudinal gradient of more than 5% shall be built, “unless no other solution is geographically possible” ( EU, 2004:63). Most Norwegian subsea tunnels fail to comply with the longitudinal gradient requirement, and Norway has been granted a “general” derogation from this requirement ( NPRA, 2012a:25). Safety for tunnel users has become a political issue as a result of several severe incidents, for example the fire in the Oslofjord tunnel in 2011 ( AIBN, 2012) and the rock blocks that fell from the tunnel roof of the Hanekleiv tunnel in 2006 ( Bollingmo et al., 2007). To improve cargo and passenger transportation on the coastal highway (E 39) along the west coast of Norway, the NPRA is working towards realizing a permanent ferry-free road from Kristiansand in the south to Trondheim in the north (see NPRA, 2012b). The Rogfast subsea road tunnel project north of Stavanger, is one milestone in the work towards this goal. The tunnel will provide a solid link across the Bokn-fjord, connecting Harestad and Arsvågen, see Fig. 2. The design incorporates a branch to the island of Kvitsøy, which means the tunnel system will include a subsea traffic junction (see Fig. 3). Full-size image (48 K) Fig. 1. Illustration of the calculation of the AMF, based on its parent nodes (Schubert et al., 2011). Figure options Full-size image (69 K) Fig. 2. The Rogfast tunnel project (figure courtesy of NPRA). Figure options Full-size image (25 K) Fig. 3. Rogfast length profile including ventilation shafts (figure courtesy of NPRA). Figure options By replacing the existing ferry connection the Rogfast tunnel will reduce travel time significantly, and ensure a continuous traffic flow that will be especially beneficial to the commercial heavy goods road transport sector. When completed, the Rogfast road tunnel will be the longest and deepest underwater road tunnel in the world. The main tubes are currently designed to be 25.5 km long. In addition to the criteria presented in Table 1, several other safety-related recommendations are made in the risk assessment (Hokstad et al., 2012). Among these are relocation of the fire and ambulance station closer to the tunnel, creating landing location for rescue helicopter entrances, impose restrictions on heavy goods vehicles (HGV) in the case of bidirectional traffic in the main tunnel tube, and use of comprehensive monitoring, detection and information systems. Table 1. Key characteristics of the Rogfast road tunnel (Hokstad et al., 2012). Tunnel length Main tunnel: 25.5 km, branch to Kvitsøy: 4 km Number of tunnels and lanes Main tunnel: 2 tubes with 2, and on some stretches 3, lanes (unidirectional) Branch to Kvitsøy: 1 tube, bidirectional traffic Maximum gradient (ascent/descent) Ascent towards Arsvågen: approximately 3.5 km of 5% plus 3 km of 7% Deepest point 392 m below sea level Annual Average Daily Traffic (AADT), 20 years after opening 13,000 Fraction of heavy goods vehicles (HGV) 15% Restrictions on dangerous goods No restrictions planned during normal operation Smoke ventilation concept Mechanical longitudinal ventilation and extraction shafts Emergency exits Emergency exits every 250 m. Suggested to reduce the distance between exits to 125 m in the risk assessment Geometrical features Four rock caverns with artistic lighting design (see Jenssen et al., 2006 and Flø and Jenssen, 2007) to reduce monotony, including the junction connecting the Kvitsøy tube 3–5 Cross connections between the two main tunnels to direct traffic to one tunnel (bi-directional) in case of incidents and maintenance Table options 1.3.1. Project stage at the time of this study Fig. 4 indicates the time of our involvement in the Rogfast project on the basis of the “capital value process” (CVP) (Kjellén, 2007). The CVP depicts the project’s phases, and at the end of each phase there are decision-making processes, which are illustrated by decision gates (DG). Full-size image (22 K) Fig. 4. The capital value process (CVP), adapted from Kjellén (2007). Figure options The CVP depicts a continuous detailing of projects towards execution and operation, implying a need for flexibility of the risk assessment methodology in the project development stage. We argue that one of the main sources of uncertainty in the Rogfast project was associated with the identification of events specific to the project. Emergency personnel and stakeholders struggled to see how the proposed tunnel differed from other tunnels in terms of, for instance, possible fire scenarios and what challenges it might present to emergency services responding to a situation. 1.3.2. Safety concept The general safety concept adopted for the Rogfast tunnel is based on self-rescue. This means that people who are trapped in the tunnel due to an accident must find a way to exit the tunnel on their own. The risk assessment that was conducted for the Rogfast tunnel (Hokstad et al., 2012) recommended a set of safety measures beyond the minimum requirements in the prescriptive regulations to maintain an acceptable safety level. The risk assessment is made up of qualitative assessments that are combined with quantitative scenario analyses. 1.4. Major evaluation issues Realization of major transportation projects depends on widespread political and social support, and is generally initiated by societal needs, which is transformed into design problems. Review of a specific design proposal, based on a tentative design problem, may lead to new insight and a revision of the original design problem. Hence, a design process could be seen as a co-evolution of design problems and design solutions, where the goal is to end up with a matching problem–solution-pair ( Dorst and Cross, 2001). To support concept selection at an early stage, a risk analysis methodology must be flexible with regard to comparing and separating several very different alternatives, while in the later stages the methodology must be flexible with regard to handling the full range of components, sub-systems and interactions that affect safety. TRANSIT is claimed by the developers to be a road tunnel risk analysis tool that predetermines what unwanted events to consider and which causal factors are relevant to determine the risk picture. From a design science perspective (Krippendorff, 2006, Schön, 1991, Simon, 1996 and Tehler and Brehmer, 2013), the rigid structure of TRANSIT represents a challenge with regard to it being useful in the various situations that may occur, since it is generally founded on a very restricted notion about what is relevant knowledge in road tunnel safety engineering. Hence, it was deemed necessary to explore the boundaries of relevant applications of the tool in road tunnel design projects. A major question when considering the inherent flexibility of the methodology is why the developers and their clients have decided to incorporate the Bayesian Network methodology within a rigid computer software model (TRANSIT). Furthermore, the relationships between risk assessors and designers, and risk assessors and decision makers have been scrutinized in our assessment of TRANSIT. The aim has been to assess how TRANSIT communicates as part of the risk management strategy. Finally, the best practice approach statement is challenged in order to make it understandable within a risk management context.

In this paper we have assessed a methodology for risk assessment in road tunnels developed on behalf of the Norwegian and Swiss road authorities, as a development of best practice methodology for risk assessment in road tunnels. The proposed methodology includes a model, TRANSIT, which is based on a Bayesian Network (BN) approach. We conclude that the use of BNs as a structural model for system risk analyses is promising. A major trait of BN is the ability to directly represent complex systems in a flexible manner. In order to take advantage of this, it seems appropriate to use BNs as part of a flexible analysis process where the BN is part of the knowledge base of the analysts. TRANSIT, on the other hand, is a holistic model which is locked to the common user. This will deprive the analysts of the flexibility of a general BN model and the responsibility for the outcomes of the analysis. Instead, responsibility for the results is placed on the developers of the model. A possible consequence is an increasingly distanced relationship between analysis, safety problems, designs and safety critical decisions. The TRANSIT model has a restricted “window of application” with regard to the project phases and associated usefulness. In the very early phase TRANSIT may be too detailed or rigid, while in the late phase the project information may be too detailed for TRANSIT. Nevertheless, a major advantage of the model is that it makes quick comparisons between different tunnel concepts to evaluate how the different variables influence risk. Hence, the model may come into its right especially in cases where there are several tunnel design alternatives under consideration. For example where the aim is to rank the alternatives based on major indicators, e.g., cost, benefit, environmental impact and risk. It could also be a very important tool with regard to challenging risk analyses performed by external consultants. Our calculations show that the expected number of injuries and deaths due to traffic accidents are broadly similar for the Rogfast risk assessments and TRANSIT. However, the expected number of injuries and deaths due to fires are inconsistent. This difference should stimulate a discussion about the quality of the performed analyses and a search for a broader knowledge base with an aim of developing safer and more functional solutions. A consequence is therefore that TRANSIT is most valuable as a tool in a risk assessment and needs to be used together with other risk assessment methodologies to provide a valuable basis for design and in the decision making process. TRANSIT could preferably be a part of a “triangulation” process, where different models and methodologies are applied to the same problem. It is not evident that the TRANSIT model, on its own, can be regarded as a best practice risk assessment methodology. TRANSIT is built on a rather narrow scientific perspective on the risk concept. This concept is for example misleading when dealing with low probability high consequence activities such as accidents and fires in road tunnels. The model lacks proper treatment of uncertainties. Using TRANSIT will neither promote understanding of tunnel risk phenomena nor encourage learning about factors that influence tunnel risk. It is unclear how the expected values obtained by the model can contribute to the decision making process apart from in a comparative analysis, since acceptance criteria for risk in road tunnels are not provided. The users of the model become experts in (1) use of the model and (2) combinations of measures that result in the best calculated risk number, which does not necessarily represent the risk in the given tunnel. Although the model is built on a substantial amount of research, one cannot ignore the fact that many fundamental assumptions in the model are value-judgments which may violate project-specific needs. In summary, we have identified many challenges with TRANSIT. The task of describing risk in socio-technical systems like road tunnels is complex, and in such cases standardization of methodology, models and input data is not necessarily appropriate. It is clear that TRANSIT provides answers very fast, which makes it possible to carry out analysis of many comparable concepts. However, before we conclude that a methodology constitutes best practice, we need to consider what information it gives us, and to what questions and in what stages of the process. Performing a quantitative risk assessment is no goal in itself, as it also has to be fit for the purpose (Rae et al., 2012). The following issues are important to reflect upon when adopting TRANSIT: • In Norway the NPRA is inheriting the responsibility for the BN model and for continually updating the model as new knowledge and statistics become available, etc. • The methodology excludes tacit knowledge in terms of tunnel design and local characteristics in the risk assessment, for instance considerations based on qualitative assessments. • Use of the TRANSIT model may lead to predictable risk assessments, because: o The results of risk assessments would only be linked to the result obtained from the model. o The learning effect of the risk assessment process would be small as the assessment only involves the mechanical application of the model. • The model emphasizes key performance indicators such as average annual daily traffic (AADT), tunnel length and curvature, while causes found in accident reports such as driving behavior, latent conditions and organizational and managerial factors may be neglected.