s40038 015 0006 6 PDF

Gehandler Fire Science Reviews (2015) 4:2
DOI 10.1186/s40038-015-0006-6
REVIEW Open Access
Road tunnel fire safety and risk: a review

Jonatan Gehandler1,2
Abstract
A review concerning road tunnel fire safety and risk is presented. In particular different perspectives and methods
on safety and risk are discussed. Road tunnel fire safety usually involves high uncertainty and high-stakes decisions.
Thus, a wider group of stakeholders and different types of knowledge should be included in the fire safety analysis
and evaluation, than what is required by technical risk analyses. It is argued that the decision process should not be
separated from the design and safety evaluation as they are strongly dependent and iterative processes. Decision
theory can guide the design and decision process in negotiation with stakeholders. Key parameters for the decision can
be analysed through a combination of functional requirements, societal and political values, safety engineering, safety
factors and systems theory. By taking an organisational viewpoint, potential latent and active errors can be analysed and
a good safety culture can be engineered. In order to improve the safety culture of truck companies, regulation ensuring
proper maintenance, training and quality management may be necessary in a competitive global economy.
Keywords: Road tunnel fire safety; Fire safety; Safety; Risk analysis
Introduction methods and perspectives concerning road tunnel fire

Despite sometimes heavy regulation and sophisticated safety and risk.
assessment methods, accidents continue to occur. A A striking comment from a risk analysis assessor is that
recent example is the Fukushima Daiichi nuclear “what is actually quantified is the assessor’s knowledge of
power plant accident in 2011, which happened due to the situation” (Contini et al. 1991:146). This means that any
an earthquake followed by a 14 m tsunami wave. The model is limited by the assessor’s understanding of road
plant had been designed for a 6 m wave despite that tunnels, traffic safety, human behaviour and tunnel fire
more severe waves had occurred in the past. Severe dynamics, which will be the starting point of this review.
flooding have also happened near nuclear power
plants before, why have we not learned (Epstein 2012; Road tunnel fire safety
Epstein et al. 2012)? Setting the scene
Several studies suggest that large uncertainties can be Fire requirements for tunnels and buildings in general
expected in a Quantitative Risk Analysis (QRA) (Amendola are stated in the EU regulation on harmonised condi-
1986; Contini et al. 1991; Lauridsen et al. 2001a,b; Fabbri tions for the marketing of construction products (CPR):
and Contini 2009), this is not least the case for road “The construction works must be designed and built in
tunnels, where data is sparse and models for basic such a way that in the event of an outbreak of fire:
phenomenon such as fire behaviour, human behaviour and
fire spread include rough assumptions, if they are at all a) the load-bearing capacity of the construction can be
considered (PIARC 2008; Ferkl and Dix 2011; Kirytopoulos assumed for a specific period of time;
and Kazaras K 2011; Kazaras et al. 2012; Rein et al. 2009). b) the generation and spread of fire and smoke within
Bjelland (2013) argues that the scientific framework within the construction works are limited;
fire safety is too narrow. In order to improve fire safety, c) the spread of fire to neighbouring construction works
other methods and perspectives on safety and risk can is limited;
contribute. This review article aims to explore different d) occupants can leave the construction works or be
rescued by other means;
Correspondence: [email protected]
e) the safety of rescue teams is taken into consideration.”
1
SP Technical Research Institute of Sweden, Box 857, 501 15 Borås, Sweden (CPR 2011)
2
Lund University, Box 118, 221 00 Lund, Sweden
© 2015 Gehandler.; licensee Springer. This is an Open Access article distributed under the terms of the Creative Commons
Attribution License (http://creativecommons.org/licenses/by/4.0), which permits unrestricted use, distribution, and reproduction
in any medium, provided the original work is properly credited.
Gehandler Fire Science Reviews (2015) 4:2 Page 2 of 27
Due to severe alpine tunnel fires in 1999 and 2001 the In recent years, a comprehensive theory on tunnel fire
European Commission later released minimum require- dynamics has started to develop. Fire parameters such as
ments for road tunnel safety (EC 2007, 2004) in support the temperature development, flame length, backlayer-
of the CPR. The EC-requirements cover administrative, ing, visibility and gas concentrations can be calculated
organisational and technical aspects. Risk analysis as a for tunnels with longitudinal air flow (Ingason et al.
method is highlighted for verification of safety. Due to the 2015; Ingason 2012, 2008). In tunnels with longitudinal
increased awareness of tunnel fire risk, several research or natural ventilation there is an air flow along the
projects where initiated including several tunnel fire tests tunnel due to static and dynamic pressure differences.
(Ingason and Lönnermark 2012; DARTS 2004) and a study Transversal ventilation systems have air inlets and out-
of the assessment of tunnel safety which further explored lets along the tunnel length. With some minor modifica-
the use of risk analysis (Beard and Cope 2007). tions or limitations, a large part of the theory will also
apply for tunnels with transversal ventilation. When a
Tunnel fire dynamics fire develops, buoyancy forces make the hot gases rise
Despite that knowledge on tunnel fire dynamics now and spread along the ceiling depending on the tunnel
exist, enclosure fire dynamics is of importance, although inclination and initial ventilation. Depending on the air
some large differences exist (Ingason et al. 2015). In flow speed, the hot smoke and cold air mix and the
enclosure fires, the heat and smoke is kept inside the smoke eventually becomes homogenously distributed in
enclosure and the availability of oxygen likely becomes a the cross-section downstream the fire. The first tunnel
limiting factor. The size of openings will determine how fire science study was performed by Thomas (1958) to
large the fire can grow before it becomes ventilation study the effect of backlayering, when hot smoke travels
controlled, i.e. controlled by oxygen supply (Karlsson upstream along the ceiling against the air flow, see
and Quintiere 1999). For enclosure fires, unburnt fuel Figure 1. Later Thomas (1968) introduced the concept
can burn outside the enclosure openings as it is mixed of a critical air velocity needed to prevent backlayering.
with fresh air. When the fuel is surrounded by a gas The critical air velocity will increase with the heat re-
mixture with less than approximately 13% oxygen, the lease rate (HRR) towards a constant value at around
fire will extinguish. 3 m/s for most tunnels (Ingason 2008; Ingason 2012).
In tunnel fires fresh air is usually transported to the The fire generates a resistance that increases with the
fuel along floor level which sustains the fire. Unlike en- fire size, called the throttling effect. Therefore, although
closure fires all combustion takes place inside the tunnel 3 m/s will be sufficient to resist backlayering, the fan
and for ventilation controlled fires this can lead to nearly capacity has to be increased for increasing fire sizes
zero % oxygen further downstream. In tunnel fires the (Vaitkevicius et al. 2014).
hot smoke initially rise and impinges on the ceiling, ex- The main fire load in tunnels concerns the vehicles
tends along the ceiling and gradually descends towards that drive through it. A typical car has a fire growth rate
the floor as it is being cooled, see Figure 1. The amount corresponding to a fasta fire and a peak HRR at around
of backlayering and the distance downstream that the 5 MW. A bus reaches around 30 MW and a heavy goods
smoke remains stratified is highly dependent on the ven- vehicle (HGV) between 20 and 200 MW with an ultra-
tilation conditions (Ingason 2012; Ingason et al. 2015). fast1 fire growth rate. For dangerous goods vehicles
Figure 1 A schematic diagram over a tunnel fire introducing several important terms.
(DGV) there is no experimental data available although Modelling of fire in general as well as tunnel fires
fires similar or worse than the HGV fire can be expected in particular is challenging as several basic mechanisms,
(Ingason and Lönnermark 2012; DARTS 2004). HGV e.g. combustion and fire spread, are poorly understood.
and DGV fires can develop into catastrophic tunnel fires Furthermore, modelling assumptions are numerous, e.g.
involving several vehicles with a ventilation controlled the grid size, radiation model, turbulence model etc. In
HRR between 300 and 700 MW (Ingason 2003). The single comparisons between computer simulations and
heat release rate (HRR) of ventilation controlled fires experimental data good results are often reported, e.g.
will increase with larger cross-sectional area while fuel (Hadjisophocleous and Jia 2009). However, a round-
controlled fires (unlimited oxygen supply) will increase robin study involving 11 independent teams reveals an-
with decreased cross-sectional area due to increased other picture (Rein et al. 2009). A significant spread in
heat transfer from the surrounding enclosure to the fuel the simulated results was found, despite the fact that
(Ingason 2012; Ingason et al. 2015). Typically 2/3 of the each team received the same information of the fire test
HRR will be transferred by convection and 1/3 by radi- set-up that was to be modelled. The basic tunnel fire dy-
ation. If a sprinkler system is activated the convective namics theory presented by Ingason (2012) seems to
part decrease to about 50%. The ventilation system is perform well in comparison with more advanced models
only affected by the convected HRR while the structure (Nilsen and Log 2009), and to offer sufficient precision
is exposed to both convective and radiative HRR Ingason for risk analysis (Gehandler et al. 2014a).
and Li (2014)).
According to Carvel et al. (2001) ventilation has a Tunnel accidents
strong impact on the fire growth rate. In a more recent In Europe, about 20 vehicle fires occur per billion ve-
study Ingason and Li (2010a, b) found the fire growth hicle km in tunnels (Nævestad and Meyer 2014). Around
rate to increase linearly with the ventilation velocity. 30% of all fires originate from HGV, despite that they
Also, depending on the type of fuel, ventilation condi- only constitute 15% of the overall traffic volume
tions and fuel porosity the HRR can increase by a factor (Ingason et al. 2005; Nævestad and Meyer 2014). An
of 1–3 compared to free-burn tests if the ventilation Austrian survey (Rattei et al. 2014) covering the
is increased (Ingason 2005; Lönnermark and Ingason period 2006–2012 identified 38 car fires and 30 HGV
2007). There is an upper limit to how much a material and bus fires inside tunnels from national incident
can burn per fuel area, therefore the HRR will reach a statistics, indicating HGV fires may have an even lar-
maximum level at which higher ventilation does not ger share of all fires. The rate of HGV and bus fires
increase the HRR further (Ingason and Li 2010a, b). was 25 per billion km and the corresponding number
The ceiling height is an important parameter that for car fires was 4.2. A wide spread in the number of
receives limited attention when tunnels are designed, fires per vehicle km was found between different tunnels
although the ceiling height together with the ventila- (Rattei et al. 2014).
tion conditions is the most important parameters for The most common causes for tunnel fires are colli-
the fire development. Another important factor is the sions, overheating in combination with leakage or elec-
geometry and the design of the vehicle on fire, e.g. trical failure, overheated bearings, brakes, tyres or
containers or solid panels will significantly reduce the engines. Collisions involving HGV or DGV are clearly
fire (Ingason et al. 2015). overrepresented among the severe fires causing fatalities
There are three mechanisms by which heat is trans- (Kim et al. 2010). According to recent Norwegian statis-
ferred from one object to another: heat flux by radiation, tics, injuries or fatalities result from traffic accidents
conduction inside objects, and convection between hot rather than from fires (Nævestad and Meyer 2014). In
air and objects, see Figure 1 (Holman 2010). The driving the Austrian survey only 7% of the fires were reported to
force of all heat transfer modes is the temperature differ- have been caused by collisions, among which all were as-
ence. For the estimation of heat flux for tunnel applica- sumed to have included the entire vehicle. Out of 28
tions, basic theory is presented in (Ingason et al. 2015). HGV fires caused by spontaneous ignition only 3 fires
Tunnel theory commonly ignores the effect of heat spread to the entire vehicle (Rattei et al. 2014).
transfer through conduction, which means that the A Norwegian risk analysis estimated the expected loss
temperature development may seem independent of the of life from dangerous goods accidents to be less than
thermal inertia of the tunnel structure. Decreased ther- 2% of the expected loss of life from normal traffic acci-
mal inertia, e.g. insulation instead of concrete, will in dents (Lille and Andersen 1996). An international survey
general result in higher temperatures and faster fire of 1932 accidents during the transport of hazardous sub-
growth rates; which has the potential to, for example, in- stances by road and rail found that the most frequent
crease the risk of fire spread (Gehandler et al. 2014a, b; accidents were release of hazardous substances (78%)
Gehandler and Wickström 2014). followed by fire (28%), explosion (14%) and gas clouds
(6%). 63% of the accidents occurred on roads. Most acci- 2. Single fires that propagate to neighbouring vehicles.
dents (75%) were caused by collision between vehicles. All 5 fires in this category originated from HGVs
3% or 13 accidents with hazardous materials took place and claimed fatalities.
in tunnels among which five were in road tunnels 3. Collision fires limited to the vehicles that are
(Oggero et al. 2006). involved in the collision. In 5 out of 7 cases
The major cause of collisions is driver error, according fatalities occurred.
to a US study in 57% of cases and a UK study in 65% of 4. Collision fires that spread to other vehicles which
cases. Adding all the cases when the road user was at were not involved in the collision. 13 fires belong to
least a contributing factor the numbers rise to around this group and all claimed fatalities.
95%. According to Oppenheim and Shinar (2012), traffic
safety is more than the mere absence of accidents. We The analysis shows that fire spread is one of the key
must go beyond accidents if we are to understand safe factors behind escalating consequences, both in terms
driving behaviour. Three error types can be distinguished of fatalities and tunnel downtime (Kim et al. 2010).
as follows: #1 slips, i.e. right intention incorrectly exe- Ingason et al. (2015) offers a comprehensive theory on
cuted, #2 lapses, i.e. failure to carry out any action at all, fire spread in tunnels. Fire spread is closely related to
and #3 violations, i.e. deliberate deviation from accepted the HRR, gas temperatures, ceiling height, distance be-
safe driving behaviour, e.g. speeding. Both slips and lapses tween neighbouring vehicles, flame length of the fire,
relate to attention and memory failures. Lapses are of par- and ventilation conditions. Tunnel fires can spread in
ticular relevance to traffic safety as they relate to skill- a few minutes after the start of the fire (Kim et al.
based automatic behaviour. A mistake occurs when a 2010; Lönnermark 2007). Fire spread in tunnels can
driver intentionally performs an action that is wrong. occur through five main mechanisms (Ingason 2008;
Non-deliberative errors (lapses, slips and mistakes) may be Ingason et al. 2015):
reduced by training, memory aids, and better human-
machine interfaces (Oppenheim and Shinar 2012). Viola- 1. Flame impingement due to flame tilt in the presence
tions are best dealt with by trying to change users’ atti- of a ceiling and due to the ventilation flow.
tudes by improving the overall safety culture. 2. Flame spread along the fire load.
Among environmental factors, high traffic density, 3. Spontaneous ignition of vehicles downstream due to
narrow lane width, high horizontal curve grade, rising increased temperature.
and falling gradients and limited lateral clearance are re- 4. Fuel transfer through leaking fuel tanks or debris
lated to increased incident rates (Oppenheim and Shinar downstream of the fire.
2012; Martens and Jenssen 2012). In particular rising 5. Sudden deflagration.
and falling gradients is highlighted to increase the num-
ber of HGV and bus fires in Austria (Rattei et al. 2014). Hansen and Ingason (2011, 2012) have developed a
The area where the gradient goes from falling to rising is method for calculating the critical heat flux for ignition
accident prone due to a likely abrupt change in speed according to mechanism 3 above. Beard (2006) has de-
(Martens and Jenssen 2012), which is also confirmed by veloped a non-linear model called FIRE-SPRINT to
Norwegian tunnel incident statistics (Nævestad and identify the onset of instability with major fire spread ac-
Meyer 2014). Tunnel entry portals have a high accident cording to either mechanism 1 or 3 above, see (Grant
frequency, probably due to changing lighting conditions. and Jagger 2012; Charters 2012) for an overview.
The provision of traffic and safety information is neces- Despite the fact that fire spread and catastrophic fires
sary to improve driving behaviour and safety; but there involving multiple vehicles are key indicators of tunnel
is also a risk in providing too much information. In par- fire safety they are not accounted for among the most
ticular, information should be restricted 200 m before common QRA methods for tunnels (PIARC 2008). Sev-
the tunnel entrance since then most drivers focus on the eral parameters and systems can be used to reduce the
tunnel portal. It has been seen that many vehicles con- risk of fire spread, such as reduced longitudinal ventila-
tinue entering a tunnel even though traffic signals indi- tion speed, transversal ventilation systems, Fixed Fire
cate the tunnel is closed, instead some kind of physical Fighting Systems (FFFS) or manual extinction (Mawhinney
obstacle should be used (Martens and Jenssen 2012). 2011; Ingason and Li 2010a; Ingason 2012). Transversal
Kim et al. (2010) analysed 69 tunnel fires and divided ventilation systems reduce the risk of fire spread outside
them in four incident categories: the fire and smoke zone. In the near field of the fire, the
risk of fire spread is similar to longitudinal ventilation.
1. Single fires that do not spread to other vehicles. The Transversal systems work effectively if enough fresh air is
majority (43) belong to this group. Only 11 caused supplied from both sides of the fire (Ingason and Li 2010a;
fatalities. Ingason et al. 2015).
From a compilation of 20 fire fighting activities Kim exceeded the evacuation has failed. By accumulative
et al. (2010) found that 15 were extinguished by the fire methods the accumulated effects from several asphyxi-
brigade or driver. It was further noted that fires caused ant gases are combined into a Fractional Effective Dose
by collision develop very rapidly and have a short time (FED) value. A FED value of 1.0 corresponds to the me-
frame when fire fighters are able to approach them. dian of log-normal distribution of responses. A typical
Therefore FFFS is highlighted as a preventive measure endpoint is incapacitation (Forster and Kohl 2012;
to reduce catastrophic tunnel fires. From their study ISO 2012a).
Kim et al. (2010) proposed the following four parameters The risk of explosion most notably exists for transpor-
for tunnel risk classification: tation of gases that are liquefied by cooling or high pres-
sure. An explosion occurs when the energy stored in the
Allowance and amount of HGV and DGV gas is released in a short time. In a full vessel almost all
Bi-directional or uni-directional traffic flow gas will be in liquid phase. A rupture in a full vessel
Tunnel congestion leads to a sudden pressure drop to ambient causing the
Rescue service response time. liquid to boil. The quick change from liquid to gas phase
cause an increase in volume. Depending on the vessel
HGV and DGV represent a large risk as they consti- temperature a blast wave can occur, if the evaporation
tute the fire load that potentially can lead to a cata- is fast enough. This process is called, boiling liquid
strophic outcome. Bi-directional tunnels increase the expanding vapour explosion (BLEVE). In an almost
risk of collision and make the evacuation process more empty vessel much fuel will be in the gas phase. In this
difficult as road users are found both upstream and case a rupture causes an expansion of the pressurized
downstream of the fire. Highly congested tunnels have a vapour. The resulting blast depends on the temperature,
higher frequency of collisions and greater risk of fire type and amount of gas, and the dimensions of the tun-
spread to nearby vehicles. Finally rescue service response nel. These two bursting vessel scenarios, without igni-
time can significantly influence the ability for assisted tion, lead to high explosion loads in the zone around the
egress and the potential for the fire service to approach bursting vessel (200–500 kPa), but is reduced after a
the fire for manual fire fighting. couple of metres when the blast is directed along the
tunnel axis, at around 100 kPa. Once the gas has ex-
Tunnel fire hazards panded, ignition, e.g. by a spark or a hot surface, can
As for fires in general, exposure to smoke poses the occur if the gas-air mixture is within flammability limits.
main threat. During a large tunnel fire the hazards that Depending on the speed of the flame front and expan-
an evacuee meet are numerous. Firstly, the visibility is sion from combustion, a deflagration (10–800 kPa
impaired and the evacuee is forced to move through for HC-air mixtures) or detonation (1500–2000 kPa
smoke. Within a few minutes, due to smoke irritants, for HC-air mixtures) can take place. Of these, a def-
the visibility is further impaired, furthermore, pain and lagration in the order of 100 kPa is the most plausible
breathing difficulties occur as irritants also affect the scenario. Detonation is less likely as it requires instantan-
respiratory tract. After some further minutes of smoke eous release of an almost empty tank. A pressure of
exposure asphyxiant gases start to cause asphyxiation 100 kPa or larger will cause direct casualties from the
leading to confusion and loss of consciousness followed blast (Weerheijm 2014).
by death from hypoxia (Purser 2009). Another hazard
concerns the heat generated from the fire. Heat can be Structural behaviour
an issue for evacuation close to the fire, but foremost A number of past fires, for example the Channel tunnel
heat restricts rescue service intervention and can dam- fires and the Mont Blanc tunnel fire, show that fires
age equipment or the tunnel structure, potentially lead- pose a serious threat to the tunnel structure. There are
ing to collapse or expensive renovation. four main types of tunnel constructions: cut and cover,
Most materials that burn are carbon-based. The end immersed tube, drilled and blasted and bored tube tun-
product of carbon-based fuels is mainly CO2, H2O and nels. The dominating construction material is concrete.
heat. CO2 is a toxic asphyxiant gas in large doses. There are two main classes of concrete for tunnels: low-
Depending on the fuel composition, temperature and porosity (high-strength) and high-porosity concrete. For
ventilation conditions, other toxic products can be low-porosity concrete (often used in bored and blasted
formed, e.g. CO or HCN (Blomqvist 2005). Methods for tunnels) the dominant failure process in tunnel fires is
quantifying fire hazards can be distinguished into limit- spalling, i.e. the explosive delamination of concrete. For
based and accumulative methods. In a limit-based high-porosity concrete in immersed and cut-and-cover
method the gas concentration is estimated and com- tunnels the main failure mode is sagging of the roof due
pared with a limit value for each gas. If the limit is to loss of strength and expansion due to heat. Another
threat for cut-and-cover and immersed tunnels is that models for understanding human behaviour (such as
the opposite, unexposed side, cracks. Measures to pro- the affiliative and role-rule model) can be used but in an
tect the tunnel integrity are, for low- and high-porosity iterative process. Two new concepts are introduced to
concrete tunnels, either focused on withstanding fire ex- describe the process. Feedback in action describes how
posure (fireproof concrete or insulation) or on fire sup- people continuously act in response to new information ra-
pression (Carvel 2005; Carvel and Both 2012). ther than from an inert condition. Effectance motivation
The Eurocode offers general rules for structural fire describes the continuous interaction of an individual with
design of concrete structures (CEN 2004). It is generally their environment to reduce uncertainties and ambiguities
sufficient to assume a fully developed ventilation con- (Tong and Canter 1985).
trolled compartment fire with a uniform temperature An important finding concerning human behaviour in
distribution and to only verify individual members dir- fire is that people’s reaction to an alarm is as important
ectly exposed to fire (Thomas 1986). For this purpose, as the time it takes to physically move to an exit, if not
standardised testing of internal members using pre- more. In a lecture theatre evacuation study, two thirds
defined time-temperature curves have been developed, of time from the onset of the alarm was spent not mov-
e.g. the standard fire curve in EN 1363–1 and ISO 834, ing at all. Sime et al. (1992) therefore concluded that
the hydrocarbon (HC) curve in EN 1363–2, or the there is a disproportionate emphasis on time to move
Rijkswaterstaat (RWS) curve from the Dutch regula- and exit flow rates in design standards and regulations.
tions. Members are classified according to the number The theory of affordance explains what affordances
of minutes that load-bearing capacity (R), integrity (E) (perceived utility) an object such as an emergency door
or insulation (I) is ensured. A more performance-based has on a person escaping. People perceive objects in
alternative to the standardised fires is to develop a terms of what they can offer or afford in relation to the
unique time-temperature curve given actual fire load fulfilment of their goal. Affordances can be divided into
and conditions, see for example the Natural fire safety different categories depending on how they aid or sup-
concept (Sleich et al. 2002). An attempt to develop a port the user. Sensory affordance is the affordance of an
similar concept for performance-based tunnel design object to be seen or sensed. Cognitive affordance sup-
can be found in (Gehandler et al. 2014b). ports understanding, such as how or why an object
is used. Physical affordance supports the user physically,
Human behaviour in fires e.g. opening an emergency door. Functional affordance
Key theories and concepts concerning human behaviour help users to achieve their goal (Nilsson 2009).
in fires were mainly developed during the 1970s and As the understanding of human behaviour in fire in
1980s. More recently, interest in human behaviour dur- tunnels is limited, knowledge of human behaviour in
ing tunnel fires has started to develop, see (Shields 2012; buildings is of high value, although, differences between
Noizet 2012) for an overview. This research into human tunnels and buildings must be considered. The human-
behaviour in tunnels has merely scratched the surface. tunnel-vehicle system is different in many ways from
Social influence explains why we act differently to a that of human-building systems. Some of these differ-
fire threat alone and in groups, e.g. the apparent indiffer- ences are that road users are sitting inside a vehicle
ence of others can lead to passivity (Latané and Darley which in general is a familiar place and not on fire. Fur-
1970). The importance of social influence is believed to thermore, the surrounding environment is an alien
increase with decreasing distance to the nearest person environment. The road user depends on visual impres-
and when the fire cue is unclear or uninformative sions, since she cannot smell or hear much from the
(Nilsson and Johansson 2009). environment outside the vehicle. For buildings, user
According to the behaviour sequence model the phases familiarity can sometimes be assumed, for tunnels user
of evacuation are characterized by interpretation, prepar- familiarity cannot be assumed. In particular, the notion
ation and action. The action in the last stage depends on of destination, person and property affiliation can ex-
previous stages. The activities people engage in to fulfil plain why instructions to drivers often are disobeyed
their role in any given situation are influenced by guid- (Shields 2012). Note that most studies on tunnel egress
ing principles or rules. When faced with a fire threat this behaviour neglect differences in cognitive behaviour due
role-rule attribute continues to guide the individual’s to age and/or abilities (Noizet 2012).
behaviour (Canter et al. 1980). The affiliative model Emergency information is often provided for pedes-
suggests that people in a situation move toward familiar trians. According to Shields emergency information
persons and places simply because they are familiar should immediately be available for road users inside
(Sime 1985). their vehicle. Especially considering that it has been
In the process model the focus is shifted to human noted in real tunnel fires that many road users stay in
information processing and decision making. Earlier their vehicle (place of affiliation and familiarity) during
an emergency. Emergency exits and signs should have move to the tunnel exit, and 17% towards the tunnel en-
sufficient affiliation to persuade the road user of the trance. Gandit et al. (2009) concluded that although
associated benefits. When driving through tunnels, signs, users are well aware of the safety devices, they do not
emergency doors or even the tunnel walls are hardly use them automatically. Safety campaigns or a fire safety
noticed, the side walls flash by due to the speed of the module in driver training courses could improve the
vehicle (Boer and van Zanten 2007). The tunnel is seen situation to clarify why and how safety devices should be
in a flash and when tunnel users have to evacuate used (Gandit et al. 2009).
by foot they have no idea of the appearance of the There is a wide range of egress models available for
tunnel. buildings and an extensive review can be found in
In an evacuation experiment in the Benelux tunnel a (Kuligowski et al. 2010). As can be seen in the review
truck fire was simulated to study human behaviour. In 6 above modelling of human behaviour is a challenging
out of 7 tests, motorists stayed in their cars until the first task as many parameters affect the complex decision-
announcement. In one test motorists started to leave making process resulting in a wide range of behaviours.
their cars immediately and others followed. In all seven To account for this fact some models try to use artificial
tests the first announcement was sufficient to start the intelligence or probabilistic rules. Some models have
evacuation. One test showed extreme passivity by the been tested against fire drills or people movement exper-
motorists in the front who stayed in their cars even after iments. One can expect a large operational uncertainty
they were engulfed with smoke. First after the second in applying these models, in particular with relation to
announcement did they react and commence evacuation. tunnels.
A common reason for not reacting to the incident was
that no one else did anything. Another reason to stay in Perspectives on safety
the car without reacting can be to stick to the role of be- Although this paper belongs in the technical science
ing a motorist. As visibility decreases so do these social field it is also in accordance with Renn (2008), who be-
influences. This is believed to be part of the explanation lieved that insights from other sciences, e.g. natural,
as to why some motorists stayed in their cars being psychology, economics, and cultural and social sciences,
engulfed by smoke: they did not see the motorists leav- can enrich the understanding of safety and risk. The
ing behind them (Boer and van Zanten 2007). main paradigm for dealing with safety is risk analysis as
Proulx and Sime (1991) investigated the efficiency of developed from the technical science field, called tech-
different communication systems for initiating evacu- nical risk analysis by Renn (1998). Similar to technical
ation in a Newcastle underground metro station. It was risk analysis, the economic concept of risk transforms
found that a regular alarm bell lead to a delayed evacu- physical harm and other effects into utilities. In contrast,
ation or no evacuation at all. Although an alarm bell is a psychological perspective on risk reveals that we as in-
supposed to mean ‘evacuate the building’, people seem dividuals have a multidimensional concept of risk, which
to interpret the information as a system failure or a test. cannot be reduced to utilities, probabilities and conse-
The will to reach the destination is so strong that every- quences. A sociological perspective on risk tries to
one continued with their normal behaviour only slightly understand how the risk society works. A basic notion is
disturbed by the ringing of the bell. The response to that humans do not perceive the world with pristine
evacuate was improved if staff members shouted at eyes, but through perceptual lenses filtered by social and
people to evacuate, or, even better, if a message was cultural meanings. Cultural theory seeks to make sense
given on the public communication system. The fastest of the things humans do. Studying the origins of beliefs
response was achieved when the message was timely and that guide risk-taking decisions reveals cultural patterns
precise, e.g. a live voice describing what action is ex- and different world views. This helps explain controver-
pected and why, and giving personal messages to people sies concerning risk issues and explains why risk assess-
identified on the CCTV who had not started to evacuate. ment cannot claim universal validity among all groups
It is important that the message is clear, reliable, and and cultures in society (Adams 2000; Renn 1998).
easy to understand. The scientific method can be defined in terms of the
In a survey conducted on 151 firemen, truck drivers, three characteristics: reductionism, repeatability, and
regular drivers and student drivers, the management refutation. The complexity of the real world is reduced
strategies in the event of a tunnel fire were investigated in experiments whose results are validated by their re-
(Gandit et al. 2009). The spontaneous response to a tun- peatability and knowledge is built by refutation of hy-
nel fire was to evacuate (40%), exchange information potheses. The scientific method has been successful in
(35%), or to help others (13%), mainly through the use many fields, however, complexity and social phenomena
of a fire extinguisher. Of those who wanted to evacuate pose difficult problems. After having conducted case
50% looked for an emergency exit, 33% said they would studies of fire safety engineering projects, Bjelland (2013)
argues that the scientific framework for fire safety is too The Netherlands has adopted a policy for intrinsic infra-
narrow to capture the essence of fire safety. In particular, structure safety. To achieve decisions for intrinsic safety, a
reductionism leads to great simplifications in the treat- shared view of safety among all decision makers should
ment of complex systems and excludes critical issues that emerge before safety objectives are evaluated against other
are difficult to quantify, e.g. human and organizational objectives, e.g. economic (Rosmuller and Beroggi 2004).
behaviour. This leads to an overemphasis of model con- The safety circle in Figure 2 visualises different aspects
cepts such as relative frequencies or causal structures. of safety as a dynamic process of learning and improv-
Bjelland (2013) highlights design science, systems safety ing. In any holistic safety approach all elements in the
and social constructivism as good compliments to the safety circle should be addressed, and it may be ineffi-
scientific method to broaden the view of relevant cient to only focus on one or a few. Pro-action is about
knowledge in the design process. In the design process, eliminating the root causes, for example through train-
more emphasis should be placed on prior experience ing or design. Prevention is about reducing tunnel acci-
and tacit knowledge. Engineers should be allowed to dent probabilities of crucial events, for example through
creatively frame and reframe the problem in negotiation reduced speed. Preparation concerns the management of
with stakeholders (Bjelland 2013). emergencies. Mitigation (also called protection) is about
The method of systems is, unlike the scientific mitigating the consequences of a tunnel accident. Inter-
method, based on the idea that at certain levels of com- vention refers to the efforts of rescue teams. After-care
plexity there exist properties which are emergent at that actions are performed to quickly return to normal oper-
level and which cannot be reduced to lower levels. An ation. Lastly, evaluation is about learning and constantly
example of such a complex system is the human body improving. Safety features that function early in the cir-
with its organs, cells and DNA. At each level, e.g. that of cle are in general most cost-effective (PIARC 2007).
organs, properties can be found that cannot be found at The five requirements stated in the CPR (2011) are
other levels (Checkland 1985). Performance is controlled largely consequence focused. One reason is that fire
by the higher levels of system hierarchy. In order for this rules and regulation have developed as a reaction to oc-
control to be effective there is the need for communica- curred incidents. The fire is already assumed to have
tion, feed-back and feed-forward about the state of the happened and regulations are designed to protect our-
system (Bjelland 2013). selves against future occurrences (IRCC 2010). This is a
Möller and Hansson find no less than 24 safety princi- reactive safety approach in contrast to a proactive ap-
ples in the engineering literature, which are grouped in proach. Consequently Malmtorp and Vedin (2014) find
four categories as follows (Möller and Hansson 2008): that about 80% of all safety measures aimed at tunnel
safety focus on reducing consequences, despite the fact
1. Inherent safe design. Potential hazards are excluded that preventive measures generally are more efficient.
rather than just enclosed or coped with. In general An overview of key terms and measures aimed at pre-
this is the preferred solution if possible. vention and protection for tunnels is given by Beard and
2. Fail-safe. If the system does fail it should fail safely, Scott (2012). Gehandler et al. (2014a, b) argue that to-
or it should be fail-safe, i.e. internal components day’s tunnel fire safety codes and standards do not cater
may fail without the system as a whole failing, or the to the complexity of modern multi entry and exit urban
system fails without causing harm. Defence in depth, road tunnels. A suggested solution to account for
reliability, and safety barriers are example of fail-safe both this complexity and the need for more proactive/
concepts. preventive measures is to move to a performance-based
3. Safety reserves. A system or construction is made design methodology and QRA (Gildersleeve and Sherlock
strong enough to resist loads by a margin of safety 2014; Malmtorp and Vedin 2014).
to account for higher loads than foreseen, worse However, both prescriptive and risk-based approaches
material properties than foreseen, imperfect theory have their positive and negative aspects. Prescriptive ap-
of the failure mechanisms, possible unknown failure proaches contain a rich seam of knowledge and experi-
mechanism, and human error. ence encapsulated in codes and guides, grounded in the
4. Procedural safeguards. Procedures and control real world, based on implicit risk but without explicit
mechanisms are implemented to maintain safety. understanding of risk. A risk-based approach allows us
This includes safety standards, quality assurance, to estimate the risk, although with several assumptions
and training. and considerable uncertainty, grounded more in models
than in the function of the entire system in the real
In general the efficiency of a safety measure decreases world (Beard 2004, 2012). Fire models have the potential
with increasing number above, i.e. inherent safety is more to be valuable and aid decision-making, but they also
efficient than implementing procedures and safeguards. have limitations and can be used in ways which cause
Figure 2 The safety circle (PIARC 2007).
poor decisions to be made, see (Beard 1992, 1997, 2005). One way of classifying different models for risk ana-
Consequently Beard and Scott (2012) argue for a sys- lysis is by examining how uncertainty is treated. Six
temic approach where fire risk is seen as a product of levels (from 0 to 5) are introduced by Paté-Cornell
the working of a system as a whole, and a healthy mixture (1996). The success of analysis at various levels is
of prescriptive requirements, qualitative risk assessment dependent on resources, available knowledge, models
and quantitative risk assessment is applied (Beard 2012). and data. In some cases it does not make sense to per-
form an analysis at level 5 because there may not be any
Technical risk analysis numerical models or data available. Uncertainty can also
Due to the diversity of fields that deal with risk analysis, be treated in words by stating the gaps in knowledge, or
a wide spectrum of concepts and names are used. Some- through reducing the uncertainty in the system by mak-
times the same words are used for different methods ing it more robust.
and sometimes different words are used for the same At level 0, the first step in risk analysis, risk identifica-
method; this is a fertile ground for confusion and misun- tion is carried out. This can be sufficient for a strict
derstandings (Kaplan 1997). Central concepts for risk zero-risk policy or for low cost decisions when the op-
can be identified from the ISO (2009a) definition of risk tions are clear. Analysis at levels 1 and 2 consider a
which is: “effect of uncertainty on objectives” in which worst or plausible worst case and can be an option if this
events, consequences and likelihood are key parameters. is sufficient to support a decision, e.g. to design for the
Uncertainty is the state of deficiency in information re- maximum credible earthquake. The uncertainty in con-
lated to, understanding or knowledge of, an event, sequences is implicitly considered. This approach can be
its consequences, or likelihood (ISO 2009a). IEC/ISO used in deterministic design procedures where scientific
(2010) defines the risk assessment process with the fol- theories and empirical methods using conservative as-
lowing phases: #1 risk identification, what can happen? sumptions are used to evaluate the design as either suc-
#2 risk analysis, the consequences and likelihood of fu- cessful or not (BS, 2001). Analysis on Level 3 uses the
ture occurrence is analysed, and #3 risk evaluation, deci- best estimate or central value that reflects the most
sions are made in relation to objectives and risks. probable outcome and is often used in Cost and Benefit
Analysis (CBA). An analysis on level 3 has a poor estimation and description is according to Kaplan (1991)
capability to capture the uncertainty of the outcome. versatile and have worked well for several types of risk.
(Paté-Cornell 1996). Another way to describe one or more risk scenarios is
At levels 4 and 5, a Probabilistic Risk Assessment by logic diagrams, e.g. the bow-tie model (PIARC 2007)
(PRA), or a QRA is performed. A distribution of prob- or the crucial event model (Beard and Scott 2012). The
abilities is used in contrast to the previous deterministic essence of these models is that causal factors come to-
approaches. This includes the worst case, plausible worst gether to produce one or more events that then lead to
case, central values and a set or continuum of other consequences, see Figure 3. A causal factor can be of
cases. The output of level 4 is a risk curve over the like- any nature, e.g. it may be a temporal event or condition
lihood for different consequences. This curve represents such as ‘fuel is present’ or a latent condition. The causal
the uncertainty involved under the limitations of the factors can be further analysed in a Boolean fault tree with
method used and the assumptions made. At level 5 AND or OR gates representing the logic of how the causal
competing models and assumptions are taken into con- factors produce the failure event. Likewise, the possible
sideration and results in a distribution of risk curves consequences from each event can be logically constructed
providing an estimate of the inherent uncertainty of in an event tree, see Figure 3. By applying probability the-
the risk measures (Paté-Cornell 1996). PRA emerged ory to the fault and event trees the probabilities of the end
from a reactor study on nuclear power plant safety states can be calculated (Stamatelatos et al. 2002a).
(WASH-1400) in the mid-1970s (Stamatelatos et al. An important qualitative result of fault trees is the
2002a). The introduction of the notion of ‘scenario’ con- minimal cut set (MCS) for top event failure to occur. An
trasted with the deterministic practice current at the MCS is the smallest combination of basic events that re-
time, which was to only study reliability for a given de- sult in the top event. Any MCS with only one basic
sign basis challenge, Level 1 or 2 above (commonly done event represents a single failure that alone can cause the
in fire safety science where the term design fire is used to top event to occur. These are often weak links in the
define the stress for the system in question). In contrast safety chain. An MCS having events with identical char-
WASH-1400 studied several high consequence-low prob- acteristics are susceptible to common cause failures.
ability scenarios (Stamatelatos et al. 2002a). Through a quantitative evaluation the dominant cut sets
An informative definition of risk is the set of triplets with the highest risk contribution can be identified
definition (Kaplan and Garrick 1981): (Stamatelatos et al. 2002b). Although theoretically
sound, it has proven difficult to model common cause
R ¼ fS i ; Li ; X i gc ; i ¼ 1; 2; …; N failures (Renn 2008). Nývlt et al. (2011) apply PRA on
road tunnels using an unknown base probability. The
The risk (R) is the comprehensive answer to the fol- logic is that, despite the fact that the probability of fire is
lowing three questions (Kaplan 1997). unknown, it can be analysed and demonstrated to be
well managed and mitigated. Similarly a logic tree ap-
1. What can go wrong? This gives all possible proach is used by Beard (1983) where a reduction factor
scenarios Si. is calculated for various combinations of safety systems
2. What is the likelihood of each scenario Si? This with unknown base probability.
gives Li.
3. What are the consequences of each scenario Si? This Economic perspective on risk
gives Xi. Through an economic perspective on risk the physical
damage is transformed into utilities. The objective yard-
The brackets denote the set of triplets, i.e. the set of stick for measuring utility is the amount of money some-
each scenario Si with its likelihood Li and consequence one is willing to pay for a change. By this transformation
Xi and the subscript c implies that the set is complete, other aspects such as psychological or social effects can be
i.e. all relevant scenarios are evaluated. In practice the measured besides physical harm. Furthermore risks and
identified scenarios will never be complete as we do benefits can easily be compared as they are expressed in
not know what we have not thought of (Beard 2002); the common denominator of utility. Collective utility can
this calls for cautionary decision-making (Beard 2004). be deduced by looking at past behaviour or through sur-
No quantitative number or curve is “big” enough to veys. The economic perspective on risk conceptualizes risk
capture the concept of risk. Scenarios and evidence as a cost factor that can be exchanged (Renn 1998).
also needs to be described in words since it is not pos- A controversial issue with the economic perspective on
sible to express everything in numbers (Kaplan 1997). risk, e.g. CBA, is that all costs and benefits are translated
The aim to identify all scenarios including scenario into the single dimension of money, including e.g. life,
descriptions, likelihood estimation and consequence which for many of us is considered to be incommensurable.
Figure 3 Fault tree and event tree.
Since resources are finite, society needs to make tough de- repeatability and refutation. At the other end of the
cisions when setting priorities between different life-saving spectrum are the soft systems methodology, e.g. by
alternatives (HSE 2001). Mooney (1977) argues that valu- Checkland (1985). In a purely hard methodology, a con-
ation of human life for life safety decisions is an useful aid siderable knowledge and understanding of the system is
that complies with liberal democratic traditions and en- necessary. The method proceeds from problem to solution
sures rational decisions. According to social theory, human in a mechanical, orderly manner without any iteration. On
valuation and CBA are tools that are used by some groups complex and/or social systems the scientific method can
in society to ease management, but lack validity among be less successful, e.g. risk controversies where different
other groups (Adams 2000). actors have different values and objectives. The soft sys-
Another controversial issue is how costs and benefits tems methodology is described as a never ending learning
are to be compared over time. Economists have devel- system that starts by expressing the situation where the
oped a widely accepted solution to this problem by perceived problem lies while not distorting the problem
discounting the future. According to Fischhoff and into a preconceived or standard form. Hard systems think-
Kadvany (2011) it is questionable how well this applies ing (e.g. systems engineering and systems analysis) as-
to public decisions, e.g. future generations may not sumes that problems can be formulated as the making of a
benefit from money that is saved today at the cost of the choice between alternative means achieving a known end
environment, and there is no obvious justification for (Checkland 1985; Beard 2012).
discounting future lives. Beard and Cope (2007, 2012) proposed an intermedi-
According to Thomas (1986) the general objective of ate methodology between the hard and the soft ends of
fire protection is to minimize the combined loss and the spectrum for tunnel fire safety. Such a methodology
cost of fire. An early application of utility theory on fire is the risk management process in IEC/ISO (2010), see
protective trade-offs was developed by Baldwin and Figure 4. Beard and Cope (2007, 2012) further presents a
Thomas (1974). In particular they were investigating check-list concerning what a tunnel fire safety method-
the optimal combination between passive and active ology should include, e.g. to make all assumptions clear,
(sprinkler) fire protection. An important notion is that and to use an iterative process.
both active and passive protection may fail, there is in Funtowicz and Ravetz (1992) argue that the limit of
this sense no need to discriminate between the two science is being reached for risk analysis involving in-
modes of protection, and they both have a non-zero eradicable uncertainties in value-laden contexts. They
probability of failure. A balance has to be struck between argue that awareness of complexities in both the factual
the risk of failure, the ensuing damage, and the cost of and the value-laden dimensions of the problems are ne-
reducing the risk or damage. A probabilistic approach cessary, which they call post-normal science. The gap
for such evaluations is offered by Johansson (2001). between scientific expertise and a concerned public can
be bridged by dialogue among all stakeholders. The
Risk evaluation and decision-making democratization of the political life of modern societies
Methodologies for risk evaluation and decision- means ordinary people can read, write, vote and debate.
making range from hard methodologies to soft systems Funtowicz and Ravetz (1992) hope that a similar
methodologies. Hard methodologies are derived from democratization of knowledge in society will take place,
the scientific method, characterized by reductionism, creating space for enhanced participation in decision
Figure 4 The IEC/ISO (2010) Risk management process.
making for common problems, which is necessary for Another consequence of the separation between risk
meeting the challenges of modern times. This requires analysis and decision-making and evaluation is that the
that the problem is framed in a way that acknowledges search for the best decision is sometimes framed as an
the different perspectives of the stakeholders, e.g. trust- “acceptable risk” problem. In 1969 Chauncey Starr pub-
worthiness of managing institutions (Funtowicz and lished a study aimed at finding a formula for determin-
Ravetz 1992; Wynne 1992). Meacham (2004a) argues that ing whether risks were socially acceptable. He assumed
fire safety design, involving modelling of fire and human that society revealed its preferences through the risks
behaviour with significant uncertainties, has reached the and benefits that are accepted from various hazards. The
realm of post-normal science. This then requires the in- general rationale for acceptable risk is that if people
put from a broader group of concerned stakeholders in accept one risk, they should accept all risks of the same
the decision process. order of magnitude measured in the same way. Accord-
Risk analysis has achieved a more and more distinct ing to Fischhoff and Kadvany (2011) such comparisons
and separate role in relation to decision-making and are flawed in three fundamental ways:
evaluation. This separation started in the 1980s when a
National Research Council (NRC) report called the ‘Red by assuming that all risks can be defined by the
Book’ proposed a division between analysis and evalu- same risk measure,
ation arguing that this would remove overt policy values by assuming that risk decisions are about risk
form the assessment part and ensure scientific expertise alone, and
without value judgments (Vareman and Persson 2010). to assume that accepted risks are acceptable.
An earlier NRC report had warned that it is difficult and
sometimes unwise to separate analysis from evaluation. According to Renn (2008), it is important to under-
Some members of the committee felt that setting an stand the central importance of benefits. Benefits are
ideal of value-neutral reporting of uncertainties is so un- weighted versus risks and make them “acceptable”. Risky
attainable that it distorts the analytical process (NRC decisions are not about risk alone. Rather they are a
1982). Fischhoff et al. (1981) argue that, although a dis- choice between options with different features, including
tinction between facts and values enrich risk debates, the level of risk. When a technology is adopted, so is its
such a distinction is often impossible to attain. The ob- entire package of features which means it is impossible
jectivity of a fact is always contingent on a correct state- to infer some level of acceptable risk. All relevant fea-
ment of the problem. Beliefs concerning “facts” shape tures must be included in risky decisions to find the
our values and those values in turn shape the facts right level of risk for each particular case (Fischhoff
we search for and their interpretation. According to et al. 1984; Slovic 2000). As an example one may accept
Fischhoff et al., the search for an objective method a large risk, such as smoking, if the benefit from smok-
such as risk analysis is doomed to fail and may obscure ing is perceived to be worth the risk; while one may
the value-laden assumptions that inevitably will be made reject a small risk from a chemical plant nearby that
(Fischhoff et al. 1981). is perceived as bringing no benefits but noise and
disturbance. In risk perception studies several more fac- Table 1 Different policy factors to account for different
tors have been identified that affect how risks are per- type of activities in terms of voluntariness and benefit
ceived and judged by the public (Slovic 2000, 1987). (Vrijling et al. 1998)
According to Otway (1992), attitudes towards technology Policy factor βi Voluntariness Benefit Example and its
individual risk
as a whole, associated with risk, reveals a better under-
standing than the more narrow framing of risk perception. 100 Completely Direct benefit Mountaineering 10−3
voluntary
It follows that one cannot and should not define risk
in general terms suitable for all problems. Defining risk 10 Voluntary Direct benefit Motor biking -
is a political act that expresses values regarding the rela- 1 Neutral Direct benefit Car driving 10−4
tive importance of different possible adverse conse- 0,1 Involuntary Some benefit Factory 10−6
quences for a particular decision (Fischhoff et al. 1984). 0,01 Involuntary No benefit LPG station -
Whoever controls the definition of risk controls the ra-
tional solution (Slovic 2000). Defining risk is a political
and social act, determining what should be regarded as different types of activities are proposed, based on his-
risk and how it is to be measured. The risk measure should torical accident data.
be related to the decision context, e.g. if risk relates to an For social risk Vrijling et al. (1995) assume that indi-
individual question concerning means of transportation viduals assess social risk on the basis of the events that
the measure should reflect the whole journey from start to occur within their circle of acquaintances. Assuming
finish, and include the values of the concerned stake- that each individual on average has 100 fairly close ac-
holders (Holmgren and Thedéen 2003). quaintances, statistical data show that the recurrence of
Vrijling et al. (1998) argue that the degree of protec- an accident claiming the life of one out of 100 acquain-
tion should be expressed in terms of acceptable risk. tances, is on the order of a human life span. They next
Additionally the choice of a certain technology and risk use statistical accident data for different policy factors (β)
should be made in a cost-benefit framework. Since al- as above, which results in an activity that is permissible if it
most all studies on acceptable risk use two measures for claims less than
acceptable risk Vrijling et al. use the same. One is the
point-of-view of the individual who “decides to under-
710−6 βi national population size
take an activity against direct and indirect benefits”. The
other measure considers if the benefits outweigh the risk
for society. As the acceptable level of risk stands in rela- deaths per year. The model also includes a risk aversion
tion to the benefits and voluntariness, the notion of ac- index and a model to calculate locally acceptable risk
ceptable risk needs to be flexible in relation to these from nationally acceptable risk.
aspects. Both the individual and societal level of risk For transportation risks it is noted that the applicabil-
needs to be “acceptable”, i.e. below a defined threshold, ity is questionable. One solution would require the def-
or in relation to benefits and voluntariness. Society inition of a standard unit length, but it is arbitrary what
should represent the whole nation so that several local unit length is defined (Vrijling et al. 1995). In a later
risks cannot add up on a national scale. Depending on article the framework is applied to road traffic where
the benefit and relation a person has with a given activ- each vehicle is seen as an installation. As so many
ity, a useful distinction in risk acceptability is often made “installations” exist the current risk should not be accept-
between third party users, users/passengers, and em- able according to this framework (Vrijling et al. 1998).
ployees. The framework rests on statistical accident data, Finally, the framework for acceptable risk proposed by
similar to the study by Starr mentioned above, which Vrijling et al. (1998) aims at an economically optimal
shows that the individual risks can be ordered according level of risk. The rationale is that the total cost for safer
to the generated benefit and voluntariness. To account systems and expected total damage in monetary units is
for the different categories a policy factor, β, is defined minimized. Vrijling et al. (1998) further underline that
so that the individually acceptable probability of failure the three means they propose, i.e. individual and societal
can be calculated accordingly (Vrijling et al. 1998): risk criteria and economical optimization, are just means
to reach the goal of managed safety. The tools only
10−4 βi measure some aspects of the entire system. The frame-
Pf i ¼ work on risk acceptance proposed by Vrijling et al. is ap-
P d jf
i
plied to tunnels by Arends et al. (2005). However, it is
unclear how the method is applied in practice consider-
Where P djf denotes the probability of being killed in ing the lack of data which is also acknowledged by the
i
the event of an accident. In Table 1 policy factors (β) for authors.

The Tolerability of Risk (ToR) framework was devel- ethical relationships amongst the three parties: the risk-
oped by the UK Health and Safety Executive (HSE) in exposed, the beneficiary, and the decision-maker. Seven
order to efficiently align decisions with policies and the questions have been developed to cover the ethical is-
preferences of UK citizens. Tolerability is a better word sues between the three risk parties (Hermansson 2007):
than acceptability since one does not really accept risks,
although the practical implications are the same. In the 1. To what extent does the risk-exposed benefit from
HSE approach risks are characterized as unacceptable, the risk exposure?
tolerable or acceptable depending on the risk magnitude. 2. Is the distribution of risks and benefits fair?
In order for a risk to be tolerable it should be reduced 3. Can the distribution of risks and benefits be made
to a level that is As Low As Reasonable Practicable less unfair by redistribution or by compensation?
(ALARP). CBA is the main tool to prove that a risk is 4. To what extent is the risk exposure decided by those
ALARP (Bandle 2007; Bouder et al. 2007). who run the risk?
HSE apply the precautionary principle for hazards sub- 5. Do the risk-exposed have access to all relevant infor-
ject to high scientific uncertainty, which rules out lack of mation about the risk?
scientific certainty as a reason for not taking preventive 6. Are there risk-exposed persons who cannot be
action. A key point of the framework is to generate trust, informed or included in the decision process?
therefore it is important to base the process on open- 7. Does the decision-maker benefit from other people’s
ness, transparency and stakeholder involvement (Guen risk exposure?
2007; HSE 2001). A drawback with ToR is that CBA and
the ALARP principle do not consider how the benefits In order to consider a wide range of concerns, Fischhoff
and risks are distributed, e.g. whether one person is and Kadvany (2011) put forward a British framework
benefitting grossly while many others are taking the risk called ‘concern assessment’ that included a CBA and
(Fairman 2007). the six societal factors: familiarity, understanding,
The approaches put forward by Vrijling et al. and HSE equity, dread, control, and trust. Each societal con-
are the current dominating paradigm for risk evaluation cern is measured with judgements allowing five levels
and builds on utilitarian ideas where the collective is for each attribute.
seen as a carrier of utility. The underlying rationale is Bilson and Purchase (2014) employ a risk evaluation
that through a levelling of differences in cost per statis- framework to tunnel safety that includes several ethical
tical life, financial resources can be used in a more cost- aspects. Utilitarian values are evaluated through a CBA.
effective way allowing more lives to be saved (Hermansson Duty ethics concern an evaluation of whether the re-
2005; Hansson 2003). quired level of safety in terms of standards and regula-
As already mentioned, this paradigm may not protect tion and societal expectations is achieved. Rights ethics
the individual from unfair risk exposure. Hermansson concern an evaluation of the different perspectives of
(2005) argues that risk management should acknowledge the owner, constructor and polititians (obviously the ex-
moral factors such as individual rights and fair risk tak- posed should also be included here, see Hermansson
ing. She also argues that the focus in risk management above). Finally, virtue ethics is about finding a balanced
should shift from the outcome to the procedure for decision that takes account of all relvevant factors.
decision-making. Those affected by a risk decision In many fields such as nuclear safety, QRA has proven
should have the opportunity to be involved in a fair to be very successful to ensure and increase nuclear
decision-making process. Public participation is a goal safety and aid cost efficient decision making (Apostolakis
for democracy and a requirement for rational decision 2004; Garrick et al. 2010; Garrick 1998). As pointed out
making (Renn 1998; Hermansson 2010). by Apostolakis (2004), a QRA can improve safety deci-
Risk management implies value judgement on three sion making, but it is not a replacement for traditional
levels: the choice of acceptability criteria, trade-off be- safety methods or philosophies. QRA benefits include
tween criteria, and generation rational solutions. The the logical and analytical consideration of thousands
dual nature of risk as a potential for physical damage of scenarios, in-depth understanding of system failure
and as a social construction demands a dual strategy for modes, uncertainty quantification, identification of dom-
risk management. Public values and social concerns can inant scenarios so that resources can be wisely used
identify the topics for risk management. Technical ex- (Apostolakis 2004; Garrick et al. 2010).
pertise can assess the magnitude and likelihood of risks,
but public input is needed to set priorities and objectives Uncertainty
(Renn 1998). Uncertainty is central to the concept of risk. Any deci-
Hermansson (2007) proposes a model that analyses sion involves uncertainty in several aspects, e.g. empir-
ethical factors in risk issues. The model focuses on the ical parameters, decision variables, value parameters,
model domain parameters or outcome criteria. Empirical uncertain relationships ‘design by magic’. A more suitable
quantities represent measurable properties of the real- method for estimating the epistemic uncertainty is
world system being modelled, e.g. temperature or fuel Variation Mode and Effect Analysis (VMEA) which uses
price. Value parameters are quantities such as discount second order moment statistics which is more easily
rate or value of life. Probability is a good way to express accessible. A more crude way to account for epi-
uncertainty, however, Morgan and Henrion (1990) argue stemic uncertainties is through the use of safety factors
that only empirical quantities should be represented by (Johannesson et al. 2013; Svensson and Johannesson 2013;
probability distributions. Uncertainty can also be treated Johansson et al. 2006).
by parametric sensitivity analysis, where the sensitivity In general there are two issues to consider when using
in the output from deterministic changes to the uncer- statistics in order to estimate the likelihood of an event.
tain quantity is examined, or by stating the knowledge Firstly, the amount of statistics should be as large as
base and made assumptions in words. Standard scientific possible, secondly they should be relevant to this par-
practice deals with the technical level uncertainty. Ac- ticular site or system. These two objectives often work
cording to Funtowicz and Ravetz (1990, 1992) the meth- against each other. It is further important to consider
odological and epistemological levels of uncertainty that failure frequencies and accidents are not primarily
should be dealt with qualitatively. The methodological caused by technical but organisational factors (Davidsson
level concerns systematic error and the epistemological et al. 2003). For tunnels, the collected data stretches over a
level concerns ignorance. few decades which mean the data relates to vehicles which
Uncertainty in risk analysis is often classified into ran- have little relationship with modern vehicles in terms of
domness (aleatory), representing variations in samples, heat release rates and other aspects of fire performance
or uncertainty due to inadequacies in the knowledge (Ferkl and Dix 2011).
base (epistemic). When the evidence base is small the
epistemic uncertainty is large. A third type of uncer- Risk analysis reliability
tainty is introduced by the risk assessor. Despite the use The subjectivity and inherent uncertainty of risk assess-
of the same models on well-defined problems a large op- ment can be considerable. Surprisingly few comparative
erational uncertainty remains. Operational uncertainty experiments have been performed to give an idea of the
includes the following factors, relevant for most risk accuracy of risk assessments which is very surprising as
analysis (Lauridsen et al. 2002; Lauridsen et al. 2001a,b): risk assessment is being widely used by scientists and
engineers alike. According to the scientific method, any
implicit or explicit assumptions about the nature of theory that does not yield comparable results when re-
probability and choices among databases and within peated by others on the same problem, should be
the same database, refuted.
system conceptualisation and hazard identification, In the early eighties a systems reliability round-robin
choice and use of models, exercise was performed including several European
bias introduced by the context, teams on the auxiliary feed water system of a nuclear
choice of boundaries, and power plant. The exercise showed that modelling uncer-
experience of the analysts. tainties were considerable and in some cases overwhelm
data uncertainties due to different understanding of key
Möller (2006) argues that any adequate concept of concepts, e.g. common cause failures and human factors,
safety must include not only the measure of risk (includ- and the analyst general judgements, e.g. use of data and
ing aleatory uncertainty), but also the measure of epi- information, interpretation of the system and use of dif-
stemic uncertainty. The epistemic uncertainty will be ferent approaches/philosophies. This introduces a sig-
large for new or unknown risk since there are little or nificant subjectivity in the assessment (Amendola 1986).
no statistical data. Then the risk should be judged to be In a round-robin exercise in 1990 eleven different
high which is also how we intuitively perceive risks, e.g. teams of experts performed risk assessments on an am-
we have an aversion against new or unfamiliar risks monia storage facility given the same information and
(Möller 2009). If probability distributions were known, preconditions. The different methods applied, the differ-
probabilistic models could be used to estimate the epi- ent boundaries and hypothetical assumptions made for
stemic uncertainty. However, probabilistic distributions the accident sequences, and the different ways of calcu-
are seldom known to any accuracy. In particular it is lating risk counters and presenting risk figures, made it
difficult to correctly model the tails of probabilistic very difficult to compare the final results on a common
distributions. Unfortunately, in QRA and engineering basis. Therefore, the authors argue that the comparative
design it is often the tails that matter. Svensson and picture should not be taken as representative of the
Johannesson (2013) call design through the use of such uncertainty in risk analysis in an absolute way. Large
differences, one to several orders of magnitude, were round robin investigation covering 16 standard struc-
found in the results and analysis by the different teams tural engineering calculations the results differed by sev-
(Contini et al. 1991). eral factors due to engineering modelling uncertainty
The spread in results could be traced both to a large (Fröderberg and Thelandersson 2014). Due to several
variability in event frequencies used, as well as conse- stochastic variables and limited knowledge, the model-
quence modelling. A large number of assumptions must ling of fire and human behaviour for tunnels will be
be made to narrow down the infinite amount of scenar- highly uncertain (Beard and Cope 2007). Consequently
ios to a manageable and understandable set that can be any QRA on tunnel fire safety will be even more uncer-
modelled. A multidisciplinary and collective procedure is tain as large uncertainties concerning probabilities
recommended for the hazard identification phase to are multiplied with the consequence outcome of the
yield a more complete picture as this is a critical step in modelling.
the analysis. Comparing the frequencies obtained from Beard (1997, 2005, 2007) has offered recommendations
fault trees and statistics suggests that the technique of for acceptable fire model use. In particular, the model it-
using fault trees to obtain failure frequencies is neither self needs to have the potential to be valuable. Further, a
robust nor accurate. Even though the same model is generally acceptable methodology of use which encour-
used, the result could widely differ because the models ages the user to be explicit needs to be followed, and the
were used differently. The authors conclude that trans- user needs to be knowledgeable. Since the conditions for
parency in terms of all the assumptions that are intro- reliable and acceptable use of complex computer models
duced in all steps of the risk analysis must be explained for tunnel fires do not yet exist, several models may only
together with the result as they are strongly dependent be valuable in a qualitative sense rather than quantitative
(Contini et al. 1991). (Beard 2012).
An interesting statement from one of the teams when
operator reliability was assessed was that “what is actu- Fire safety engineering and performance-based design
ally quantified is the assessor’s knowledge of the situ- Building on the ideas of risk analysis and risk-based de-
ation” (Contini et al. 1991:146). The exercise did not sign, Fire Safety Engineering (FSE) has evolved as a dis-
allow for much interaction with any operators which tinct research field in fire safety. One approach is to
partly explains the comment, however, engineering pursue the following steps. First, fire safety objectives
judgement is unavoidable as information is never are formulated qualitatively. Depending on the building
complete and not all failure modes have been experi- and occupancy involved the fire safety objectives will be
enced by operators. prioritized differently. The next step is to more precisely
Another round-robin exercise on an ammonia storage specify these goals according to the client’s loss objec-
facility was conducted in 1998–2001 by seven different tives. For example, one loss objective could be “no loss
teams. Again the intrinsic uncertainty present in risk as- of life outside room of origin”. For each objective one or
sessment was significant and some of the main sources more measurable functional requirement is formulated,
of uncertainty were identified as follows: the hazard and for each functional requirement, a performance cri-
identification phase, the estimation of scenario likeli- terion is specified. In other terms, the type and degree of
hood, and the calculation of consequences (Lauridsen fire stresses that equate to the stated loss objectives are
et al. 2002). These are three key aspects of the risk specified. Such fire stresses could be a radiant heat flux
assessment process which were also identified in the or a rate of heat release. For example, the client loss ob-
earlier studies. jective of “no loss of life outside the room of origin”, re-
The uncertainties found were significant for decisions quires maintaining tenable conditions in all egress paths
concerning land use. For example, the safe distance from until all occupants outside the room of origin have been
a process industry differed in the worst scenario between evacuated to safety. In quantifiable engineering terms
65 and 10000 m (Lauridsen et al. 2002). Due to the in- tenability may be expressed as CO concentration, dis-
trinsic uncertainty in risk assessment, Fabbri and Contini tance of the smoke layer above floor or visibility. Once
(2009) argue that the resulting learning and increased the functional requirements and performance criteria
understanding from performing QRA are more import- are defined design proposals can be evaluated. The com-
ant than the actual risk estimate. This raise questions mon method for doing this evaluation for buildings as
concerning todays tunnel fire design process since the well as tunnels is through a scenario analysis (determin-
risk analysis would often be carried out by an external istic risk analysis including one or a few scenarios) or a
consultancy and any lessons learned would not necessar- QRA (involving all identified and relevant scenarios). An
ily go into tunnel operational practice. acceptable design should fulfil the agreed loss objectives
The reported uncertainties found in risk analysis may, and performance criteria (ISO 2009c; Meacham and
however, be fundamental to any engineering model. In a Custer 1995; ISO 2012b; PIARC 2007). Gehandler et al.
(2013, 2014b) have developed a performance-based de- same way. Preferably the safety equipment should look
sign guide for road tunnel fire safety. and work the same in all regions within which drivers
In scenario analysis a number of characteristic scenar- operate, e.g. in all of Europe.
ios are selected to test the trial designs. The selection of
scenarios is critical. The potential number of scenarios is Human error and organisational accidents
infinite and a manageable set has to be identified. Each One drawback with technical risk analysis is that
fire safety design objective has its own set of challenging organizational aspects are excluded (Renn 1998, 2008).
scenarios. It is important that the resulting design solu- The starting point of this section is that, in order to im-
tion is conservative (ISO 2006). The consequences for prove safety, human error has to be understood. Three
each scenario are evaluated against a pre-defined criter- types of human strategies in problem-solving can be dis-
ion. The scenario-based risk analysis is also a suitable tinguished: skill-based, rule-based, and knowledge-based
method for the planning of tunnel emergency response (Reason 1997). If possible the fast and skill-based strat-
measures (PIARC 2008). egy will be applied. If no suitable skill-based strategy is
The basis for deciding a performance-based acceptable found, the problem is compared to similar rules and if a
level of risk is that the available safe escape time (ASET) suitable rule which has been used several times before
is larger than the required safe escape time (RSET) by a with success is identified it is applied. If no rule-based
margin of safety. The objective is often that all occu- strategy can be found that works, an analytical and
pants should be able to escape without experiencing or knowledge-based solution is generated. Depending on
developing serious health effects. The margin of safety which problem-solving strategy that is used different
depends on the chosen fire scenarios, the uncertain- error-types can be identified: slips and lapses are con-
ties in the calculations, and the fire safety objectives nected to the skill-based strategy, and mistakes to the
(ISO 2009b). other two strategies (Akselsson 2011). From a cognitive
Bjelland and Njå (2012) find that current practice of perspective, due to the mechanism of the human mind
ASET/RSET analyses in the Norwegian building industry and its response to the environment, errors are unavoid-
are done to confirm that chosen solutions are sufficient able and should be seen as a consequence rather than a
while the analyses themselves have limited constructive cause (Reason 1997).
value for engineering design. Out of 75 examined pro- Since evacuation in tunnels is an unfamiliar activity, a
jects, none contained evaluations of more than one de- skill-based problem-solving strategy will not be adopted.
sign alternative. A rule-based strategy may be adopted through finding
According to Babrauskas et al. (2010), the ASET/RSET the similar event of evacuating a public or private build-
concept is flawed precisely because it is used, as the ex- ing during exercise or real emergencies. However, it is
ample above illustrate, to verify fire safety to an “accept- likely that no past situation and successful strategy is
able level”, rather than to maximise fire safety. Roughly matched with the current situation which means that a
half of all deaths and 2/3 of the injuries could be pre- more time-consuming knowledge-based strategy is initi-
vented if more time was available for escape. To try to ated. The error type concerned with rule-based and
save these people another method or concept seems to skill-based strategies is mistakes, i.e. wrong action such
be necessary. Consequently Babrauskas et al. (2010) ad- as staying in the vehicle is carried out. A driver inside
vise against the idea to define quantitative criteria as a a tunnel needs all possible help to speed-up the
measure of acceptable safety. Instead they propose a knowledge-based strategy so that the correct action to
safety factor approach to be used. evacuate is performed as fast as possible. Since we are
FSE advocate performance based design in favour of aware of these factors surrounding evacuation, it is a de-
prescriptive regulations. Standardisation aims to stand- sign error not to support the road user correctly. As
ardise the design and resist unique solutions. Both ap- Reason says, human error is a consequence, not a cause.
proaches have cost-efficiency and safety as an argument Due to the difficulty in achieving a fast human response
for their rationale. FSE proponents argue that if the solu- in the event of fire, it may be wise to give obligatory in-
tion is tailored to the situation the construction will be formation or even training in driver licence courses.
more effective and cheaper while standardisation argue Reason (1997) further distinguishes error by active
that if solutions are standardised the wheel does not error whose effects are felt immediately and latent error
have to be reinvented (Johnson 2012; Ruijter 2012). whose adverse consequences may lie dormant within the
Ruijter recognise that standardisation is not possible for system for a long time. In general active errors are asso-
all aspects of a tunnel but highlight safety demands and ciated with front-line operators while latent errors are
operational processes as highly appropriate for standard- caused by decision makers and management separated
isation. One practical advantage would be that all tun- in time and space. Detailed analyses of accidents in com-
nels and safety equipment would look and work the plex systems such as nuclear power plants or industrial
sites reveal that latent errors pose the greatest threat to Similarly a review of 1000 shipping accidents concluded
safety. Examples of latent failures relevant to fire safety that accidents resulted from highly complex coinci-
are the corroding sprinklers of Piper Alpha and the in- dences which could rarely be foreseen by the people in-
ability to realise the fire risk in London metro (Reason volved (Reason 1990).
1990; Akselsson 2011). Lately there have been several incidents in Norwegian
Reason (1997, 1990) offers a theoretical framework for road tunnels, e.g. Gudvanga 5 August (UPI 2013) and
accidents in complex systems. According to Reason, pro- Storsand 22 August (Adressa 2013), one reason is that
duction systems (e.g. mass transportation) share several poorly maintained foreign trucks increase the risk of fire.
basic elements in common and can be generalised into In the incident in Gudvanga a fire started in a Polish
the following five components: truck. One political and societal factor responsible for
this is the strive for larger markets and globalization.
1. decision makers (e.g. designers and high-level Transportation markets are enlarged within EU which
managers), means low salary countries enter the market of richer
2. line management (e.g. maintenance, training), countries. The tough competition decreases the re-
3. preconditions (e.g. reliable equipment, safety culture), sources for safety, training and maintenance. This is a
4. productive activities (i.e. integration of human and typical example of the struggle between production and
mechanical elements), and protection in organizations (Reason 1997). It may be
5. defences (i.e. safeguards) time for stricter regulation aiming at proper mainten-
ance, quality management systems, and defensive driving
There is a flow from #1 to #5: decisions from decision culture. Another issue is that foreign drivers may not
makers (#1) are implemented by line managers (#2), this understand the culture, language and road signs in the
in turn affect the preconditions (#3) and later the actual country where they drive.
performance in delivering the right product at right time The human layer can be seen as the last layer of pro-
(#4). The defences (#5) prevent foreseeable injury, dam- tection. Since we know the human element is dynamic
age or outages in the product activities. Feedback loops and will always change, latent failures that are allowed in
return feedback to the line management and decision the other layers of protection will eventually be exposed
makers. Operators carry out their duties such as main- by the human layer and cause an accident. Since we
tenance and production activities managed by the line knew that the human element was variable, it was really
management and affected by the preconditions of the the latent failures which caused the accident. To in-
workplace. crease safety, latent failures must be minimized, identi-
All of the five mentioned components of production fied, and monitored so that barriers can be constructed
can have human contributions to failures. These failures before them (Reason 1997).
can either become latent system failures or they are ac- In the tunnel-vehicle-driver system the front line oper-
tive failures. For the corresponding component number ators are the drivers themselves. Reason highlights,
above, errors can be categorized accordingly: among others, the importance of the front-line opera-
tors. From the review on road safety by Oppenheim and
1. fallible decisions (latent), Shinar (2012) it is obvious that the human factor is a
2. line management deficiencies (latent), key factor causing road accidents. In particular this has
3. psychological precursors of unsafe acts (latent), to do with lapses, i.e. failure to respond to a threat. For
4. unsafe acts (active), and tunnel fires the human factor is also a contributing fac-
5. Inadequate defences (latent & active). tor. Fires may start as a result of crashes, but they can
also start while driving e.g. overheated brakes or engines.
According to Reason (1990) system’s accidents have Technical failures can be due to poor maintenance, poor
their primary origin in fallible decisions made by de- design, or bad luck. Note that there is a human element
signers and high-level management. The key factors that behind the poor maintenance and poor design as well. A
contribute to fallible decisions are safety and production Canadian truck company managed to reduce the num-
goals which in turn are affected by money, equipment, ber of incidents through creating a culture of safety
personnel, and available time. An accident occurs when within the fleet. A Trucking philosophy was established
an unsafe act is committed in the presence of a potential which was to serve as a reminder of the drivers responsi-
hazard for which latent failures from decision makers, bilities. It was displayed around the facilities and on ma-
psychological precursors, and the defence coincide. Rea- terial distributed to the drivers. A safety committee was
son uses the word unpredictable to describe the coinci- established where safety was discussed. Training on de-
dence of latent and active errors that cause an accident, fensive driving was given bi-annually to the drivers. A
which suggest quantification is not very meaningful. rating system was introduced with personal incident
ratings for each driver. The number of incidents was al- Tunnel operators have many tasks. They are monitor-
most halved in four years (Menzies 2007). This shows ing the traffic flow and traffic situation, detect distur-
that a safer culture can be engineered and improve road bances, closing the tunnel if necessary, communicate
and tunnel safety. with users, communicate and assist the emergency ser-
This indicates that we can only reach high road tunnel vice, reporting and evaluation. Since incidents and espe-
safety by reaching out to all citizens, to establish a na- cially larger fires are rare, training and exercises of such
tional and even international culture of road safety. As is situations is very important. Another parameter that af-
noted by Holm (2007), the Swedish society has a poor fects their performance is their cognitive load depending
road safety culture. It is difficult for authorities to take on business and the complexity of their tasks. Cognitive
decisions such as lowered speed or traffic barriers aim- over-load and under-load is believed to worsen perform-
ing at improving safety when the citizens living there ance (Martens and Jenssen 2012).
work against them and mainly prioritize high availability
and accessibility. Several campaigns have been per- Systems safety
formed to alter the public perception into a more safety A central concept for understanding risk is that of a
oriented perspective, not least safety belt, keeping speed system, which Beard (2012) defines as: any entity, con-
limits, and ‘drinking equals no driving’ campaigns. Cul- ceptual or physical, which consists of interdependent
tural beliefs and habits are naturally transferred from parts. In contrast to a purely reductionist approach, risk
older to younger generations, as it becomes part of concerns the system as a whole, as it functions in reality.
how we do things, resulting in safer roads in the long Since systems change and tunnel risk is complex and
run. multi-faceted, any analysis will be incomplete (Beard and
Taking an even larger perspective, a certain company Scott 2012). This is, according to Hollnagel (2010), cap-
may have international organisations and national gov- tured through the terms tractable and intractable sys-
ernments, regulators and associations on higher level, tems. Typically a tractable system is simple to describe
whose decisions affect their activities. Many nested levels with few details, principles of functioning are known,
of decision-making are thus involved in how, for ex- the system does not change while being described and it
ample, a hazardous process is dealt with. Unfortunately is independent of other systems. An intractable system is
this is seldom studied as a whole, instead several re- the opposite. A metaphor for a tractable system is a
search disciplines study different levels so that, for ex- clockwork and a metaphor for an intractable system is
ample, management theories are independent of the teamwork. According to Hollnagel (2010) most socio-
context of a given organization. But the study of technical systems are intractable. Current approaches to
decision-making cannot be separated from the study of safety assume the system to be tractable and further-
the social context and value system in which it takes more make the following assumptions (Hollnagel 2011):
place (Rasmussen and Svedung 2000).
To account for the nested levels of decision-making, Systems are well designed and scrupulously
Rasmussen and Svedung (2000) propose a framework maintained
called proactive risk management. The first step towards The procedures that are provided are complete and
proactive risk management is to ensure operation within correct
the design envelope. The mechanism generating the ac- People behave as they are expected to, and more
tual behaviour of decision-makers at all levels has to be important, as they are trained to
understood. Their values and objectives as well as their System designers have been able to foresee and
need for information and feedback have to be clarified. anticipate every contingency
This involves a top-down communication of values
and objectives and a bottom-up communication of Under those assumptions humans are clearly a liability
actual state of affairs. The method and framework and a threat. Example of frequently used methods to
necessary to maintain a high level of safety is a Total control this liability includes training, standardisation,
Quality Management (TQM) system (Rasmussen and rules and regulation. This approach represents an ideal
Svedung 2000). but is not practically achievable. The two main reasons
No matter how many improvements that are suggested for this are that most systems are intractable and that
from different efforts, improvements are dependent on performance variability is inevitable (Hollnagel 2011). As
the organisation’s ability to learn and to improve in real- an example, Lutz (1993) examined 209 safety-related
ity. To support the process of learning a TQM system software errors concerning two space crafts. He found
and Deming’s cycle, which aims at constant improve- that the main root causes for errors were discrepancies
ment through an iterative cycle: plan, do, study, and act between documented requirement specifications and ac-
(PDSA) can be applied (Akselsson 2011). tual requirements needed for correct functioning of the
system, and misunderstanding of the system interface hazardous system states and translate them into safety
with the rest of the system. constraints. To achieve the safety constraints, a safety
Acknowledging that precise procedures and instruc- control structure over components and paths of control
tions are not attainable, an alternative approach for and feedback loops is defined (socio-technical). By using
intractable systems considers adaptation to meet func- the safety control structure inadequate control actions
tional goals as a necessary process. In this way perform- are identified and used to determine necessary safety
ance variability is seen as an asset rather than a threat. functions (Kazaras et al. 2012).
In fact, according to Hollnagel, performance variability Santos-Reyes and Beard (2012) take a systemic ap-
is on the whole the reason why socio-technical systems proach to tunnel fire safety management. In their frame-
works as well as they do. Assessment methods must be work the systemic approach is compatible with QRA.
able to capture the duality that human performance both The tunnel fire safety management model is also used
can enhance and detract safety. From such a viewpoint by the authors as a template for comparison with an
systems work because (Hollnagel 2011): actual real world system in order to improve the
existing management system (Santos-Reyes and Beard
people can learn to identify and overcome design 2011; Santos-Reyes and Beard 2006; Santos-Reyes and
flaws and functional glitches, Beard 2003).
people can recognise the actual demands and adapt
their performance accordingly, Design
when procedures must be applied people can interpret Following the traditions of natural and technical sci-
and apply them to match the conditions, and ences, safety engineering becomes an activity of structur-
finally people can detect and correct when ing goals and performance criteria into mathematical
something goes wrong or when it is about to go language (Bjelland 2013; Meacham and Custer 1995).
wrong, and hence intervene. This approach assumes well-structured problems and
leads to a narrow view on what is considered as relevant
This is a more realistic description of work as actually knowledge. In contrast, design science can be seen as a
done, rather than imagined, hence systems that are real reflective conversation with the situation that highlight
rather than ideal. Since both failure and success depends the skills and experience that designers and engineers
on performance variability, failure is seen as opportun- bring to situations of uncertainty and value conflicts.
ities for learning (Hollnagel 2011). Important designer skills are creativity, the ability to
Kirytopoulos and Kazaras (2011) argue that QRA of frame the design problems in different ways and to
tunnels suffer from the following limitations. structure different solutions based on previous experi-
ence. Design processes are not linear and the stake-
The probability of a fire starting in a tunnel cannot holders’ goals and values will be conceptualized and
be reliably calculated. refined during the design process (Bjelland 2013).
The complexity of tunnel accidents is too large. According to Hollnagel (2006) there has been a
Large difficulties and assumptions in assessing technological bias in design in the sense that design for
human behaviour. technology came first and design for humans at a distant
The influence of management and organizational second. However, putting the human at the centre of
aspects are often neglected despite that they are things is just as inadequate as machine-centred design
believed to be the key factor for safety in socio- since one part of the system is seen as opposed to the
technical systems. other. Design should therefore embrace a function-
centred view and be problem-driven. For tunnels this
Therefore, they propose a systems theory approach means we should study the joint tunnel-vehicle-human
and a method called STAMP. In STAMP the accident system, and design should further the purposes or goals
model is viewed as interconnected networks rather than of this joint system, i.e. to be in control in a dynamic en-
sequential events as in QRA. Furthermore, much ana- vironment (Hollnagel 2006).
lysis is made on management and organization to make Ruland et al. (2012) takes a function-cantered systems
it function well. It is largely a proactive approach to as- approach to road tunnels. They incorporate Systems
sess whether the organization is effective enough to keep Engineering (SE) and other safety tools into the whole
the system within safety constraints. STAMP will not re- design process. SE highlights both validation (are we
sult in the same output as QRA why they could be used building the right thing according to the road users
in parallel. (Kazaras et al. 2012). need?) and verification (are we building it right, are
The STAMP assessment process for tunnel safety pro- all specifications correctly implemented?). In the
posed by Kazaras et al. (2012) begins by identifying Netherlands the infrastructure authority use SE as a
working method to administrate their contracts. Their Decision theory

design process includes the following steps. Clear and ac- According to Fischhoff and Kadvany “the foundations of
curate specification of what the system is, does, and risk lie in decision theory, which articulates concepts
should handle. The specification process starts from top whose emergence must have begun with the first hu-
requirements and specifies lower level system require- man thought about uncertain choices” (Fischhoff and
ments into finer and finer detail. Each subsystem, and its Kadvany 2011:2). The logic of decision-making is to
effect on the system as a whole, is analysed from four choose the option that promises most of what you want.
perspectives: Reliability, Availability, Maintainability Meacham (2004a) has written a review on decision-
and Safety (RAMS). Scenario-driven tools such as sce- making for fire risk problems. Most decision theories are
nario analysis or table-top exercises validate that the based on Bernoulli’s concept that choice depends on the
system and subsystems offer the required functional- likelihood of various outcomes and on the utility of those
ity. Eventually, the specification is detailed enough to outcomes to the decision-maker, e.g. Expected Utility
start the realisation. Each specification step is then Theory. Social Choice Theory is a concept of rationality
validated and verified as the design is being realised, for synthesizing preferences among individuals affected
from smaller components to larger system parts by the decision, e.g. consensus building that takes into
(Gehandler et al. 2012; Ruland et al. 2012; Ruland and account primarily the facts and values of those participat-
Snel 2010). ing in the development of fire safety regulation. Once a
regulation is in place CBA plays a more central role when
Safety culture fire risk decisions are required for specific projects, see
Pidgeon (1997) views culture as a system of symbols or (Johansson 2001). In this case the decision-maker is less
meanings through which a given group understands the concerned with the “social good” than providing an
world. “Such a culture is itself created and recreated as “acceptable” level of safety at a minimum cost (Meacham
members repeatedly behave and communicate in ways 2004a). For tunnels the situation is quite different. Usu-
which seem to them to be natural, obvious and unques- ally it is the state that develops fire safety regulations and
tionable, and as such will serve to construct a particular plans, builds and owns tunnels. In all cases, safety and
version of risk, danger and safety.” (Pidgeon 1997:7). A the social good have a high priority.
good safety culture can be supported by the following Decision making is fundamental to all fields. A general
factors (Choudhry et al. 2007; Pidgeon 1997): model called PrOACT which is applicable to any deci-
sion is offered by Hammond et al. (1999). The method
A shared care and concern for hazards. consists of eight elements: problem, objectives, alterna-
Realistic and flexible norms and rules about hazards. tives, consequences, trade-offs, uncertainty, risk toler-
Continual reflection upon practice. ance, and linked decision. The essence of the method is
Work with attitudes and behaviour. to divide and conquer. By systematically breaking down
Management commitment (allocation of resources, the problem into smaller parts focus can be directed to
to “walk the talk”, inspections). the most critical aspects. In order to focus on the most
Employee involvement (empowerment, involvement important parts the process should rather be cyclic, i.e.
of employees). iterative, than sequential.
Promotional strategies (mission statements, slogans) The way the problem is stated frames the decision and
Training and seminars. determines what can be regarded as solutions, in fact
Special campaigns (e.g. health week). posing the right problem drives everything else. By
questioning the problem statement the root trigger
According to Reason (1997) a safe culture can be engi- can be identified and constraints that narrow the
neered through organizational characteristics like struc- range of considered alternatives can be removed. Ob-
tures and systems which becomes a collective practice jectives specify the goal of the decision, and give the
that an organization can have. The safety culture is the direction to strive for. Objectives can be identified by
engine that drives the organization towards better safety, specifying all the concerns that the decision must ad-
and its power is derived from ‘never forgetting to be dress. To reach the fundamental objectives, ends are
afraid’. It consists of an informed culture, i.e. right infor- separated from means (potential decision alternatives)
mation is collected and spread. It is dependent upon a through why-questions. What-questions clarify each
reporting culture which relies upon a just culture, i.e. objective and increase the understanding of how to
treating each other in a way that is morally right. Finally reach it (Hammond et al. 1999).
a safety culture must draw the right conclusions and Alternatives are the different courses of action avail-
have the will to implement changes, i.e. it must also be a able to choose from. The decision can be no better than
learning culture. the best alternative. The objectives can identify decision
alternatives by asking “how?” for each objective. Next, fire safety decision-making from this review are given
consequences from each alternative are evaluated for in parenthesis:
each objective. Often objectives conflict with one an-
other, which is why trade-offs are inevitable. If an alter- working on the wrong problem (e.g. rather than
native is dominated by another on practically all discussing safety, it is often a discussion of whether
objectives it can be eliminated. For tougher trade-offs the design is better or worse than a prescriptive
the even swap method can be used to eliminate objec- solution. This may include great emphasis on
tives for which all alternatives are equally good. In this finding an appropriate prescriptive reference
sense both alternatives and objectives can be eliminated building (Bjelland 2013).),
iteratively, resulting in more manageable decisions failure to identify key objectives (e.g. to aim for an
(Hammond et al. 1999). ‘acceptable’ design rather than ‘saving as many lives
The future is always uncertain and different outcomes as possible’ (Babrauskas et al. 2010).),
will be more or less certain. Hammond et al. (1999) failure to develop good and creative decision
propose the usage of risk profiles to capture information alternatives (e.g. to only develop and evaluate one
about uncertainty. A risk profile answers the following design alternative (Bjelland and Njå 2012).),
questions. overlooking crucial consequences (e.g. to ignore the
risk of fire spread and multiple vehicle fires.),
Which are the key uncertainties? giving inadequate thought to trade-offs (e.g. by having
What are the possible outcomes of these uncertainties? rigid regulations that does not allow for trade-offs),
What are the chances of occurrence of each possible disregarding uncertainty (e.g. to disregard
outcome? considerable uncertainty in the Rogfast road tunnel
What are the consequences of each outcome? risk assessment (Bjelland and Aven 2013).),
failure to account for relevant risk tolerance, and
This risk profile share many similarities with a risk failure to plan ahead when decisions are linked over
analysis. The last two questions are included in the triple time.
definition commonly used in risk analysis (Kaplan 1991;
Kaplan and Garrick 1981). If the safety analysis is com- It is argued that these errors can be reduced if the
plemented by an explicit analysis of epistemic uncertain- decision-problem is acknowledged and systematically
ties, all four questions above are covered. Möller (2009, dealt with.
2008) argue that epistemic uncertainty should be in-
cluded in any concept of safety. The practical experience Discussion
of Hammond et al. (1999) is that that all decisions in- The different methods and perspectives of this review
volve uncertainties, but most uncertainties do not influ- highlight different aspects of safety and risk. They all
ence consequences enough to matter. By identifying the have the potential to be valuable for road tunnel fire
few uncertainties that influence the decision, analysis safety. No single method or perspective can claim uni-
can be performed where it matters. The resulting risk versal validity. Only through combining several methods
profile can be expressed in the form of a decision tree and perspectives can an efficient approach to managing
where each fork represents an uncertainty and the road tunnel fire safety be achieved.
branches the outcomes and likelihoods. Tunnel fire safety is largely a low probability-high con-
Depending on the risk tolerance, risk profiles will seem sequence risk issue. Small fires (5–20 MW) are seldom
more or less beneficial. This can be quantified by a desir- any issue for life safety or business continuity. Larger
ability scoring, which in essence has close similarities fires occur rarely, but can mean both loss of lives as well
with expected utility used in economics. The desirability as long tunnel closure and expensive repair costs. The
curve will reveal whether we in this case are risk aver- uncertainty in estimating probabilities and modelling of
sive, risk neutral, or risk seeking. There are several fire and consequences is considerable. Decision stakes
means to re-shape the risk profile into a more desirable are often high in terms of investment costs and the risk
one, e.g. through risk sharing, to seek risk-reducing in- of longer tunnel closure and life safety. The methodo-
formation, to diversify the risk, to hedge the risk, or to logical framework of the fire safety community is too
insure against the risk (Hammond et al. 1999). narrow for these problems to be efficiently addressed
Current FSE and risk analysis practice does not seem (Bjelland 2013). The limits of post-normal science are
to acknowledge the decision problem context and the being reached (Meacham 2004a) and a broader group of
overall aim to find the best decision. Hammond stakeholders should now be included in the decision
et al. (1999) offers a comprehensive list of error process. The realm of relevant knowledge should be ex-
types in decision making in which examples of poor tended to include other sciences, concepts and methods
of ensuring safety. A risk decision is not merely about design are two efficient engineering principles. Acknow-
risk or cost, although these are two important factors, ledging the nature of human error and the importance
each risk decision have challenges, uncertainties and fac- of a well-functioning organisation, latent errors should
tors that society value, this should be reflected in the de- be analysed, reduced and controlled. A good safety cul-
cision process and guide the process and trade-offs. ture within the tunnel organisation should be engi-
In practice this could mean putting more trust in tacit neered. A TQM system can ensure improved safety
and prior experience rather than formalized risk assess- during operation in the long run. Systems thinking can
ment, although, for example, fire modelling should fol- further remove safety constraints and faulty design in
low standard procedures of good practice. The concept the real socio-technical system.
of safety factors for different functional parameters
should be used in qualitative and quantitative ways in- Conclusions
stead of an overall quantitative risk measure. Depending Road tunnel fire safety concerns high uncertainty and
on data and modelling uncertainty, quantitative methods high-stake decisions. This means the decision process
may only be valuable in a qualitative sense. In the words should include a wider group of stakeholders and in-
of Svensson and Johannesson (2013) this is a move to- clude different types of knowledge, e.g. prior experience,
wards enlightened engineering rather than design by safety engineering, decision theory, systems theory, so-
magic. In the creative and cyclic process the design cial science and design science.
group frames and reframes the problem and potential It is argued that the decision process should not be
solutions in negotiations with stakeholders. The design separated from the design and safety evaluation. Instead
process should further be function centred and problem decision theory should be used to structure and drive
driven. Performance-based design offers a good starting the process; to identify the basic objectives, alternative
point with a complete set of basic goals, objectives and solutions and key uncertainties, and prioritize resources
functions of the tunnel system, e.g. (Gehandler et al. for analysis where they matter the most.
2014b), but authorities and engineers need to make the An efficient pro-active safety measure would be to im-
best out of the new freedom offered by performance- prove the safety culture of professional drivers and truck
based design. Several examples in this review show that companies. Regulation ensuring proper maintenance,
better solutions or safer design does not come for free. training and quality management may be necessary in a
Good examples can be found in the Netherlands with global competitive economy.
intrinsic safety efforts in early decision making and
Systems Engineering in the design process, which en-
Endnote
forces verification and validation of needed functions. a
Fast, and Ultra-fast fire developments refers to the
It is argued that decision-making should not be sepa-
t-square model where the growth factor α is defined
rated from design and evaluation as they are strongly
as 0.047 and 0.19 (kW/s2) respectively (Karlsson and
dependent and iterative processes. Decision-making is
Quintiere 1999).
fundamental to most reviewed methods, therefore we
should acknowledge that we are dealing with a decision Competing interests
problem. Then the tools for decision-making, see section The author declares that he has no competing intrests.
(Decision theory), can be used to structure the problem,
to remove constraints and biases, to identify the basic Acknowledgements
This study was funded as part of SP:s centre of excellence on tunnels and
objectives and potential solutions, to evaluate solutions underground facilities (SP Tunnel). The author would like to thank his
and to perform trade-offs. It is likely a few factors will colleges Haukur Ingason, Anders Lönnermark, Margaret McNamee, Francine
show up as the most important ones to evaluate further. Amon and supervisor Håkan Frantzich for valuable comments and support.
The author would also like to express his gratitude to the reviewers of this
Then a set of suitable methods that evaluate these paper, their comments have enhanced this paper’s quality.
aspects can be selected, taking into account their limita-
tions, uncertainty and strengths. In light of new under- Received: 25 June 2014 Accepted: 6 March 2015
standing along the iterative process the problem and
potential solutions are reframed. Guidelines exist that References
have the potential to improve fire safety decision- Adams J (2000) Risk. Routledge, London
making, e.g. Beard (2012) and Meacham (2004a, b). Adressa. Omkom i ulykke i Storsandtunnelen - Et vogntog tok fyr inne i tunnelen
på E39. 2013. adressa.no: http://www.adressa.no/nyheter/sortrondelag/
Most tunnel fire safety measures focus on protection article8144363.ece (In Norwegian). Accessed 15 Jan 2014
despite the fact that pro-active and preventive measures Akselsson R (2011) Människa, teknik, organisation och hantering av risker (In Swedish),
in general are more efficient. However, all aspects of the vol 2011. Institutionen för Designvetenskaper, LTH, Lund, Sweden
Amendola A (1986) Uncertainties in systems reliability modelling: Insight gained
safety circle, see Figure 2, need to be included for safety through European Benchmark exercises. Nucl Eng Des 93(2–3):215–225,
to be managed efficiently. Intrinsic safety and fail-safe http://dx.doi.org/10.1016/0029-5493(86)90221-9
Apostolakis GE (2004) How useful is Quantitative risk assessment? Risk Anal Charters D (2012) Control volume modelling of tunnel fires. In: Beard A,
24(3):515–520 Carvel R (eds) Handbook of Tunnel Fire Safety, 2nd edn. ICE Publishing,
Arends BJ, Jonkman SN, Vrijling JK, van Gelder, PHAJM (2005) Evaluation of London, pp 347–364
tunnel safety: towards an economic safety optimum. Reliab Eng Syst Saf Checkland P (1985) Systems Thinking. Systems Practice, Wiley, Chichester
90(2–3):217–228, http://dx.doi.org/10.1016/j.ress.2005.01.007 Choudhry RM, Fang D, Mohamed S (2007) The nature of safety culture: A survey
Babrauskas V, Fleming JM, Don Russell B (2010) RSET/ASET, a flawed of the state-of-the-art. Saf Sci 45(10):993–1012, http://dx.doi.org/10.1016/j.
concept for fire safety assessment. Fire Mater 34(7):341–355, ssci.2006.09.003
http://dx.doi.org/10.1002/fam.1025 Contini S, Amendola A, Ziomas I (1991) Benchmark Exercise on Major Hazard
Baldwin R, Thomas PH (1974) Passive and active fire protection — The optimum Analysis, vol 1. Description of the Project. Discussion of the Results and
combination. Fire Technol 10(2):140–146, http://dx.doi.org/10.1007/bf02642517 Conclusions, JRC
Bandle T (2007) Tolerability of Risk: The Regulator’s Story. In: Bouder F, Slavin D, CPR (2011) Regulation (EU) No 305/2011 of the European Parliament and of the
Löfstedt RE (eds) The Tolerability of Risk: A New Framework for Risk Council of 9 March 2011 laying down harmonised conditions for the
Management. Earthscan, London, pp 93–104 marketing of construction products. EUR-Lex, Brussels
Beard AN (1983) A logic-tree approach to the St Crispin Hospital fire. Fire Technol DARTS (2004) Durable and Reliable Tunnel Structures – The reports (CD Rom).
19(2):90–102, http://dx.doi.org/10.1007/bf02378564 CUR Gouda, The Netherlands
Beard A (1992) Limitations of computer models. Fire Saf J 18(4):375–391, Davidsson G, Haeffler L, Ljundman B, Frantzich H (2003) Handbok för riskanalys
http://dx.doi.org/10.1016/0379-7112(92)90025-8 (In Swedish). Räddningsverket, Karlstad, Sweden
Beard AN (1997) Fire models and design. Fire Saf J 28(2):117–138, http://dx.doi. EC (2004) Directive 2004/54/EC of the European parliament and of the council
org/10.1016/S0379-7112(96)00082-3 on minimum safety requirements for tunnels in the Trans-European Road
Beard AN (2002) We don’t know what we don’t know. In: 7th International Network. European Comission, Brussels
symposium on fire safety science, Worcester, MA, USA. pp 765–775 EC (2007) Minimum levels of safety in European road tunnels. http://europa.eu/
Beard AN (2004) Risk assessment assumptions. Civ Eng Environ Syst 21:19–31, legislation_summaries/transport/road_transport/l24146_en.htm#. Accessed
http://dx.doi.org/10.1080/10286600310001605489 November 8 2012
Beard AN (2005) Requirements for acceptable model use. Fire Saf J 40(5):477–484, Epstein W (2012) A PRA Practioner Looks at the Fukushima Daiichi Accident.
http://dx.doi.org/10.1016/j.firesaf.2004.10.003 Paper presented at the PSAM11 & ESREL 2012, Helsinki, 25–29 June
Beard AN (2006) A theoretical model of major fire spread in a tunnel. Fire Epstein W, Yamaguchi A, Laaksonen J, Geller B, Cooke R, Pate-Cornell E,
Technol 42:303–328 Kitamura M, Kuzmina I, Tappin D, Bot PL (2012) Fukushima – panel
Beard A (2012) Decision-making and risk assessment. In: Carvel R, Beard A (eds) discussion. PSAM11 & ESREL 2012. Helsinki
Handbook of Tunnel Fire Safety, 2nd edn. ICE Publishing, London, pp 635–648 Fabbri L, Contini S (2009) Benchmarking on the evaluation of major accident-
Beard A, Cope D (2007) Assessment of the Safety of Tunnels - Study. Science and related risk assessment. J Hazard Mater 162(2–3):1465–1476, http://dx.doi.org/
Technology Options Assessment. European Parliament, Brussels 10.1016/j.jhazmat.2008.06.071
Beard A, Scott P (2012) Prevention and protection: overview. In: Carvel R, Fairman R (2007) What Makes Tolerability of Risk Work? Exploring the Limitations
Beard A (eds) Handbook of Tunnel Fire Safety, 2nd edn. ICE Publishing, of its Aplicability to Othe rRisk Fields. In: Bouder F, Slavin D, Löfstedt RE (eds)
London, pp 67–88 The Tolerability of Risk: A New Framework for Risk Management. Earthscan,
Bilson M, Purchase A (2014) Determining benefits of fixed fire fighting systems in London, pp 119–136
road tunnels - A risk-based approach. In: Ingason H, Lönnermark A (eds) Ferkl L, Dix A (2011) Risk Analysis - from the garden of eden to its seven most
Proceedings from the Sixth International Symposium on Tunnel Safety and deadly sins. Paper presented at the 14th International Symposium on
Security (ISTSS 2014), Marseille, France. SP Technical Research Institute of Aerodynamics and Ventilation of Tunnels (ISAVT 14), Dundee, Scotland,
Sweden, pp 475–484 May 11–13
Bjelland H (2013) Engineering Safety with Applications to Fire Safety Design of Fischhoff B, Kadvany J (2011) Risk: A very short introduction. Oxford University
Buildings and Road Tunnels. University of Stavanger, Norway, Stavanger Press, Oxford
Bjelland H, Aven T (2013) Treatment of uncertainty in risk assessments in the Fischhoff B, Lichtenstein S, Slovic P, Derby S, Keeney R (1981) Acceptable Risk.
Rogfast road tunnel project. Saf Sci 55(0):34–44, http://dx.doi.org/10.1016/j. Cambridge University Press, Cambridge
ssci.2012.12.012 Fischhoff B, Watson S, Hope C (1984) Defining risk. Pol Sci 17(2):123–139,
Bjelland H, Njå O (2012) Interpretation of safety margin in ASET/RSET assessments http://dx.doi.org/10.1007/bf00146924
in the Norwegian building industry. Paper presented at the PSAM11 & ESREL Forster C, Kohl B (2012) Ways of improvements in quantitative risk analyses by
2012, Helsinki, application of linear evacuation module and interpolation strategies. In:
Blomqvist P (2005) Emissions from Fires - Consequences for Human Safety and Ingason H, Lönnermark A (eds) Proceedings from the Fifth International
the Environment. Report 1030. Lund University, Lund, Sweden Symposium on Tunnel Safety and Security (ISTSS 2012), New York, USA. SP
Boer LC, van Zanten DW (2007) Behaviour on tunnel fire. Springer Berlin Technical Research Institute of Sweden, pp 627–636
Heidelberg, Berlin, Heidelberg, pp 91–98, http://dx.doi.org/10.1007/978- Fröderberg M, Thelandersson S (2014) Uncertainty caused variability in
3-540-47064-9_8 preliminary structural design of buildings. Struct Saf 52:183–193,
Bouder F, Slavin D, Löfstedt RE (eds) (2007) The Tolerability of Risk: A New Framework http://dx.doi.org/10.1016/j.strusafe.2014.02.001
for Risk Management. Risk Society and Policy series. Earthscan, London Funtowicz S, Ravetz J (1990) Uncertainty and Quality in Science for Policy. Kluwer
BS (2001) Application of fire safety engineering principles to the design of Academic Publishers, Dordrecht, The Netherlands
buildings-Code of practice, vol 7974. British standards Institution, London Funtowicz S, Ravetz J (1992) Three Types of Risk assessment and the Emergence
Canter D, Breaux J, Sime J (1980) Domestic, Multiple Occupancy, and Hospital of Post-Normal Science. In: Ka G (ed) Social Theories of Risk. Praeger,
Fires. In: Canter D (ed) Fire and Human Behaviour. John Whiley & Sons, Ltd, Westport, CT, USA, pp 251–274
pp 117–136 Gandit M, Kouabenan DR, Caroly S (2009) Road-tunnel fires: Risk perception and
Carvel R (2005) Fire protection in concrete tunnels. In: Carvel RO, Beard AN (eds) management strategies among users. Saf Sci 47(1):105–114, http://dx.doi.org/
The Handbook of Tunnel Fire Safety. Thomas Telford Publishing, London, 10.1016/j.ssci.2008.01.001
pp 110–126 Garrick JB (1998) Technological stigmatism, risk perception, and truth. Reliab Eng
Carvel R, Both K (2012) Passive fire protection in concrete tunnels. In: Beard A, Syst Saf 59:41–45, http://dx.doi.org/10.1016/S0951-8320(97)00117-8
Carvel R (eds) The Handbook of Tunnel Fire Safety, 2nd edn. ICE Publishing, Garrick BJ, Stetkar John W, Bembia Paul J (2010) Quantitative Risk Assessment of
London, pp 109–126 the New York State Operated West Valley Radioactive Waste Disposal Area.
Carvel RO, Beard AN, Jowitt PW, Drysdale DD (2001) Variation of heat release rate Risk Anal 30(8):1219–1230, http://dx.doi.org/10.1111/j.1539-6924.2010.01418.x
with forced longitudinal ventilation for vehicle fires in tunnels. Fire Saf J Gehandler J, Wickström U (2014) Estimation of tunnel temperature downstream a
36(6):569–596, http://dx.doi.org/10.1016/S0379-7112(01)00010-8 tunnel fire considering time dependent wall heat losses. In: Ingason H,
CEN (2004) Eurocode 2: Design of concrete structures - Part 1–2: General Lönnermark A (eds) Proceedings from the Sixth International Symposium on
rules - Structural fire design, vol EN 1992–1–2:2004. European committee for Tunnel Safety and Security (ISTSS 2014), Marseille, France. SP Technical
standardization, Brussels Research Institute of Sweden, pp 195–204
Gehandler J, Ingason H, Lönnermark A, Frantzich H (2012) Requirements and Ingason H, Li YZ (2010a) Model Scale Tunnel Fire Tests- Point extraction ventilation.
verification methods of tunnel safety and design. SP Technical Research SP Technical Research Institute of Sweden. Borås, Sweden
Institute of Sweden. Borås, Sweden Ingason H, Li YZ (2010b) Model scale tunnel fire tests with longitudinal ventilation.
Gehandler J, Ingason H, Lönnermark A, Frantzich H, Strömgren M (2013) Fire Saf J 45(6–8):371–384, http://dx.doi.org/10.1016/j.firesaf.2010.07.004
Performance-based requirements and recommendations for fire safety in Ingason H, Li YZ (2014) Technical trade-offs using fixed fire fighting systems. In:
road tunnels (FKR-BV12). SP Technical Research Institute of Sweden. Proceedings from the Seveth International Conference on Tunnel Safety and
Borås, Sweden Ventilation, Graz, Austria. pp 90–97
Gehandler J, Eymann L, Regeffe M (2014a) Limit-based fire hazard model for Ingason H, Lönnermark A (2012) Heat Release Rates in Tunnel Fires: A Summary.
evaluating tunnel life safety. Fire Technol 50(4):1–30, http://dx.doi.org/ In: Beard A, Carvel R (eds) In The Handbook of Tunnel Fire Safety, 2nd edn.
10.1007/s10694-014-0406-5 ICE Publishing, London, pp 309–328
Gehandler J, Ingason H, Lönnermark A, Frantzich H, Strömgren M (2014b) Ingason H, Bergqvist A, Lönnermark A, Frantzich H, Hasselrot K (2005)
Performance-based design of road tunnel fire safety: Proposal of new Räddningsinsatser i vägtunnlar (In Swedish). Räddningsverket,
Swedish framework. Case Stud Fire Saf 1(0):18–28, http://dx.doi.org/ Karlstad, Sweden
10.1016/j.csfs.2014.01.002 Ingason H, Li YZ, Lönnermark A (2015) Tunnel Fire Dynamics. Springer, New York
Gildersleeve C, Sherlock W (2014) Do modern fire and life safety standards and IRCC (2010) Performance-Based Building Regulatory Systems. Inter-Jurisdictional
codes restrict innovation in urban multi entry and exit road tunnel design Regulatory Collaboration Committee, Washington
and cosntruction? In: Ingason H, Lönnermark A (eds) Proceedings from the ISO (2006) 16733:2006 Fire safety engineering - Selection of design fire scenarios
Sixth International Symposium on Tunnel Safety and Security (ISTSS 2014), and design fires. International Organization for Standardization, Geneva
Marseille, France. SP Technical Research Institute of Sweden, pp 299–308 ISO (2009a) Risk management - Vocabulary, vol 73. International Organization for
Grant G, Jagger S (2012) The use of tunnel ventilation for fire safety. In: Beard A, Standardization, Geneva
Carvel R (eds) Handbook of Tunnel Fire Safety, 2nd edn. ICE Publishing, ISO (2009b) 2009(E) Fire-safety engineering: Technical information on methods
London, pp 177–216 for evaluating behaviour and movement of people, vol 6738. International
Guen J-ML (2007) Applying the HSE’s Risk Decision Model: Reducing Risks, Organization for Standardization, Geneva
Protecting People. In: Bouder F, Slavin D, Löfstedt RE (eds) The Tolerability ISO (2009c) 23932:2009 Fire safety engineering - General principles. International
of Risk: A New Framework for Risk Management. Earthscan, London, Organization for Standardization, Geneva
pp 105–118 ISO (2012a) 13571 :2012 (E) Life threatening components of fire – Guidelines for
Hadjisophocleous G, Jia Q (2009) Comparison of FDS Prediction of Smoke the estimation of time to compromised tenability in fires. International
Movement in a 10-Storey Building with Experimental Data. Fire Technol Organization for Standardization, Geneva
45(2):163–177, http://dx.doi.org/10.1007/s10694-008-0075-3 ISO (2012b) 16732–1 Fire safety engineering - Fire risk assessment - Part 1:
Hammond JS, Keeney RL, Raiffa H (1999) Smart choices: a practical guide to General. International Organization for Standardization, Geneva
making better decisions 2002 edn. Broadway Books, New York Johannesson P, Bergman B, Svensson T, Arvidsson M, Lönnqvist Å, Barone S, de
Hansen R, Ingason H (2011) An engineering tool to calculate heat release rates of Maré J (2013) A Robustness Approach to Reliability. Qual Reliab Eng Int
multiple objects in underground structures. Fire Saf J 46(4):194–203, 29:17–32, http://dx.doi.org/10.1002/qre.1294
http://dx.doi.org/10.1016/j.firesaf.2011.02.001 Johansson H (2001) Decision Making in Fire Risk Management. Lunds
Hansen R, Ingason H (2012) Heat release rates of multiple objects at varying Universitet, Lund
distances. Fire Saf J 52(0):1–10, http://dx.doi.org/10.1016/j.firesaf.2012.03.007 Johansson P, Chakhunashvili A, Barone S, Bergman B (2006) Variation Mode and
Hansson SO (2003) Ethical criteria of risk acceptance. Erkenntnis 59(3):291–309, Effect Analysis: a Practical Tool for Quality Improvement. Qual Reliab Eng Int
http://dx.doi.org/10.1023/A:1026005915919 22:865–876, http://dx.doi.org/10.1002/qre.773
Hermansson H (2005) Consistent risk management: Three models outlined. J Risk Johnson P (2012) Fire Safety Engineering: A Tool in Tunnel Design. In: Ingason H,
Res 8(7–8):557–568, http://dx.doi.org/10.1080/13669870500085189 Lönnermark A (eds) Proceedings from the Fifth International Symposium on
Hermansson H (2007) A three-party model tool for ethical risk analysis. Risk Tunnel Safety and Security (ISTSS 2012), New York, USA. SP Technical
Management 9(3):129–144, http://dx.doi.org/10.1057/palgrave.rm.8250028 Research Institute of Sweden, pp 57–68
Hermansson H (2010) Towards a fair procedure for risk management. J Risk Res Kaplan S (1991) The general theory of quantitative risk assessment. In: Haimes YY,
13(4):501–515, http://dx.doi.org/10.1080/13669870903305903 Moser DA, Stakhiv EZ (eds) Risk-Based Decision Making in Water Resources V.
Hollnagel E (2006) A function-centred approach to joint driver-vehicle British Library, Santa Barbara, California, United States, pp 11–39
system design. Cognit Tech Work 8(3):169–173, http://dx.doi.org/ Kaplan S (1997) The Words of Risk Analysis. Risk Anal 17(4):407–417, http://dx.doi.
10.1007/s10111-006-0032-1 org/10.1111/j.1539-6924.1997.tb00881.x
Hollnagel E (2010) Extending the scope of the human factor. In: Hollnagel E (ed) Kaplan S, Garrick JB (1981) On the quantitative definittion of Risk. Risk Anal
Safer Complex Industrial Environments. CRC Press, London 1(1):11–27, http://dx.doi.org/10.1111/j.1539-6924.1981.tb01350.x
Hollnagel E (2011) Prologue: the scope of resilience engineering. In: Hollnagel E, Karlsson B, Quintiere JG (1999) Enclosure fire dynamics. CRC Press, London
Pariès J, Woods DD, Wreathall J (eds) Resilience engineering in practice. Kazaras K, Kirytopoulos K, Rentizelas A (2012) Introducing the STAMP method in
Ashgate, Farnham, England, pp xxix-xxxix road tunnel safety assessment. Saf Sci 50(9):1806–1817, http://dx.doi.org/
Holm L. Var är visionen? Tidningen Proffs: 2007. http://www.tidningenproffs.se/ 10.1016/j.ssci.2012.04.013
kronika/2007/10/26/Var-ar-visionen/ (In Swedish). Accessed 15 Jan 2014 Kim HK, Lönnermark A, Ingason H (2010) Effective fire fighting operations in road
Holman JP (2010) Heat Transfer, 10th edn. Mc Graw Hill, Boston, USA tunnels. Sweden, SP, Borås
Holmgren Å, Thedéen T (2003) Riskanalys. In: Grimvall G, Jacbosson P, Thedéen T (eds) Kirytopoulos K, Kazaras K (2011) The need for a new approach in road tunnels
Risker i tekniska system (Swedish). Studentlitteratur, Lund, pp 253–274 risk analysis. In: Soares CG (ed) ESREL 2011, Troyes French. CRC Press,
HSE (2001) Reducing risks, protecting people: HSE’s decision-making process. pp 2562–2569. http://dx.doi.org/10.1201/b11433-363
Health and Safety Executive, London Kuligowski ED, Peacock RD, Hoskins BL (2010) A Review of Building Evacuation
IEC/ISO (2010) EN 31010:2010 Risk management - Risk assessment techniques. Models, 2nd edition. NIST, Frie Research Division, Technical Note 1680
CENELEC, Brussels Latané B, Darley L (1970) The unresponsive bystander: Why doesn’t he help?
Ingason H (2003) Fire Development in Catastrophic Tunnel Fires (CTF). In: Meredith Corporation, New York
Ingason H (ed) International Symposium on Catastrophic Tunnel Fires Lauridsen K, Christou M, Amendola A, Markert F, Kozine I (2001a) Assessing the
(CTF). SP Swedish National Testing and Research Institute, Borås, uncertainties in the process of risk analysis of chemical establishements: Part II. In:
Sweden, pp 31–47 Zio E, Demichela M, Piccinini N (eds) Towards a Safer World - Proceedings of the
Ingason H (2005) Model Scale Tunnel Fire Tests - Longitudinal ventilation. SP ESREL Conference. Turin, Italy, pp 16–20
Swedish National Testing and Research Institute. Borås, Sweden Lauridsen K, Christou M, Amendola A, Markert F, Kozine I, Fiori M (2001b)
Ingason H (2008) State of the Art of Tunnel Fire Research. Fire Saf Sci 9:33–48, Assessing the uncertainties in the process of risk analysis of chemical
http://dx.doi.org/10.3801/IAFSS.FSS.9-33 establishements: Part I. In: Zio E, Demichela M, Piccinini N (eds)
Ingason H (2012) Fire dynamics in tunnels. In: Beard A, Carvel R (eds) Handbook Towards a Safer World - Proceedings of the ESREL Conference, Turin,
of Tunnel Fire Safety, 2nd edn. ICE Publishing, London, pp 273–308 Italy. pp 599–606
Lauridsen K, Kozine I, Markert F, Amendola A, Christou M, Fiori M (2002) Oppenheim I, Shinar D (2012) A context-sensitive model of driving behaviour
Assessment of Uncertainties in Risk Analysis of Chemical Establishments: and its implications for in-vehicle safety systems. Cogn Tech Work
Final summary report. The ASSURANCE project, Risoe National Laboratory, 14(3):261–281, http://dx.doi.org/10.1007/s10111-011-0178-3
Roskilde, Denmark Otway H (1992) Public Wisdom, Expert Fallability: Toward a Contextual Theory on
Lille GH, Andersen T (1996) Acceptance of risks related to the transport of dangerous Risk. In: Ka G (ed) Social Theories of Risk. Praeger, Westport, CT, USA,
goods through road tunnels. In: OECD-ERS2 working group - Seminar on decision pp 215–228
models for the tranportation of dangerous goods through road tunnels, Paté-Cornell ME (1996) Uncertainties in risk analysis: Six levels of treatment. Reliab
Oslo, Norway. Eng Syst Saf 54(2–3):95–111, http://dx.doi.org/10.1016/S0951-8320(96)00067-1
Lönnermark A (2007) Goods on HGVs during Fires in Tunnels. In: 4th International PIARC (2007) Integrated approach to road tunnel safety (2007R07). World Road
Conference on Traffic and Safety in Road Tunnels, Hamburg, Germany. Association. La Défense cedex, France
Lönnermark A, Ingason H (2007) The Effect of Cross-sectional Area and Air Velocity PIARC (2008) Risk analysis for road tunnels. World Road Association, La Défense
on the Conditions in a Tunnel during a Fire. SP Report 2007:05. SP Technical cedex, France
Research Institute of Sweden, Borås, Sweden Pidgeon N (1997) The Limits to Safety? Culture, Politics, Learning and Man–Made
Lutz RR (1993) Analyzing software requirements errors in safety-critical, Disasters. J Contingencies and Crisis Management 5(1):1, http://dx.doi.org/
embedded systems. In: Proceedings of IEEE International Symposium on 10.1111/1468-5973.00032
Requirements Engineering. SP Technical Research Institute of Sweden, Proulx G, Sime J (1991) To Prevent 'Panic' In An Underground Emergency: Why
Pasadena, CA, USA, pp 126–133 Not Tell People The Truth? Fire Saf Sci 3:843–852, http://dx.doi.org/10.3801/
Malmtorp J, Vedin P (2014) An alternative approach to safety in road tunnels. In: IAFSS.FSS.3-843
Ingason H, Lönnermark A (eds) Proceedings from the Sixth International Purser D (2009) Hazards from toxicity and heat in fires. Hatford Environmental
Symposium on Tunnel Safety and Security (ISTSS 2014), Marseille, France. SP Research, Hatford
Technical Research Institute of Sweden, pp 309–316 Rasmussen J, Svedung I (2000) Proactive risk management in a dynamic society.
Martens MH, Jenssen GD (2012) Human behaviour in tunnels what further steps Räddningsverket (Swedish rescue service agency), Karlstad, Sweden
to take? In: Ingason H, Lönnermark A (eds) Proceedings from the Fifth Rattei G, Lentz A, Kohl B (2014) How frequent are fire in tunnels - Analysis from
International Symposium on Tunnel Safety and Security (ISTSS 2012), New Austrian tunnel incident statistics. In: Proceedings from the Seveth International
York, USA. SP Technical Research Institute of Sweden, pp 69–86 Conference on Tunnel Safety and Ventilation, Graz, Austria. pp 5–11
Mawhinney J (2011) Fixed Fire Protection Systems in Tunnels: Issues and Reason J (1990) Human Error. Cambridge University Press, Cambridge
Directions. Fire Technol 49(2):477–508, http://dx.doi.org/10.1007/s10694- Reason J (1997) Managing the risks of organizational accidents. Ashgate,
011-0220-2 Farnham, England
Meacham BJ (2004a) Decision-Making for Fire Risk Problems: a Review of Rein G, Torero JL, Jahn W, Stern-Gottfried J, Ryder NL, Desanghere S, Lázaro M,
Challenges and Tools. J Fire Protect Eng 14(2):149–168, http://dx.doi. Mowrer F, Coles A, Joyeux D, Alvear D, Capote JA, Jowsey A, Abecassis-Empis
org/10.1177/1042391504040262 C, Reszka P (2009) Round-robin study of a priori modelling predictions of the
Meacham BJ (2004b) Understanding risk: Quantification, perceptions, and Dalmarnock Fire Test One. Fire Saf J 44(4):590–602, http://dx.doi.org/10.1016/
characterization. J Fire Protect Eng 14(3):199–227, http://dx.doi.org/10.1177/ j.firesaf.2008.12.008
1042391504042454 Renn O (1998) Three decades of risk research: accomplishments and new
Meacham BJ, Custer RLP (1995) Performance-Based Fire Safety Engineering: An challenges. J Risk Res 1(1):49–71, http://dx.doi.org/10.1080/136698798377321
Introduction of Basic Concepts. J Fire Protect Eng 7(2):35–53, http://dx.doi. Renn O (2008) Risk gouvernance: coping with uncertainty in a complex world.
org/10.1177/104239159500700201 Earthscan, London
Menzies J (2007) Creating a culture of safety: Private fleets share tips on Rosmuller N, Beroggi GEG (2004) Group decision making in infrastructure
implementing safety programs. Transportation and logistics, Canadian safety planning. Saf Sci 42(4):325–349, http://dx.doi.org/10.1016/S0925-
Möller N (2006) Safety and decision-making. Stockholm, Royal Institute of 7535(03)00046-8
Technology (KTH) Ruijter HA (2012) Safety of Dutch tunnels guaranteed by standard approach. In:
Möller N (2009) Should we follow the experts' advice? Epistemic uncertainty, Ingason H, Lönnermark A (eds) Proceedings from the Fifth International
consequence dominance and the knowledge asymmetry of safety. Int J Risk Symposium on Tunnel Safety and Security (ISTSS 2012), New York, USA. SP
Assess Manag 11(3–4):219–236, http://dx.doi.org/10.1504/IJRAM.2009.023154 Technical Research Institute of Sweden, pp 283–288
Möller N, Hansson SO (2008) Principles of engineering safety: Risk and Ruland T, Snel A (2010) Determination and analysis of tunnel safety requirements
uncertainty reduction. Reliab Eng Syst Saf 93(6):798–805, http://dx.doi.org/ from a functional point of view. In: Ingason H, Lönnermark A (eds)
10.1016/j.ress.2007.03.031 Proceedings from the Fourth International Symposium on Tunnel Safety
Mooney GH (1977) The valuation of human life. Macmillan, London and Security (ISTSS), Frankfurt, Germany. SP Technical Research Institute
Morgan MG, Henrion M (1990) Uncertainty. Cambridge University Press, of Sweden, pp 557–560
New York Ruland T, Daverveld T, Duijnhoven Bv, Gelder Jv, Krouwel R, Teeuw J-M (2012) An
Nævestad T-O, Meyer S (2014) A survey of vehicle fires in Norwegian road integrated functional design approach for safety related tunnel processes. In:
tunnels 2008–2011. Tunnelling and Underground Space Technology Ingason H, Lönnermark A (eds) Proceedings from the Fifth International
41(0):104–112, http://dx.doi.org/10.1016/j.tust.2013.12.001 Symposium on Tunnel Safety and Security (ISTSS 2012), New York, USA.
Nilsen AR, Log T (2009) Results from three models compared to full-scale tunnel SP Technical Research Institute of Sweden, pp 167–176
fires tests. Fire Saf J 44(1):33–49, http://dx.doi.org/10.1016/j.firesaf.2008.03.001 Santos-Reyes J, Beard AN (2003) A systemic approach to safety management on
Nilsson D (2009) Exit choice in fire emergencies - Influencing choice of exit with the british railway system. Civ Eng Environ Syst 20(1):1–21, http://dx.doi.org/
flashing lights. Lund University, Lund 10.1080/10286600302232
Nilsson D, Johansson A (2009) Social influence during the initial phase of a fire Santos-Reyes J, Beard AN (2006) A systemic analysis of the Paddington railway
evacuation - Analysis of evacuation experiments in a cinema theatre. Fire Saf accident. Proceedings of the Institution of Mechanical Engineers, Part F. J Rail
J 44(1):71–79, http://dx.doi.org/10.1016/j.firesaf.2008.03.008 and Rapid Transit 220(2):121–151, http://dx.doi.org/10.1243/09544097JRRT33
Noizet A (2012) Egress behaviour during road tunnel fires. In: Carvel R, Beard A Santos-Reyes J, Beard AN (2011). A preliminary analysis of the 1996 Channel Tunnel
(eds) Handbook of Tunnel Fire Safety, 2nd edn. ICE Publishing, London, fire. In: 3rd International Tunnel Safety Forum for Road and Rail, Nice, France.
pp 421–438 Santos-Reyes J, Beard A (2012) A systemic approach to tunnel fire safety
NRC (1982) Risk and Decision Making: Perspectives and Research. National management. In: Carvel R, Beard A (eds) Handbook of Tunnel Fire Safety, 2nd
Research Council, Washington, DC edn. ICE Publishing, London, pp 485–508
Nývlt O, Prívara S, Ferkl L (2011) Probabilistic risk assessment of highway tunnels. Shields J (2012) Human behaviour during tunnel fires. In: Carvel R, Beard A (eds)
Tunnelling and Underground Space Technology 26(1):71–82, http://dx.doi. Handbook of Tunnel Fire Safety, 2nd edn. ICE Publishing, London,
org/10.1016/j.tust.2010.06.010 pp 399–420
Oggero A, Darbra RM, Muñoz M, Planas E, Casal J (2006) A survey of accidents Sime J (1985) Movement toward the Familiar Person and Place Affiliation in a
occurring during the transport of hazardous substances by road and rail. J Fire Entrapment Setting. Environ Behav 17(6):697–724, http://dx.doi.org/
Hazard Mater 133(1–3):1–7, http://dx.doi.org/10.1016/j.jhazmat.2005.05.053 10.1177/0013916585176003
Sime J, Creed C, Kimura M, Powell J (1992) Human behaviour in fires. Joint

Committee on Fire Research, London, ISBN 0-86252-621-3
Sleich JB, Cajot LG, Pierre M (2002) Competitive steel buildings through natural
fire safety concepts. Directorate-General for Research and Innovation
Luxembourg, European Commission
Slovic P (1987) Perception of Risk. Science 236(4799):280–285, http://dx.doi.org/
10.1126/science.3563507
Slovic P (2000) The Perception of Risk. Routledge, London
Stamatelatos M, Apostolakis G, Dezfuli H, Guarro S, Moieni P, Mosleh A, Paulos T,
Youngblood R (2002a) Probabilistic risk assessment proceedure guide for
NASA managers and Practitioners, 11th edn. NASA Office of Safety and
Mission Assurance, Washington, DC
Stamatelatos M, Vesely W, Dugan J, Fragola J, III JM, Railsback J (2002b) Fault tree
handbook with aerospace aplications, 11th edn. NASA Office of Safety and
Mission Assurance, Washington, DC
Svensson T, Johannesson P (2013) Reliable fatigue design, by rigid rules, by
magic, or by enlightened engineering. In: 5th Fatigue Design Conference,
Fatigue Design, Senlis, France.
Thomas P (1958) The movement of buoyant fluid against a stream and the
venting of underground fires. Fire Research Note 351. Fire Research Station,
Borehamwood
Thomas PH (1968) The Movement of Smoke in Horizontal Passages Against an
Air Flow. Fire Research Note 723. Fire Research Station, Borehamwood
Thomas P (1986) Design guide: Structure fire safety CIB W14 Workshop report.
Fire Saf J 10(2):77–137, http://dx.doi.org/10.1016/0379-7112(86)90041-X
Tong D, Canter D (1985) The decision to evacuate: a study of the motivations
which contribute to evacuation in the event of fire. Fire Saf J 9(3):257–265,
http://dx.doi.org/10.1016/0379-7112(85)90036-0
UPI. Fire in Norwegian tunnel hospitalizes 70. 2013. upi.com: http://www.upi.
com/Top_News/World-News/2013/08/05/Fire-in-Norwegian-tunnel-
hospitalizes-70/88231375728950/. Accessed 15 Jan 2014
Vaitkevicius A, Colella F, Carvel R (2014) Rediscovering the Throttling Effect. In:
Ingason H, Lönnermark A (eds) Proceedings from the Sixth International
Symposium on Tunnel Safety and Security (ISTSS 2014), Marseille, France. SP
Technical Research Institute of Sweden, pp 373–378
Vareman N, Persson J (2010) Why separate risk assessors and risk managers?
Further external values affecting the risk assessor qua risk assessor. J Risk Res
13(5):687–700, http://dx.doi.org/10.1080/13669871003660759
Vrijling JK, van Hengel W, Houben RJ (1995) A framework for risk evaluation. J
Hazard Mater 43(3):245–261, http://dx.doi.org/10.1016/0304-3894(95)91197-V
Vrijling JK, van Hengel W, Houben RJ (1998) Acceptable risk as a basis for
design. Reliab Eng Syst Saf 59(1):141–150, http://dx.doi.org/10.1016/
S0951-8320(97)00135-X
Weerheijm J (2014) Berg Bvd Explosion risks and consequences for tunnels. In:
Ingason H, Lönnermark A (eds) Proceedings from the Sixth International
Symposium on Tunnel Safety and Security (ISTSS 2014), Marseille, France. SP
Technical Research Institute of Sweden, pp 46–61
Wynne B (1992) Risk and Social Learning: Reification to engagement. In: Ka G (ed)
Social Theories of Risk. Praeger, Westport, CT, USA, pp 275–297
Submit your manuscript to a

journal and beneﬁt from:
7 Convenient online submission
7 Rigorous peer review
7 Immediate publication on acceptance
7 Open access: articles freely available online
7 High visibility within the ﬁeld
7 Retaining the copyright to your article
Submit your next manuscript at 7 springeropen.com

s40038 015 0006 6 PDF

Uploaded by

Copyright:

Available Formats

s40038 015 0006 6 PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

s40038 015 0006 6 PDF

Uploaded by

Copyright:

Available Formats

Gehandler Fire Science Reviews (2015) 4:2

REVIEW Open Access

Road tunnel fire safety and risk: a review

Introduction methods and perspectives concerning road tunnel fire

Figure 2 The safety circle (PIARC 2007).

Figure 3 Fault tree and event tree.

Figure 4 The IEC/ISO (2010) Risk management process.

the event of an accident. In Table 1 policy factors (β) for authors.

working method to administrate their contracts. Their Decision theory

Sime J, Creed C, Kimura M, Powell J (1992) Human behaviour in fires. Joint

Submit your manuscript to a

Submit your next manuscript at 7 springeropen.com

You might also like