Deciding when a tunnel is degraded

Tunnels are built with layers: ventilation, detection, communication, lighting, drainage, escape routes. On any given day some layer is partly unavailable. A jet fan is out. A pump is down. A camera is dark. A radio repeater is being replaced.

The design assumed all of it worked. The regulation sets a level below which the tunnel must close. Between those two points is where operational life actually happens, and it is the part a design-time risk report says least about.

Tunnel Control models the tunnel as it is right now, not as it was designed. When a barrier is unavailable, the scenarios that barrier was there to handle are the ones that move — and it shows which, and by how much.

Which barrier, and for which scenario

A ventilation deficiency does not raise all risk uniformly. It bears on smoke control in a fire, and hardly at all on a rear-end collision. The model keeps that specific rather than averaging it away.

For how long

A fan out for two days and a fan out for two months are not the same decision. The degraded state is modelled over its expected duration, not as a single moment.

Is the deficiency actually driving it

A deficiency can be present without being the reason risk is elevated. The model separates the deficiency's own contribution — what changes with it and without it — from everything else that happens to be true at the same time.

This is the part that is routinely left out. A closed tunnel does not reduce the number of journeys; it reroutes them. Those journeys end up on a road that is often longer, frequently undivided, sometimes unlit, and shared with pedestrians, cyclists and motorcyclists who were never in the tunnel at all.

Per kilometre, an ordinary rural road can be a considerably more dangerous environment than a tunnel — and a detour adds kilometres. A closure can therefore lower the risk inside the tunnel and raise the total risk of the journey. Both can be true at once, and only one of them shows up if you look at the tunnel alone.

So the detour is modelled as a road, with its own exposure and its own accident risk — not assumed to be safe because it is in the open air.

How much traffic actually transfers

Not all of it. Some journeys are cancelled, some were local, some were going to take that road anyway. The transferred share is what creates the added exposure, and it is modelled as a share rather than assumed to be everything.

One-tube two-way operation

For a twin-tube tunnel, running both directions through one tube is often the real alternative to closing. It carries its own risk — head-on exposure — and it is only available if the tunnel is registered as capable of it. Both parts are checked, not assumed.

Dangerous goods, separately

A detour that is acceptable for cars is not automatically acceptable for a tanker. Dangerous goods transport is treated as its own question, because the consequence side is different and the route options usually are too.

No double counting

Closure risk and tunnel risk share terms. Adding them naively counts the same exposure twice and produces a number that looks rigorous and is inflated. The model guards against that explicitly.

The regulation states what must happen at a given equipment level. It is binding, and the model does not argue with it. What the rule requires is presented as what the rule requires — not as a recommendation, and not blended into a risk figure.

The risk model answers a different question: what would each option cost in expected harm? That answer is shown separately, with its inputs and its uncertainty visible, and it is never dressed up as the rule.

Most of the time the two agree, and then the decision is easy. The value is in the cases where they do not.

A disagreement between the rule and the risk picture is not a problem with the model. It is the decision — and it is the thing an operator has to be able to justify afterwards, to a supervisory authority, an insurer, or an inquiry.

Operational decisions are made quickly and questioned slowly. The question comes months later, in a different room, from someone who was not there — and by then the reasoning has usually gone home with whoever was on duty.

Because the decision is taken inside the model, what informed it is kept with it: which data was available, what the alternative was estimated to cost, what the rule required, and what was decided.

That record is worth more than speed. A defensible decision is one you can explain a year later — including a decision to close, which is often the right one and is stronger for having the alternative written down beside it.

This part of the model is data-hungry, and it says so rather than filling gaps quietly. It needs the detour route to be registered, the transferred traffic share to be estimable, and the tunnel's own capability for one-tube operation to be recorded.

Where those are missing, the comparison is not shown as a confident number with an invisible assumption underneath. It is shown as what it is: a comparison that cannot yet be made, and the specific registration that would make it possible.

That is the same discipline as everywhere else in the model. A missing input is a finding, not something to paper over.