- 101 - TUNNEL TECHNICAL INSTALLATION TESTING ASSURES DEMONSTRABLE TUNNEL SAFETY Boersen P.AM., Sogeti Nederland B.V., Netherlands ABSTRACT A tunnel technical installation of a road tunnel is mainly a safety system to provide safety to travellers. Due to increasing demands and increasing dependency of software, both the chances and the consequences of malfunctioning technical installations are increasing. Typically, safety regulations contain a group of demands which have become more stringent and have given rise to the need for tighter quality assurance. Based upon experiences and best practices, an approach for structured and risk based testing is discussed in this paper. Keywords: testing, tunnel safety, software, tunnel technical installation. 1. INTRODUCTION Since 2006, new laws and guidelines regarding tunnel safety regulations in the Netherlands apply to all closed road tunnels over 250 metres long. Tunnels will have to comply to these new tunnel safety regulations the latest at may 1 st in 2014. Existing tunnels and new tunnels under construction are already impacted by these new regulations, because proof of tunnel safety is obligatory. Furthermore, the number of road tunnels will rise in the Netherlands since the country is very densely populated and environmental regulations will cause parts of highways to get covered by land tunnels. This is done to reduce air pollution in populated areas. Apart from this, major infrastructural changes to road networks often include new tunnels. In fact, the number of tunnels, combined with their positions in the highway network, will lead to the situation that tunnels may become potential bottlenecks. Technical failures of a tunnel technical installation may cause tunnel shutdowns. In all, the need for reliable tunnel technical installations which comply to tunnel safety regulations is increasing. Since the need to prove tunnel safety is demanded by law, the need for professional testing of tunnel technical installations is rising as well. This paper elaborates a high level approach for structured and risk based testing of tunnel technical installations, called the W-model, which stems from best practices in the Netherlands. 2. TUNNEL SAFETY AND CONTEXT This paragraph describes tunnel safety and its context as well as the dependency of tunnels and tunnel technical installations for information technology (IT). 2.1. Tunnel Safety In the Netherlands, guideline 2004/54 of the EC, dated april 29th 2004, is worked out in a number of laws such as Wet Aanvullende Regels Veiligheid Wegtunnels (WARVW) and Besluit Aanvullende Regels Veiligheid Wegtunnels (BARVW), both of February 2006. These laws are the main laws regarding tunnel safety in road tunnels and contain numerous process related and product related requirements to be met, the latest in May 2014. In
- 102 - addition, there are guidelines by Rijkswaterstaat (RWS), the Dutch organization within the Ministry of Traffic and Waterways responsible for construction and maintenance of roads and waterways. The main guideline for tunnel safety is Leidraad Veiligheidsdossier Wegtunnels, dated October 1 st 2007. This guideline deals among others with the obligatory set up and maintenance of the tunnel safety dossier. Tunnel safety regulations, as described in the fore mentioned laws and guidelines, concerns the safety of tunnel users. The three main demands for their safety are: Facilitate self rescue possibilities of tunnel users, Facilitate professional assistance squads to do their jobs, also in the event of (major) accidents, Prevent escalation of incidents and accidents. These requirements refer to the tunnel as an integral safety system and to the training of traffic controllers who operate the tunnel. Furthermore, the laws and guidelines demand proof of test results, a tunnel safety archive and a tunnel safety plan to operate a tunnel. At Rijkswaterstaat the tunnel safety philosophy emphasizes the integral approach of tunnel safety in the following way (Mante, R., 2009): The tunnel system as a whole is to be considered. Not only the road, the tunnel construction, the installations, but also the organization during exploitation of the tunnel (traffic management, handling of accidents etcetera) The whole safety chain is to be considered, which involves pro-active measurements, prevention, preparation, risk mitigation, repression and after care. For the purpose of this paper, we will use the following definition of tunnel safety. Tunnel safety concerns the safety of the tunnel users and: addresses the three main safety requirements of the ability to save yourself, facilitating professional assisting squads and prevention of escalation, involves technical and organizational aspects as well as the construction and the exploitation phases, considers the tunnel to be an integral system and considers the tunnel technical installation to be primarily a safety system consisting of all hard- and software to operate a tunnel. 2.2. Availability and reliability Requirements for availability of tunnels are high and in some cases reach over 99 percent availability, excluded for maintenance intervals. Tunnel safety and availability therefore are diametrically opposing factors. For example, in the case of technical failures of a tunnel technical installation, the traffic manager operating the tunnel, could be forced to shut down the tunnel. However, from an availability perspective, it s preferable to keep the tunnel open for traffic. Since the introduction of the tunnel laws in 2006, technical failures in tunnel technical installations have caused major traffic congestions in main area s like Rotterdam and Amsterdam. Both cities have an encircling ring of highways and these rings contain major tunnels as well. A major traffic congestion in these cases mean that severe highway traffic jams during an entire traffic peak of three hours holds the traffic flow around the city and causes delays of one hour or more for motorists.
- 103 - Because tunnel safety and availability are opposing factors, the reliability of tunnel technical installations gets ever more important. If the reliability is very high, the tunnel is able to meet both the demands of tunnel safety and availability. 2.3. Importance of information technology A typical tunnel consists of fifty installations or more. These installations are connected by interfaces and supported by software. Moreover, the functionality of these installations as a group, is enabled by IT. This implies that the dynamic conduct of a tunnel is determined by the tunnel technical installation which relies on software for its conduct. Therefore, the importance of IT is substantial and the consequences of malfunctioning software are ample. To put things in perspective, IT is only a fraction of the costs to realize a tunnel. New tunnel projects may cost around 500 million euro, the tunnel technical installation costs less than ten percent of this amount and the software less than one percent. However, the risks involved with IT may cause millions of damage to both society and operators of tunnels. Keeping in mind that contracts for exploitation may stretch thirty years, the expected damage because of malfunctioning software extends the investment costs for the IT-project or the software. 2.4. Demand and supply side responsibilities The government in the Netherlands supports the view that the public sector leaves as much as possible to the private sector concerning infrastructure projects. At the end of last century the department Rijkswaterstaat was still the organization that designed and specified the tunnels in detail and the private sector constructed the tunnels as specified. This situation no longer exists. Currently, the department Rijkswaterstaat, or some other state representing institution like provinces or cities, prescribes with high level requirements the objectives for the tunnel, its surroundings, its capabilities and the private sector designs and constructs the tunnels, either with design and construct contracts or with design, build, maintain and finance contracts. The situation today could best be described as a situation where both sides, the public sector and the private sector, is still in the process of mastering the new balance in demand and supply side responsibilities. The public sector needs to direct and control the tunnel projects and has yet to achieve maturity at these aspects. The private sector for their part is still mastering the design phases, before constructing the tunnel. Enhanced tunnel safety demands have been a complicating factor in this process and to date remain a major factor. 3. TRENDS AND CHALLENGES Tunnel demands will increase in the future. Amongst others, safety demands and availability demands will increase because of technological progress in general terms. Environmental demands will increase as well and therefore, tunnels will maintain evermore functionality in a increasingly demanding environment and society. It is to be expected that IT-complexity within tunnels will increase as well,. The need to keep in control with regard to IT-related activities, will gain importance over the years to come. Testing, and quality assurance in general, will therefore gain significance in tunnel projects and tunnel exploitation as a prime success factor for risk mitigation. Moreover, the change in demand and supply side responsibilities enhances the need for control of requirements management, designing, constructing and exploitation at both sides, public and private parties involved in tunnel projects, and in their cooperation to realize tunnel projects. This also implies.the need for testing and quality control in a broad sense as a key success factor.
- 104-4. EXPERIENCES In the last four years experiences at seven tunnel projects in the Netherlands, including three investigations, several points of attention for testing can be drawn up. Test maturity levels are low compared with the risks involved with tunnel technical installations and the needed test attention. Adequate test environments are essential to test tunnel technical installations during the construction and the exploitation phase. During the project phase of tunnel realization, relatively little attention is given to maintenance and exploitation with respect to testing. The capability to assess the status of the entire tunnel technical installation during the exploitation phase is lacking in many cases. System architecture; the interfaces between systems, subsystems and installations are not always clear in the design documents. Therefore the test base for integral testing of functions and scenarios aimed at the dynamic behavior of the tunnel is insufficient. The main processes should be worked out at the beginning of each tunnel project. This is important for a successful cooperation between the sponsor and the contractors and is the base for the contractor to elaborate the required design documents. During the construction phase, the emphasis is at technical tests of separate installations, rather than integral tests at the functional level or the level of scenarios or main processes. With the emphasis at technical tests, the prove of complying to tunnel safety requirements is lacking. Moment of involvement for IT with regard to architecture, design, realization and testing. This moment is lagging behind other disciplines like civil engineering. Ideally, the systems engineering involves the enabling functions of IT right from the beginning of tunnel projects. At the one of investigated tunnel projects, methods of testing are not standardized in practice although required by the used standards for systems engineering. Therefore it was unclear what executed tests have demonstrated. More specific: o test objects during testing remain less defined, o test scripts don t determine precisely which tests have been executed, o descriptions of test data and test data is lacking, o traceability of tested requirements is lacking in most situations. Tests aren t always repeatable in an easy manner. In the tunnel projects where certified test specialists were involved, the traceability aspects and the structured approach of testing was evident. The main conclusion is that the significance and the need for structured risk based testing is underestimated at the demand side as well as the supply side. Nevertheless, the need for structured risk based testing during the entire life cycle of an tunnel technical installation is evident and awareness is growing.
- 105-5. PROPOSED SOLUTION, W-MODEL From an IT perspective, several solutions are possible to solve issues with the IT-delivery processes involving the construction of a tunnel technical installation. One solution is using systems engineering with standards like J-STD-016 or MIL-STD-1521. However, prescribing systems engineering with acknowledged standards is already common practice in tunnel engineering and yet, timely delivery of an adequate tunnel technical installation remains problematic in the Netherlands. Therefore testing adds value to the processes constructing a tunnel technical installation by measuring progress and demonstrating the status. In our view, testing throughout the construction and the exploitation phases of a tunnel is a key success factor. Therefore, a model to test tunnel technical installations, based upon our experiences in tunnel projects and test experience in the Netherlands, is presented. 5.1. Requirements of the model The following is taken into account for the presented model. It should be easy to understand because common practices within the IT-industry may be unfamiliar to engineers involved in construction of tunnels. It should be relatively easy to apply the model in practice. In general, it should be a framework for all tunnel projects. It should ensure demonstrable tunnel safety or other requirements. It should be cost effective throughout the entire lifecycle of a tunnel. The division in demand and supply responsibilities of sponsor and contractor should be incorporated in the model. The presented model is called the W-model and is elaborated in the next paragraphs. 5.2. W-model overview The W-model is graphically shown in the next model overview. Figure 1: Graphical overview of the W-model.
- 106 - First of all, the W-model is derived from the V-model (Koomen, T., 2006). This V-model exemplifies the following among others: The construction of (information) systems comprises a process of decomposition of high level requirements to detailed designs and a process of integration to construct bottom up the required system based upon the designs. The referred V-model is a way to control a software delivery process. The decomposition and integration steps enable control in terms of progress and quality. Each block within the V-model contains an identified piece of work. The W-model is based upon these principles since the model consists of two interlinked V- models. One for the design and the realisation of the tunnel technical installation and one for the corresponding test activities. The horizontal line divides the responsibilities for these two tracks between the sponsor and the contractor. The blocks above the horizontal line are the responsibility of the sponsor, below the horizontal line are the responsibility of the contractor. However, cooperation is necessary since both parties are taking part in the same tracks. Furthermore, the model overview clearly shows that testing parallels designing and realisation. It is emphasized that testing starts the moment requirements analysis starts and that testing goes on until the tunnel technical installation is at the end of its lifecycle. In the model overview the exploitation phase is omitted. However, the result should be that testing capabilities to validate tunnel requirements are preserved. 5.3. Objectives and testing conform the W-model The W-model aims to deliver a test approach and a test method to ensure timely and demonstrable delivery of the needed quality of a tunnel technical installation. Testing relies on a test strategy and the two main components of a test strategy are: the phasing of testing and the test coverage of the risks which need to be addressed. From a different perspective, these two main components represent on a high level structured risk based testing as meant by the test method TMap. To explain more detailed the test phases, the test levels in the model are briefly described: Testing as shown in the left hand side of the test track with the test levels testing requirements TTI, testing design TTI, testing sub systems TTI and testing design components. One objective is to trace the development of business requirements in user requirements and in system requirements and the development of these requirements in the corresponding design documents. The result of tracing is amongst others the degree to which can be demonstrated that the tunnel technical installation is safe for the tunnel user. Moreover these tests focus on completeness, accuracy and, consistency of the requirements and the design documents. The components test is basically the technical test for all separate installations. The test for a single component is done solitarily. The test has to prove whether the component under meets the requirements and whether the component may be part of the tunnel technical installation together with other components. The factory acceptance test (FAT) is a test for sub systems like energy supply, air supply, directing and handling. The tests are executed at a test environment at the site of the contractor. This environment has to be maintained throughout the design and realisation phase and during the exploitation phase of the tunnel. In all, the sub
- 107 - systems of the tunnel technical installations are tested separately as well in interaction with each other. This means that the tunnel technical installation is tested as an integral system as well. The FAT may be split in two separate test levels to divide the tests for the sub systems and the integral system. The site acceptance test (SAT) is a representative sub set of the FAT, complemented with at least a small portion of newly designed tests based upon the experiences and the remaining risks of the FAT. The test environment is a production like environment at the tunnel site with interfaces to its surroundings. There is a redundancy between the FAT and the SAT and the test strategy for the entire test project should determine the level of redundancy. The site integration test (SIT) is to prove at the process level whether the tunnel technical installation meets the process requirements and whether the organisation can operate the tunnel. This is done because tunnel safety laws demands it as well. The three top demands for tunnel safety are explicitly tested in the SIT. The test environment is production like and no interfaces are simulated Furthermore, the SIT may be split into a test level aimed at the processes and a test level aimed at the interaction between travel managers, firemen, policemen and other rescue workers. This proposal for phasing the test project secures a controlled way of verification and validation of the tunnel technical installation The risk based component of testing is encapsulated within the W-model as well. A typical test project initially delivers a test master plan containing a division of risks over test levels. Since the test track parallels the design and realisation track, the status of tunnel technical installations is constantly available. This information provides the basis for risk assessment and risk management. In the figure underneath this is illustrated graphically. Figure 2: Iterations with risk based testing
- 108 - Deviations are detected by testing and need to be addressed at the requirements management level. If a requirement is altered, corresponding design documents and (sub)systems are altered subsequently. In other cases requirements remain the same but the corresponding design documents and or (sub)systems need to be changed. The iterations involved with risk based testing are a main tool for controlling and directing and the entire project of constructing the tunnel technical installation. A single iteration typically consists of: Testing and in this manner finding defects and assess progress. Analyze single defects or grouped defects and assess risks involved with it. Determine the needed adjustments. This concerns requirements and the system or the system alone. Deliver the adjusted requirements and system or the adjusted system. Start retesting. The whole process starts with the initial requirements analysis at the level of business requirements, followed by user requirements and systems requirements. Summarizing, the W-model contributes to timely delivery of tunnel technical installations and at the required quality level and assures demonstrable tunnel safety. It is a structured and risk based approach based upon the global test method TMap. It takes into account that in the Netherlands public institutions remain at the demand side of tunnel construction and the private sector for the main part design, constructs and sometimes finance and maintain the tunnels. Moreover, the model also takes into account that IT-complexity will rise and that an approach to direct and control the IT-delivery processes is needed. 6. PRACTICES SO FAR The model is currently in use at a tunnel project in the Netherlands, called Kanaalkruising Sluislkil, which will become approximately 1.000 metres long and will be built in the province of Zeeland. The process to select a contractor is currently underway and the candidate contractors are obliged to organize test processes in line with the testing principles as described in this paper. Furthermore, a presentation at a national road congress in the Netherlands was given on the same subject (Boersen, P., 2009). 7. RELATED DEFINITIONS Testing is a quality measure and is one of the measures available for quality assurance. In this sense, what does quality mean? Quality is the totality of features and characteristics of a product or service that bear on its ability to satisfy stated or implied needs (Koomen, T., 2006) What is testing? Testing is a process that provides insight into, and advice on, quality and the related risks. (Koomen, T., 2006) Other related terms are the terms verification and validation. Verification is about testing whether a test object meets the requirements properly. Validation concerns testing whether the testobject suits the operational organisation. 8. REFERENCES Boersen, P., (september 2009), presentation Hoe voldoe je aan de tunnelveiligheidswet? Koomen, T., Aalst van der L., Broekman, B., Vroon, M., (2006); TMapNext, p. 36, 48, ISBN 90-72914-79-9 Mante, R., (4 november 2009), Integrale veiligheidsfilosofie Steunpunt Tunnelveiligheid