It is inappropriate, if not meaningless, to attempt to apply limit state design methods, such as those encapsulated in Eurocode 7, to the design of primary support for tunnels in rock, particularly weak rock or any rock under high stress. By reference to some 41 case histories of major tunnel failures, this article shows that more than 85 per cent were the result of unexpected geology or hydrogeology. It is submitted that the unknowns and uncertainties in geology and hydrology cannot be properly dealt with by applying codified factors to eotechnical parameters. It is concluded that working stress methods should be retained for tunnel support design, and that such design would benefit, far more, from competent geological and hydrogeological understanding, than from faith in code factors.

**Introduction**

Limit state design came from structural engineering where structure, loads, deformations and collapse modes are reasonably easy to know, or postulate, and can be appropriately factored. The factors in structural engineering are linked, closely to failure probability because material properties, and loadings can be defined statistically.

There have been great difficulties in defining limit stage design for geotechnical works, and in particular for works where there is substantial interaction between man-made structure and the ground (ref 1 and 2). Since the mid-1980s, Limit State Codes have been developed in many countries for two kinds of geotechnical works, namely piles (AS 2159) and retaining structures (AS 4678 and BS 8002). These codes are quite complex, even for these simple types of works where each unit in the ground usually has only a few variables, namely:

• Undrained conditions: unit weight, undrained shear strength and stiffness.

• Effective stress conditions: unit weight, effective stress cohesion and friction, drained stiffness.

The publication of Eurocode 7 for Geotechnical Design (and BS EM 1997-1) has changed the landscape dramatically. Now there is bureaucratic pressure on the geotechnical profession to do all design using limit state methodology.

However, design of primary support for tunnels in weak rock, or any rock under high stress, is substantially more complex than designing piles or retaining walls. In this application, limit state design is inappropriate, and counterproductive.

This is not to say that limit state methodology is inappropriate in all tunnel support design. It probably could be used for segment design in soft ground tunnels, but whether it would add any value to present design procedures is questionable.

**Learning from others**

In 1981, when he viewed what became Eurocode 7, approaching over the horizon, M D Bolton, then a lecturer at Cambridge, produced an erudite article, in which he wrote:

“We are therefore entering a critical period in which a concerted input of effort will be required in order to avoid pivotal philosophical mistakes which could so constrain designers as to affect the degree of security of soil constructions in Europe for many years.”

He made, and justified, some very wise suggestions for the way forward, all of which seem to have been ignored. He also noted that, “Deterministic calculations based on observable mechanisms offer a more reliable route to decision-making in geotechnical design than do the processes of statistic inference,” and, “The omission of a limit state mode will not be rectified by application of larger factors against those limit-modes that have been recognised.”

Along similar lines Day, Wong and Poulos note:

“For a probability calculation to work there is an assumption that the actions and resistances are independent variables, i.e. that changes to the loading do not influence the resistance and visa versa… in the design of soil retaining structures this is not true because the same soil acts as a load and a resistance.”

A lecture by Dr Colin Smith of the University of Sheffield seeks to explain how limit state design, according to Eurocode 7, can be implemented for the two simple problems of bearing capacity of a pad footing, and a cantilever retaining wall. The process is not simple, or intuitive.

Smith points out two important points that are relevant to this article, namely:

1. For Ultimate Limit State (ULS) analyses, Eurocode 7 requires five separate checks:

EQU: loss of equilibrium

STR: failure of the structure

GEO: failure of the ground

UPL: failure by uplift

HYD: hydraulic heave, and

2. The Eurocode 7 factors address Ultimate Limit State only, and the code states (2.4.8(4)): “it may be verified that a sufficiently low fraction of the ground strength is mobilised to keep deformations within the required serviceability limits, provided this simplified approach is restricted to design situations where:

• A value of the deformation is not required to check the Serviceability Limit State (SLS).

• Established comparable experience exists with similar ground, structures and application method.”

Smith suggests that only STR and GEO are required for ULS for design of footings and retaining walls, SLS is left for a separate, undefined, calculation.

However, tunnel support design must require consideration of EQU, STR, GEO, UPL and HYD, and is anyway usually dictated by allowable movements, namely SLS! Welcome to the world of acronyms and valid logic, but in this author’s opinion, impossible application.

The substantial difficulties associated with limit state design in geotechnical engineering are described clearly by Day who concludes:

“The following important points must be understood when using ‘limit state’ code methods.

• The partial factor method was adopted by structural design codes as a convenient way to carry out routine design based on probabilistic considerations. It produces a more consistent probability of failure than the working stress method.

• The ultimate load is a mathematical concept. It has no physical meaning.

• In geotechnical codes the partial factors are not based on reliability analysis as they are in structural codes.

• For geotechnical design, the partial factor limit state design codes are simply the old traditional design methods, but with the factor of safety applied in a different way.”

In passing, Day notes the following dilemma when applying ultimate limit state (ULS) concept to retaining wall design.

“The earth pressure and pore water pressure are interrelated through equilibrium and the laws of physics. Partial factor limit state calculations apply factors to the soil pressure and the water pressures independently to determine the ultimate load. This ultimate load does not represent the true load at the limit state and has no physical meaning. It violates equilibrium and the theories that were used to determine the loads in the first place.”

It may be thought that all is well in structural engineering, at least where there is not structural-ground interaction. The article by Alasdair Beal, in the June 2010 issue of New Civil Engineer, will rapidly dispel this false view. It is almost a horror story, and I offer the following extracts as examples:

(i) Language and symbols

The most surprising aspect is that Eurocodes also attempt to create a new technical language for engineering. All over the world, English-language engineering textbooks and codes have been written for over a century in standard technical English, using the familiar terms ‘stress’, ‘strain’, ‘load’, ‘ compression’, ‘tension’, ‘force’, ‘moment’, ‘shear’, ‘torsion’, and ‘imposed deformation’.

However, Eurocodes set out to replace this with a new language based on the word ‘action’, which is given a new meaning of ‘load or imposed deformation’. In this new language, loads become ‘direct actions’, imposed deformations are ‘indirect actions’ and axial forces, shear forces and moments become ‘action effects’, which may be ‘transverse’, ‘tangential’ and so on. Dead load becomes a ‘permanent direct action’ and imposed loads are ‘variable direction actions’.”

(ii) Calculations

“Eurocode load combinations involve considering each imposed load in turn as a ‘leading variable action’, while other imposed loads and deformations are applied as reduced ‘accompanying variable actions’. All the different possible permutations of factors must then be considered to find which has the worst effect.

For those who enjoy calculations and working with numbers, there is certainly fun to be had. However, before the governing equation can be applied the engineer must identify which variable actions can be considered as being separate actions in the calculation and which cannot, so as to apply the factors correctly. This also affects safety and economy, because if the total imposed load can be divided into separate actions, this reduces the design load and the tructure’s safety factor. The more the loading on the structure can be divided up into separate actions, the lower the safety factor becomes.”

(iii) Geotechnical design

“Eurocode 7 part 1 for geotechnical design is the most radical and different of all Eurocodes. It proposes a complete change from past practice, with a new, complex system of partial factors replacing the traditional global safety factors of geotechnical design. According to Bond:

‘When I last counted, there were 112 partial factors to choose from in EN 1997-1, with a further 34 converted from characteristic values to design values by the application of specific factors’.

Eurocode 7 changes almost everything that is said about geotechnical design in existing soil mechanics books and codes of practice, yet if engineers are to design structures to Eurocodes, they will have to master it.”

**The show-stopper: problems in tunnel support design **

Following from the above discussion, it is concluded that there are three reasons why limit state design of primary support for caverns in rock, particularly weak rock or any rock under high stress, is much more complex than design of piles or retaining walls.

1. There is no separation between ‘structure’ and ‘ground’; overall behaviour is one of interaction, with the support elements affecting loading from the ground and groundwater, and the ground and groundwater affecting the support elements.

2. The engineering behaviour of just a single Geotechnical Unit, is a function of many variables, namely:

• Unit weight.

• Substance stiffness.

• Substance strength.

• Number of defect sets.

• Spacing and continuity of defects.

• Dip and dip direction of each set of defects.

• Normal and shear stiffness of each defect set.

• Peak cohesion and friction of each set of defects.

• Water pressures.

Frequently, there are at least three defect sets (bedding, joints and shears) so the above list amounts to 38 variables. Some of these variables have to be increased to increase load on the support system, some have to be reduced to increase load.

Then there may be two to six Geotechnical Units, giving 76 to 228 variables, each which has to be factored, somehow.

3. Ground reinforcements, such as untensioned fully grouted bolts or cables, are neither ‘structure’ nor ‘ground’, but serve to modify the ground behaviour. Given the above, it is no wonder that there is no specific Limit Design Code for design of primary support for caverns in rock. However, Eurocode 7 is a ‘catch-all’ code, and there are major tunneling projects in Australia, and, no doubt, elsewhere in the World, currently under design, ostensibly, according to this code. The writer has examined the procedures set out in the design manual for one such project, and concludes that the methodology is non-sensical.

As a small example; following to Eurocode 7, the dead load is supposedly factored up by 1.35 by increasing the unit weight of the rock. However, as any trained rock mechanics engineer knows, the load on tunnel support is a function of the horizontal stresses as much as the overburden stresses; and also the relative stiffness of the rock mass and the support; and also the sequence of support installation as the face advances. Factoring the unit weight by 1.35 does not factor the load by 1.35. And factoring the natural horizontal stress by 1.35 will, in some situations, lead to a lesser load on the support, not greater. Again, as any trained rock mechanics engineer knows, this will depend on whether, in the definitions of Lauffer, we are dealing with ‘loosening pressures’, or ‘true rock pressures’.

Then there is the issue pointed out by Wong, Day and Poulos:

“The code requires that the design resistance is equal to the characteristic strength of the material multiplied by each of the factors in series. The problem with this approach is that basic statistics demonstrates that the probability of such a design value occurring is miniscule. For example, if a strength factor of 0.8 is meant to represent a 0.1 per cent (0.001) probability of a more adverse value occurring, then if there are five independent strength factors of all equal to 0.8, the resultant strength factor is 0.85 = 0.3, and the probability of occurrence (assuming all have an equal probability) is 0.0015 = 1×10-15, which is an unrealistically occurrence (assuming all have an equal probability) is 0.0015 = 1×10-15, which is an unrealistically low probability of occurrence for design, particularly remembering that the loads will also be factored up.”

If we have between 76 and 228 variables, as discussed above, it is fairly obvious that we are likely to find ourselves in unknown territory in respect to the reasonableness of the probability of failure of our final design. Notwithstanding this difficulty, there is even more fundamental reason why limit state philosophy should not be applied to tunnel support design. This is geological uncertainty.

Table 1 summarises major tunnel failures, documented by the Civil Engineering and Development Department of Hong Kong, and also taken from the writer’s own experience. The failures occurred between 6

1964 and 2010, some with terrible loss of life, all with great financial pain. Of these 41 failures, 35 (85 per cent) are ascribed to unexpected geological or hydrogeological conditions, three to management coupled with design, and three to construction errors. All the failures occurred during construction.

Jacobs discusses five other significant tunnel failures. In only one case, the Wilson tunnel in Hawaii, can the failure be ascribed to flawed design. The other failures related to geology, to water and to gas in the ground.

Eurocode 7 protagonists may argue that because about 85 per cent of the major tunnel failures, documented in Table 1, were caused by unexpected geology or hydrogeology, we should apply a factor to geology. But this is impossible. Firstly, how do you apply a factor to something of whose existence you are ignorant. Secondly, how does one apply sensible factors to all the parameters listed when it is not clear which changes are adverse. Thirdly, given that the fundamental intent of limit state design procedures, such as Eurocode 7, is to achieve a known low probability of failure, how do we know what factors to select when we have no way of knowing what is the likely failure probability of the final design.

Given the above facts, we have two choices.

We could, not unreasonably, adopt the view of Nassim Taleb (ref 10), that the geological and groundwater conditions that led to the failures in Table 1 are ‘Black Swans’- unexpected, unpredictable, outliers, carrying extreme impact. With the ‘Black Swan’ view we may as well shrug our shoulders and hope.

Or we take my view that it is blatantly obvious that our profession should be concentrating on the proper training of engineering geologists, namely geologists who properly understand rock mechanics, and we should rely on these people, and not be trying to apply meaningless factors to, often, guessed geotechnical parameters.

In the first drafts of this article I set out to document, what I thought was, a sensible path for using the principles of Eurocode 7 in the design of tunnel support. These were the procedures that I had documented to introduce into a major Australian project which was locked into Eurocode 7. They included consideration of 80 factors for the geotechnical parameters, not including the orientations of joints, faults and bedding, and ground water pressures.

However, when it came to this final article I had to cut that out.My reasons are threefold.

Firstly, the only way I could achieve something sensible out of Eurocode 7 was to reduce it to something it is not, namely a system of partial factors of safety.

Secondly, I was wrong in my assessment of the factors – the reason being as set out by Wong, Day and Poulos (2007), and quoted above. The combination of all the factors gave a ridiculously low probability, but a meaningless one, because the real issue was uncertainty in the structural geology.

Thirdly, I found myself being sucked into the very place that should be rejected. This is the place where engineers consider that geologists and hydro geologists have limited value, and the laws of physics are insufficient, or too difficult. And so we produce bureaucratic procedures to hide behind, and to make ourselves more comfortable.

**Parting comment**

A quote, attributed to Brian Simpson, encapsulates the issue.

“An understanding of limit state design can be obtained by contrasting it with working state design:

• Working state design: Analyse the expected working state, then apply margins of safety.

• Limit state design: Analyse the unexpected states at which the structure has reached an unacceptable limit.

• Make sure the limit states are unrealistic (or at least unlikely).”

The issue is that selection of meaningful ‘unexpected’ and ‘unrealistic’ states is impossible, or meaningless. For design of tunnel support, which, in weak rock, or rock under high stress, is dominated by geological materials and geological structures, and with the loading of the support being a function of the mass stiffness of the ground and the stiffness of the support elements.

We should, in fact we must, retain working state design, based on the expected. The expected should be based on detailed site investigations interpreted by the best engineering geologists, of whom there are too few. Then we must properly use the Observational Method, by whatever name we chose to call it, even the New Australian Tunnelling Method!

Hangzhou metro pit collapse, 2008 The Nicoll Highway collapse of 2004 The corner of the residential building directly over the collapse Plan diagram of the Lane Cove tunnel project with the collapse site shown The Pinheiros station cavern and shaft collapse in Sao Paulo in January 2007 Table 1