ITA/IMIA Tunnelling Code of Practice (2023) · EXCO/JTA · December 2025 · Bill Newns
The views and interpretations expressed in this paper are personal views of the author. They do not necessarily reflect those of the ITA, IMIA, or contributors to the Code of Practice.
The ITA/IMIA Tunnelling Code of Practice had its origins in a crisis. A series of significant failures in the 1990s — most notably the collapse of the Heathrow Express tunnels in 1994 — placed the viability of tunnelling insurance in serious doubt. The frequency of claims prompted the Association of British Insurers to warn the industry that without a significant reduction in losses, capacity would be withdrawn. The Code was the industry’s collective response: a framework designed to make failure extremely remote. Three revisions later, the Code remains highly relevant — not because it has failed, but because the failures it was designed to prevent continue to occur, often with the same or very similar causes.
That observation is the starting point for everything that follows. We have reached a very high level of sophistication as an industry. Continued technological advances are taking us into ever more challenging environments. Yet the frequency of repeated catastrophic failures highlights areas that need greater attention — and especially in relation to how risks are managed, starting at the project funding, planning and procurement stages, including the choice of contract. The technology has advanced. The system around it has not kept pace.
The Code
What it requires and what it is designed to achieve
The objective of the Code is precise: to manage risks such that the failure of the tunnel works from all reasonably foreseeable causes — including high consequence, low likelihood events — is extremely remote during construction and the design life of the tunnel works.
The lineage of that objective goes back to Sir Alan Muir Wood’s CIRIA 79 guide of 1978, one of the first documents to describe ground reference conditions and the role of the insurer. Muir Wood stated it simply: the purpose of defining a risk in its nature, extent and liability is so that planning, safety and financial provisions can be made. A project should have adequate financial provisions for a contractor to make a reasonable profit and for risk contingencies to be funded.
“Re-establish good faith. Give the estimation of the work and do not refuse a reasonable payment to a contractor who will fulfil his obligations. That will always be the best transaction you will be able to find.”Vauban, 1683 — cited in CIRIA 79, Sir Alan Muir Wood, 1978
Vauban was a builder, not a theorist. He wrote from projects that failed because those conditions were absent. And he identified something the modern procurement system still hasn’t resolved: that selecting a contractor is ultimately a judgment about character and intent — about who will fulfil their obligations — not a comparison of prices. Three hundred and forty years later, the industry is still circling around it.
The 2023 revision of the Code reflects developments since the 2012 edition. It places significant emphasis on competence, culture and collaboration. It aligns with ISO 31000, the international risk management standard. Health and safety considerations are now embedded throughout all project stages. A dedicated section on digital models and BIM acknowledges the growing role of technology. Emergency response planning is now a required component of both tender and construction stages.
The central argument
Clients have the primary responsibility — because they create the risks
The Code places the client organisation at the centre of the risk management framework. This is not a procedural point. It reflects a structural reality: decisions that preclude the elimination of risks may only be made in the early stages of the project lifecycle. The decision about alignment, procurement model, investigation budget, and contract form — all of these are made before a contractor arrives. By the time construction begins, the most consequential decisions have already been made.
Client organisations should establish a health and safety risk management framework for proposed or existing underground assets before tendering. They should assess and evaluate health and safety risks prior to releasing procurement documentation. They should require tenderers to provide health and safety assessments with their tenders. They should allow adequate time for the interactive assessment and comparative evaluation of all tenderers’ proposals.
These requirements are not aspirational. They are conditions for the procurement process to function as designed. An informed client — one with genuine technical competence, or the capacity to procure it — is the most important factor in project culture and risk management. Choose your team carefully. What is most important for a client is good company.
The success formula
What determines quality of outcome
Empirical Tunnel Quality Formula — after Klaus Erbar, Muir-Wood Lecture, WTC Stockholm 2025
T = m · k² · i³ · aˣ
T = Quality of outcome — measured against original objectives, scope and requirements
m= Material and human resources — related to procurement; precursor for culture
k² = Know-how, squared — competence, methodology, clarity of scope and requirements
i³ = Information and communication, cubed — design assumptions, monitoring, observation
aˣ = Motivation — +/− incentive or disincentive; can be positive (collaboration) or negative (adversarial)
Motivation is the exponent. In a collaborative environment it amplifies every other factor. In an adversarial environment it is negative — and a negative exponent cascades through everything else. Full risk transfer is inefficient not merely as a commercial arrangement. It degrades the information environment on which safe construction depends. The motivation to communicate active risk is diminished precisely when it matters most.
Collaboration is not a soft concept. It is an obligation to work together for mutual benefit — a development of the traditional good faith ethical duty not to be dishonest or to undermine an agreement. It depends on individuals and their interpersonal relations. Those relations inform group dynamics. Group dynamics build or destroy the motivation to work together. That motivation determines whether the information environment functions.
Ground risk
What cannot be eliminated and what must be communicated
Ground risks, more than any other single factor, influence the costs and outcomes of any tunnel. It is axiomatic that a client pays for a comprehensive ground investigation whether they do one or not. There is a further principle: by setting the alignment and shaft or portal positions, ground risks are created that cannot be eliminated — only minimised by tunnelling method, validation of the engineering geological model, and ground treatment.
The communication of those risks is an underappreciated skill. A working definition is useful here: information is data or observation of a system that reduces uncertainty, enabling interpretation, decision, or action — in other words, effective communication. At each point in the project when risks and tasks are allocated, the question is not merely whether risks were disclosed, but whether they were communicated in that sense. There are three distinct categories of uncertainty in play:
Natural Variability – Spatial variability in geological materials — irreducible, present in all ground.
Knowledge Uncertainty – Geological model uncertainty and parameter uncertainty arising from the limits of investigation and statistical estimation.
Ontological Uncertainty – Semantic and interpretational uncertainty — different meanings attributed to the same terms, reliability limits not clearly defined, human biases in data interpretation.
The first two categories are familiar to the industry. The third is the one that produces the most expensive disputes — because it is the one that lawyers are asked to reconstruct after the fact, from silence and inference, at cost to both parties. Express allocation of risk at contract formation is the only mechanism that addresses ontological uncertainty in advance.
The Ground Reference Conditions requirement in the Code — the Geotechnical Baseline Report — is the most effective instrument the industry has developed for honest risk allocation. Its objective is not to offset unbalanced and poorly defined risks. It is to ensure that a contractor is prepared with the right level of resource to undertake the project and to efficiently manage any necessary contingencies. The GBR process is a powerful technique to facilitate due diligence during procurement. As Alan Muir Wood observed in reference to the Heathrow collapse: the principal cause was the fragmentation of responsibility resulting from the procurement scheme.
Culture and learning
Why compliance is not enough and what a more mature approach looks like
Regulations and codes are typically recreated after catastrophic failures to prevent recurrence. This produces a compliance culture — and compliance cultures can be rigid, ineffective and forgetful. They address the last failure. They do not build the dynamic capacity to manage the next one.
The tunnelling industry is not effectively capturing the lessons learned from failures and losses. No unified database exists that relates failure events to industry-wide activity levels. Data is fragmented, underreported, and inconsistent. An industry that cannot see itself clearly cannot learn from itself reliably. The result is systemic amnesia — repeated catastrophic failures with the same or similar causes, across decades and jurisdictions.
High Reliability Organisation principles, developed for aviation and adapted to healthcare, offer a more mature model. They include: avoiding the oversimplification of root causes; deference to expertise over organisational rank; just culture over blame culture. The Risk Maturity Model — developed in software, adapted to finance — describes a scale from reactive compliance to dynamic risk-adjusted decision-making. The tunnelling industry, as a sector, is not consistently at the mature end of that scale. Moving there requires investment in systems, culture, procurement design, and the willingness to look at failures honestly rather than defensively.
The most tunnelling-relevant of these principles is deference to expertise over organisational rank — the recognition that the person closest to the face often has the most accurate picture of risk, and that organisational or contractual pressure to suppress that signal is a systemic failure in itself.
In many languages, the word failure implies a shameful act. That reflex is not neutral — it shapes what gets reported, how it gets characterised, and whether the signal reaches the people who need it. Terminology in engineered systems should reflect performance obligations, not moral judgement. A classification first presented by the author at EXCO/JTA in December 2025 proposes three tiers: incidents (near miss, low consequence) requiring corrective action and continual improvement; failures (loss of control, major consequence) requiring root cause analysis; and catastrophic failures requiring systemic review. The measure of resilience is not whether failures occur, but how effectively the system responds, improves, and avoids a repeat.
Conclusion
What the Code asks of us
The Code is precise about what it asks. The objective — failure extremely remote from all reasonably foreseeable causes — is not aspirational language. It is a performance standard. Meeting it requires an informed client with genuine technical competence, procurement decisions made before a contractor arrives, and a contract structure that does not destroy the motivation to communicate risk. Those three conditions are interdependent. Absent any one of them, the others are undermined.
The Erbar formula makes the mechanism visible. Motivation is the exponent. In an adversarial environment it is negative — and a negative exponent cascades through resources, competence, and the information environment simultaneously. Full risk transfer is not merely commercially inefficient. It actively degrades the system on which safe construction depends.
Ground risk sits at the centre of this. The industry understands natural variability and knowledge uncertainty. What it handles less well is ontological uncertainty — the failure to agree on what terms mean before the work begins. That failure is not reconstructable after the fact. It can only be addressed at contract formation, through honest risk allocation and a properly constituted GBR.
The learning problem compounds everything. No unified dataset exists that relates failure events to industry-wide activity levels. Until that changes, the Code provides the framework but the industry lacks the mirror it needs to use it well.