Road Tunnel Fire Risk: The QRA Born From Mont Blanc 1999

On 24 March 1999 a lorry carrying margarine and flour caught fire inside the Mont Blanc road tunnel. The fire burned for 53 hours and killed 39 people. Yet the truck carried nothing that any dangerous goods code would flag. That gap between an ordinary load and a mass fatality turned tunnel fire risk into a discipline of its own. So this post traces how one disaster produced EU Directive 2004/54/EC and the OECD/PIARC quantitative risk assessment (QRA) toolset. It also explains why the design fire for a tunnel fire QRA grew sevenfold in a decade. Then it lays out the event trees, the equations and the acceptance lines in use today.

TL;DR

What the Mont Blanc tunnel fire changed

• The fire reached an estimated 190 MW and killed 39 people. Of those, 29 never left their cars, while two operators ran opposing fans and shared no control room.
• Europe then passed Directive 2004/54/EC in 2004. Annex I sets prescriptive minima, yet Article 13 also demands an independent risk analysis for any tunnel with special features.
• The OECD/PIARC DG-QRAM model became the backbone of tunnel fire QRA. It runs 13 scenarios through an event tree and returns F-N curves and an expected number of deaths per year.

Why tunnel fire risk still needs care

• Full-scale tests rewrote the design fire. At Runehamar in 2003, ordinary cargo peaked at 202 MW, far above the 20–30 MW in the guidance of the day.
• Acceptance criteria differ by country. The Dutch use a fixed F·N² line, Austria uses a reference tunnel, and Switzerland prices a statistical life. So one tunnel can pass one model and fail another.
• Hydrogen and battery vehicles sit outside the standard model. As of 2026 the Directive remains unrevised, so engineers must add those scenarios themselves.

What happened in the Mont Blanc tunnel fire?

A refrigerated lorry stopped 6.5 km inside an 11.6 km single-tube tunnel, and its load erupted. Within an hour the smoke had killed most of the people trapped behind it.

At about 10:46 CET on 24 March 1999, a Belgian Volvo lorry entered the tunnel from the French side at Chamonix. It carried roughly 9 t of margarine and 12 t of flour. Oncoming drivers flashed their headlights at white smoke from the cab. At around 10:53 the driver stopped, then fled toward Italy. A motorist in refuge 22 raised the alarm at 10:54, and staff halted traffic at 10:55. By then about 10 cars and 18 trucks had already entered from France, according to the incident timeline.

The margarine load then drove temperatures past 1,000 °C along a 500 m stretch. According to the service analysis of the incident, the fire “burned for 53 hours and reached temperatures of 1,000°C.” More than 30 vehicles burned out. In the previous 35 years, 16 other trucks had caught fire in the same tunnel. Crews had put out every one on the spot, so that record bred a false sense of control over tunnel fire risk.

Why did 29 of the 39 victims die in their cars?

Because they waited, and the smoke reached them before any rescue could. Most victims died from smoke and toxic gas rather than from heat, the usual pattern in a tunnel fire.

The fire service study The Causes, Effects and Control of Real Tunnel Fires sets out the count. “29 victims were found in their vehicles. Obviously they did not try to flee early enough. 7 people tried to flee and died from intoxication. 2 people were trapped and killed in shelter 20.” The lethal component came mainly from hydrogen cyanide. Our post on smoke inhalation explains why that gas kills so fast. Pierlucio Tinazzi, an Italian security officer on a motorcycle, made repeated rescue runs into the smoke and died there.

The fire itself carried no instruments. Estimates put the peak heat release rate near 190 MW, so modelling studies use about 200 MW as the severe HGV case. Treat that figure as an engineering reconstruction, not a measurement. For comparison, a later instrumented test in the same tunnel reached 128 MW with a smaller load.

What did the inquiry and the trial find?

Four systemic failures, and 13 criminal convictions. The ignition source mattered far less than the people and systems around it.

The Franco-Italian inquiry, the Duffé–Marec report of 1999, made 41 recommendations. It recorded two separate control rooms, one per operator, with no joint command. It also found opposing ventilation. The French semi-transverse system kept supplying fresh air, which fed the fire and pushed smoke onto people. The refuges lacked fire resistance, protected air and escape routes. Finally, no joint emergency plan existed, and the last full drill dated from 1973.

The trial opened at Bonneville on 31 January 2005 with 16 defendants. On 27 July 2005 the court convicted 13 of them of involuntary manslaughter. The French operator’s security chief received 30 months, six of them firm. Judges faulted him for failing to organise drills and for ignoring a near-miss fire in 1990. Both operating directors and the former president received suspended terms, while the driver received four months suspended. Charges against Volvo fell away for lack of a design flaw, as New Civil Engineer reported.

How did the rebuilt tunnel change?

Into a single-command tunnel with 37 pressurised shelters, one every 300 m, linked to a parallel escape duct.

The tunnel reopened on 9 March 2002 after full-scale fire tests in January that year. Cost estimates run from US$273 million to about €380 million, depending on the source. Smoke extraction nozzles now sit every 100 m instead of every 300 m. Their capacity exceeds 150 m³/s per 600 m section. Then 38 pairs of jet fans push air along the tube, and thermal cameras scan trucks at both portals. One joint body, GEIE-TMB, now runs a single control regime. Remote inspection zones at Passy and Aosta also check heavy vehicles before entry. The tunnel closed again for 15 weeks in autumn 2025 for vault repairs, then reopened on 12 December 2025.

Why did one tunnel fire rewrite European law?

Because two more Alpine fires followed within 31 months. Together the three killed 62 people and exposed the same pattern.

On 29 May 1999, two months after Mont Blanc, a collision in Austria’s Tauern tunnel started a fire that killed 12. Then on 24 October 2001, a head-on crash in Switzerland’s 16.9 km Gotthard tunnel killed 11. All three tunnels ran two-way traffic in a single tube. In each case, smoke moved faster than people, and many victims stayed in their vehicles. So the pattern looked systemic rather than local, and the European Commission moved to legislate.

France acted first. Its circular of 25 August 2000 created a national safety committee, the CESTR. It also required a safety dossier for every tunnel over 300 m. The tunnel research centre CETU then wrote the method for the French hazard studies that followed.

What does Directive 2004/54/EC require?

Minimum safety measures for every tunnel over 500 m on the Trans-European Road Network. It also requires an independent risk analysis wherever a tunnel has special features.

Directive 2004/54/EC dates from 29 April 2004. It covers tunnels “whether they are in operation, under construction or at the design stage”. Its structure splits into roles, minima and risk analysis.

Why call the Directive a hybrid?

Because it fuses prescriptive rules with risk-based judgment. Annex I fixes the recipe, while Article 13 lets a tunnel fire risk analysis extend or override it.

That tension has never fully resolved. The Commission’s reviews found a positive effect, yet compliance lagged at the 2019 deadline. Italy carried the heaviest burden, with roughly half of the 515 network tunnels over 500 m. Even so, the Commission’s 2018 staff working document concluded that the findings did not justify a revision. The 2019 road safety reform then went into a separate directive. So 2004/54/EC remains in force without major change as of 2026.

Which national rules sit beneath it?

A patchwork. Each Member State transposed the Directive with its own model, and countries outside the EU wrote parallel codes.

Austria uses RVS 09.03.11, known as TuRisMo, plus RVS 09.03.12 for dangerous goods. The Netherlands runs its Tunnel Act with the QRA-tunnels model. Germany combines the RABT 2006 design rules with the BASt risk model. France pairs CETU guidance with its hazard studies, and Italy transposed the Directive through D.Lgs. 264/2006. Outside the EU, the UK applies CD 352 in the Design Manual for Roads and Bridges. The US relies on NFPA 502. Dangerous goods routing follows the ADR tunnel categories A to E, assigned on the basis of a risk assessment.

How does a tunnel fire QRA work?

Through an event tree. A tunnel fire QRA starts from how often fires begin, branches through what happens next, and ends in deaths per year.

The first input sets the tunnel fire frequency. PIARC’s compilation across 12 countries puts an average tunnel at 5 to 15 fires per billion vehicle-km. Older French data put HGV fires at up to 8 per 10⁸ vehicle-km. Geometry then shifts those rates. For example, a Norwegian study in Fire Safety Journal found a fire rate about 5.7 times higher in subsea tunnels, because long gradients overheat brakes and engines.

Branches then cover fire size, detection and response time, ventilation mode, and traffic mode. Congested traffic changes everything, since it puts people downstream of the fire. Two-way traffic does the same on both sides at once. Our post on event trees and fault trees explains the algebra behind those branches.

Consequence models close the tree. A one-dimensional smoke model or a CFD run predicts temperature, visibility and toxic gas along the tube. An evacuation model then compares escape time against tenability. Buildings use the same ASET versus RSET test. Each end branch yields a frequency and a death count. Summing them gives two outputs, an F-N curve and an expected value (EV) of deaths per year.

Human behaviour remains the weakest branch in any tunnel fire model. At Mont Blanc, Tauern and Gotthard, many victims stayed in their cars, so pre-movement delay dominated the outcome. Yet most models still treat that delay as a fixed input.

What is the DG-QRAM?

The OECD/PIARC Quantitative Risk Assessment Model for dangerous goods in road tunnels. INERIS, WS Atkins and the University of Waterloo built it between 1995 and 2001, and CETU now maintains it.

The DG-QRAM compares a tunnel route against a surface alternative. It returns societal risk, individual risk and F-N curves for both. The OECD report behind it runs 13 typical scenarios, though the exact roster depends on the software version.

These scenarios map onto the ADR tunnel groupings. Category A permits all goods, while category E bars almost all dangerous goods. Between them, B bars goods that may cause a very large explosion. Then C adds large explosions and large toxic releases, and D adds large fires. PIARC later built out the method in three reports. They cover risk analysis for road tunnels (2008), current practice for risk evaluation (2012), and design fire characteristics (2017).

How do national tunnel fire QRA models differ?

In their acceptance criteria, more than in their event trees. The same tunnel can therefore pass in one country and fail in another.

Austria’s TuRisMo first appeared in 2008 and gained a revision in 2015. It calibrates its event tree on 447 tunnel accidents with injuries. It reports mechanical, fire and dangerous goods risk separately, then compares the tunnel with a reference tunnel equipped to RVS minima. For dangerous goods it applies DG-QRAM with an F-N reference line of $F = 0.1 \cdot N^{-2}$ for $N \ge 10$.

The Dutch criterion takes the same shape. PIARC’s 2012 report on risk evaluation records it as an anchor of 10⁻³ per year at N = 10, with a slope of −2.

$F \le \frac{0.1}{N^2}\ \text{per km-tunnel per year},\qquad N > 10$

The squared term encodes strong risk aversion. So a tenfold rise in deaths demands a hundredfold fall in frequency. Our post on F-N curves and societal risk explains where that slope comes from. The UK takes a different route. CD 352, first published in March 2020 and updated in 2024, states that “the risk assessment process should include ALARP decisions”. So the ALARP test governs the final step there.

Which design fire should a tunnel fire QRA use?

One anchored in full-scale tests, not in 1990s guidance. For a tunnel that admits heavy goods vehicles, that means 100 MW or more, and 200 to 300 MW where tankers pass.

The design fire drives every consequence in a tunnel fire event tree. Yet for a decade the guidance lagged the evidence.

What did the Runehamar tests show?

That ordinary cargo burns like a tanker. Four HGV trailer mock-ups peaked between 66 and 202 MW, with ceiling gas temperatures of 1,281 to 1,365 °C.

In 2003, SP Sweden ran the tunnel fire tests in a disused 1,600 m tunnel in Norway. The loads held wood pallets, plastic pallets, mattresses, furniture and plastic cups in cardboard boxes. None counted as dangerous goods. Ingason and Lönnermark reported in their IAFSS paper that “the maximum heat release rates produced by the four different fire loads varied between 66 and 202 MW”. Flame lengths reached about 100 m. Their later paper in Fire Safety Journal gathered the data.

Earlier programmes had pointed the same way. The EUREKA 499 tests at Repparfjord in Norway, from 1990 to 1992, reached about 120 MW. Then the Memorial Tunnel programme in West Virginia ran 98 tests up to 100 MW between 1993 and 1995, and anchored ventilation design in the US. Today the FHWA design fire guidance lists typical values. It gives 8 MW for a car, 30 MW for a bus, 150 MW for an HGV and 300 MW for a tanker.

A tunnel fire also grows faster than the free-burning t-squared curve suggests. Ventilation feeds the flames, and fire jumps between queued vehicles. So a QRA needs both a bigger peak and a steeper rise than the building codes assume. Our primer on the heat release rate covers the physics behind that number.

What is critical velocity, and why did it matter at Mont Blanc?

Critical velocity means the lowest longitudinal air speed that holds smoke on the downstream side of a fire. It protects everyone upstream, yet it pushes all the smoke onto everyone downstream.

Thomas derived the first form in 1968 from a Froude number balance between buoyancy and inertia. With $Q'$ as the heat release rate per unit tunnel width, it reads $V_c = k\left(\frac{gQ'}{\rho_0 c_p T_f}\right)^{1/3}$. Designers more often use the Kennedy/Danziger form, which NFPA 502 carried for many years. It sets a critical Froude number of about 4.5. It then iterates the hot gas temperature $T_f$ together with the velocity.

$V_c = K_g\,k\left(\frac{gHQ}{\rho_0 c_p A T_f}\right)^{1/3},\qquad T_f = \frac{Q}{\rho_0 c_p A V_c}+T_0$

Here $H$ stands for the tunnel height, $A$ for the cross-section, $K_g$ for a grade factor, and $k$ for $4.5^{-1/3}$, about 0.606. Two features of this result matter in tunnel fire design.

First, the cube root makes the answer weakly sensitive to fire size. For a two-lane tube of 50 m², the form returns about 2.2 m/s at 30 MW and 3.1 m/s at 200 MW. So a sevenfold rise in the design fire lifts the fan demand by only 40%. Second, Memorial Tunnel data confirmed that about 3 m/s suppresses back-layering for fires of 50 to 100 MW. A 2024 review in Fire Technology revisits that result.

Why does longitudinal ventilation fail in a two-way tunnel?

Because people sit on both sides of the fire. Any airflow strong enough to protect one side drives hot smoke onto the other.

That trap explains the Mont Blanc ventilation failure. The French semi-transverse system kept supplying fresh air near the fire. So the fire grew while operators on each side worked at cross purposes. It also explains clause 2.9.3 of Annex I. Longitudinal ventilation in a two-way or congested tunnel passes only if an Article 13 risk analysis shows it acceptable. Where people can sit downstream, designers prefer smoke extraction that preserves the stratified layer.

Where does tunnel fire QRA still fall short?

In three places: model divergence, human behaviour, and new energy carriers. Each one can swing a result by more than the safety margin.

• Models disagree by orders of magnitude. The EU networks UPTUN, SafeT, DARTS and FIT compared national models on the same tunnels between 2001 and 2005. Results differed by orders of magnitude because of consequence sub-models, fire frequency data and behaviour assumptions.
• Human behaviour stays under-modelled. Pre-movement delay decides most tunnel fire outcomes, yet models often fix it at a single value. The 29 in-vehicle deaths at Mont Blanc show what that assumption hides.
• Hydrogen and batteries sit outside DG-QRAM. The model has no scenario for a hydrogen fuel cell vehicle or a lithium-ion pack. So engineers must borrow from newer work until PIARC adds them.

A 2013 critique in the Journal of Risk Research reached the same conclusion on model divergence. On hydrogen, the EU HyTunnel-CS project built a dedicated QRA before it concluded in 2022. It found that tank rupture and pressure relief device behaviour dominate the risk. BASt tests also recorded hydrogen burning at over 2,000 °C. For battery packs, see our posts on thermal runaway propagation and on EV fire frequency.

How do the major tunnel fires compare?

Mont Blanc stands out for its death toll, yet every tunnel fire in the table shares one of its lessons.

The Channel Tunnel fires of 1996 and 2008 make a useful rail comparator. Both HGV shuttle fires reached about 1,000 °C, yet neither killed anyone. The service tunnel gave passengers a protected escape route. Peak heat release rates for the older road incidents remain scale-only estimates, since none carried instruments.

How should you run a tunnel fire QRA?

Treat it as a design tool, not a compliance checkbox. Five rules cover most projects.

On scope and inputs

1. Run the Article 13 QRA early. For any two-way, steep, HGV-heavy or dangerous goods tunnel, build the event tree before the bore layout and ventilation strategy freeze. A short one-way tunnel with few trucks and no dangerous goods can rest on Annex I alone.
2. Pick design fires from full-scale evidence. Use at least 100 MW where HGVs pass, and 200 to 300 MW where tankers do. A fixed fire fighting system may justify a lower value, but only with test data, never with vendor claims.
3. Check ventilation against the downstream occupant. In a two-way tube, confirm that no longitudinal strategy trades upstream safety for downstream deaths. Longitudinal-only control belongs in one-way, free-flowing tunnels.

On criteria and gaps

4. State the acceptance criterion and test it. Report the EV, the F-N curve against the chosen national line, and how the result shifts under a second model. If the tunnel passes one recognised model and fails another, treat it as not yet ALARP and add mitigation.
5. Add hydrogen and battery scenarios now. DG-QRAM lacks them, so supplement it with HyTunnel-CS-type cases. Then revisit the case when PIARC or the Directive formally adopts these energy carriers.

Key takeaways

The Mont Blanc tunnel fire killed 39 people because of organisation, not chemistry. A margarine load, two control rooms, opposing fans and refuges that failed turned a truck fire into a mass fatality. Europe answered with Directive 2004/54/EC and a QRA method built on event trees, F-N curves and expected values.

The numbers moved most where the tests spoke. Runehamar pushed the HGV design fire from 30 MW to 200 MW, and the cube root in the critical velocity equation kept fan demand within reach. Yet the criteria still differ by country, and human behaviour still resists modelling. Hydrogen and battery vehicles also wait outside the standard model. So run the tunnel fire QRA early, name your acceptance line, and reopen the case when the traffic changes.

Cite this articleHow to cite

Dinh, D. C. (2026, September 8). Road Tunnel Fire Risk: The QRA Born From Mont Blanc 1999. PyroRisk. https://pyrorisk.net/blog/road-tunnel-fire-risk-the-qra-born-from-mont-blanc-1999/

Get citation →