Five responsibilities that keep a tolled motorway running

Tunnel ventilation, lighting, fire detection, traffic signals and variable message signs are run by systems that wear out decades before a concession ends, and they have to be replaced while traffic keeps moving. I plan those renewals around the operating constraint rather than the supplier's preferred cutover: parallel running where closures would be costly or unsafe, staged commissioning by subsystem, and test scenarios written with each tunnel's safety officer and the local fire service. I insist that interface specifications, control narratives and point lists belong to Elvaran, so the next replacement can be tendered competitively. The approach has a real cost; on our northern concession it added about €4.5 million and seven months. I judge it against lost toll revenue, contractual deductions for unavailable lanes and the risk of commissioning a fire scenario in the few hours between two night closures.

Toll lanes, tunnel controllers and traffic-management systems were designed to be reliable, not to resist an attacker who has already reached the corporate network. After the 2022 ransomware attack I made segmentation a standing programme rather than a project: a separate identity domain for operational systems, monitored conduits for the few data flows that must cross into the business network, one-way transfer where the direction allows it, and an inventory of 11,400 networked devices that we actually reconcile against the field. Our head of operational-technology security, Agnieszka Rolewska, reports to me and presents with me to the audit and risk committee each quarter. As national laws implementing the EU's NIS2 directive take effect, I spend less time on the wording of policies and more on whether we can show supervisors, and ourselves, that a given control works on a given site.

A concession ends with a contractual inspection, and the grantor will judge our structures, pavements and equipment against the condition the contract requires. That makes asset data a financial matter as well as an engineering one. I am responsible for the register that now holds 2,340 structures, their components, inspection history and defects in one data model, with pavement condition and tunnel equipment linked to the same identifiers. I am cautious about the phrase digital twin. We built three-dimensional models only for the three tunnels where geometry affects ventilation design and equipment replacement; elsewhere a well-kept register, with a named owner for each field, is what our engineers actually use. Image-based defect detection is now being tested on 310 kilometres of pavement as a way of ranking what inspectors look at first, not as a substitute for their judgement or their signature.

Tolling is where Elvaran earns its revenue and where it handles most personal data. I am responsible for lane equipment, transaction processing and the interfaces with electronic-tag issuers; the commercial team owns customer accounts and the grantor sets tariffs. Free-flow tolling replaces barriers with gantries that photograph number plates, which reduces congestion and plaza maintenance but creates a large store of images about people's movements. With our data protection officer, Sofia Brandeira, I keep that store narrow: purpose limited to charging and recovering tolls, deletion 120 days after settlement unless a transaction is disputed, and only aggregated, anonymised counts released for traffic analysis. I also report the leakage figures, because a free-flow scheme that cannot recover tolls from foreign-registered vehicles is a revenue problem, and the board should hear it from the technology side as well as from finance.

Elvaran reports under the EU's corporate sustainability reporting rules, and much of what we disclose about energy and emissions depends on systems my function runs. Tunnel ventilation and lighting are our largest electricity loads. Since 2023 we have installed 1,860 sub-meters across tunnels, toll plazas, maintenance centres and service-area common parts, so that we report consumption we measured rather than consumption inferred from invoices. I keep measured figures apart from modelled ones, such as estimates of emissions from the vehicles using our roads, because the two carry different uncertainty and should not be combined into one commitment. I work with the finance team and our external assurance provider on the controls around those data flows, and I treat a meter that has stopped reporting as a defect to be fixed, not a gap to be estimated quietly.