Subrata Das, FIE, Chartered Engineer, Advisor-PMDCS examines why the real test of underground safety lies not in the presence of safeguards, but in their ability to withstand foreseeable failures. From independent protection and common-cause failure to human reliability, digital safety assurance and controlled recovery, the article makes a compelling case for designing tunnel safety systems that remain dependable when individual protections fail.
Why fail-safe design, redundancy and independent protection deserve greater attention in underground construction
It is well understood that tunnel construction is inherently hazardous. Most major underground projects therefore have ventilation systems, gas detectors, communication arrangements, alarms, emergency procedures, safety personnel, inspections, permits and evacuation plans.But another question deserves much greater attention: What protects the workforce when one of these protections itself fails? A ventilation fan can stop. A gas detector can malfunction. Communication can be lost. A responsible person may become unavailable. Conditions underground can change between two inspections. Emergency power may fail when needed. Most importantly, two individually manageable failures may occur at the same time.
None of these situations are extraordinary in underground construction. The real question for management is therefore not simply, “Do we have a safety system?” but rather “Will the safety system still protect people when something within the system fails?”
This is where fail-safe thinking needs to become much more prominent in tunnel construction.
Fail-safe does not mean that failure will never occur
No practical construction system can guarantee that equipment will never fail, people will never make mistakes, or underground conditions will never change unexpectedly.Fail-safe engineering begins with a more realistic assumption: failures will occur, and the system must prevent a foreseeable failure from progressing directly into a catastrophic consequence.
In practical tunnelling terms, this requires four basic principles:
- Safety must be positively established. Absence of information cannot be interpreted as evidence that conditions are safe.
- Loss of certainty should move the operation towards the safer condition. If a critical safety condition can no longer be verified, continuation of exposed work should not depend on assumptions.
- One failure should not defeat the entire protection system. Where the potential consequence is severe, another sufficiently independent barrier should remain available.
- Recovery must require positive verification. Correcting the immediate problem does not automatically mean that underground conditions are ready for normal work to resume.
Redundancy is more than providing standby equipment
In construction, redundancy is often understood as one operating unit plus one standby unit. That is important, but it is not necessarily fail-safe.Consider two ventilation fans. If both depend on the same power source, control panel, switching arrangement or cable route, one common failure may disable both.
Two communication devices connected through the same vulnerable network may still represent only one real communication system. Similarly, two instruments of the same type, affected by the same calibration problem, may create the appearance of redundancy without providing genuine independence.
This leads to an important principle: redundancy without independence can create a false sense of security. For critical underground operations, redundancy needs to be considered across ventilation, power supply, atmospheric detection, communication, warnings, responsible personnel, decision-making, emergency response and recovery verification.
The better question is therefore not, “Do we have a standby?” It is, “Can the standby survive the same event that caused the primary protection to fail?” The distinction is important.
36 conditions worth testing against an existing tunnel safety system
Experienced tunnellers will recognise most of these situations immediately. They can be grouped into six areas for a more systematic examination of an existing safety system.Atmosphere and gas
- Gas concentration increases significantly between scheduled checks.
- Methane is encountered where previous information did not indicate its presence.
- Oxygen concentration falls unexpectedly.
- Harmful blasting gases persist longer than anticipated.
- Additional diesel equipment changes the atmospheric load.
- Gas accumulates in a crown cavity, recess, dead end or poorly ventilated area while conditions at the normal monitoring location appear satisfactory.
- One work location remains acceptable while another becomes hazardous.
- Atmospheric conditions deteriorate following a ventilation disturbance while personnel remain underground.
Ventilation
- The main ventilation fan stops unexpectedly.
- The standby fan fails when actually demanded.
- Duty and standby ventilation depend on the same electrical source.
- Ventilation ducting tears, collapses, separates or becomes obstructed.
- Leakage progressively increases as the heading advances.
- The fan continues running, but actual airflow reaching the working face becomes inadequate.
- Ventilation arrangements are temporarily changed to suit construction activities without fully reassessing the consequences.
- Manpower, diesel horsepower or simultaneous activities increase while the ventilation arrangement remains unchanged.
Measurement and instrumentation
- A gas detector fails without clearly indicating that it has failed.
- Calibration validity or instrument reliability becomes questionable.
- An instrument is unable to correctly measure the range actually encountered.
- Air velocity is measured at a convenient location rather than a representative location.
- A previously valid measurement no longer represents the current underground condition.
Human and organisational failure
- A key safety or supervisory person is unexpectedly unavailable.
- A shift handover fails to communicate an abnormal condition completely.
- Two competent engineers interpret the same developing condition differently.
- Several weak warning signs are noticed individually, but nobody recognises their combined significance.
- Production urgency begins to influence the timing of a safety decision.
- A temporary deviation gradually becomes accepted as normal because nothing adverse has happened previously.
- During an emergency involving several contractors or work fronts, responsibility for a critical action becomes unclear.
- A competent person unintentionally misses, misunderstands or bypasses an important safety requirement.
Communication, warning and infrastructure
- Communication between an underground work area and surface control is lost.
- A warning does not reach everybody who may be exposed.
- Normal electrical power fails during the initiating emergency.
- A monitoring, communication or digital safety system itself becomes unavailable.
- Information available to management no longer represents the actual underground condition.
Emergency and recovery
- A blast, misfire, rockfall, cavity, sudden water ingress, smoke event or other underground occurrence immediately invalidates conditions that had previously been considered acceptable.
- The initiating emergency appears resolved, but work resumes before atmosphere, ventilation, access, personnel status and the original cause have all been adequately verified.
Procedures describe what should happen. Fail-safe design asks what happens when they do not.
A conventional procedure generally assumes that the required inspection will be carried out, the instrument will function correctly, the information will be communicated, the responsible person will understand its significance and the required action will follow.All of this is necessary. But fail-safe engineering asks another set of questions:
- What happens if the inspection is missed?
- What happens if the instrument is wrong?
- What happens if communication fails?
- What happens if the responsible person is unavailable?
- What happens if somebody makes an entirely understandable human error?
- Most importantly, what happens when two protection systems fail because they depend on the same underlying system?
Human error should be treated as a foreseeable operating condition
Tunnel construction is not a controlled manufacturing environment. Faces advance, ventilation lengths increase, plant moves, geology changes, groundwater conditions change, support requirements change and blasting interrupts normal operations. Different crews work different shifts, multiple subcontractors may operate simultaneously, production pressure is real, and emergencies rarely occur at convenient times.Even an experienced engineer can therefore miss information, misunderstand a message, delay an action or make a judgement based on incomplete evidence.
The solution cannot be to remove engineering judgement from tunnelling. That would be neither practical nor desirable. Instead, the safety architecture should be designed so that one human omission or judgement error does not have an unrestricted path to catastrophe. Human error should therefore be considered a foreseeable design condition, rather than merely something investigated after an accident.
Multiple independent barriers are essential
A robust tunnel safety system should not depend on one line of defence. It should work in layers.Prevention attempts to stop the hazardous condition from developing through appropriate design, geological prediction, probe drilling, ground treatment, ventilation planning, maintenance and work planning.
Detection identifies developing hazards through atmospheric monitoring, airflow verification, instrumentation, geological observation and physical inspection.
Independent verification provides another means of confirming critical safety conditions where the consequences of error are severe.
Restriction and warning ensure that when an essential safety condition cannot be established, normal work does not continue simply because nothing adverse has happened yet.
Withdrawal and personnel accountability ensure that communication, evacuation and knowledge of who remains underground continue to function during degraded conditions.
Finally, controlled recovery should follow a deliberate sequence:
Identify the cause → Control the cause → Inspect → Verify → Independently confirm critical safeguards → Authorise resumption
The principle is simple: where failure of one barrier can expose many people, another sufficiently independent barrier should stop the progression.
Common-cause failure deserves particular attention
Some of the most dangerous situations arise when systems that appear independent actually share the same vulnerability.Consider combinations such as:
- Ventilation failure + electrical failure
- Gas rise + communication failure
- Water ingress + lighting failure
- Emergency evacuation + uncertainty about underground personnel
- Instrument failure + replacement supervision unfamiliar with the developing condition
- Emergency + shift change
A fail-safe approach should therefore consider not only individual failures, but also dependent failures, common-cause failures and simultaneous failures.
This is where thinking from fields such as RAMS, barrier management, functional safety, human reliability and resilience engineering can provide useful lessons for underground construction.
The objective is not to transplant another industry's standards blindly into tunnelling. It is to adopt the underlying engineering philosophy:
A safety function should remain dependable when it is actually demanded.
Compliance is essential—but it is not the final question
Tunnel construction is already governed by applicable codes, statutory provisions, contractual requirements, project procedures and safety plans. These remain fundamental.But compliance should be followed by another management question: “If the prescribed protection fails, what happens next?”
That question moves safety assurance beyond documentation. It forces us to examine whether a system has genuine defence in depth.
From recording safety to actively assuring safety
Construction projects generate large volumes of safety records. Measurements, inspections, permits, training and observations are all recorded. All of these are necessary.But recording safety is not the same as continuously assuring that the conditions required for safe work still exist.
A stronger management system should be capable of repeatedly asking:
- Are the required safeguards available?
- Are they still valid?
- Have underground conditions changed?
- Has ventilation demand changed?
- Has a critical protection become unavailable?
- Is an independent backup actually available?
- Has communication degraded?
- Has an abnormal event invalidated earlier assumptions?
- Are all personnel accounted for?
- Have all prerequisites for recovery genuinely been satisfied?
- Are several apparently minor failures now combining into something more serious?
Experienced engineers provide judgement. A properly designed rule-based system provides persistence, consistency and memory. The strongest system uses both.
A question I believe project leadership should ask
For an MD, COO, Project Director, Owner or Regulator responsible for major underground works, perhaps the most revealing safety assurance question is no longer: “Do we have a procedure for this?”Instead, ask: “Show me what happens when the person, instrument, ventilation system, power supply or communication arrangement on which that procedure depends becomes unavailable.”
Then ask: “What independent barrier prevents that failure from reaching the workforce?”
If the answer ultimately depends on the same person, same power source, same instrument, same communication route or same assumption, the protection may not be as redundant as it appears.
The direction tunnel safety needs to take
Underground construction will always contain uncertainty. Geology cannot be completely known. Equipment can fail. People can make mistakes. Conditions can change rapidly. Emergencies can combine.The objective therefore cannot be to design a safety system around the assumption that every component will always work exactly as intended.
The objective should be to make the overall safety architecture tolerant of foreseeable failure. That requires greater attention to redundancy, independence, verification, degraded operating conditions, human reliability, common-cause failure and controlled recovery.
The next advance in tunnel safety may therefore not come simply from more procedures, more instruments or more reporting. It may come from engineering the relationship between them so that: when one protection fails, another still stands between the hazard and the workforce.
The real test of a tunnel safety system is not how it performs when everything works. It is what happens when something does not.
