Tunnel Boring Machine Safety Certification: What Must Be Verified?

Tunnel boring machine safety certification starts with a question: does the evidence cover the actual machine, its intended use, and the conditions in which it will operate? A manufacturer’s declaration or component certificate can support that judgment, but neither automatically establishes that the complete TBM is safe to assemble, commission, operate, maintain, and dismantle underground.

A sound review connects applicable requirements to the machine’s design, protective functions, test results, operating instructions, and project interfaces. It also separates equipment conformity from site authorization: a conforming machine can still be unsuitable for a particular geology, tunnel layout, ventilation strategy, or emergency plan.

Establish the certification boundary before reviewing documents

Start by identifying the market where the TBM will be placed into service and the legal framework that applies there. Machinery requirements, electrical rules, pressure equipment obligations, and underground construction duties can involve different parties and different forms of evidence. A declaration, an independent examination, and a site operating permit are distinct documents with different purposes.

For example, in the European market, CE marking and the accompanying declaration concern conformity with applicable legislation; they should not be treated as a universal third-party certificate for the entire project. Whether independent assessment is required depends on the applicable rules, equipment and conformity assessment route. Elsewhere, local machinery, mining, construction, or electrical requirements may lead to a different approval process.

The scope must describe the equipment being assessed. A TBM is an integrated installation, potentially including the cutterhead and shield, thrust and steering systems, trailing backup, conveyors, transformers, ventilation connections, grout plant, and personnel access arrangements. Some systems may be supplied by separate contractors or installed only after delivery.

Request an equipment boundary drawing and a list of exclusions. Then assign responsibility for each interface. If the TBM supplier excludes the tunnel conveyor, for instance, the project still needs to establish who provides emergency-stop integration, guarding, fire precautions, and safe access at the connection.

Match the risk assessment to the intended ground and construction method

A useful risk assessment describes foreseeable tasks and conditions, rather than listing generic hazards. It should cover normal boring, interventions, cleaning, fault finding, maintenance, recovery, and dismantling. It should also identify assumptions about ground behavior, groundwater, gas, alignment, tunnel gradient, and the method used to support the excavation.

Those assumptions affect the suitability of the machine. A pressurized-face TBM, for example, needs procedures and equipment appropriate to face-pressure control and chamber access. An open machine operating in competent rock presents a different combination of exposure to unsupported ground, falling material, dust, and moving equipment. A design assessment for one setting should not be accepted unchanged for another.

Check that significant risks are linked to protective measures and that any remaining risks appear in the operating instructions. If a hazard is controlled by a site procedure, identify the person responsible for that procedure and the conditions required for it to work. A statement that “the operator must ensure safety” is not a substitute for defining the machine’s limitations or providing the necessary protective features.

Examine safety functions as complete systems

Emergency stops, interlocks, speed limits, pressure limits, and access controls depend on more than individual switches. Their effectiveness relies on sensors, wiring, controllers, power supplies, actuators, and the behavior of the connected machinery.

For each significant safety function, ask what initiates it, which movements or energy sources it controls, and what state the equipment reaches after activation. A stop command may need to affect the cutterhead, screw conveyor, belt conveyors, hydraulic equipment, or other connected machinery differently. The correct response depends on the hazard: stopping one system without coordinating another can create a separate problem.

• Emergency stops: Check their location and accessibility along the machine and backup, including positions where people work near moving equipment. Review the stop zones, reset method, and prevention of unintended restart.
• Guards and interlocks: Inspect access to rotating, crushing, and drawing-in hazards. Verify that removable or movable guards and their interlocks suit maintenance tasks as well as production.
• Control-system integrity: Review the design basis for safety-related controls, including fault detection, loss of power, communication failure, and any bypass arrangements. The required level of integrity should follow the risk assessment and applicable requirements.
• Isolation: Verify that electrical, hydraulic, pneumatic, mechanical, and stored energy can be isolated and controlled for the tasks described. Isolation points need to be identifiable and usable by the people performing the work.

Component certificates are useful supporting evidence, but they do not demonstrate that a completed circuit performs its intended function. Seek functional test records for the assembled system, including relevant interfaces and foreseeable faults. Where a test cannot be performed before site assembly, the open item should be carried into the commissioning plan with a named owner and acceptance criterion.

Review underground hazards and the systems that control them

Fire, smoke, and evacuation

Inspect the fire-risk assessment against the machine’s actual layout and materials. Hydraulic fluids, electrical equipment, cables, conveyors, and confined spaces can affect both ignition risk and fire spread. Review detection, alarms, suppression or extinguishing provisions, and the ability to isolate equipment where appropriate.

Evacuation arrangements must work with the tunnel’s overall emergency strategy. Check routes through the backup, access around equipment, emergency lighting, communication points, and any refuge or rescue provisions assigned to the machine. A fire system on the TBM does not by itself establish that smoke control, rescue access, or evacuation from the tunnel is adequate.

Ventilation, dust, and hazardous atmospheres

Identify where the machine produces dust, fumes, heat, or potentially harmful gases, and how those hazards will be monitored and controlled. The machine supplier and ventilation designer should agree on connection points, operating assumptions, alarms, and responses to inadequate airflow.

Where the geological assessment indicates a potential for flammable gas or another hazardous atmosphere, review the equipment selection and operating procedures against that scenario. Electrical suitability, gas detection, ventilation, and shutdown arrangements must be considered together; a detector alone does not make equipment suitable for use in a hazardous atmosphere.

Ground support and pressurized interventions

Examine how workers install support and segments, including handling aids, pinch points, access to the erector, and protection from material falling into work areas. The review should connect the machine’s support capabilities to the project’s expected ground conditions and construction sequence.

For machines that require entry into a pressurized excavation chamber, examine the intervention concept as a separate safety-critical activity. Relevant evidence may include the design and examination records for pressure-containing equipment, access and communication arrangements, emergency provisions, and procedures for competent personnel. The project must also address the medical and operational arrangements associated with compressed-air work where applicable.

Electrical, hydraulic, and mechanical evidence

Electrical review should cover the supply interface, protective devices, earthing, cable routing, enclosure suitability, and protection against environmental conditions expected underground. Look for a clear distinction between the permanent machine installation and temporary site power arrangements. A change in supply characteristics or protection coordination can affect the assumptions used in the original design.

For hydraulics, inspect provisions for pressure relief, hose protection, leak control, and safe release of stored pressure. Where suspended components or pressurized accumulators can retain energy after shutdown, the maintenance instructions should explain how they are secured before intervention.

Mechanical verification should address load-bearing structures and lifting arrangements as well as moving parts. Review the design basis and inspection records for elements involved in cutterhead handling, segment lifting, assembly, and dismantling. A lifting point’s documentation needs to match its intended configuration and load path; a general statement about the machine’s strength is insufficient.

What evidence should be in the review package?

The document set varies with the market and contractual scope, but it should allow a reviewer to trace each material risk from identification through control and verification. Request documents for the delivered configuration, including revisions made during manufacture and assembly.

• A declaration or other conformity documentation appropriate to the applicable market, identifying the machine and responsible entity.
• The machine description, intended use, operating limits, boundary drawings, and list of excluded equipment.
• A risk assessment with the protective measures, assumptions, and residual risks relevant to the supplied configuration.
• Electrical, hydraulic, pneumatic, and safety-control documentation sufficient to understand protective functions and interfaces.
• Inspection, examination, and test records, including functional tests and any outstanding site tests.
• Instructions for assembly, commissioning, operation, isolation, maintenance, emergency response, and dismantling.
• A register of modifications, concessions, open defects, and actions transferred to the site team.

Check identifiers and revision numbers across the package. A test report for an earlier control configuration, or a manual that omits a later conveyor modification, may no longer demonstrate the condition of the supplied machine. Where parts of the detailed technical file are retained by the manufacturer, agree on the evidence and access needed to support the review.

Close the gap between factory acceptance and site readiness

Factory acceptance can demonstrate many functions, but it may not reproduce the assembled TBM, site power supply, tunnel communication system, ventilation connection, or full conveyor arrangement. Site commissioning should therefore test the interfaces and operating conditions that could not be represented earlier.

Use an action register to connect each open item to its owner, required evidence, and point of closure. For example, an emergency-stop test may need to show that a stop device on the backup initiates the intended response in a separately supplied conveyor. A ventilation alarm may need to be checked with the installed sensor and the project’s actual control interface.

Reassess the affected risks when equipment is modified, relocated, or used outside its stated limits. Replacing a control system, adding an extension to the backup, or changing the intervention method can alter the protective measures on which the original assessment depended. The final decision to operate should rest on the assembled configuration, completed verification, resolved interfaces, and a site plan capable of controlling the risks that remain.