Please enable JavaScript.
Coggle requires JavaScript to display documents.
Dreamworlds Thunder River Rapids Ride failure that led to 4 fatality's…
Dreamworlds Thunder River Rapids Ride failure that led to 4 fatality's on the 25th of October 2016
Sequence of events
At 11:50 am on October 25th 2016 an electrical fault shuts down the south pump after a ride operator noticed a raft being held up as water levels where too low, a problem that is becoming more and more frequent The electrician is brought in to fix the issue and shows the level 3 ride operator how to restart the pump.. A short time later the ride is reopen to the public.
Operators where required to monitor the water level and shut down the ride including the conveyor if water started to drop.
Grout (2016) discusses the different factors that contribute to mistake-proofing in the design process and ways in which design can avert error. descriptions of fail-safing to prevent the effect of failure or mistakes while work is under way, are also discussed.
Equipment failure, warning signs and strange events will precede the majority of major accidents (Norman 2013)
At 1:09 pm a warning light is reported to be flashing, indicating the south pump has failed once again. the leading ride operator restarts the pump and reopens the ride at 1:25 pm. Procedure dictates the ride should be shut for the day after 3 alarms.
The only other warning that the pump has failed is by visually noticing the water level decrease, gauged by the water surfaces proximity to a scum line on the trough, built up over years of water flow.
At 2:03:50 pm The South pump is captured by CCTV camera, shutting down once again. Water can be seen flowing back through the pump.
No water level float or sensor present to detect a drop in the water level.
At 2:04:10 pm, number 6 raft becomes stuck at the bottom of the conveyor, on the support beams as the water level has lowered once more.
The new ride operator, trained that day, proceeds to try and raise the attention of the level 3 operator for further instruction. During the new operators training that morning, it was suggested that the emergency stop button isn't important and is only there for maintenance purposes.
Norman (2013) describes how human error is just an action that isn't appropriate for the requirements of technology.
At 2:04:50 pm, raft 5 begins it's decent on the conveyor towards raft 6 which is obstructing it's path.
It takes some time to raise the level 3 operators awareness of the situation.
At 2:05:03 raft 5 is caught on CCTV colliding with raft 6, both rafts are pushed together as the conveyor continues forward. A concertina effect occurs as raft six is wedged into a cross member, supporting the rails, pushing both rafts up into the air. Raft 5 remains vertical, stuck between the conveyor and the support rails while the conveyor continues to cycle, violently shaking the raft.
By the time the level 3 operator notices a failure is occurring, it is too late.
2 guests fell out and into the conveyor mechanism, another 2 where trapped under the raft. Of the 6 occupants, 4 died and 2 children escaped.
The System
The nature of the system
Human - machine system
(Human supervisory control)
Some automated aspects.
System parts
Main pumps: 2 in total (North and South), each responsible for an adequate water flow and level. Powered by 2 Danfoss VLT Aqua VLT 8502 Drives and each capable of pumping 4000 liters per second. Both drives where controlled by a VLD device which regulates the electricity to the drives as water flow in the ride dictate.
Rafts: 9 in operation, Fiberglass construction mounted on a rubber tube, seating capacity of 6
The trough: A concrete channel built to direct water flow and rafts. 1.3 meters deep and 410 meters long. A rapids effect is given to the waterflow by placement of log shaped obstructions at the bottom of the trough.
Raft support rails: Steel rails placed in the section between the conveyor and the end of the loading area to stop rafts from tipping over while guest where stepping on or off the rafts.
The Conveyor: Located at the end of the ride, it brings the rafts back up to the disembarkation and through to the loading area. It is chain driven by an electric motor. There are 2 lanyard emergency stops located on each side of the conveyor and one in the disembarkation area on a post.
Operator control panel: Located in the loading area and the only panel capable of controlling all the separate parts of the ride. It is positioned so the operator can see both the loading, unloading and conveyor areas and has a monitor displaying 5 CCTV camera angles at different stages of the ride.
Dispatch control panel: A button to dispatch each raft at desired intervals.
Ride operators: There are 3 levels of training and responsibility's for ride operators. Level 1 deckhands are stationed at the dispatch control panel and queue area, They seat guest's on the rafts and dispatch each raft. Level 2 operators are trained in start up, shutdown, emergency stops, operating the ride and diagnosing some problems. A level 3 ride operator is stationed at the main control panel and has the primary responsibility for the operating of the ride, level 3 also supervises the other operators. Level 3 ride operators undergo 1 full day of training while other levels only need 1 or 2 hours of training.
Water: The ride relies on a swift water current to propel the rafts through area's of simulated rapids along the length of the water trough.
System lifecycle
Design
Designed in house by Dreamworld, based upon the 1979 design of the "rapids ride" that was originally made by Intamin Amusement.
Construction
Constructed in place at Dreamworld
Commissioning
The ride first opened to the public on the 11th of December 1986
Operating and maintaining
Several alterations occurred in the first decade of operation, the most significant being the removal of 2 out of every 3 wooden boards from the raft conveyor, done sometime in the early 1990's in an attempt to reduce the frequent repair cost's on the conveyor chain, damaged from the additional weight and resistance in the water.
Design decisions can impact on a products sustainability and and will effect the product or system over it's whole lifecycle (Ramani et al. 2010)
The automated controller for the pump drive had been replaced 10 years before the incident took place. Danfos variable speed drives (VSD's) have a service life of 10 years and require very little maintenance over it's service life. Dreamworld was advised by the Danfos technician in 2015 to budget for new VSD's as the current ones in service are too outdated to source replacement parts. A quote for the replacement was provided later in 2015.
Decommissioning
After almost 30 years of service, the ride was decommissioned. The ride never reopened after the 2016 incident
Design failures
The wooden slats that are attached to the conveyor originally where causing damage to the conveyor chain, cogs and an axle between 2 cogs at the start of the conveyor. The added buoyancy, weight and resistance made by the wooden boards was too much for the running gear. By around 1990 the decision was made to modify the conveyor by removing 2 out of every 3 boards in an attempt to save on costs associated with repair. It didn't work with repairs still ongoing (McDougal 2020)
A large turntable was removed from the ride by around 1990. The turntable aided the rafts off the conveyor. It was constantly being repaired and serviced costing the company upwards of $22,000 a year to maintain. The turntable wouldn't operate correctly in wet weather. When it was removed, the raft guide rails where then installed at the end of the conveyor, where the incident took place in 2016.
Chao and Ishii (2006) Discuss the usefulness of a failure mode and effects analysis technique as a tool in working towards zero errors in the design process.
An alarm that transmits over every 2 way radio in the park when the pumps break down, failed to sound as it is manually activated from the control panel. No other method of detecting the water level was incorporated into the design.
The back flow when a pump shuts down is a design failure. several automated water level sensors or float sensors, could have been present allowing for the automatic shutdown of the ride. Leaving staff to be responsible for monitoring the water level is also a design failure.
Consultation with the end-user during any testing phases in the design process would have given the project a better chance of operating free of errors (Day, Toft & Kift 2011).
The Variable speed drives (VSD's) are an automated component of the pumps, ride operators have no control over the VSD's and have no warning when one fails
Latent errors in design are enacted by those that have no first hand contact with the interfaces, latent errors often remain hidden and tend to manifest when combined with other factors (Carpignano and Piccini, 1999). Having no control over the pumps variable speed drive is what overloaded the amperes feeding into the pump drive (a latent error in design).
A gap between the interface of the conveyor and the support rails is too big. a design modification that ultimately failed.
Issues
Management
Very little documentation kept that details the modifications made to the ride over the years.
Lack of purchase records with regards to the variable speed drives. Timelines and estimated dates of installation came from old staff members.
Workplace
Poor emergency stop button placements and no signage to notify public of an emergency stop as public also had access to the button incase of emergency.
Inadequate training of staff.
Lack of communication devices between the level 2 and 3 operators.
References
Norman, D 2013,
The design of everyday things
, revised and expanded edition. Basic Books, United States of America.
Grout, J R (2006). ‘Mistake proofing: changing designs to reduce error’,
Quality & Safety in Health Care
, vol. 15, no. 1, pp. 44-49.
Day, R, Toft, Y & Kift, R 2011, Error-proofing the design process to prevent design-induced errors in safety-critical situations.
Ergonomics Australia – HFESA 2011 Conference Edition
, viewed 25 August 2020,
https://d1wqtxts1xzle7.cloudfront.net/8544486/day_r.pdf?1328909394=&response-content-disposition=inline%3B+filename%3DError_proofing_the_design_process_to_pre.pdf&Expires=1598434481&Signature=aOwpa3EaDIdgIrshZyLoTB6lTwvvWYGhq0X2X0-gm4XAvnf-fWnz805q3KzcPsMQC0M69jxHk~OhYze9psPEN~merh9Y0RnBQASik-94ZlKYD172964kCWV24l6I4wP4pC2PgkfgihWuAwFzEwW9vsPhZaNkfxzrvt6lCfUi10C4YHQoGmW0RO0KwqSgttHDkpnlGh37AIeAWwY-RooPSEI5vYPzVWH5Gpadw~jxkVX67cKb-qUBKLQzLi0-5bWjBuXNLr6~tsRK7eM-mbCCf13BjjTEyXfvTfPpzlhPKRgqE2iJyRFE9QLWtaA8EYIKY75pPnsE4xlauayQs7jcKA__&Key-Pair-Id=APKAJLOHF5GGSLRBV4ZA
Chao, LP & Ishii, K 2006, ‘Design process error proofing: Failure modes and effects analysis of the design process’,
Journal of Mechanical Design
, vol. 129, no. 5, pp. 491–501.
Ramani, K, Ramanujan, D, Bernstein, WZ, Zhao, F, Sutherland, J, Handwerker, C, Choi, J, Kim, H & Thurston, D 2010, 'Integrated sustainable life cycle design: A review ',
ASME Journal of Mechanical Design
, vol 132, no. 9.
McDougall, J 2020,
Inquest into the deaths of Kate Goodchild, Luke Dorsett, Cindy Low & Roozbeh, Araghi at Dreamworld, October 2016
, Findings and Recommendations, Coroners court of Queensland, Brisbane.
Carpignano, A & Piccini, M 1999, 'Cognitive theories and engineering approaches for safety assessment and design of automated systems: A case study of a power plant',
Cognition Technology and Work
, vol. 1, pp. 47-61.
