Thunder River Rapids Incident Coronial Inquest

[rappa]

Would be good to know what the labels were. Anything labeled Emergency Stop MUST remove all energy from the system, so can't just stop one thing. 

Similarly if it's a red button on a yellow background regardless of the label (if any) it is implied that this is an Emergency Stop and should function as above. 

[New display name]

45 minutes ago, AlexB said:

If my understanding is correct, then the instructions 'not to use' and 'nobody uses that' kind of make sense. In an emergency, you would want an 'all stop' not just a 'stop the conveyor' so it does kind of make sense in most scenarios.

The second e-stop was installed when the turntable was removed so the unloader could stop the conveyor belt if an issue arrived while unloading passengers.  The operator on the control panel had an obstructed view and would often be facing the other way while performing their duties.  First the controller had to be alerted before that e-stop would be pushed.

It doesn't make sense because the unloader only needs to control the area in which that person oversees.   If the unloader is having an issue, then the unloader needs the ability to shut down their area.  Not somebody who isn’t giving the unloading area any attention.

 

Look at Parkz photos.

Who out of these 2 operators will see an issue unfolding in the unload area first?

Who out of these 2 operators will be able to respond the quickest?

 

 

 

Edited June 18, 2018 by Skeeta

[DaptoFunlandGuy]

22 minutes ago, djrappa said:

Would be good to know what the labels were. Anything labeled Emergency Stop MUST remove all energy from the system, so can't just stop one thing. 

Similarly if it's a red button on a yellow background regardless of the label (if any) it is implied that this is an Emergency Stop and should function as above. 

This is not disagreement, but what if the "system" the second button was installed on was 'just' the conveyor?

Couldn't one have a 'conveyor belt emergency stop' that ONLY stopped the conveyor? It isn't reliant on any other part of the ride - if the conveyor stopped, no other operating part of the ride could cause danger to the conveyor part of the ride... could it?

I'm not arguing this is, or isn't how it was actually set up, i'm just trying to get an understanding of the terms, and rules applying to those terms as you've explained it...

[New display name]

I don't know the rules around the stop buttons and by the the sounds of it the 2 operators has 2 different views too.

[pushbutton]

I'd have expected that there had to be 2 emergency stop buttons, both of which completely and quickly stopped the whole ride. They should be placed well apart, and if there's 2 operators each should have fast, easy access to at least 1 of the buttons.

Oh, and most definitely no operator should EVER be discouraged from using the emergency stop button, provided they honestly believe there is a reason to do so (having been trained on these reasons prior to being allowed to operate the ride).

[Brad2912]

Detective Sergeant Nicola Brown told the inquest the ride operator who was near the only emergency stop button did not know what it was for.

The ride operator was not aware the button could stop the conveyor belt in two seconds.

The control panel only had a “slow stop” of the conveyor belt.

She said the ability of police to gather information from Dreamworld “could’ve perhaps been better”.

Sgt Brown said Dreamworld provided all the information requested but the format it was in made it difficult to decipher and determine which documents were relevant.

The court also heard the ride did not have an emergency stop button which disabled all of the components of the ride.

Sgt Brown said a second stop button brought the conveyor belt to a stop, but took seven seconds to completely stop.

She said safety audits had previously recommended a single emergency stop button be installed.

Det Sgt Brown also told the court there had been a recommendation in 1999 that an emergency stop button that shut off rides immediately — rather than taking seven seconds to shut down — be installed.

“The 1999 recommendation of positive energy stop didn’t happen then or even later,” Mr Fleming asked.

“No,” Det Sgt Brown said.

So reading that - there is NO positive energy stop on the ride?? WTF? A full shutdown required both buttons to be pushed? 

[New display name]

Yes @Brad2912 That's what we have been saying.  The button at the conveyer belt was the button that needed to be pressed to stop it.  Operator 1 and operator 2 disagree if operator 2 was told to push this button in an emergency.

[pushbutton]

Some pretty shocking comments being made so far by the sound of it. Seriously, there is NO excuse for any organisation not taking all the reasonable steps they can to prevent incidents which could put people in serious danger.

That's definitely well and truly covered by Work Health & Safety Legislation though. If that turns out to have been breached in any way (and it might well have been numerous times by the sound of the above) Ardent is going to be in very serious trouble, and rightly so.

[AllegroCrab]

Really goes to show how nothing ever really is a complete unforeseeable accident. Also how there's never only one cause for an accident.

[pushbutton]

5 minutes ago, AllegroCrab said:

Really goes to show how nothing ever really is a complete unforeseeable accident. Also how there's never only one cause for an accident.

Actually some accidents are completely unforeseeable. In such cases, that's actually when it really is an accident (nobodys fault).

However some of the comments in this thread would indicate circumstances which definitely were foreseeable, and actions that definitely should have been taken (but apparently weren't. If that's the case it's not an accident at all, but a preventable tragedy which wasn't prevented.

Edited June 18, 2018 by pushbutton

[New display name]

It's a bit early to be calling it @pushbutton

[rappa]

2 hours ago, AlexB said:

This is not disagreement, but what if the "system" the second button was installed on was 'just' the conveyor?

Couldn't one have a 'conveyor belt emergency stop' that ONLY stopped the conveyor? It isn't reliant on any other part of the ride - if the conveyor stopped, no other operating part of the ride could cause danger to the conveyor part of the ride... could it?

I'm not arguing this is, or isn't how it was actually set up, i'm just trying to get an understanding of the terms, and rules applying to those terms as you've explained it...

No that's the problem. You can't have an Emergency Stop button attached to a piece of equipment (ie the ride) that doesn't stop all parts of the ride and remove all energy (read that's not just electrical power). Otherwise it isn't an Emergency Stop. 

A 'conveyor stop' button say black in colour is perfectly legal though and doesn't have to remove power. 

The whole thing is ridiculous anyway. There should have been both an interlock between the pumps and the conveyor as well as safety logic that stops the conveyor on a station backup like what occurred. 

The ride had neither. It was a majorly deficient control system. 

Edited June 18, 2018 by Roachie

[pushbutton]

6 minutes ago, Skeeta said:

It's a bit early to be calling it @pushbutton

Yes it is. I'm not the person who'll call it anyway. I'm just merely giving my initial response to the comments I've read in this thread!

[Slick]

 

 

 

Edited June 18, 2018 by Roachie

[DaptoFunlandGuy]

25 minutes ago, djrappa said:

No that's the problem. You can have an Emergency Stop button attached to a piece of equipment (ie the ride) that doesn't stop all parts of the ride and remove all energy (read that's not just electrical power). Otherwise it isn't an Emergency Stop. 

A 'conveyor stop' button say black in colour is perfectly legal though and doesn't have to remove power. 

The whole thing is ridiculous anyway. There should have been both an interlock between the pumps and the conveyor as well as safety logic that stops the conveyor on a station backup like what occurred. 

The ride had neither. It was a majorly deficient control system. 

I assume a typo in your first line "you can't have..." - if i'm wrong, apologies.

 

I understand what you're saying if everything is looked at as a whole (which I agree it should be) however if it were considered a separate system, isn't it feasible?

A hypothetical example - we all know about the gantry rig "helicopter" at AOS. Now, I have no knowledge of this thing at all, but I would assume that the gantry rig itself has some sort of 'E-stop' which can be pressed by the 'pilot' or someone else (say an operator backstage) that shuts it down... and that isn't that big of an assumption to make...

However, I also imagine that show-control also has a 'big red button' which would stop not only the chopper, but every single thing wired to show control...

thus a 'separate' system is designed to work under a 'master control' but still has its own "e-stop" to shut down just that system in an emergency...? Or (assuming the gantry was in some way industry standard equipment) would they have to remove an inbuilt "red-with-yellow" button when they install a bigger, redder button elsewhere that is wired to shut down other, separate systems?

I'm honestly trying to understand this for my own sake, and not trying to be argumentative for the sake of it - but in case i'm still not explaining my difficulty in understanding - here's one more ludicrous example:

If someone were to wire in an "emergency stop" button at some 'big office' in a park, that could literally E-stop EVERYTHING in a park - would that render all the 'e-stops' on each individual attraction, show and device illegal, and require them all to be turned into a standard black 'stop' button, simply because a 'higher' e-stop existed higher up in the control chain?

 

I'm mindful about clogging this thread up with tangents though, so appreciate whatever answer you can give me and i'll leave this one at that for now.

[webslave]

I'm not particularly familiar with the term "positive energy stop".  Is this a term used to describe a system that uses energy to stop a mechanical element (eg; if you had a flywheel it would apply friction braking)?  The seven second delay on conveyor stop seems strange itself, much would the idea that they conveyor would coast (except, perhaps, backwards if it was loaded?).

Probably barking up the wrong tree here.

[Slick]

1 hour ago, AlexB said:

I assume a typo in your first line "you can't have..." - if i'm wrong, apologies.

 

I understand what you're saying if everything is looked at as a whole (which I agree it should be) however if it were considered a separate system, isn't it feasible?

A hypothetical example - we all know about the gantry rig "helicopter" at AOS. Now, I have no knowledge of this thing at all, but I would assume that the gantry rig itself has some sort of 'E-stop' which can be pressed by the 'pilot' or someone else (say an operator backstage) that shuts it down... and that isn't that big of an assumption to make...

However, I also imagine that show-control also has a 'big red button' which would stop not only the chopper, but every single thing wired to show control...

thus a 'separate' system is designed to work under a 'master control' but still has its own "e-stop" to shut down just that system in an emergency...? Or (assuming the gantry was in some way industry standard equipment) would they have to remove an inbuilt "red-with-yellow" button when they install a bigger, redder button elsewhere that is wired to shut down other, separate systems?

I'm honestly trying to understand this for my own sake, and not trying to be argumentative for the sake of it - but in case i'm still not explaining my difficulty in understanding - here's one more ludicrous example:

If someone were to wire in an "emergency stop" button at some 'big office' in a park, that could literally E-stop EVERYTHING in a park - would that render all the 'e-stops' on each individual attraction, show and device illegal, and require them all to be turned into a standard black 'stop' button, simply because a 'higher' e-stop existed higher up in the control chain?

 

I'm mindful about clogging this thread up with tangents though, so appreciate whatever answer you can give me and i'll leave this one at that for now.

You wouldn't have one e-stop for multiple attractions because there's no logical justification in the first place. Same with Outback Spectacular - you don't need to wire the helicopter's e-stop in with AV because the speakers and the projectors doesn't pose a safety risk to paying punters, only the big mechanical thing moving about does.

From what i've read today there's a lot of mis-use  of the term e-stop so let's re-clarify with the world's most trusted source, Wikipedia:

Quote

known as an emergency stop (e-stop) and as an emergency power off (EPO), is a safety mechanism used to shut off machinery in an emergency, when it cannot be shut down in the usual manner. Unlike a normal shut-down switch or shut-down procedure, which shuts down all systems in order and turns off the machine without damage, a kill switch is designed and configured to abort the operation as quickly as possible (even if it damages the equipment) and to be operated simply and quickly (so that even a panicked operator with impaired executive functions or a by-stander can activate it). Kill switches are usually designed to be noticeable, even to an untrained operator or a bystander.

Now let's take it a step further, in Australia, Omron defines the difference between a normal button and an e-stop button:

Quote

An Emergency Stop Switch must be highly visible in color and shape, and must be easy to operate in emergency situations. The following requirements are specified in the European Standard EN 418 (International Standard: ISO13850).
 

1. A direct opening mechanism must be installed on the NC contact.

2. There must be a self-holding function.

3. The button must be a "mushroom" head design or something equally easy to use.

4. The button must be red and the background must be yellow.

In addition to the 4 points mentioned above, the emergency stop control circuit must have countermeasures for each category.

here is no difference between a general-purpose push button switch and an emergency push button switch regarding the function of the NO contact.

A general-purpose push button switch doesn't have a direct opening mechanism on the NC contact. If the contact welds, conduction will be maintained and the device cannot be stopped in a hazardous situation (load). If this occurs, the device may keep operating in the hazardous state. Therefore, use the NC contact of an emergency stop push button switch for safety applications.

There's other sources like Safework which are worth a read - but here's the long story short, if it's not clearly an e-stop button and it doesn't do what an e-stop button is supposed to do, then it's not an e-stop button, and that's a huge issue.

From everything i've read today, there's a lot of conflicting information about buttons and ride history from journos live-tweeting inside the hearing so i'll be continuing to keep my ear on the ground as this develops - remember this is day one and already it's been draining to say the least.

Edited June 18, 2018 by Roachie

[rappa]

Thanks for the pickup AlexB on my typo. 

To answer your example. The 'big red button' at outback did stop everything. For the very reason that it's the 'law'.

When additional elements were added to that show the 'old' button that continued to only act on the helicopter had to be swapped to a different colour, be renamed, and have a placard attached that stated it acted on the chopper only and was not an EStop. 

 

So back to rapids, any components that interact with others must be all considered part of the one 'system' and thus an actual EStop must act on all. 

 

If youre super bored then what you want is the Australian Standard for Machine Guarding. That will give you all this info. 

[RossL]

For it to even be debated whether the e-stop was implemented correctly or not, is pretty damning to be honest.

How many other Dreamworld rides do (/did) not have a clear e-stop?

[Brad2912]

My guess would be none, now. 

[Brad2912]

Quality work again by GCB, they have a timeline of all the events, here is a couple of the “events”... hmm, anyone spot the problem? 

[ambe_bambe]

7 hours ago, Brad2912 said:

Quality work again by GCB, they have a timeline of all the events, here is a couple of the “events”... hmm, anyone spot the problem? 

Didn't know grizzly peak was a part of Dreamworld now....

[pushbutton]

Detailed report in Courier Mail

 

[reubot]

Ardent may as well give up:

Dreamworld reputation 'irretrievable' after inquiry evidence: analysts (ABC)

The operators being told not to use the emergency off/not knowing about it is probably the most damning.

Edited June 18, 2018 by reubot

[pushbutton]

20 minutes ago, reubot said:

Ardent may as well give up:

Dreamworld reputation 'irretrievable' after inquiry evidence: analysts (ABC)

The operators being told not to use the emergency off/not knowing about it is probably the most damning.

As is the fact that numerous warnings were ignored from previous safety audits, and previous incidents. 

Totally unacceptable.