Thunder River Rapids Incident Coronial Inquest Findings

[Ratbag93]

$2,000-$3,000.

 

Thats it. I can't believe it. 

It's incredible to think of the things alot of people can buy for that amount of money. 

- A Computer

- A Phone

-A Holiday

- A Dog (Seriously mine cost $3,500)

 It's a whack of cash but its also really not that much especially when you think about the fact that it cost four people their lives literally and so many others figuratively.

"852. Mr. Rutherford estimated that the cost of such a water level detection system 
being supplied and interfaced with the safety controller already installed, 
including dual diverse water level sensors, cabling installation, programming and 
testing/validation, would have been around $2000-$3000, had it been carried out 
at the same time as the other modifications in February 2016.

33 minutes ago, Brad2912 said:

And to think at the end of the day, a water level sensor - that’s lets be honest would seem like a stock standard instrument on ANY ride incorporating water - was all that was required to save 4 lives. In 30 years of operation, and probably 1000s of sets of eyes, no one thought that to be worth the pittance (in relative terms) It would have cost. 

 

 

By not putting a water level sensor in Dreamworld effectively put a price hunann life. It's unacceptable and unbelievable.

 

I hope they have and continue to change and learn. I know what I have said above it harsh but they have my favourite rides and I really want them to continue on a positive path where consumer confidence and the good times are restored. 

[webslave]

It's easy to look back now and say "$2,500 was what they decided a human life was not even worth" but that's hyperbole.  After all, it's no more meaningful than telling someone who had just killed someone in a car wreck that if they had just left 10 seconds later then it wouldn't have happened and that therefore they decided another person's life wasn't worth 10 seconds of their time.  Yeah, they totally should have done it but you never know at the time that's what's riding on it.

Here's a bit I found interesting;

Quote

648. With respect to statutory notices issued to Theme Parks or amusement devices since 2002 up until the tragic incident, Dreamworld received 34 notices, the highest for all of the Theme Parks, and the Ekka.1276Movie World and Wet N Wild for the same period, received no notices. Following the 25 October 2016, 17 notices were served on Dreamworld, with Movie World receiving two and Wet N Wild receiving one.

 

[Jamberoo Fan]

TECHNICAL CAUSE & CIRCUMSTANCES OF THE INCIDENT

Spoiler

Based upon the investigation, analysis and testing conducted on-site by Senior Constable Cornish, as well as consideration of supplementary documentary and physical exhibits, the technical timeline of the raft and conveyor movements shortly before and during the tragic incident, are as follows:

1. At 2:03:50, the south pump can be seen to stop operating as water is rapidly flowing back into the pump outlet.
2.  Raft 6 is observed to exit the conveyor system at 2:04:05 initially moving freely into the trough. At 2:04:10, it is then seen to become stranded on the raft supporting rails at the interface area due to the sudden drop in the water flow. 
3. As the conveyor continues to operate, at 2:04:22, Raft 5 approached the start of the conveyor before beginning to commence traveling the incline. At this time, Raft 6 had been stationary at the interface at the end of the conveyor for 12 seconds.
4. Raft 5 can be seen approaching the downside of the conveyor at 2:04:50. It is now apparent that Raft 6 is seated directly on top of the support rails with insufficient water height in the area to allow the raft to flow forward.
5. After Raft 6 has been stationary for 53 seconds, at 2:05:03, Raft 5 reaches the end of the conveyor and is released into the unloading zone. Contact between the two rafts first occurs at 2:05:03.
6. As the conveyor continues to operate, the rafts subsequently make contact three times. On each occasion, both rafts appear to move slightly forward, with Raft 5 bumping into Raft 6 causing it to move along the support rails before it comes into contact with the cross beam of the support rails. CCTV footage confirms that the conveyor is still in operation at this time, as the planks can be seen to be moving underneath Raft 5.
7. Following the third impact between the two rafts, contact is then maintained as they pivot upwards at the central contact point (2:05:06). This is because the force of the conveyor, an amount of compression between the contact point of each tube, the long plank and cross beam create a hinge point. The rear of Raft 6 and front of Raft 5 have then become slightly raised.
8. At 2:05:07, the rafts appear to become inverted at an approximately 90 degree angle. At this time, Raft 5 has become entrapped between the moving conveyor and the fixed leading edge of the support rails.
9. Raft 5 has continued to invert, whilst Raft 6 has dropped back into a level position on the support rails. Raft 5 was inverted for 7 seconds before the conveyor began to slow, before coming to a complete stop a further 8 seconds later. During this time, 22 planks (eight long and 14 sets of short planks) have passed through the area, which is in contact with tubing and fibreglass construction of the raft.
10. As Raft 5 became fully inverted, the conveyor continued to operate, causing the raft to shake violently, as each pass of the planks, long or short, damaged the raft ripping pieces of fibreglass from the tub construction. During this time, Raft 5 was pulled down within the interface void between the conveyor and supporting rails. At 2:05:11, Ms. Goodchild can be seen to be shaken from the raft. At 2:05:13, Mr. Dorsett also falls from the raft and into the moving conveyor drive axle and cog area. The conveyor can be seen to begin to slow at 2:05:14, coming to a final stop at 2:05:22.
11. The force and position of the raft has ‘pulled’ Raft 5 down between the conveyor and the support rails to a distance of approximately 45 centimetres. It was during this time that one of the air chambers of Raft 5 has become torn and deflated. The final resting position of Raft 5 is depicted below.

FINAL RESTING POSITION OF RAFT 5 & RAFT 6 - Ex B2, pg. 51

471. It is evident that it only took one minute and 17 seconds from the time the south pump failed until Raft 5 became inverted.

472. Investigators have established that within the first 15 seconds of a pump failure on the TRRR, approximately (200mm) of water height was drained. As Raft 6 entered the unload area, there was insufficient water flow for it to proceed forward over the support rails once it exited the conveyor. This occurred within 20 seconds of the pump failure.

473. Further testing conducted by Investigators following the incident confirmed that when one pump was not operational there was a difference in water level of approximately (400mm), which occurred over approximately one minute. When only one pump was in operation, it was found that there was insufficient water flow over the support rails in the unload area to allow rafts to pass over them. Within a minute, the rails can be seen to be exposed above the water.

474. Raft 6 was stationary for 53 seconds prior to coming into contact with Raft 5. It took four seconds for Raft 5 to become inverted, and to commence to shake violently whilst the conveyor continued to operate at its normal speed.

475. Given the violent nature of Raft 5 being pulled into the mechanism, Ms. Goodchild and Mr. Dorsett were released from their Velcro strap seatbelts and tragically fell between the moving conveyor planks, drive axle and cog mechanism. Ms. Low and Mr. Araghi, who were positioned at the rear of the raft, were subsequently caught within the moving mechanism of the conveyor belt during the period of inversion, and were pulled into the plank and cog mechanism as it continued to operate.

476. Raft 5 sustained significant damage to three of the six seats at the back of the raft where Ms. Goodchild, Mr. Araghi and Ms. Low were seated. There was no contact damage sustained to Raft 6.

477. Testing of the E-Stops at the TRRR by investigators following the tragic incident, in the presence of Dreamworld staff, confirmed that none of the E-stop’s had been activated at any time during the course of the incident. CCTV footage of the incident also confirms this finding.

478. Testing also revealed that the opening of the pump outlets within the pit area under the conveyor were at a level lower than that of the raft support rails. Due to this design aspect of the ride, and the large volume of water that is extracted during the reverse flow, the water drops below the level of the rails quickly.

DEPICTS NORTH PUMP OPERATING WITH BACKFLOW & EXPOSED RAILS - Ex. B2, pg. 87

Plank Damage and Observations

Spoiler

479. Investigators determined that during the course of the incident, eight large planks and 15 pairs of small planks were damaged. The type of damage observed ranged from small chips of timber being removed to small planks being split into two.

480. During examination of the planks on the conveyor, Senior Constable Cornish noted that there were some large planks that had a degree of concave and convex bowing along the centre. Video review of the CCTV footage suggests that the two ‘pivot’ planks passing under Raft 5 have a degree of convex bowing. Testing was attempted to replicate whether these planks could cause an inversion, however, this was unsuccessful.

Reconstruction of the Incident

Spoiler

481. A series of tests were conducted by Investigators with loaded and unloaded rafts in an attempt to reconstruct and replicate the incident. Whilst different set ups were utilised during the testing, with the rafts positioned and held by different methods, one test involved the holding of a raft in place in an attempt to replicate the positioning of Raft 6 whilst in a stationary position. The failure of the south pump was then emulated prior to the collision with a secondary raft. Whilst the raft inversion was not able to be replicated, the testing did reveal the following:

• Variations in the behaviour of the planks with the centre convex aspect were highlighted. Planks that bowed outwards were found to make considerably more contact with the floatation collar of the raft, gripping into wear strips and compressing the collar. During the inquest, Senior Constable Cornish noted that whilst the bowing of the planks could be a variable in the incident, he was unable to say with any certainty whether they played a part.
• The presence of the cross beam at the support rails near the unload area was found to restrict forward motion of the raft during the course of one test, and when this occurred, there was a ‘severe’ grab by a long plank at the rear of the raft on the wear strip of the collar.
• The resistive nature between the rafts floatation collars and the exposed support rail was evident during testing.

482. No inversion or pivoting of the rafts occurred during testing. Investigators opined that this may have been as a result of alterations in the positioning of the rafts during testing as opposed to the actual incident. Nonetheless, during testing, the resistive nature between the rafts floatation collar and the exposed support rails was evident, as was the prospect of a large movement of the second raft by the first, which would force it along the support rails to the area of the crossbeam.

483. It was observed during testing that whilst the conveyor continued to move, combined with the convex planks and 0.78 m gap between the long planks, this created an open area for the floatation collar to slightly drop within, which makes it easier for the plank to make substantial contact with the wear strips.

484. At inquest, Senior Constable Cornish stated that at the time of the reconstruction he did not have unrestricted access to a copy of the CCTV for the purpose of the positioning of the rafts.

FCU Investigation Findings as to Causation

Spoiler

485. Having considered the Operator controls, design and mechanical function of the components of the ride, as well as the Operator procedures and safety features, Senior Constable Cornish reached the following conclusions as to the causes and circumstances of the incident: 

1. The primary cause of the event was due to the failing of the south pump, which in turn led to a sudden drop in water level. It was proven during testing that a raft was unable to complete the circuit when only one pump was in operation. Water level monitoring for the ride was undertaken through visual observations by the Operator, using existing structures of discoloration of the trough walls. There was no automated safety system to monitor the water level and provide any audible or visual alert should the level fall below a safe operating level. 
2. Monitoring the operation of the pumps was also through operator observation by way of the ride water level, a small digital ampere reading and the sighting of pump activation lights on the control panel. This monitoring is in addition to the other responsibilities of the Operators, which include the safe loading of patrons into rafts. Given the normal sounds of the environment when the ride was in operation, it was noted that there was no discernible change in environmental noise when one pump failed, and only one remained in operation. There was no audible alarm or visual warning associated with the failure of either one of the pumps, combined with a full ride shutdown.
3. The two major components of the ride were the water pumps and conveyor, which were controlled independently of each other. Accordingly, when one of these components failed or malfunctioned, the other continued to operate. This was a factor during the incident, as the CCTV confirms that when the south pump broke down, the conveyor continued to operate at full speed, collecting Raft 5 and transporting it towards the unload area where the incident transpired. There is no automated electronic system recognizing the failure of one component which automatically ceases the operation of the other system.
4. Raft 5 became entrapped within the gap of the conveyor and the raft support rails. The intent of the raft support rails was to prevent the raft from dropping to the bottom of the trough and to reduce excessive heeling should the raft become unstable. Senior Constable Cornish noted that it could not be determined if the closure of the gap would have prevented or increased any loss of life, given there was no automated shutdown systems in place. Consideration should have been given to the potential risk of the gap exposure and prevention of injury.
5. The height of the pump outlets was below that of the support rails. As such, during a pump stoppage and subsequent reverse backflow, the water level rapidly reduced below the rails given water will find its lowest point with the least amount of resistance. Whilst the north pump was still operating leading up to the incident, it was visually noticeable that the majority of this water predominantly flowed back into the south inlet. Senior Constable Cornish noted that had the height of the inlets been above the support rails this may have slowed the water extraction and ensured that sufficient water and/or current was available for a greater amount of movement of Raft 6 upon its exit of the conveyor. 
6. Within the unload area there was an Emergency Stop button easily accessible by the unload Operator, or a member of the public. It was established that this button was not utilised during the incident.
7. The visual inspection of the Main Control Panel area revealed that there was an obscured view of the conveyor, particularly the area where the tragic incident occurred. Further, the CCTV monitors positioned at the Main Operator control panel did not have any available view of the unload area or end of the conveyor. Senior Constable Cornish noted that, in his opinion, had the view of the conveyor/support rail interface area been unobstructed and the CCTV positioned in a more easily visible position with more views available, the identification of the incident may have been prompter.
8. ‘Raft Safety Stops’ were installed at the beginning of the conveyor, which detected a stationary raft and shutdown the conveyor. Had the same sensor mechanism be in place at the end of the conveyor, it would have acted as a secondary stoppage device, in conjunction with the automated pump and conveyor shutdown as was also recently proposed to be installed.
9. Examination of the main operating panel revealed that there was no Emergency Stop for the conveyor, only a standard stop button, which took 8-9 seconds to stop the operation. The implementation of an Emergency Stop for the conveyor, or a full ride Emergency Stop, which would have reduced the shutdown protocols.
10. X. Throughout the testing procedures and review of the CCTV footage, it became evident that once the first raft became stationary atop the support rails there was no other mechanism, other than water current, to enable it to flow/move through to the unload area. XI.
11. The occupants were restrained in the raft by a large Velcro strap. There is no variation in the strap depending on the patron’s age, gender or size, nor is there any vertical adjustment of the belts. The locking mechanism was through the adhesiveness of the Velcro itself, with no secondary system. Had an alternate system, inclusive of a three or five point harness or a ride bar, as a secondary locking system to supplement the Velcro, this may have reduced the injuries to those killed, particularly Mr. Dorsett. XII.
12. Senior Constable Cornish expressed the view that the Operators had a substantial amount of tasks and functions to perform, in a short timeframe, whilst also conducting continued operational requirements. He opines that the lack of automated safety systems, audible alarms, CCTV range and situational awareness training were contributing factors in this incident.

486. In summary, Senior Constable Cornish found that:

…it was not one single event that caused the fatal incident that occurred on Tuesday the 25th of October 2016, but a series of preventable safety features, operating procedures and engineering design faults all occurring together within a short period of time…

In my opinion based on the information I have been supplied, the introduction of a simple water level alarm or other warning device(s), automated shutdown facilities or a change in operation procedures would have completely prevented this incident from occurring. Notwithstanding these modifications could have been introduced with independent evaluation and consultation from similar facilities worldwide. Acknowledging that the ride has been functioning for approximately 30 years, it must be known that advances in safety requirements and technology should be an integral part of any amusement ride and their maintenance and renovation programs.

487. During the inquest, Senior Constable Cornish described the TRRR as ‘severely’ lacking in any type of automation, which is readily available. He described the event as ‘twofold’ having occurred due to the design of the interface between the conveyor and support railings, as well as the lack of safety mechanism for the electrical system.

 

EARTH FAULT AND PUMP DRIVES EXAMINATION

Spoiler

488. Between 25 October and 2 November 2016, several electrical tests were conducted on the Danfoss Variable Speed Drives (VSD’s) following the tragic incident in order to establish a probable cause of the noted Code 14 ‘Earth Fault’.

History of VSDs at Dreamworld

Spoiler

489. A VSD is an electronic device, which is connected to electrical mains power and, depending upon the control system used, regulates the electric motor speed via electrical power cables from the output terminals of the drive. The VSD works as follows:

The electric motor converts electrical energy provided by the drive into mechanical energy in the shaft of the electric motor, which is mechanically connected to the water pump and therefore turns the water pump, which then draws water from the inlet pipe through the pump with the outlet of the pump into the watercourse of the ride.

The water flow and subsequent height of the water in the watercourse depends on the pump’s output flow, which is governed by the motor speed. The motor speed is determined by the power (voltage and frequency) output of the drive which is set by an operator or a control system.

…

The VFDs adjust the speed of electric motors by varying the output (frequency and voltage) of the electrical supply to the electric motor.

490. The design operating life of the VSD’s was 10 years, with the estimated average operating time per unit being 6,000 hours/year. According to Danfoss, under normal operating conditions and load profiles, the VSD’s are maintenance free throughout its designed lifetime, other than cleaning of fan filters etc. 

491. Prior to the tragic incident, Danfoss had been contacted in February 2012 by Dreamworld regarding the number of faults and repairs required of the two VSD’s since installation. Faulty parts were sent back to the factory for further analysis and the complaint was answered by Danfoss. A service history for the North and South Pump drives show that service jobs were performed in 2008, 2009 and 2012. In 2015, Danfoss Drives Help Desk were contacted by Dreamworld in relation to Earth Fault trips, which had been experienced on the South Drive.Assistance was provided to the technician onsite as to an assessment of the drive and it was suggested that an external wiring problem be explored, motor low insulation resistance and for a new control card and ribbon cables to be replace and tested to see whether the Earth Faults continued. Danfoss’ recordsnsuggest that AES swapped control cards with the North Drive when diagnosing the Earth Faults of the South Drive.

492. According to Danfoss’ records, Dreamworld had been advised that spares for the current drives were becoming limited and therefore, given the drives’ age and operating hours, they should start to budget for replacement drives if they required ‘reliable operation’. In 2015, Danfoss sales partner, Electronic Power Solutions, requested a quotation for replacement drives, which was provided to Dreamworld.

Testing on drives post incident

Spoiler

493. On 25 October 2016, Mr. Takac, an Electrical Services Technician with Applied Electro Systems Pty Ltd, attended Dreamworld to retrieve the ‘fault logs’ from the Danfoss VSDs. From 2009 until June 2017, Applied Electro Systems Pty Ltd were contracted with Danfoss as an authorised service partner. Records confirm that Applied Electro attended Dreamworld on a number of occasions during this time to carry out annual maintenance of the VSD’s and when requested to service the drives, including on the following dates: 

• June 2012 – Onsite commissioning of the VLT; and
• August 2013 – commission drive with new motor.

494. In 2015, Mr. Takac made a call to Danfoss Drives Help Desk to seek guidance as to ‘earth fault trips experienced on the south drive’. A help desk engineer provided assistance with the assessment of the drive. It was suggested that checks be undertaken to determine whether external wiring problems, motor low insulation resistance and to replace/test a new control card and ribbon cables be undertaken, to see if the Earth Faults trips continued. New control cards were purchased and exchanged in the drives.

495. In June 2016, Mr. Takac, on behalf of Applied Electro, attended Dreamworld to conduct maintenance of the VSD’s at the TRRR. However, he was unable to do so as the south pump had broken down and was not in operation. During the inquest, Mr. Takac confirmed that the requisite checks that needed to be carried out on the VSD’s, including input and output voltage and currents, could not be performed when one of the pumps was not in operation.

496. The logs taken following the tragic incident revealed that the ‘South VSD’ recorded eight trips, the first two of which were ‘heat seek temperature too high’ faults and the remaining six were ‘Earth Faults’. Mr. Takac was of the view that three faults appeared to have been recorded within a short time period. He expressed the view that the various faults could have been caused by a number of reasons both internal and external to the VSD.

497. According to the Danfoss Manual for the VSD, in relation to an Earth Fault it states, ‘There is a discharge from the output phases to ground, either in the cable between the frequency converter and the motor or in the motor itself. Turn off the frequency converter and remove the earth fault’.

498. The first series of testing was carried out by Mr. Christopher Sandry, Senior Electrical Safety Inspector, OIR, who attended the scene on the day of the incident and on a number of occasions following. He was present for a number of walkthroughs and information downloads from the drives during the course of the days he attended site.

499. Relevantly, on 28 October 2016, Mr. Sandry was requested by OIR to perform an insulation resistance test on the South pump motor. He determined that both the North and South pump motors needed to be tested in order to compare results. He isolated the supply to the South and North pump motor drives by turning off the pump circuit breakers in the switch-room, which was confirmed in accordance with ESO procedure. He then disconnected each pump motor supply cable from their respective drive units. The insulation resistance test between each pump motor cable and earth revealed a reading of OL, which indicates that the resistance value is higher than the instrument can register. The minimum value of insulation resistance to be deemed compliant by AS/NZS 3000:2007, the wiring rules, is 1 mega ohm. As such, the pump motors were deemed to have passed. On completion of the testing, Mr. Sandry reconnected all pump motor cables to their respective drive units.

500. Based upon the insulation resistance testing conducted, Mr. Sandy formed the view that the cause of the South Pump failure was the result of an intermittent fault in the pump drive unit.

501. On 2 November 2016, representatives from Danfoss Pacific, including Mr. Mike Smits, Danfoss Pacific Director and Mr. Eduardo Gie, the Technical and Engineering Manager of Danfoss Drives, Danfoss (Australia) attended Dreamworld to examine the Danfoss VLT AQUA VLT 8502 Drives in use on the TRRR, which ran the North and South water pumps at the TRRR. These drives had been in use at the ride since 2005. This was at the request of OIR for the purpose of visually inspecting the mechanical and electrical installation of the Danfoss drives, and to perform static and dynamic test procedures in line withthe applicable service manuals. Unfortunately, as the water pumps could not be run due to the water being drained, the dynamic testing could not be carried out.

502. Given the age of the two drives (approximately 10-11 years old) it was challenging to extract data from the units.

503. The data that was obtained from the drive disclosed no recent Fault Trips on the North Drive, however, the South Drive recorded six recent Earth Faults, Trip Locked (Error Code 14). The last three of these six fault alarms occurred within two hours. An Earth Fault (Error Code 14) is described as follows,

‘…a discharge from the output phases to earth, either in the cable between the frequency converter and the motor or in the motor itself. The drive relies on three current transducers to measure the output currents drawn by the motor, and when the addition of the three output currents are above 48% of nominal current of the VLT 8502 (658A) for 10 µsec it results on a Trip Locked Fault. A Trip Locked Fault is only cleared by cycling the main power supply and then a Local Reset to the frequency converter. As per drive’s settings the reset function (Par. 400) was set to infinite and the auto restart time (par. 401) to 10 sec. Meaning that drive, during a Trip Locked condition, would have been ready to start the motor 10 seconds after cycling the mains supply, without the need to apply local reset.’

504. In a statement provided by Mr. Gie for the purpose of the coronial investigation, he noted that an Earth Fault is usually caused by conditions external to the drive and nothing was observed during the site visit, which would indicate that the faults were caused by an internal drive component. The static test procedures conducted by Danfoss show that the main drives’ components were within the range at time of measurement, except the fans mounted on the enclosure door. As such, the root cause of the earth faults leading up to the tragic incident could not be determined.

505. Ultimately, a cause as to the Earth Fault could not be determined.

 

 

Edited February 25, 2020 by Jamberoo Fan

[New display name]

@webslave DW knew the rafts could flip and did nothing.   You're not looking backwards if you already know the outcome of a situation.   

Edited February 25, 2020 by Skeeta
I spelt/spelled new like an idiot.

[webslave]

Just now, Skeeta said:

@webslave DW new the rafts could flip and did nothing.   You're not looking backwards if you already know the outcome of a situation.   

Actually, they knew there was a possibility the rafts could flip and decided they had done enough about it.  As we now know, they had not.  There's a difficult to determine but nonetheless distinct difference between knowing about a risk and believing you'd done enough to mitigate it and knowing about a risk and continuing to take it even though you know you hadn't done enough to mitigate it.  That's why criminal charges are so hard to make stick with this stuff.

The reality is that in almost every incident there's a case of an entity thinking they have done enough to mitigate a risk and finding out that they had not, or indeed not even having identified the risk in the first place.  For all of the attention and the tragic outcome this unfortunately boils down to both (depending on who we are talking about).

[DaptoFunlandGuy]

1 minute ago, Skeeta said:

@webslave DW new the rafts could flip and did nothing.   You're not looking backwards if you already know the outcome of a situation.   

Agree - the coroner mentioned this and I'm pretty sure it was in one of my rapid fire updates - they argued 'hindsight bias' as influencing the views that something so cheap and simple could have fixed it.

(For those who don't know what that means, here's a copypasta slab complete with wiki references:

Quote

Hindsight bias, also known as the knew-it-all-along phenomenon^[1] or creeping determinism,^[2] refers to the common tendency for people to perceive events that have already occurred as having been more predictable than they actually were before the events took place.^[3][4] As a result, people often believe, after an event has occurred, that they would have predicted, or perhaps even would have known with a high degree of certainty, what the outcome of the event would have been, before the event occurred. Hindsight bias may cause distortions of our memories of what we knew and/or believed before an event occurred, and is a significant source of overconfidence regarding our ability to predict the outcomes of future events.^[5] Examples of hindsight bias can be seen in the writings of historians describing outcomes of battles, physicians recalling clinical trials, and in judicial systems as individuals attribute responsibility on the basis of the supposed predictability of accidents.^[6][7][2]

This was Dreamworld's argument before the coroner - that everyone can see how predictable the events were in hindsight.

 

The coroner emphatically rejected this claim of hindsight bias, and used the examples of the MULTIPLE previous historic incidents over more than a decade as justification that the incident was VERY predictable.

Further, the coroner stated it was more a case of good luck than good management that nobody had been injured previously.

1 minute ago, webslave said:

decided they had done enough about it.

The coroner also stated that a risk assessment had NEVER been completed on the ride operation in 30 years. And that any competent person could see the risks.

 

[webslave]

9 minutes ago, AlexB said:

The coroner also stated that a risk assessment had NEVER been completed on the ride operation in 30 years. And that any competent person could see the risks.

Which is, of course, an interesting thing for him to say when his report actually references risks that had been assessed on the ride by several parties.  Perhaps some obtuse wording on his part.  For example;

Quote

284. Whilst the scope of these risk assessments varied somewhat, it is clear from the material provided that a documented engineering risk assessment of the ride, adequately considering the hazards posed by different components or the ride as a whole, was never conducted. This is particularly troubling having regard to the previous incidents already documented.

285. Based upon the documentation, a summary of the ‘risk assessments’ conducted on the TRRR is outlined below. Given the limited and poor record keeping and databases maintained in relation to such assessments, it is not possible to determine if any further undocumented assessments were conducted, and what changes if any were subsequently made.

286. On 9 July 2015, Mr. Deaves, Mr. Alex Navarro, Mr. Shane Green and Ms. Anneke Triebels conducted a ‘risk assessment’ of various aspects of the TRRR, including breakage of the conveyor chain and the depth of the watercourse. It is not clear what the catalyst was for this risk assessment. Ms. Horton does recall two instances were rafts had slid down the conveyor, whilst on the mechanism.

Furthermore, later in his report he goes on to state that several purportedly competent persons had looked at the ride and either failed to see the risk, or indeed considered the risk mitigated.  I believe the implication here is that none of these were ultimately competent persons in the literal sense.  Unfortunately this isn't solely a Dreamworld issue - these issues extended through a number of engineering firms and the OIR itself.

Edited February 25, 2020 by webslave

[New display name]

6 minutes ago, AlexB said:

MULTIPLE previous historic incidents over more than a decade as justification that the incident was VERY predictable.

This needs to be highlighted.  

DW put money ahead of guest no two ways about it.  We all thought DW was looking like a shithole and DW was not spending money on the upkeep of the park, but we never thought it went to the level of DW not spending money on keeping the rides safe.  Well it turned out Ardent was making a killing in profits and killing people at the same time. 

Cost cutting on safety is something you think would happen if a company was in trouble and not to turning a pretty penny.

 

 

[Jamberoo Fan]

EARTH FAULT AND PUMP DRIVES EXAMINATION

Spoiler

Recommended Course of Action in Response to an Earth Fault

Spoiler

506. According to Danfoss, their recommended course of action to ascertain the root cause of an Earth (Ground) Fault Alarm #14 is as follows: 

1. Disconnect the mains supply to the VLT 8000;

2. Remove the motor cables from the drive end;

3. Measure the insulation resistance of the motor winding and earth, including the motor cables, with a test voltage > 500 V;

a. A low resistance measurement would mean a faulty motor, damage cable insulation, or presence of moisture in the motor cable and/or motor windings.

b. A high resistance value, in other words reading open, will require further investigation.

4. Power up the drive without the motor cable connected, start the drive and read the motor current from the display. Any offset current reading .2A on the VLT’s display without motor connected suggests the need for the re-calibration of the current sensor offset by doing an Automatic Motor Adaptation (AMA) procedure, select ‘RUN LIMITED AMA’ option in para 1-07.

5. If the Alarm 14 keeps re-occurring after doing the AMA procedure, now with motor connected to the drive, there is either a large offset in the current sensors outputs, problem with the control card, problem with the +/-15 volts power supply on the power card that supplies the sensor circuit, a bad connection between the control card and sensors, etc. In this scenario a service call should be arranged to identify the faulty component within the drive.

507. It was noted that sometimes intermittent earth fault alarms, which occur more often over time, can be attributed to slow motor insulation resistance degradation.

508. During the inquest, Mr. Takac was asked what his advice would be if he had been informed that there had been an Earth Fault over a number of days, and then in quick succession on the same day. He stated that he would recommend that the client ‘obviously, stop the machine and not use it and investigate deeper what that earth fault is’. Mr. Takac noted that a recurrent issue like that requires ‘a lot more thorough testing’.

Mr. Ritchie’s Assessment of the Fault Prior to the Tragic Incident

Spoiler

509. Prior to the incident, it was Mr. Ritchie’s assessment that the earth fault was no more than an inconvenient and intermittent issue, which did not pose any risk to guest or Ride Operator’s safety. During the inquest, he acknowledged that he had consciously made a decision that the ‘intermittent fault’ would not be a danger, as long as the operating procedures were followed.

510. At the time of the incident, Mr. Ritchie states that as the fault was happening ‘so intermittently (four times in six days to my knowledge) and because I had already contacted the experts to come and have a look at the situation, I did not consider that it was necessary to shut the ride down or take any further steps as there was no risk to staff or guests’.

511. During the inquest, Mr. Ritchie gave evidence that it was his firm view that the ‘Alarm 14’ error was caused by an internal fault in the drive, rather than the motors. When challenged with the definition of the alarm as contained in the operating manual for the drive, which stated that ‘there is a discharge from the output phases to ground either in the cable between the frequency converter and the motor or in the motor itself’, Mr. Ritchie disagreed. He was of the view that an Earth Fault could not be intermittent. However, he was unable to explain, given his diagnosis, why during the QPS testing of the ride, which involved some 200 starts and stops, the drives didn’t fail. He based his opinion on ’42 years’ experience as an industrial electrician.

 

Edited February 25, 2020 by Jamberoo Fan

[webslave]

Let's also bear in mind here that as far as I've read the report doesn't say that automated water level monitoring alone would have been enough to prevent this - it needed to be linked (preferably) to a non-administrative action which would have been to command the PLC to halt the conveyor.  It's been a little while since I've read over that part, but I believe there's also some risks with stopping the conveyor, so these also would have had to have been mitigated.  To try and dress this as a 'simple' $10k modification is erroneous.

[DaptoFunlandGuy]

15 minutes ago, webslave said:

Which is, of course, an interesting thing for him to say when his report actually references risks that had been assessed on the ride by several parties.  Perhaps some obtuse wording on his part.  For example;

Furthermore, later in his report he goes on to state that several purportedly competent persons had looked at the ride and either failed to see the risk, or indeed considered the risk mitigated.  I believe the implication here is that none of these were ultimately competent persons in the literal sense.  Unfortunately this isn't solely a Dreamworld issue - these issues extended through a number of engineering firms and the OIR itself.

A risk assessment on the ride operation was never completed in 30 years.

Individual hazards were assessed for risk, but not a wholesome view - each hazard was assessed in isolation.

The coroner also mentioned in his findings, that controls (mainly administrative ones) were put in place to mitigate risks (reactionary) without considering what other hazards those controls caused, which is why a whole-of-ride assessment (that was never done) should have been.

2 minutes ago, webslave said:

Let's also bear in mind here that as far as I've read the report doesn't say that automated water level monitoring alone would have been enough to prevent this - it needed to be linked (preferably) to a non-administrative action which would have been to command the PLC to halt the conveyor.  It's been a little while since I've read over that part, but I believe there's also some risks with stopping the conveyor, so these also would have had to have been mitigated.  To try and dress this as a 'simple' $10k modification is erroneous.

The section of the report that covers the new sensors installed - which is also the section that discusses whether a water level sensor should also be installed - does mention that the rollback and chain break sensors weren't just alarms - they were wired into the PLC systems to stop the ride \ ride components when the sensors indicated a fault.

So if the additional water level sensor HAD been isntalled, one can assume, based on the operation and programming of the other sensors, that the water level sensor would also have been wired into the PLC, and programmed to stop the ride.

You're reaching here mate. they fucked up. And any competent person responsible for safety and risk management in the park should have seen that coming. The trouble is - Dreamworld didn't have one.

[Levithian]

1 hour ago, webslave said:

It's easy to look back now and say "$2,500 was what they decided a human life was not even worth" but that's hyperbole.  After all, it's no more meaningful than telling someone who had just killed someone in a car wreck that if they had just left 10 seconds later then it wouldn't have happened and that therefore they decided another person's life wasn't worth 10 seconds of their time.  Yeah, they totally should have done it but you never know at the time that's what's riding on it.

Here's a bit I found interesting;

 

It's not evwn remotely the same.

It's different when youve had multiple incidents in the past that have lifted the rafts due to water level; youve had an incident where it was shown one of your most experienced operators was not able to manage the ride operation when a low water level fault occurrs, placing people in danger; By your own proceedures acknowledge low water levels are an extremely dangerous situation,  cause for a ride stoppage due to safety issues; 

AND

The issue had been highlighted a number of times in the past by inspections and staff and was considered important enough to quote for the upgrade, but was never acted upon. 

20 minutes ago, webslave said:

Let's also bear in mind here that as far as I've read the report doesn't say that automated water level monitoring alone would have been enough to prevent this - it needed to be linked (preferably) to a non-administrative action which would have been to command the PLC to halt the conveyor.  It's been a little while since I've read over that part, but I believe there's also some risks with stopping the conveyor, so these also would have had to have been mitigated.  To try and dress this as a 'simple' $10k modification is erroneous.

Experts testified exactly that. Including one of the police investigators.

The 10k cost included water level and plc upgrade. 

Heres an example. This expert was one tasked by the Office of Industrial Relations to investigate the ride control systems and its operation after the incident..

Edited February 25, 2020 by Levithian

[webslave]

2 minutes ago, AlexB said:

A risk assessment on the ride operation was never completed in 30 years.

Individual hazards were assessed for risk, but not a wholesome view - each hazard was assessed in isolation.

The coroner also mentioned in his findings, that controls (mainly administrative ones) were put in place to mitigate risks (reactionary) without considering what other hazards those controls caused, which is why a whole-of-ride assessment (that was never done) should have been.

Absolutely, the amount of administrative controls in-play here is quite staggering and quaint.  I personally also don't see how any remotely competent person could have looked at this ride which has almost no automated safety measures in the last decade (if not longer) and said "yes, it's acceptable to me to put this much reliance into humans".  I guess the problem here is that a number of people who were supposedly competent were able to justify it to themselves and those that they report to.

8 minutes ago, AlexB said:

So if the additional water level sensor HAD been isntalled, one can assume, based on the operation and programming of the other sensors, that the water level sensor would also have been wired into the PLC, and programmed to stop the ride.

I'm not sure I can assume that, since if you're prepared to make that assumption you would surely also have to be prepared to make the assumption that a one-button e-stop would also exist.  Reading the information in this report tells me that we could have assumed nothing of these people.  It's entirely plausible to me that they would have wired it in and had it flash a light at the control panel - certainly more plausible than the notion that they might have done it right.

10 minutes ago, AlexB said:

You're reaching here mate. they fucked up. And any competent person responsible for safety and risk management in the park should have seen that coming. The trouble is - Dreamworld didn't have one.

Please don't read my comments as a mitigation of Dreamworld's actions or an attempt to say that they did not fuck up.  They most certainly did, and that's very clear in the report.  What I'm encouraging us to do is to actually read the report and understand it rather than just doing media sound-bytes.  Dreamworld didn't have one, for sure.  They also never managed to engage the services of one.  The regulator also failed in their duty to identify any of this, and were in my view wholly deficient too.

In fact, one of the more interesting things to come out of this report for me is that I don't believe the ride operators have any significant culpability here.

[Levithian]

Heres another from the senior investigating the incident.

"WOULD HAVE COMPLETELY PREVENTED THIS INCIDENT FROM OCCURRING".

[webslave]

4 minutes ago, Levithian said:

Experts testified exactly that. Including one of the police investigators.

The 10k cost included water level and plc upgrade. 

Are we talking about this section?

Quote

132. This upgrade was intended to include the following: - The addition of a 7-inch Proface Touch Screen which would monitor all alarms, monitor the water level and monitor the pump loads; and - Upgrade the controls of all arrival and exit gates.

133. It was estimated that the additional cost for this further component to the upgrade, which would ‘future proof this system for years to come’ was $10,000.Mr. Ritchie was of the view that this increase to the scope of work would allow for the necessary infrastructure to make the ride capable of future automation projects, which may be considered, and would also improve the state of the wiring at the Main Control Panel, which would enable faster electrical fault finding in the future.

134. In relation to the monitoring of the water level at the TRRR, Mr. Ritchie was of the view that water level sensors could be installed, which would monitor the operating efficiency of the pumps. He was aware that the pumps for the TRRR accounted for approximately 30% of Dreamworld’s overall electricity bill, and such monitors may allow for the performance of the pumps to be adjusted to increase or decrease the operating capacity, thereby leading to a significant cost saving.

135. This memorandum was sent to Mr. Deaves by Mr. Ritchie via email. Subsequent discussions were had whereby Mr. Deaves advised that whilst he supported the additional work proposed, it could not proceed at this stage, with the focus to remain on the upgrades to the bottom of the conveyor. Mr. Ritchie understood that the potential hazard identified at the bottom of the conveyor needed to be rectified as a priority. He did not consider that a delay to the second stage of the project would have a negative impact on guests’ or Operator’s safety.

Because, if so, I may not be reading that the same way you are.  I don't see anything in that which tells us that in the case of a drop in water level this system would disable the conveyor.  Instead, my reading of this is that if there was to be monitoring of the water level it was intended as an efficiency measure, rather than a safety measure.  I can't see anything here that indicates as part of the scoping of the project that they considered it a safety measure.

 

15 minutes ago, Levithian said:

Heres an example. This expert was one tasked by the Office of Industrial Relations to investigate the ride control systems and its operation after the incident..

Yes, that supports my suggestion that water level monitoring alone was not enough here - the important part is interfacing it to the conveyor system.

[Levithian]

6 minutes ago, webslave said:

Are we talking about this section?

Because, if so, I may not be reading that the same way you are.  I don't see anything in that which tells us that in the case of a drop in water level this system would disable the conveyor.  Instead, my reading of this is that if there was to be monitoring of the water level it was intended as an efficiency measure, rather than a safety measure.  I can't see anything here that indicates as part of the scoping of the project that they considered it a safety measure.

You missed the reasoning for the proposal, not the physical plans for the upgrade. Its in the paragraph above it. Starts at paragraph 129.

Edited February 25, 2020 by Levithian

[webslave]

1 minute ago, Levithian said:

You missed the reasoning for the proposal, not the physical plans for the upgrade. Its in the paragraph above it.

Maybe I'm still missing it here (and if so I apologize), but I'm not seeing anything in paragraphs 128-130 that indicate that they considered a drop in water level had anything to do with operating the conveyor.  They seemed totally focused on rollbacks and stranding of a raft at the bottom of the conveyor, rather than water level and stranding at the top of the conveyor.  Taking that entire section as a whole the only time they talk about water level monitoring is in reference to efficiency rather than safety.

[DaptoFunlandGuy]

27 minutes ago, webslave said:

if you're prepared to make that assumption you would surely also have to be prepared to make the assumption that a one-button e-stop would also exist. 

No. Because the investigation showed that they brought a company in to upgrade PLC and sensors, and eventually a touch screen control system. That company installed the chain break and raft sensor, and wired it into the PLC, and quoted for the water level sensor but were told not to proceed.

So it IS an easy assumption to say, that if they installed the water sensor, they'd have wired it to the PLC. A one button stop was also discussed, and not proceeded with.

31 minutes ago, webslave said:

In fact, one of the more interesting things to come out of this report for me is that I don't believe the ride operators have any significant culpability here.

These were some of the coroner's first words - he essentially cleared the ride operators of any fault.

[webslave]

1 minute ago, AlexB said:

No. Because the investigation showed that they brought a company in to upgrade PLC and sensors, and eventually a touch screen control system. That company installed the chain break and raft sensor, and wired it into the PLC, and quoted for the water level sensor but were told not to proceed.

So it IS an easy assumption to say, that if they installed the water sensor, they'd have wired it to the PLC. A one button stop was also discussed, and not proceeded with.

That would be true if they considered low water level a reason to stop the conveyor, which I haven't seen any evidence of. You could well be right that they would have, but I'd have a hard time based on what I've read in this document believing that they'd have gone that far prima-facie.

[Levithian]

14 minutes ago, webslave said:

 

Yes, that supports my suggestion that water level monitoring alone was not enough here - the important part is interfacing it to the conveyor system.

How can you infer that? It clearly states and is the view of multiple parties that a safety feature that monitored water levels is what was needed. 

The conveyor is already monitored and gated. How is it the problem? 

That they are proposing is that the water level monitoring would have, within seconds of the pump stopping, halted the conveyor. This would have caused a ride safety fault. This was 100% relied upon by humans to judge.

The report found this completely unacceptable, because even someone completely aware of the water level dropping would not be expected to react in time, and the difference between human and automated process would prevent an incident like this occurring 100%

Its why they keep ramming home the phrase risk assessment. Its literally a document that studies what is at risk, the potential for injury or death, how this risk can be mitigated or removed completely. 

They are so common they are used daily, across multiple facets. It shouldnt have even been a yearly thing, one should have been performed anytime someone was to work on the ride or attend a shut down because there is a massive risk to staff when working on plant equipment like this, so assessments remove complacency about the dangers of being in that environment. Following multiple shutdowns, the incidents should have been debriefed within the management team. Dreamworld acknowledged they have meetings that do exactly that, address failures and breakdowns. This is when further risk to ride operation should have been discussed.

Its why the report finds there is a systemic failure within the management of the park as every level of management ultimately failed to manage the risk. 

 

[DaptoFunlandGuy]

2 minutes ago, webslave said:

That would be true if they considered low water level a reason to stop the conveyor, which I haven't seen any evidence of.

The ride operators manual considered pump failure to be the most serious issue - code 6 "operation ASAP". And the procedures for pump failure included initiating a shutdown of the ride including the conveyor.

around 1 minute passed between pump stoppage, until impact. Even if the PLC initiated a slow stop at the time of pump failure, it would still have been fast enough to prevent this, even based on the minimum 30 second despatch times.

I get what you're saying - nowhere is it spelled out bluntly that that is what it was for, and you can't take anything for granted given the gross negligence and ignorance, but there's enough there that even if water level was a cost factor first and a safety factor second, it'd still have been within scope and therefore under the PLC control in the pump interlocks.

[webslave]

Just further to this - and perhaps somewhat in conflict with a couple of the other quotes provided here recently - these comments by Dr Frank W. Grigg, Forensic Engineering Consulting Pty Ltd strike me as interesting (my bolding);

Quote

855. Dr Grigg noted that an automatic shutdown of the conveyor in the event that one of the pumps failed would have prevented the incident from occurring. Furthermore, had a means of detecting a stranded raft in the unload area been installed, which stopped the conveyor, the tragic incident would have been prevented, as had been the experienced in 2001. In relation to the incident in 2001, Dr Grigg concluded that this ‘provided clear operational experience of what could occur in the event that the movement of a raft became blocked after being discharged from the conveyor, even without pump failure and water level dropping’.

Interestingly enough, this would suggest to me that such an incident was capable of occurring without the water level dropping, which begs the question as to whether water level monitoring and action (which would have been enough in this incident) was going to be a sufficient mitigation overall.  It's fair to say that shutting down the conveyor when the water level dropped in this case would have prevented this incident - but would it potentially have allowed a similar incident regardless?

I guess I'm taking exception to the notion that a $10k upgrade that included a water level sensor (of which it's in dispute whether this sensor was intended to stop the conveyor) was all that was needed to here to prevent disaster.  It's certainly a possible mitigation, but we know others were missed too - to focus all of the attention on a missing water level sensor is myopic.

[New display name]

7 minutes ago, webslave said:

h it's in dispute whether this sensor was intended to stop the conveyor) was all that was needed to here to prevent disaster.  It's certainly a possible mitigation, but we know others were missed too - to focus all of the attention on a missing water level sensor is myopic.

Do you think if the pump didn't stop and the water level didn't drop the raft would have still flipped in this case?

[webslave]

5 minutes ago, AlexB said:

The ride operators manual considered pump failure to be the most serious issue - code 6 "operation ASAP". And the procedures for pump failure included initiating a shutdown of the ride including the conveyor.

This is very true, however;

Quote

Procedural Manual and associated supplementary memorandums, Professor Sanderson noted that: The manual does not specify the timeframe by which a shutdown needs to be performed in the event of a pump failure;

Now, I may have forgotten by now if I read a part in the document where it says they considered what risk a pump failure actually caused to the operation of the ride, but I'm not sure if they ever properly made a link between the water level dropping requiring the immediate shutdown of the conveyor.  

7 minutes ago, AlexB said:

I get what you're saying - nowhere is it spelled out bluntly that that is what it was for, and you can't take anything for granted given the gross negligence and ignorance, but there's enough there that even if water level was a cost factor first and a safety factor second, it'd still have been within scope and therefore under the PLC control in the pump interlocks.

I'd very much hope it was in scope too.  I think we both get where each other is coming from, I guess in my case I just don't have the faith that they properly got the link between broken pump and conveyor.  I mean, was that link clearly apparent to all of us before the incident?  Personally, I think there's a stronger link (if I'm looking to mitigate a risk of collision/rollover caused by the conveyor) between an obstruction at the end of the conveyor and the conveyor itself.  After all, for me I'd be of the opinion that since an obstruction can happen with or without a drop in the water level that you're better off (and this assumes you're only going to test for one condition) making provision to detect an obstruction rather than detect low water level. 

Just now, Skeeta said:

Do you think if the pump didn't stop and the water level didn't drop the raft would have still flipped in this case?

In this case?  No.  But that line of argument has flaws because it can be applied to more than just the water level.  Would this case have still happened if;

- If the water level didn't drop? No.
- If the nip point didn't exist between the conveyor and the rails? No.
- If they conveyor wasn't missing slats? Unlikely.
- If the rails weren't there in the first place? No.
- If the training/labeling on the conveyor e-stop was adequate? Probably.
- If the ride hadn't already been taken out of service due to successive failures? No.
- If the ride had interlocking detection for a jam/obstruction at the top of the conveyor? No.

But I encourage you to look beyond this one incident and at the safety of the ride overall - could you have had a raft flip if;

- If the water level didn't drop? Yes.
- If the nip point didn't exist between the conveyor and the rails? No.
- If they conveyor wasn't missing slats? Possibly.
- If the rails weren't there in the first place? No?
- If the training/labeling on the conveyor e-stop was adequate? Probably.
- If the ride hadn't already been taken out of service due to successive failures? No, but this could have happened without prior failures.
- If the ride had interlocking detection for a jam/obstruction at the top of the conveyor? No.

[New display name]

24 minutes ago, webslave said:

 In this case?  No. 

I'm not looking beyond the incident because the inquest was about the incident.