Building Better Ride Safety Regs

One of my former bosses used to tell me, “I have made a good living fixing ‘perfect’ rides”. What he meant by that is that sometimes manufacturers are so caught up in their “perfect” design, that any problems that come up have to be someone else’s fault.

On a particular Wild Mouse, there was a problem with cars occasionally shooting part way into the next block, and setting up the ride. Of course, this never happened when the manufacturer was on site. Everything would be checked, the ride would be tested, and nothing would be found. And the system would be returned to service, only to have it happen again. Maybe not that day, or even that week, but it was going to happen again. The braking system in the trouble area involved using variable speed motors on a frequency drive. There was a conventional caliper brake set ahead of this section. So with the manufacturer’s blessing, we slowed down the release speed of the caliper brakes. This reduced the frequency of the problem, but did not make it go away.

We tested, troubleshot, tried everything we could think of. The electrician there took to taking his breaks in the control room, to see if he could see anything. One day, he was using the computer to watch the drives. I am not sure what he was looking for, but as luck would have it, he was there.  As the car came into the drive, the current went up, the bus voltage went way up - and the drive faulted. And then it reset itself!

Just then, the overtravel fault came in. He called me at home. I initially couldn’t believe that the manufacturer had set the drive to reset itself on an overvoltage fault. I had the electrician send me the files, as well as the drive’s fault log. And there it was.

During commissioning, the manufacturer had been having trouble with the drive handling the braking energy. When a frequency drive regens, it has to get rid of the energy. A conventional frequency drive cannot put the energy back on the bus, so it uses a resistor to dissipate the excess. There is a limit to how much energy the resistor can dissipate. Apparently, the drives were faulting, so instead of resolving the problem, either with bigger drives, or a bigger brake resistor, they just set the drive to fault, reset, and go on.

Most of the time, this little trick worked for them. Every so often though, when the temperature was high, a car was heavily loaded, and the stars were aligned, it didn’t work. Instead of recovering in time to stop the car, it slid into the next zone. And as the drives aged, it seemed to happen more often.

The point of this story is that the manufacturer is not always right. And that is why they need someone looking over their shoulder.

Today I want to open a rant on safety rated devices. Not the devices themselves. I am a big fan of safety rated PLCs, relays, sensors. The whole safety rated device movement is a great thing for safety in general, and ride safety in particular.

No, what I am concerned about is the people who when you ask them about their safety system say ” oh yeah it’s safe, we got ourselves one of them big red safety rated PLCs.”

The problem here is one of understanding what the red box does for you. The red box has been designed and tested to prevent failures, and make sure that when it does fail, it does so in a way that is predictable and detected. But that design only works if the device is applied properly. If you mis-apply a safety rated device, it is no different than any other switch, relay, or PLC.

I fell into this trap myself several years ago. One of the “I’ve got a barn” manufacturers was putting in conveyance type ride. The ride had a semi-manual transfer track system. The cars on this system were powered by a bus bar system. There was an interlock between the bus bar and transfer track system, that was to make sure the bus bars were only powered when correctly connected to either the main track or storage track. When I went to discuss the interlock with their engineer, he pulled open the enclosure, and proudly displayed the red relays. “Safety relays” he grinned. Then he showed me the red limit switches - “safety switches”. Being an ugly american, I still tried to ask questions. Then he pulled out the big gun “this system has been approved by (insert name of major third party European certification agency here)”. Oh my. They obviously have done everything right! And I fell for it.

A year or so later, an electrician came into my office, and asked me to come out to this ride. He placed the transfer track in the middle of it’s travel (and totally out of position with either track) and pushed the button to power the bus. Both of the pretty red relays pulled in, and the bus powered up. All the bus - main line and transfer. With the car aimed out into space.

Now, this by itself is not going to cause an incident. When a car is being transferred, the ride is under the control of a maintenance person. Even with the car powered, this maintenance person would have to take certain steps to cause a problem. And there would never be guests in a car at this point.

Still - it’s not supposed to happen. So what went wrong? Well, the safety rated limit switches are designed to be used so they are forced open in what is supposed to be the “safe state”. Ordinarily, the switches on a transfer track would be set up to make the switches when you are on the side to be powered. So transfer side, the transfer side switches are made, and the bus for the transfer side is on. On the main line side, the main line switches are made, and the bus for the main line side is on.

To match the design of the safety switches, the manufacturer reversed the logic. When you are on the transfer side, the switches are forced open, which prevents the main line side from turning on. When you are on the main line side the switches are forced open, which prevents the storage side from turning on. Again, they did this because the safety switches are designed to be used this way. The switches are not designed to be used with the springs driving the contacts when you are in what is to be the safe state. So if you aren’t in either position, you can turn all busses on!

A diagram would probably help, but think of it this way - on a normal system, the limit switch on the transfer side turns on the transfer power. On this system, the limit switch on the transfer side turned off the main line power.

I don’t know how this was approved by the well known European third party reviewer, because we never got to see their report. I would be curious to see what was in it.

Now there are multiple ways to fix this. One would be to stitch weld a target for the switch all the way across the track, so that the only position where the switch can be made is in it’s home position. The problem with that is a lot of welding, plus the little rollers they put on limit switches would not last long in that application.

Another solution would be to leave these switches as they were, and then add a set of switches in the conventional configuration. We used a modification of this, changing the single pole switches for a double pole. So one set of contacts turned on the power for that side, and made sure that the power for the other side was not on.

So again, this illustrates why the owner and inspector must be aware of how the safety systems work, and ask lots of questions. Don’t take the manufacturer’s word for it. Ask questions, make sure you understand how the system works, and don’t let them hide behind the latest fad or technology. They may not understand their new toy any better than you do. And on that safety rated PLC - remember that PLC is only as good as the program inside it. Test, test, test test.

Earlier I talked about testing new systems, and how important it is to check out new systems fully. In the second of those articles I mentioned a story about cosmoline. The point I want to make this week involves how very small changes can have a big impact on a ride system. And how important it is to fully review any changes that are made.

The lead story here involves cosmoline. For those of you who don’t know, cosmoline is a rust inhibitor. The ride manufacturer I worked for used a brass/bronze material for brake pads, and mild steel for the brake fins. Our shipping department was constantly fielding complaints about pretty new trains coming in with rusty brake fins. So one day, I arrived to commission a ride, and was greeted by pretty brake fins coated with something yellow. Cosmoline, a rust preventive. I knew nothing about the stuff, nor did the mechanical guy with me. We called the office, and they told is it was cosmoline, but didn’t have any other information for us. So we proceeded getting the ride ready, just as we always did. The second or third day, when we were ready to run the train around, we transferred it on, and sent it up the lift.

This ride had a block brake, as well as a new element. The mechanical guy wanted me to stop the train in the block brake, and then release it into the new element from a stop. We watched the train go up the lift, around the track, and right through the block brake! I made sure the ready brakes were set, as well as the station brakes and we waited.

Straight through the ready’s around the hairpin turn, through the station brakes, and back up the lift! I was so shocked, I didn’t think to stop the train on the lift. So around it went again. And I got to watch again as the train went through the 3 sets of impotent brakes. This time, I had enough forethought to stop the lift. Once the train was safely stopped. We went to examine the brakes. The first thought was that we had the wrong valves, or something, that was not closing them. They were all tightly closed. We couldn’t pry them open with a 6 ft pinch bar.

Our next step was to examine the train. The yellow brake fins. Aha! The cosmoline was slick. Almost like a lubricant. Now we had our answer. We also had a coating of cosmoline on every brake throughout the entire ride. Including the side track. After several hours cleaning brake fins and pads with solvent, we had operational brakes again.

But what if this had happened with a replacement fin on an operating ride? Say one with multiple trains running? A single fin coated in cosmoline could have contaminated all of the brakes.

Another example of this problem happened when a mechanic at a park tried a new method of installing the brake pad rivets. It had always been difficult to install the rivets, which had to be put in from one side, and then have the crimping tool applied to the other side. So one bright mechanic decided to use masking tape to hold the rivets in the holes while he turned the brake shoe over and applied the tool. Worked like a charm. Unfortunately, the masking tape left a film on the brake pads. The film was not as slick as the cosmoline, but was still enough to prevent the brakes from completely stopping the train, which then gently rolled into the station, and was stopped - by the other train.

I can give you other examples of timers changed by just a few seconds, counters allowed just a few more counts, or sensors moved just a few feet. Then of course there was the ride where a different material was used on the anti-rollbacks (not on of ours).

Manufacturers are not immune to this kind of problem. The cosmoline change was a manufacturer’s change. And I have had to deal with some problems on a ride system where the manufacturer changed to another type of wire rope, which caused all kinds of problems until we determined that the new rope was shedding lubricant.

Any change to a ride system needs to be approached with the utmost caution, and should be reviewed by someone knowledgeable in that ride system. The manufacturer is your best source, but if they no longer exist or respond, try other parks with the same system, or find a good third party you can trust.

I was going to do a follow up to the buckets, or a blog on the 18 year old operator thing, but sometimes I have to chew on these topics before I really can put them out. So I am dropping back to a previous subject I have been rolling around in the back of my head.

In an earlier post, I talked about the need for testing all of the features of a system, before you put people on then. That was really brought home to me when I was doing a tram system in Juneau Alaska. My employer was a subsidiary of a French company. The mother ship had done numerous trams, but we hadn’t done one on this side of the pond. Fortunately, the parent company followed many of the IEC standards, and had excellent and extensive documentation on the design of all of their systems. Still, you are always nervous when you do your first solo.

At the time, I had only done lifts that ran in a loop. I had my roller coaster design years behind me, but still everything there ran in a loop (later on I promise to publish a story about brake fins and cosmoline). I hadn’t worked with anything that had a hard stop at the end. Then when you take a 50 passenger bus, hang it on a pivot point running on a cable, with lots of potential motion, and a hard stop at each end, it caused me some concern.

Fortunately, as I have noted before, my employer was big on testing everything. So one day, after the braking system was all tuned in, and the electric drive was up and running, it was time to set up the diesel-hydraulic evacuation system. Now I expected no problems with this system. Yes, it used a hydraulic pump and motor, while our single direction lifts could use a torque converter, but still, I was very familiar with the Cummins diesel controls, the hydraulic system passed all of our static tests, so, what could go wrong?

So I put the cabins about a 100′ or so out of the terminals, and started commissioning the diesel system. Yep, I can run it forward, I can stop it, I can run it backwards, I can stop it. I can control the speed. Ok, time to test an e-stop.

When the e-stop is pressed, it cuts the fuel to the diesel, as well as zeroing the swash-plate on the pump. Now the hydraulic system was not completely tuned in, so at zero, it drifted a little.

There was an interlock between the speed and the brake dropping. For the first so many seconds, the brake wouldn’t close until the speed dropped below a threshold. This is to prevent unnecessary wear on the brakes. After that time, the brakes dropped to ensure that you stopped no matter what.

I hit the e-stop, the swash-plate came to almost zero - and the diesel kept on running. Ok, so I have some distance to work with, but those diesels have got to go down, or I will have to drop the brakes. They should drop before we break anything, but still, it makes you tense. I ran up to the motor room, to see what I could figure out, threw the manual valve on the fuel line on both diesels. Still they ran on. Just then, the brakes dropped, and halted the slow creep. The cabin had a little swing, but nothing worrisome. And still the diesels ran on.

I had heard horror stories of diesels scavenging their lubricating oil to burn, but I had always been told that didn’t happen on a Cummins. If they were burning the lube oil, they were going to be severely damaged if I didn’t get them stopped. I was starting to look for a way to block the air intakes when…… they died.

On a a gasoline engine, it takes spark, air and fuel to run. Kill anyone of the three, and you are stopped. Of course, spark is the easiest to kill (remember the little metal flipper that you used to use to kill the spark on old lawn mowers?). On a diesel there is only air and fuel, the ignition comes from the high temperatures caused by the diesel’s high compression ratio.

Ok - the panic is over. Now let’s get the mechanics up here, and figure out what is going on. First they checked the engines out. Lube oil was fine, everything seemed Ok, all of the gauges show in range. Then we tested the solenoid valve that killed fuel. Yep, we could hear it actuate. We tried starting the diesel with the solenoid off. Nope, doesn’t get fuel. We locked the brakes closed, to make sure we didn’t have any creep, disabled the hydraulic drive, and started the diesels up. They started fine, ran well, gauges looked good. Then we killed power to the solenoid valve.

And the engines ran on.

We tried the hand valve - and still they ran. I don’t remember how long the ran (15-30 seconds maybe? Seemed like forever!) and then like before, they stopped.

Come to find out, the return line from the fuel pump to the tank had not been plumbed. The port was just plugged. So the fuel pump was running the injector rail full of fuel to some ridiculous pressure. And with the mechanical injector system on these diesels, they weren’t going to stop until the injector rail was empty.

Now imagine if the first time that the hydraulic drive had been used had been when they really needed it. And rather than being someone familiar with all of the systems, this was a mechanic who had never run these diesels before. First of all, he may not have known the correct steps to try to get the lift stopped. Secondly, he may have panicked, and tried steps that made things worse.

As I said before, all systems should be tested on site by the manufacturer’s rep. And then there should be training at startup and on a regular basis afterwards (at least once a year) on all evacuation modes and methods. The day you need to get people off the system should not be your first time using the hardware.

Over on another forum, there is a discussion going on about incident causes. You have to join this forum to see the messages, so if you aren’t yet a member, the debate is about this article. In the article, David Mandt (another Paramount alum) quotes the now infamous 85% statistic. The statistic is somewhat based on 15% of injuries being caused by mechanical failure, therefore 85% must be due to rider error or misconduct.

First of all, there is no study that I know of to back up this number. Most parks are very secretive about their injury data, and I am not sure even IAAPA has access to it. So until someone shows me where this number came from, I am going to discount it.

Secondly, why are there only two buckets. How about:

• mechanical failure
• operator error
• rider misconduct
• rider error
• poor signage or instructions
• poor or inadequate design (especially involving human factors design)

There are probably more buckets than that, but this is a good start. Beyond that, most incidents happen because of a combination of multiple events. For instance the Lightning Loops incident of many years ago. The guest sat down in the vehicle with the restraint bar down. The operator did not correctly check the restraints, and the vehicle was launched.

This incident involves guest error, but also involves operator error. Interestingly, the solution involved changing the restraint design, so that the restraints popped up when released, so there is a reasonable claim that some design improvements were required.

In the Ride Safety forum, I cited an example of my own son getting injured on a family ride with pedals. In order to reach the pedals, my son had to sit way forward on the seat, but lean back. In this almost horizontal position, when the block system activated, rapidly decelerating the vehicle, he slid off the seat, then fell forward, hitting his face on the pedal mechanism. A split lip, bloody gums, and panic from Mom ensued. Other similar incidents were occurring on this ride system. The inclination was to classify these as guest error/misconduct. Since I had been thoroughly lectured on the guest perspective by my lovely but extremely angry wife, I was able to shed some light on the incidents.

Ultimately, the vehicle was not well designed for the younger patrons that were the ones most interested in using the pedal mechanism. Once some simple adjustments were made improving the seating position for the little ones, the injuries went away.

There was clearly no mechanical failure causing the injuries. But classifying them as guest error/misconduct was not going to solve the problem. Interestingly, I probably learned as much about ride safety watching my wife and kids (especially the Boy), as I did from industry insiders. Sometimes ride designers need to think like a 6 year old boy (He is 11 now, and has started to develop Common Sense).

Saferparks has an editorial on this issue in it’s archives. And there is a researcher in Canada, trying to do some good work in this area. Unfortunately, none of the fixed parks want to work with Dr. Woodcock, because again, they are afraid that this information might somehow be used to hurt them.

I worked for a while with a southern attorney who had a different attitude about these things. Most attorneys tell you not to write things down when you find problems, and fix them as quietly as possible. His attitude was, write down whatever you need to, just make sure when everything is said and done, you fix the problem, document you fixed it, and have a plan to make sure it never happens again. He said he would rather go into court with a big pile of documents with a bow around them showing a resolution, then to have to go in with no paper trail at all.

There are numerous other examples of this issue. But in any case, while I may accept the 15% number for mechanical failures, that does not automatically translate into 85% being guest error/misconduct. So let’s put a stake in that one. And how about IAAPA actually having a study done, looking at all of the causes of rider injury. I’ll bet Dr. Woodcock would love to do it.

I still have many stories to tell, and there are some interesting things happening with the CPSC that I intend to discuss. Not to mention, I really haven’t started in on actually developing what this blog is supposed to be about. But I am going to take this week off. I spent all week fighting with a water heater

I am a flagrent do-it-yourselfer, although I finally did stoop to paying a plumber - then immediately regretted it. The diy thing partly comes from my family - my dad was the first generation off the ranch (on the ranch, you repaired it yourself, you couldn’t get a repairman this far out , and he was at various times an electrician, lineman, appliance repairman, construction manager, alarm tech, water treatment plant operator….. can’t remember them all. My grandfather on mom’s side was an auto mechanic. An uncle was appliance repair and mechanic at different times in his life. The family pretty much fixed everything that could be fixed. At an early age, I was put to work taking things apart down to the broken bits, so they could put them back together. I do wish one of them had taught me to weld.

My water heater is one of these new fancy ones with all of the safety features. So everything I knew about water heaters didn’t apply. Unfortunately, the plumber I called was pretty much a parts changer. He wasn’t much for troubleshooting. Fortunately, he didn’t have the parts for my FLIR (oops - make that FVIR) water heater. So he did apply a little knowledge he had about these new heaters, and cleaned out the burner area. That got us part way there. Then I spent several hours chasing down the info on these new water heaters, and discovered some other areas to clean out. Apparently, while these new heaters are much less likely to burn your house down, all of these safety features make them more susceptible to restrictions in their air flow.

Anyway, with that, and Easter this weekend, I have not had time to put together a post I feel is ready for prime-time. So if you are one of the 5 people who visit this blog, come back next week. I promise to have more stories to tell, and more points to make.

One thing the ski lift guys did was test all of their safety systems every time. Sometimes it wasn’t tested until the day the inspector was there, but all systems were always tested before the public rode the lift. They would specifically design each safety system so that there was a way to test it.

They also had a highly documented test plan. Frequently, inspectors would repeat some of the commissioning tests during the annual test, just to make sure they hadn’t been disabled, either accidentally or purposely. I think they have now gone to a program where the entire commissioning procedure has to be repeated every 10 years, but that’s a subject for another time.

I have run into situations on the ride side, where either there was so much faith in the design, or some kind of test was done in the past that kind of showed the safety system should work, or it was considered too difficult to test, and so the manufacturer didn’t want to do it.

On one ride in particular, it had a hydraulic lift system for raising and lowering the gondola. The cylinder was designed to be failsafe on a hose failure, so it required the pump to be on to lower the gondola. Just in case the pump failed, there was a manual valve, with a flow control installed at the base of the tower for emergency evacuation. Of course that system had been “tested in the factory”, and the manufacturer did not want to demonstrate it in the field. I think using the evac system resulted in discharge of the oil, but I don’t remember for sure.

And of course, it was not set up properly. During a ride with employees, the pump shut off and could not be restarted. When the maintenance crew attempted to use the factory evacuation system. NOTHING HAPPENED. So instead of being able to use the well designed factory evacuation system, they had to take everybody off with a ladder truck. High angle evacuations involve risks that you don’t have getting people out on ground level. Fortunately, this evac went well.

The lesson here is, figure out a way to test all safety systems, and all evacuation modes. It’s probably also a good idea to make sure that when a safety system is tested, that the test is a good representation of the real world. For instance triggering a safety system in software is not as good as triggering the actual overtravel switch.

I was involved to some extent with every new ride installation or control system retrofit during my time there, but the following are some of the bigger projects:

Italian Job (3 total)-Paramount’s Kings Island, Paramount King’s Dominion, Paramount Canada’s Wonderland
Assisted with design, development, installation and commissioning of new lim launched roller coaster system. Optimized distribution system to feed lim system, including Automatic Var Compensators.

Tomb Raider – The Ride-Paramount’s Kings Island
Managed development of a documented IEC 61508 compliant control system, assisted with installation and commissioning

Son of Beast - Paramount’s Kings Island
Managed development of control system for World’s first looping steel roller coaster. Assisted with integration of equipment from multiple suppliers.

ASTM F24-Control System Standard Proposal
Assisted with writing new control system standards for ASTM.

Brake Standardization
Managed a program to standardize application of caliper brakes (Costasur type) across all roller coasters, including testing and failure analysis.

Dual PLC Conversions-Paramount’s Kings Island, Paramount’s King’s Dominion, Paramount’s Canada’s Wonderland
Managed program to convert 8 roller coaster control systems to dual PLCs, and standardize function and operation.

Block System Review-All 5 Paramount Parks
Developed program to test and verify all Roller Coaster block systems at all 5 Paramount Parks.

Y2K Survey-All 5 Paramount Parks & Star Trek the Experience.
Surveyed and tested all rides at all sites to ensure there are no year 2000 issues with the control systems.

Outer Limits-Flight of Fear-Paramount’s Kings Island,Paramount’s Kings Dominion
Redesigned control system to allow system to operate with three trains, increasing capacity by 40%.

Ride Control Functional Standards
Updating ride control system standards to ensure that control systems meet US standards and are easy for the Amusement park maintenance staff to repair and maintain.

The post last week was about watching for people in the path of a ride.  But people aren’t the only hazard that can pop up in the vehicle path.

Many years ago, I was starting up a ride with the other University of Wyoming graduate at Arrrow. Mark McDonald, or as we called him “Buckethead”. Buckethead was actually what Mark called everyone else (especially me), but somehow the name was reflected back on him.

Mark and I were starting a ride up. The ride was in great shape mechanically, and we were going through testing the block system. All of a sudden, a big storm blew in. Rather than get wet, we went into the control room, and waited it out. Once the storm blew over, I wanted to get back to testing. Buckethead suggested we take a look around first. I told him to go ahead, and I would start firing the ride back up.

About 5 minutes later, Mark called me on the radio to come out to a helix on the ride. I met him out there. The high rail in the helix was just visible above the water. The low rail couldn’t be seen in the muddy water. The helix was in a low spot in the ride, and the hay bales that were supposed to keep the drains clear, had settled on top of the drain, and clogged it.

The track on this helix was banked about 60 degrees, so that meant the water was at least 3′ deep.

On another occasion, a storm came up in the middle of the day (on a different ride, at a different park) and pushed a tree over on the track. Not a branch. An entire oak tree. Big enough it required cutting it up to get it off the track.

It’s very important that an operator have procedures to walk the ride path anytime they can’t guarantee that the path is clear. After storms or if the ride has not remained under an operator’s control. This is another procedure that an inspector should check on, to make sure an operator has it in place.

Early in my career, I experienced a near miss. I was working with Dick Taylor starting up a ride. At the same time, Arrow’s track expert was on site, trying to resolve some track issues. Dick and I had to stop running the ride for a few minutes, so John asked if he could take some welders out and look at a problem. We said ok, but stay off the track, as we would be running again soon.

As with many electrical problems a few minutes stretched into about 30. In the meantime, the welders had decided to climb up into the track. This was on a minetrain, which has more ties than bents. The bent is the wood structure that supports the track, the tie is the square tube structure that runs between the running rails. Two of the workers were on ties over bents. When they heard us start the lift, they immediately climbed down into the structure. The third worker was on a tie without a bent. Rather than step over to a tie with a bent (he had time) he dropped down to hang from the tie. His thought may have been to swing over, but he couldn’t quite reach. He was probably 30 ft off the ground, and too high to drop. Adding to that, there is a lot of structure tying bents together, that he might have struck on the way down. John noticed that he was holding the tie at the corner, where there is no mechanism on a mine train. John told him to hang on, he was in a safe location, and they could get him out of there as soon as the train passed.

Dick and I had no idea any of this drama was occurring. John was right, the train passed over, and as soon as it had passed, they pulled him to the structure and safety. This could have been a horrible accident.

Amusement Rides have some unique safety issues. On many rides, the operator can see only a small portion of the ride. Fencing, gates, locked doors, all of these things can help control access, but eventually it all comes down to having good procedures.

This incident happened before lockout/tagout really hit the industry. Lockout even though it makes work more difficult, is important to maintain safety for inspectors, operators, maintenance staff and guests. Beyond lockout/tagout, it is important that access to critical areas of the ride be controlled by fencing, locks and doors. And then there must be procedures, such as walking the entire ride to check for personnel.

Inspectors should check to make sure that the operators have such procedures, and that they use them.