Ask RideMan
#3 — Emergency Stops
How do emergency stops and ride evacuations generally work? Why do they sometimes not evacuate a ride after there’s been a problem?
— Wicked Twister Fan
This is actually a more complicated question than you might think. The topic of emergency stops on amusement rides is a bit like the topic of grounding in electrical systems. Entire books can be written on the subject. Evacuation can be even more complicated. Because of that, I’m going to divide the question into two parts. For this installment, we’ll start by stopping everything.
STOP means STOP, right?
Conceptually, it seems obvious. Most of the hazards associated with rides are associated with ride motion. It stands to reason, then, that the most obvious way to mitigate those hazards is by stopping the ride. So frobbing a ride emergency stop button should make the ride come to a stop, right?
Wrong.
The results of activating an emergency stop function are determined by the manufacturer during the ride design process. Certainly there are rides where an emergency stop will stop the drive system, apply a set of brakes, and bring the ride to a (sometimes screeching) halt.
But that is not always the case.
On some rides, activating an emergency stop actually cuts power to the ride, which can actually prevent the ride from coming to a quick stop. Then there are the roller coasters, where an emergency stop immediately closes all of the brakes and turns off the lift and launch mechanisms, but the ride vehicles out on the course cannot be stopped until they encounter the brakes or drive systems.
Major water rides, particularly rides like Thunder Canyon, present another challenge. Boats on the ride are free-floating and a full emergency stop, which would shut down the pumps and conveyors, would merely allow the water to continue to drain to the base of the ride. In that particular case, I’m not sure what that would do to the loading area at the bottom of the ride, given that Thunder Canyon has no direct reservoir and I am not sure the culvert to Sandusky Bay can drain the ride as quickly as the water is flowing through the channel.
Because there are so many variations in what will happen if a ride is stopped, industry practice allows for several different methods of stopping the ride. These methods are generally described as two different stop ‘categories.’
Category 0
In a Category 0 stop, energy, including stored energy, is removed from the ride, bringing it to a stop as quickly as practicable. This is the functional equivalent of ‘pulling the plug’ on the ride. And while the code section doesn’t actually apply to fixed amusement rides like the ones at Cedar Point, this is described in Article 525 of NFPA 70.
NFPA 70 is the National Electric Code, and Article 525 is the section relating to carnivals, fairs and circuses. A Category 0 stop is intended mostly to eliminate the hazards caused by electrical power and stored energy, and so might not be the fastest way to bring a ride to a halt. This is especially true for modern rides that make use of regenerative braking. But if the motor catches fire or there is an electric shock hazard, it’s the quickest way to eliminate the hazardous condition. This is what usually happens in the case of a power failure, or traditionally, if someone mashes a [Ride] Emergency Stop control.
Category 1
In a Category 1 stop, the ride is brought to a controlled stop by its control system. Once the ride is stopped, the Category 1 stop may be followed by a Category 0 stop – that is, the ride is brought to a stop in a controlled manner and the power is disconnected. On some rides, there is no appreciable difference between a Category 0 stop and a Category 1 stop. On others, the Category 1 stop will stop the ride more quickly and allow for a quicker recovery. There are rides where a Category 0 stop will freeze the ride in whatever position it’s in when the stop is invoked, which may be a position from which it is inconvenient or impossible to evacuate the riders. A Category 1 stop offers a way to bring the ride to an abrupt end, separate from disconnecting the power.
As always, there are some interesting consequences to the rules. Consider, for example, the Tilt-A-Whirl. Each of the seven cars is equipped with an electric brake which is used to hold the cars steady for loading and unloading. In a Category 1 stop, the ride platform would be brought to a stop and the electric brakes on the cars would be engaged. Essentially, this would be a normal ride stop as for loading and unloading. In an emergency situation, though, a Category 0 stop would involve disconnecting electric power to the ride. This would stop the platform rotation, but it would also prevent the electric brakes from engaging, so the cars would be able to rotate freely once the power was shut off.
Likewise, on Ocean Motion, Skyhawk, or maXair, the drive system is normally used to ‘drive’ the ride to a stop. In a Category 0 stop, the drive system – whether it be hydraulic, pneumatic or electric – would be disconnected. This would tend to allow the ride to swing freely until it coasts to a stop. Again, a Ride Stop or Category 1 stop would simply drive the ride to a standstill.
All of these behaviors are determined by the ride manufacturer. Today, ride manufacturers build their rides to conform to several relevant codes, most notably ASTM F 2291, the Standard Practice for Design of Amusement Rides and Devices. Because of standardization and the harmonization of the ASTM standard with other worldwide standards such as ISO 13850 (Safety of Machinery - Emergency Stop - Principles of Design) and EN 13814 (Fair Ground and Amusement Park Machinery and Structure Safety), the principles for safe ride design are now fairly consistent. While those standards are all fairly new – EN 13814 was published in 2004 and the comprehensive safety-related control system language now in ASTM F 2291 was just rewritten and published in 2014 – those standards are largely based on common industry practice that has been going on for a very long time. So even rides that are not subject to these new standards quite often will comply with them. And all of the standards require that the ride designer/engineer must consider what kind of ride stop or emergency stop functions must be available, how those functions shall be invoked – including both manual and automatic means of invoking the stop functions – and how the ride shall behave once those stop functions are invoked.
Other Stops
If the objective is to get the ride under control, maybe an electrical disconnect shut-everything-down stop is not required. Ride stops are intended to mitigate hazards to people caused by machinery in motion. One way to avoid some of the unintended consequences of unplanned ride shutdowns is to allow for other kinds of machinery stop. For example, on Thunder Canyon, there may be situations where it makes great sense to shut down the station turntable and lift conveyor – meaning that the rafts on the lift and in the loading area will come to a full stop – but not to turn off the pumps, so the water continues to flow normally through the ride. The rafts not in the loading area can then continue through the course. This is because in many cases the hazard is presented by the loading turntable or the lift conveyor, not by the other mechanical systems on the ride. It is not at all uncommon for a ride to include stopping functions, invoked either manually or automatically, which do not shut down the entire ride. In some cases, the stops are actually a part of the normal ride safety system. Consider the blocking stops on Top Thrill Dragster and Maverick, where the trains routinely stop and wait for other trains to clear the blocks.
Results of an unplanned stop
Emergency stops are sometimes quite disruptive. An emergency stop tends to be the default response of the control system if the ride detects that it is doing something unexpected. It also tends to be the default response of a ride operator if he detects that the ride or one of the riders is doing something unexpected.
In the case of a Category 0 stop, the ride safety related control system may go down with everything else. So, when the ride is powered back up, it may not be able to positively identify the condition of the ride – where all the components are, for instance, or what the ride was doing when it was shut down.
Manual systems and modeless systems tend to be the easiest ones to recover. On the Carousel, Matterhorn, Himalaya and Tiki Twirl, for instance, it doesn’t really matter where the ride stops, or where it is when it starts up again. Even Sky Ride has a simple enough system that it can easily restart from wherever it stopped without too much difficulty.
Roller coasters tend to be some of the most complex systems, because they usually involve uncontrolled motion, multiple systems that must be coordinated, and systems that cannot reliably automatically detect the locations of the ride vehicles. Some of these problems can be avoided if the ride goes down in an orderly fashion (Ride Stop), with the control system still active. But even that isn't guaranteed. If the ride stop was automatically invoked because the ride seemed to be doing something unexpected, then the control system will already be just as confused as if the system had been completely powered down.
In order to restart the ride, then, the first order of business must be to put the ride and its control system into matching, known states. Sometimes that is as simple as allowing coaster trains to roll until they reach brake points, where they can be detected by optical, mechanical or proximity switches. In some cases the ride merely needs to be moved until it reaches some known position or limit. In other cases, because the ride must be moved manually (possibly with one or more of the operational safeguards bypassed or overridden), the ride must be evacuated before it can be moved.
And that’s what I'll talk about next time.
Dave Althoff, Jr.
Dave Althoff is a multimedia specialist, systems engineer and amusement industry consultant from Columbus, Ohio. Dave is a member of ASTM International and the National Association of Amusement Ride Safety Officials (NAARSO) and is an NAARSO Certified Amusement Ride Safety Inspector Level I (Basic). He has consulted on amusement ride design projects and ride operation controls and is listed as a co-inventor on United States Patent #7,905,789, “Specialized Restraint Systems for Amusement Rides.”
Have a question? Ask RideMan!
“Ask RideMan” is a PointBuzz feature where Dave Althoff answers your questions about the inner workings of rides and roller coasters.
Have a question you'd like to see answered? Email Dave at rideman@davealthoff.com.