Human Factors Investigation of Ejection from a Roller Coaster

Abstract

The Human Factors Analysis and Classification System (HFACS) was used to evaluate a complex forensic case. The use of HFACS in forensic human factors is demonstrated via a case study of the death of a roller coaster rider ejected from his seat. The analysis revealed systemic factors for the fatality throughout the amusement park and ride manufacturer organizations. Such system analyses are needed to move park management and state investigators away from their narrow focus on rider behavior as causes of injury incidents, and address systemic factors to make amusement parks safer for guests.

Keywords

amusement park rides restraints Human Factors Analysis and Classification System forensic accident analysis system safety ASTM F770

Investigations of injury incidents at amusement parks conducted by state regulatory agencies and amusement park staff typically focus on the behavior of the patron, ride attendant, or ride operator, and ignore the potential contributions of other systemic factors (Nemire, 2008; Woodcock & Diyaljee, 2010). The International Association of Amusement Parks and Attractions (IAAPA) narrows this focus further—to only the rider’s behavior. IAAPA’s “Amusement Ride Safety Tips” states that “Safety is the Amusement Park Industry’s No. 1 Priority...Unfortunately, a majority of the injuries occur because the guest didn’t follow posted ride safety guidelines or rode with a pre-existing medical condition (such as): Obey listed age, height, weight, and health restrictions” (IAAPA, n.d.). This perspective ignores other potential causes of rider injuries. Other significant systemic factors such as inadequate equipment design, warning systems, employee training, and safety policies and procedures may also contribute to injury incidents.

This article presents a human factors/ergonomics (HFE) analysis of a roller coaster incident that resulted in a rider’s death. While there are many HFE methods that can be used to investigate injury incidents from a systems perspective (Dempsey, 2012), I chose to use the Human Factors Analysis and Classification System (HFACS; Shappell & Wiegmann, 2001; Wiegmann & Shappell, 2016). HFACS is an extension of previous work in incident investigation and error classification (Rasmussen, 1982; Reason, 1990) that has been useful in analyzing military and civil aviation accidents (Wiegmann & Shappell, 2016), as well as accidents in mining (Patterson & Shappell, 2010), maritime (Schröder-Hinrichs et al., 2011), and railroad (Madigan et al., 2016) environments. I have found HFACS to be useful in analyzing complex forensic cases as well. The incident investigation method described in this case study can be useful for other forensic practitioners, as well as for other HFE and safety professionals responsible not only for incident investigation but also for proactively improving the design of amusement parks and other complex systems.

INCIDENT SCENARIO

Frank had never ridden a roller coaster before, but while at a California amusement park with his family, he was persuaded to ride one. After waiting in line, Frank and his family were directed to adjacent seats on the roller coaster. Attendants put the riders' lap bar restraints in place, gave the “all clear” signal, and then the operator dispatched the train. The roller coaster moved away from the platform and up the first hill. As the roller coaster dropped over the top of the first hill, in excess of 50 mph (80 kph), one of Frank’s sons glanced over in time to see Frank desperately trying to hold on to his unsecured lap bar and then fly out of his seat and out of the train. Frank fell over 100 ft (30 m) to the ground and died.

After the roller coaster train returned to the platform, ride staff noticed that the lap bar that should have restrained Frank was in the up position. The restraint had not been properly secured. The family eventually retained an attorney to bring a lawsuit against the park and the roller coaster manufacturer. The family’s attorney retained me to assess whether human factors issues contributed to Frank’s ejection from the coaster.

HFACS OVERVIEW

HFACS describes four levels of system failure: 1) Unsafe Acts, 2) Preconditions for Unsafe Acts, 3) Unsafe Supervision, and 4) Organizational Influences (Wiegmann & Shappell, 2016). Each of these is composed of multiple potential failure categories (Figure 1). As with other accident investigation methods, HFACS typically begins with the accident and proceeds backward in time to systematically determine the causes of the system failures by asking a series of questions about the reasons for the failures.

Figure 1.

Human Factors Analysis and Classification System (adapted from Wiegmann & Shappell, 2016).

SECURING THE RESTRAINTS

When the roller coaster returned to the station, Frank’s restraint was in the up position, indicating that it had not been properly secured. This failure led to Frank’s ejection from the train. The first HFACS question is: Why had the restraint not been properly secured?

Each restraint included a mechanism that allowed the restraint to be pushed down and secured, and prevented the restraint from returning to the up and unsecured position until the end of the ride. However, the restraint could be secured in a number of different positions, only one of which would secure the rider. Consequently, the manufacturer warned that to prevent customers from falling out of the roller coaster, attendants must use one hand to push down on the restraint so it was tight against the rider’s thighs, and then to use the other hand underneath the restraint to firmly pull up to make sure it was securely locked in place. The hand underneath the restraint also was used to determine if there were any space between the restraint and the thighs.

While the roller coaster was at the platform, and before the ride started, one ride attendant was responsible for checking restraints on one side of the train, and another attendant was responsible for the restraints on the other side. During the investigation, each attendant was asked to review the platform surveillance video. It was noted that the attendant securing Frank’s restraint failed to properly check it. During my review of the platform video, it appeared as if this attendant merely placed his hands on the restraint. In contrast, the other attendant employed his arms in a vigorous manner to check the restraints, and sometimes employed a second effort as if to better ensure locking. While each attendant quickly moved from one car to another to perform his check, it took the latter attendant almost 50% longer, apparently as a result of the extra effort he expended on each restraint check.

Another witness, described below, observed Frank’s restraint was not touching his thighs as the ride left the station. The design of the restraint had allowed Frank’s restraint to be secured in a position far from his thighs, most likely because it had rested on Frank’s belly instead of his thighs—he was a big man at six feet (183 cm) and 300 lbs (136 kg)—and the attendant failed to detect and correct the amount of unsafe space between the restraint and Frank’s thighs. This space allowed Frank’s body to slip from the restraint when the roller coaster dropped over the first hill.

In HFACS terminology, the attendant’s failure to detect and correct the unsafe space between the restraint and Frank’s thighs was an Unsafe Act. Unsafe Acts are further categorized as Errors or Violations, with Errors categorized as Skill-based, Decision, or Perceptual. Failure to detect the unsafe space between thighs and restraint would be categorized as a Skill-based Error. The next question asked is why the attendant committed this error. Because the attendant was new to this job, one would look to the training and on-the-job supervision he was provided. In my review of the amusement park’s training procedures for coaster staff, I discovered several training failures and inadequate coverage of some operational actions. In HFACS terminology, inadequate training and inadequate supervision would be considered Unsafe Supervision factors. These failures likely contributed to Frank’s ejection from the coaster seat (Figure 2).

Figure 2.

Summary of factors responsible for Frank’s ejection.

By design, the restraint could be secured in a number of positions, only one of which would be safe for each rider. As a result, the likelihood of an attendant failing to ensure contact of the restraint with the rider’s thigh was increased as a result of errors such as inattention to detail and distraction. In HFACS terminology, the poor design would result from Technological Environment and Resource Management factors.

INDICATOR LIGHT AMBIGUITY

Each restraint had an associated indicator light. When the light illuminated green, it indicated that the restraint had been moved to the minimum position near the rider’s body in which the restraint could be secured, but it did not indicate whether the restraint was positioned as close to the rider’s thighs as possible and properly secured. The manufacturer used a green light to represent a minimal closed position, rather than a secure and closed position, violating basic user interface principles for designing displays that accurately represent the current system state and are compatible with the users' mental model (Moray, 1996; Vicente, 1990). A green light can easily be mistaken for a restraint that is properly positioned when it is not and may lead to an attendant failing to rigorously check a restraint. Also, the color green often means “safety” or “go,” which also may play a role in the attendant’s perception that the restraint was in a safe position. The investigation revealed that attendants thought that a green light indicated that the restraint was in a secure position and ready to “go.”

Information that the minimum secure position had been achieved was communicated to a computer in the operator’s control station located near the head of the train. According to the design of the computerized restraint system, the operator could dispatch the ride only if the operator’s display indicated all restraints were in the minimum closing position, which also was represented by green lights. The operator, upon seeing all green lights on the display, dispatched the roller coaster. As it was leaving the platform, the operator visually scanned each restraint position as the train passed by. The operator recalled seeing Frank—his large size was memorable—and that the restraint was resting on Frank’s stomach rather than on his thighs.

Standard operating procedures for the ride required that there be no space between the passenger’s thighs and the restraint, and the park’s safety policy required operators to stop the ride if there were any doubts about customer safety, such as a gap between a restraint and the rider’s thighs. When the operator noticed that Frank’s restraint was not positioned correctly, park safety policy required that the ride be stopped. The operator failed to follow standard operating rules because they trusted that the attendant correctly performed the restraint check on the obese rider and the operator’s computer display showed that all the indicator lights were green. The ride operator also misinterpreted the meaning of the green indicator lights, mistakenly assuming that all green lights meant that all the riders were safely secured on the ride. The operator also said in interviews that the indicator lights often failed to show the correct restraint position if there was a larger person in the seat.

In HFACS terminology, the operator’s failure to stop the train when it was noticed that the restraint was resting on Frank’s stomach and not his thighs, would be considered a Decision Error. The likely factors for this and the attendant’s error could be considered a result of Inadequate Training, Inadequate Supervision, Technological Environment, and Resource Management factors.

FAILURE TO KEEP LARGER RIDERS SAFE

In light of the ride manufacturer’s failure to design a roller coaster restraint system for larger guests, it would be reasonable to expect that fail-safe features and procedures would be put in place to prevent “too large” riders from being placed on the ride. Two mechanisms to this end were provided—a warning sign and a test seat.

The park provided a sign at the ride entrance to inform potential riders that: “This ride may not accommodate guests of a larger size” (Figure 3). While such information may help prevent some customers from boarding the ride, there is inadequate information on the sign as to what constitutes “larger size” or to adequately warn of the possible hazards for larger guests of riding the roller coaster. For example, a consequence statement, if explicitly worded, could have been useful to visitors (Braun et al., 1995; Laughery et al., 1993). The size restriction statements did not indicate that failure to heed the size requirements could result in severe injury or death. While it may seem obvious, neither the attendant nor the operator indicated they had considered such consequences for the roller coaster riders.

Figure 3.

The top of a roller coaster entrance sign. Note there is no information about what would constitute “larger size,” such as a maximum height and weight limitation, and there are no indications of the potential consequences for “guests of a larger size” if they did choose to ride, such as injury and death. Consequently, this sign was useless in helping Frank decide to ride or not.

One amusement park standard for safe operation provides minimum guidance for how to present signs at amusement parks. Standard Practice for Ownership, Operation, Maintenance, and Inspection of Amusement Rides and Devices (ASTM F770-2019), Section 5.4, states: “Signs or other media presented by the owner/operator for instruction for riding shall be prominently placed at all patron entrances and other appropriate locations as deemed necessary by the owner/operator. Signs shall be bold in design and concise.” This standard does not address in a meaningful way how “guests of a larger size” can avoid harm when deciding to ride the roller coaster. Signage, as was used by the park operator to ensure the safety of its patrons, was inadequate, inappropriate, and, in Frank’s case, deadly.

The manufacturer provided to the park a test seat intended for placement at the ride entrance to be used by customers to determine whether they fit in the ride restraints before getting in line for the roller coaster. After the test restraint was positioned, a green light indicated that the customer could safely fit in the roller coaster seat. A red light indicated the passenger was “too big.” The park could have used the test seat to discourage “too big” customers from riding, just as the park used a height measurement to remove customers who were too short. However, park management said they did not use the test seat because they thought it was optional and did not affect safety of the ride. Given that management knew most of the restraint problems arose if there was a larger person in the seat, it would have been critical to screen customers with the test seat and do so with a ride attendant performing the check to ensure compliance. However, the park failed to utilize the test seat for potential riders.

In HFACS terminology, such failures would be categorized as Resource Management and Technological Environment factors.

SOLUTIONS

By performing the HFACS analysis, multiple factors were uncovered that led to Frank being ejected from the coaster car. At several stages in this scenario, effective HFE procedures and practices would have halted the chain of events that killed Frank. Once these multiple factors are understood, it is possible to generate potential solutions to prevent similar accidents from occurring in the future.

Any restraint warning or feedback system must be designed so that the display conveys an accurate state of the restraint system. This would be important so that attendants and operators can correctly evaluate the security of the roller coaster restraints. Unfortunately, the manufacturer failed to do so. In the absence of correcting system design defects, the manufacturer and park tried to accommodate this design defect by training attendants to perform the manual test to secure the restraint position. It was foreseeable that this training could fail.

Given the known problem with the restraint and the indicator lights, and the serious consequences of providing incorrect feedback to the attendant and operator about the secure positioning of the restraint, a redundant guard system was required. In fact, a few years before Frank was killed, another obese customer had fallen out of a roller coaster at another park and died. In that incident, the lap bar was similar to the one cited in this incident, and an attendant improperly positioned the restraint because of the larger size of that customer’s waist. Because of an investigation by that state’s park regulatory agency, the restraint system was redesigned to include a seat belt in addition to the lap bar, among other measures. Executives from both the manufacturer and park involved in the present case were aware of that incident but failed to provide a seat belt or other additional safety measures. An additional seat belt would have presented a relatively minor increase in cost and most likely would have either prevented the attendant from allowing Frank to ride due to an ill-fitting belt or prevented Frank’s fall and subsequent death.

Manufacturers have long employed specific height requirements for amusement park rides. Similar specific information should have been provided at the ride entrance as well as at the embarking platform to inform riders about whether they will safely fit on a ride. Signs at the amusement park would most likely be more effective in helping customers notice, read, understand, and comply with the warnings, if the warnings on the signs were designed according to evidence-based guidelines (Nemire, 2008; Rogers et al., 2000; Wogalter et al., 2002; Woodcock & Tsao, 2005). The ASTM F770 standard should be revised to reflect such guidelines. In addition, the park should have provided the test seat to ensure that size restrictions were enforced.

ASTM F770 (2019), Section 5.3.1 states: “Amusement ride or device operators should be given guidelines on the special considerations concerning patron size...related to the particular amusement ride or device.” However, in the absence of specific “body shape” and “size” requirements, it is difficult to adequately train ride staff. To better provide customer safety, attendants and operators need to be trained on safety issues such as the proper use of restraints, and the danger of customers too small or too large to safely fit in restraints. They also need to be trained on ways to appropriately select riders for exclusion and to politely, firmly, and consistently direct too-small or too-large riders away from the ride.

Independent research of roller coaster ejection incidents utilizing analysis tools such as HFACS is needed to better understand the chain of factors that result in the injury and death of riders. However, the lack of government oversight of ride safety at permanent, fixed-site amusement parks, such as the subject park, makes HFACS investigations difficult.

There is no federal government oversight of permanent, fixed-site amusement parks, such as Disneyland, Universal Studios, and the subject amusement park. The Consumer Product Safety Commission (CPSC) formerly regulated fixed-site amusement parks as well as mobile rides, such as at carnivals and fairs. However, in 1981, Congress passed what has become known as the “roller coaster loophole” and rescinded CPSC jurisdiction for fixed-site parks. Since then, inspections and regulations of fixed-site amusement parks are the domain of state agencies that may not have the expertise or resources to perform competent investigations and adequate record keeping. Some states do not require any investigations of amusement park injury incidents. Consequently, it is difficult, if not impossible, to obtain reasonable estimates of the number and type of injuries and fatalities that occur at amusement parks in the United States (Gilmore, 2017; Silverstein, 2016; Urbina, 2014; Visser, 2016). Several roller coaster injury databases and analyses exist, but the data are often problematic or incomplete. I refer the interested reader to Coasterforce (https://coasterforce.com/category/accidents/), Levenson (2005), Morris (2001), the National Electronic Injury Surveillance System (https://www.cpsc.gov/Research--Statistics/NEISS-Injury-Data), and Saferparks (https://ridesdatabase.org/saferparks/data/). Allowing the CPSC to once again regulate fixed-site rides as well as rides at mobile sites would be a step in the right direction (Gilmore, 2017; Silverstein, 2016; Urbina, 2014; Visser, 2016).

Adopting a systematic HFE approach, such as HFACS, to investigating accidents and designing a safe system (Hendrick, 1997, Wiegmann & Shappell, 2016) is needed to move park management and state investigators away from their narrow focus on the behavior of the customer, ride attendant, or ride operator, and include other systemic factors such as equipment design (not just function), human interaction with the equipment, warning systems, and training.

Footnotes

Kenneth Nemire, president and senior consultant of HFE Consulting LLC, has provided forensic human factors consulting for personal injury and product liability litigation for over 30 years, primarily in cases involving product design and liability, warnings and instructions, driver and pedestrian perception and behavior, and falls on level surfaces and from heights. He earned a PhD in experimental psychology from the University of California, Santa Cruz, and is a Certified Professional Ergonomist. He can be reached at knemire@HFEconsulting.com. ORCID iD: .

References

ASTM F770 (2019). Standard practice for ownership, operation, maintenance, and inspection of amusement rides and devices. ASTM International.

Braun

C. C.

Glusker

S. A.

Holt

R. S.

Silver

N. C.

(1995). Adding consequence information to product instructions: Changes in hazard perceptions. Proceedings of the Human Factors and Ergonomics Society 39th Annual Meeting, 39(5), 346–350. https://doi.org/10.1177/154193129503900511

Dempsey

P. G.

(2012). Accident and incident investigation. In Salvendy

(Ed.), Handbook of human factors and ergonomics (4th Ed., pp. 1085–1091). John Wiley & Sons.

Gilmore

(2017, August 10). Safety second: who regulates thrill rides? Saturday Evening Post. Retrieved from https://www.saturdayeveningpost.com/2017/08/safety-second-regulates-thrill-rides/

Hendrick

H. W.

(1997). Organizational design and macroergonomics. In Salvendy

(Ed.), Handbook of human factors and ergonomics (2nd Ed., pp. 594–636). John Wiley & Sons.

IAAPA (n.d.). Amusement ride safety tips. Retrieved from https://www.iaapa.org/amusement-ride-safety/amusement-ride-safety-tips

Laughery

K. R.

Sr Vaubel

K. P.

Young

S. L.

Brelsford

J. W.

Rowe

A. L.

(1993). Explicitness of consequence information in warnings. Safety Science, 16(5–6), 597–613. https://doi.org/10.1016/0925-7535(93)90025-9

Levenson

M. S.

(September 7, 2005). Amusement ride-related injuries and deaths in the United States: 2005 update. U.S. Consumer Product Safety Commission.

Madigan

Golightly

Madders

(2016). Application of Human Factors Analysis and Classification System (HFACS) to UK rail safety of the line incidents. Accident Analysis & Prevention, 97, 122–131. https://doi.org/10.1016/j.aap.2016.08.023

10.

Moray

(1996). A taxonomy and theory of mental models. In Proceedings of the Human Factors and Ergonomics Society 40th annual meeting (pp. 164–168). Human Factors and Ergonomics Society.

11.

Morris

C. C.

(August 2001). Amusement ride-related injuries and deaths in the United States: 1987-2000. U.S. Consumer Product Safety Commission.

12.

Nemire

(2008). Roller coasters, mental models, and product safety: A case study. Ergonomics in Design, 16(4), 7–10. https://doi.org/10.1518/106480408x393310

13.

Patterson

J. M.

Shappell

S. A.

(2010). Operator error and system deficiencies: Analysis of 508 mining incidents and accidents from Queensland, Australia using HFACS. Accident Analysis & Prevention, 42(4), 1379–1385. https://doi.org/10.1016/j.aap.2010.02.018

14.

Rasmussen

(1982). Human errors: A taxonomy for describing human malfunction in industrial installations. Journal of Occupational Accidents, 4(2–4), 311–333. https://doi.org/10.1016/0376-6349(82)90041-4

15.

Reason

(1990). Human error. Cambridge University Press.

16.

Rogers

W. A.

Lamson

Rousseau

G. K.

(2000). Warning research: An integrative perspective. Human Factors, 42(1), 102–139. https://doi.org/10.1518/001872000779656624

17.

Schröder-Hinrichs

J. U.

Baldauf

Ghirxi

K. T.

(2011). Accident investigation reporting deficiencies related to organizational factors in machinery space fires and explosions. Accident Analysis & Prevention, 43(3), 1187–1196. https://doi.org/10.1016/j.aap.2010.12.033

18.

Shappell

S. A.

Wiegmann

D. A.

(2001). Applying reason: The Human Factors Analysis and Classification System (HFACS). Human Factors and Aerospace Safety, 1(1), 59–86.

19.

Silverstein

(2016, May 29). The safety of summer thrills: Amusement park risks nearly impossible to know because of terrifying patchwork of state laws or almost no regulation. New York Daily News. Retrieved from http://www.nydailynews.com/news/national/amusement-park-risks-impossible-article-1.2653335

20.

Urbina

(2014, July 26). When thrill rides are real risks. New York Times. Retrieved from http://www.nytimes.com/2014/07/27/sunday-review/when-thrill-rides-are-real-risks.html?_r=0

21.

Vicente

K. J.

(1990). Coherence- and correspondence-driven work domains: Implications for systems design. Behaviour & Information Technology, 9(6), 493–502. https://doi.org/10.1080/01449299008924262

22.

Visser

(2016, August 14). Amusement park safety under scrutiny after week of accidents. CNN. Retrieved from http://www.cnn.com/2016/08/14/us/national-amusement-parks-safety-facts/

23.

Wiegmann

D. A.

Shappell

S. A.

(2016). A human error approach to aviation accident analysis. Routledge.

24.

Wogalter

M. S.

Conzola

V. C.

Smith-Jackson

T. L.

(2002). Research-based guidelines for warning design and evaluation. Applied Ergonomics, 33(3), 219–230. https://doi.org/10.1016/s0003-6870(02)00009-1

25.

Woodcock

Diyaljee

(2010). Human-factors antecedents in California amusement ride accident investigations. In Proceedings of the Human Factors and Ergonomics Society 54th annual meeting (pp. 1875–1879). Human Factors and Ergonomics Society.

26.

Woodcock

Tsao

(2005). “Rider responsibility” and amusement ride accidents: An observational and consensus study of rider behaviours. In Proceedings of the human factors and ergonomics society 49th annual meeting (pp. 1800–1804). Human Factors and Ergonomics Society.