Did History Actually Teach Us Anything? – Episode 9 Alton Towers Rollercoaster Crash Laura: Welcome to "Did History Actually Teach Us Anything?". The podcast where we unravel the most well-known tales of calamity, mishap, and unforeseen consequences that have shaped the course of history. And consider whether we've actually learned anything from them all these years later... In this podcast, we examine the historical events that you may think you know about already and the causes that led to them, be they icebergs or bakers ovens. We will consider whether these tragedies could have been avoided, and some of the surprising things we do differently now as a result. But this podcast, isn't just about dates and events. It's about learning from the past, drawing insights from hindsight, and gaining a deeper appreciation for the complexities of what really happened in these events we think we know so well. So get ready to encounter remarkable individuals, pivotal moments and fascinating insights that will make you appreciate health and safety and environmental management as far more than just red tape. A day of thrills turned into a nightmare at Alton Towers on the 2nd of June, 2015, when what should have been a routine ride on the Smiler rollercoaster, famed as one of the most intense and scariest rides in the theme park, ended in disaster when a loaded rollercoaster train collided with an empty test car. The crash left every single rider injured, and for two riders, the impact was life changing. In this episode, we are asking the questions, how did a system designed for safety fail so catastrophically and could this devastating accident have been prevented? Joining us is Kevin, one of our health and safety experts, who is going to introduce the story of one of the most devastating accidents in theme park history. Kevin: We all like to think that we would be calm and sensible in the face of an emergency, but is that true? How would you react if you witnessed a major road traffic incident? Would you calmly call the emergency services and move members of the public away from the immediate area to keep everyone safe until they arrived? Or would you go into a state of shock or disbelief and watch the scene unfold in front of you without being able to act at all? Would your reactions be any different if the vehicles involved were on a rollercoaster and you were one of the ride crew in charge of the ride at the time the incident happened? What if you had never received the necessary training or instructions on how to act in an emergency? Would you be able to work out what to do and when? This is the situation that faced the operators of the Smiler ride at Alton Towers on the 2nd of June, 2015. Laura: So Kevin, can you tell us a bit more about the equipment on the Smiler Ride and explain how it was meant to operate? Kevin: The ride was first opened in May, 2013. It is 1,170 meters long and has 14 loops and is designed to have a maximum of five cars, each with four rows of four passengers that can travel up to 85 kilometers per hour. The layout also contains two lift hills, which are inclined sections of track, requiring the cars to be pulled up by a large chain located in the center of the track. The cars that automatically disengage from the chain at the top of the incline and roll back down the other side, gaining speed as they do so. One of the lift hills has a vertical section of track, which means that passengers of the cars are lying flat on their backs during the climb. The layout also has a feature called a batwing, which comprises two half cork screws that are connected by half loops. The first of the corkscrews turns the car upside down during a 90 degree turn, and then the following half loop turns its upright again. The car is then turned upside down again in the next half loop, and in the second cork screw, it's returned to an upward position again, and through another 90 degree turn is turned back in the direction of travel. There's a small section of upright track between the half loops, and this is referred to as the apex. Passengers are secured into the cars by U shaped steel restraint bars coated in plastic, which fold down over their shoulders and lock into place. This restricts movement in the upper body to limit the effects of gravitational pull. The layout is fitted with a standard block zone system, which allows several cars to be operated at the same time, and there is an automatic fail safe system operated by the ride's programmable logic controller to keep the cars apart from each other. The system has different modes of operation. In normal mode, the car moves automatically from one section to the next until it returns to the station. If a block already has another car, the system stops the car for safety. This is called a block stop, and the ride crew must call maintenance to fix the issue. Maintenance engineers switch the system to maintenance mode to manually control it and resolve the problem. Once the issue is fixed, the system goes back to normal mode. Then, there is an evac mode. When the system is placed into evac mode, it automatically selects the car it senses to be the furthest along the track layout and returns it to the station to evacuate its occupants. The manufacturer of the Smiler recommended a maximum wind speed limit of 55 kilometers per hour for its operation, and for a test car to be sent around the track filled with water filled dummies to establish how the car would behave if wind speeds were believed to be approaching this limit. Operation of the ride should be stopped completely if wind speeds exceed the maximum 55 kilometers per hour. Finally, the whole ride was constructed in a large concrete pit and surrounded by a large fence. There had been at least four previous occasions before the crash when problems had occurred, but there have been no injuries to any member of the public that required professional treatment. Laura: Can you now talk us through the timeline of the accident and the actions of everyone involved? Kevin: On the morning of the accident, the first sign of problems ahead was the ride crew operating four of the five cars in wind speeds, reaching 74 kilometers per hour. As Alton Towers was crowded and there was a large queue of people waiting at the station, the crew made the decision to add the fifth car to cut down on wait times for the afternoon. Then at 1:08 PM the system reported a fault and automatically stopped any further cars leaving the station. The dispatcher who is the head of the ride crew, calls in the maintenance engineers as per standard procedure. The engineers established that the fault has been caused by one of the ride crew holding down the clear to start button on the console for too long and enter this information into the ride logbook. While the system is stopped, the passengers from the four operational cars are cycled through the track and disembarked into the station platform, and the fifth car is brought closer to the station ready for use. This process is completed by 1:25 PM, and the system is then put into maintenance mode to allow the fifth car to be added to the queue. At 1:29 PM an empty test car is sent out onto the track, but it fails to engage to the chain of the second hill lift and comes to a stop at the bottom of the incline in block three. The system triggers an alert because the car hasn't cleared that block section as it should have done. A team of three engineers head out to block three, leaving a fourth engineer in the control room, and they push the car forward so that it engages with the hill's chain. The test car then completes the remainder of the layout without further incident and arrives back at the station at 1:40 PM. A second empty car is then dispatched, but is unable to clear the back wing element where it pendulums between the two half loops and becomes stranded in the apex. This is a phenomenon known as valleying. The system registers that this car has not cleared block three. In the meantime, a full car has been dispatched from the station at 1:41 PM but the failsafe system stops it at the top of the first hill lift because it registers that the next block ahead (block three) is not clear. An error message in the control room registers a block stop fault, and records that four of the cars are a ground level and that's another is at the top of hill lift one and the Smiler is referred to as being in ride breakdown. One of the engineers moves to a remote control panel near the bottom of the second hill lift, where they are across the layout from the back wing and resets the block system by putting the ride into maintenance mode before heading back to the control room. Although all cars are in the same position, the system error message has now cleared. So the engineer asks the dispatcher to issue a code zero, which means an order to evacuate via the station. All engineers present in the control room agree that it is safe to put the system into evac mode. The car selected by the system is the full one standing at the top of hill lift one which is released at 1:51 PM and 30 seconds later slams into the back of the empty car stranded in the back wing, at a point where the passengers in the car were at 45 degrees to the track. It is estimated by investigators that the impact was the equivalent of a 145 kilometers per hour car crash. Two of the engineers go to find out what has caused the loud noise. Then notify their superiors about the accident but emergency services are not called until 11 minutes later. The crashed cars are located seven meters off the ground, which means that initial responders must reach the injured passengers using ladders whilst Alton Tower's maintenance crew constructs a scaffold tower. In total it takes over four hours to treat and release the 16 passengers from the car and take them to hospital. The shoulder restraints are difficult to release and a metal shield inside the front of the car has been crushed by the impact, trapping the legs of the four passengers in the front row of the car, requiring the fire service to use cutting gear to release them. Every one of the 16 passengers is injured. Two, so seriously that they lose limbs. Laura: So can you summarize the key health and safety causes of the crash? Kevin: One: the ride is operating when wind speeds are far greater than the manufacturer's recommended maximum. And although a test car is sent around the track, it is empty rather than being full of dummies, as per the manufacturer's guidance. It is possible that this error causes the car to valley in the apex of the back wing because it has insufficient weight to push against the headwind. Two: the engineers do not fully investigate the ride breakdown and discover the test car in the back wing before resetting the system. Three: the reaction of the ride crew and engineers to the accident is sluggish and chaotic, meaning emergency services are delayed in reaching the injured passengers. Four: the ride crew are clearly unsure of how to give access to the emergency services to the crash site, and time is wasted constructing a scaffold tower. Five: the system records the test car as being at ground level along with the three cars queued at the station, which suggests that it has completed its route and has returned to the station. No one checks where the empty test car is before the system is put into evac mode. Six: most worrying of all the automatic system does not recognize that the test car is further away from the station than the car full of passengers located at the first lift hill and evacuate it first. It is worth noting here that theme park management are quick to issue a press release, apologizing for the accident and for the terrible injuries sustained and putting the blame firmly on human error. Laura: Was it fair to put the blame on the park staff? Can it be said that human error was the only cause? Kevin: Our answer to these questions leads us to a series of other interesting questions. Firstly, why might the ride have been operating in such high winds? Was it because the theme park was remarkably busy and a large queue of people wanted to use the ride? Was it because the theme park needed the revenue from the ride, or was it because the ride crew were unaware of the manufacturer's guidance? Secondly, why didn't the engineers fully investigate the ride breakdown? If the test car had been removed from the track before the full car was dispatched, the accident would never have happened. Thirdly, why was the park staff reaction to the accident so sluggish? Why wasn't there a well-rehearsed plan in place so that everyone knew what to do and when in an emergency? If the staff had received suitable and sufficient emergency evacuation training, then surely the reaction would've been a lot swifter and more effective? And finally, why wasn't there an already constructed access system to the crash site easily and readily accessible for the emergency services to use? Just because there had not been a crash on the ride before does not mean that there would not ever be one. The last of our questions relate to the system itself: was it properly set up to deal with every eventuality? Why didn't it recognize where the empty test car was in relation to the other cars? Was staff understanding of error messages and how the system works adequate? Did engineers give different and contradictory instructions to the system so that it did not perform as intended? It's clear from these questions that we cannot firmly place the blame on human error. Laura: So is there a way of tracing the cause of the accident back to an underlying issue? Kevin: If we look at the James Reason Swiss Cheese Model of Accident Causation, the theory states that most accidents can be traced to one or more of four levels of failure. Organizational influences, unsafe supervision, preconditions for unsafe acts, and then unsafe acts themselves. A company's defenses against failure are represented pictorially by slices of Swiss cheese, where the holes represent weaknesses in each of the above levels and with gaps between them. If the holes in all four levels line up with each other, then a hazard passes through every layer of defense and an accident occurs. Looking at the Smiler crash, we can identify a failure on each level as follows: - organizational influences level: a lack of organizational procedures; - unsafe supervision level: inadequate supervision; - precondition for unsafe acts level: operating the ride in high winds; - the unsafe act level: engineer errors and violations of manufacturer's guidelines. Laura: What happened in the initial investigation? And can you tell us what the HSE's investigation findings were? Kevin: Park management conducted an internal investigation into the accident and blamed human error, which led to the overriding of the ride's safety control system and failure to follow company safety protocols. Initially, the health and safety executive investigated the actions of an engineer and a member of the ride crew who park management had indicated might have been at fault, but it was found that their errors were because of inadequate training, supervision management, communication, and safe systems of work. The owners of Alton Towers, Merlin Attractions Operations Limited, were therefore found guilty of health and safety failings, including a failure to: - conduct a suitable and sufficient risk assessment; - put in place a structured and effective system of work to deal with system faults, including how to reset the system after a fault; - put in place effective health and safety information, training and supervision for staff; - and a failure to put in place an effective system to evaluate and react to the impact of wind speed on the ride. This meant that members of the public had been put at serious and needless risk, made worse by the lack of adequate access for emergency services. Merlin Attractions was fined more than 5 million pounds. And although Merlin Attractions had not been found guilty of a deliberate breach of their duty of care, company standards fell far short of what the public ought to expect. Even though the ride was designed with automatic fail safe systems, it was necessary for human intervention to investigate and reset the system to fix faults. The engineers were found to have done their best within an inadequate health and safety system, and for a ride that had demonstrated problems since its first operation in 2013. Although the ride layout was covered by CCTV cameras, the engineers failed to check them and spot the test car before putting the system into evac mode. When viewing CCTV footage after the accident, it was clear that the two cars were mashed together and pendulum in the back wing apex up to 12 times in the high winds before they became stationary. The chaotic response of the park staff was found to be the result of no clear written procedures on how to deal with an emergency such as a crash, even though this was well known to be the biggest single hazard associated with rollercoasters. Laura: What was the aftermath of the crash and what impact did this have on the theme park? Kevin: Merlin attractions immediately closed the Smiler, a roller coaster ride called Saw at Thorpe Park, and two further similar rides at Chessington World of Adventures while they evaluated their safety protocols and procedures. The company experienced a significant drop in income and visitor numbers in the 2015 summer season, which led to their decision to lose 190 job positions at Alton Towers. They also experienced a drop in share values of 3% on the Financial Times stock exchange. The HSE issued a prohibition notice, which prevented the Smiler ride from being reopened until adequate protocols and procedures were put in place. Smiler was reopened in March 2016 after the HSE had approved the new operational guidelines and staff training program, which specifically included instructions on how to handle breakdowns, and a wind speed measuring system was fitted to automatically shut the ride down if the manufacturer's wind speed limit was exceeded. The CCTV system around the ride was also upgraded and improved. The two passengers who had lost legs because of the accident, filed lawsuits against Merlin Attractions in September, 2018, but the injuries and psychological effects of the accident on all passengers involved are likely to be permanent and life changing. The Smiler ride is still operating at Alton Towers and there have been no further crashes, so the changes made by Merlin Attractions have been sufficient, so far, to protect the thrill seeking public. Laura: Thanks for joining us on this episode of "Did History Actually Teach Us Anything?". If you enjoyed this episode, please follow our social media channels, leave us a rating and review, and share our podcast with anyone who wants to learn more about the risky side of history. And don't forget to subscribe so you'll get the next episode as soon as it's available. Join us next time to learn whether history did actually teach us anything...