The importance of redundant control in passenger safety control systems.
 
REDUNDANT SAFETY SYSTEMS FROM A FUNCTIONAL CONTROL VIEWPOINT
by Enrico Fabbri

In the December article we talked about the importance of redundant mechanical safety systems, highlighting how the mechanical parts must be designed in such a way as to guarantee passenger safety even in the event where one of the components breaks.

Here we address the second point concerning the importance of the functional safety management system, which too must be redundant. The image below shows a rider seat where a collective safety bar has been installed to prevent passengers from being thrown upward during operation of the ride. This safety bar can however be opened directly by the riders, which is certainly dangerous, and consequently the operator has installed a second safety mechanism to prevent this from happening. This second mechanism thus has a very important function.

Let’s then analyse in detail how this mechanism has been set up and see whether everything is compliant with the regulations. Compressed air is supplied by a compressor. A solenoid valve (controlled by a selector in the operator’s control station) retracts the cylinder rod, thus opening the safety bar. The same solenoid valve allows compressed air to be released from the pneumatic cylinder, while a spring (located inside the cylinder) pushes the cylinder rod outwards against the back plate. If the operator operates the solenoid valve while the ride is operating, it stops. So everything seems OK, but it’s NOT.

What happens if the solenoid valve fails? How does the operator know if the solenoid valve (which controls all of the pneumatic cylinders) is working correctly?

Solenoid valves are complex mechanisms that fail after a certain number of cycles. They can also fail due to impurities in the pneumatic system or insufficient lubrication. So the point is not “if it fails” but rather “when it fails”, because it is certain that sooner or later it will stop working, and we have no way of knowing if it will fail in the ‘closed’ or ‘open’ position. It is therefore a question of understanding what type of control system ‘automatically’ notifies the operator of the fault and at the same time ensures that a fault does not endanger passengers. Let’s then look at the details of the solutions:

(a) there must be a sensor that detects when the cylinder rod is correctly inserted in the back plate; in fact, incorrect rotation of the safety bar prevents the cylinder rod from entering the safety position;

(b) at least 2 solenoid valves are needed to correctly isolate the pneumatic system that supplies the cylinder, ensuring that there is no compressed air in the system; in this way, if the first one fails, the second one continues to work;

(c) at least 2 pressure switches are needed (sensors that measure the pressure in the pneumatic system). These sensors monitor that there is compressed air in the system, and thus the 2 solenoid valves are working correctly;

(d) a buzzer is needed to notify the operator when one of these components stops working properly;

(e) an appropriate electrical system is needed to properly manage these electrical components (and not a simple switch).

I see rides every day with safety systems that have been installed unprofessionally, especially those that have been operating for several years. Operators often do their best and sincerely believe they have modified the ride correctly, even when this is not so.

Perhaps (let me put this out there) theoretical-practical courses would be a good idea, to understand in detail and see first-hand how these operations need to be carried out.

 

 

 

Written by Mr. Enrico Fabbri enrico@fabbrirides.com
Article originally published in Games Industry (Italy) magazine
Original date: January 2018

#29