The Ride Had No Way to Stop Itself

A pump failed. The machine had no way to stop itself.

The Coroners Court of Queensland named two absences in the machine itself: no basic automated detection of the water level, and no single emergency stop capable of shutting everything down. It treated both as deficiencies. That inverts the usual reflex brought to artificial intelligence (AI), sensing and automated plant, that a person at every decision point is the safe design. For a decision, that reflex holds. For a hazard that moves faster than a person can act, it is the wrong answer. The practitioner consequence is a single record: for each AI, sensing or automated control, write down whether a person can physically react inside the hazard's own time window, and engineer the automatic stop where they cannot.

What the findings record, with the clock running

The Office of the Work Health and Safety Prosecutor (Queensland) records in its court report on the Ardent Leisure Limited prosecution that "At approximately 2:03pm on 25 October 2016, one of the ride's pumps failed." Four guests on the Thunder River Rapids Ride at Dreamworld were fatally injured.

The findings of James McDougall, Coroner, delivered on 24 February 2020 set out what followed in seconds rather than minutes. At paragraph 1018 the findings record that "it only took around 20 seconds from when the water level started to drop following failure of the south pump, before Raft 6 became stalled in the unload area on the steel support rails". The same paragraph continues: "A further 55 seconds passed, during which time Raft 5 travelled the conveyor and impacted with Raft 6."

Three more figures from the same findings complete the arithmetic. At paragraph 71: "A slow stop of the conveyor took 8 seconds for the conveyor to come to a complete stop. Activation of the E-Stops were found to stop the conveyor in two seconds." At paragraph 1019, the conveyor did not begin its slow stop until approximately 11 seconds after the rafts collided.

The 2 second stop was an emergency stop, and the court report records that "There was no emergency stop button for the conveyor on the main operator control panel, with only a slow stop function available."

The findings locate the deficiency in the design. At paragraph 1016 the findings state that "The lack of a single emergency stop on the ride, which was capable of initiating a complete shutdown of all of the mechanisms, was also inadequate." At paragraph 1015 the findings record, on the engineering evidence the coroner accepted, that "a basic automated detection system for the water level would have been inexpensive and may have prevented the incident from occurring". The two numbers to measure at any plant follow: the seconds from the first detectable signal to a person's exposure, and the seconds the control takes once operated.

Can a person react inside the hazard's own time window?

That question is answerable with a stopwatch rather than an opinion. Write out the reaction path the design assumed. A person has to see that the water level has dropped, recognise it as a pump failure rather than normal variation, decide that the conveyor must stop, reach the control, and press it. Only then does the plant respond, and that control took 8 seconds. Every step consumes part of the roughly 20 seconds before the first raft stalled. That 20 seconds is the reaction window, because it ends at the first exposure of a person to the hazard. The further 55 seconds to the impact is the consequence window, and counting it into the time available is what makes a failed design look as though it had seconds to spare.

At paragraph 1013 the findings record: "It remains unknown, and impossible to understand why, the two major components of the ride were controlled independently of each other." Nothing in the machine connected the pump failure to the conveyor that had to stop because of it, so the only connection available was a person.

That is the transferable test. Where the human path takes longer than the hazard allows, keeping a person at the decision point does not control the hazard. It records who was present when the harm occurred.

Why the law ranks the machine above the memo

The prosecutor reached the same conclusion from the other direction. The court report records a finding of Workplace Health and Safety Queensland (WHSQ), that "The WHSQ investigation found that the operation of the ride relied primarily on administrative controls". It separately records that "The defendant was aware of the risk of failure of the administrative controls, but continued to rely too heavily upon them."

Ranking is not a matter of taste. The prosecution was Queensland, and the hierarchy below is taken from the Commonwealth Regulations because they carry the model provisions a national audience works from. The Work Health and Safety Regulations 2011 (Cth), in Compilation No. 28 with a compilation date of 25 March 2025, require a duty holder first to "eliminate risks to health and safety so far as is reasonably practicable" under regulation 35. Where elimination is not reasonably practicable, regulation 36(3)(c) lists "implementing engineering controls". Administrative controls arrive only afterwards, at regulation 36(4), which begins "If a risk then remains". Regulation 37 adds that a duty holder "must ensure that the control measure is, and is maintained so that it remains, effective".

The coroner did not dismiss administrative controls. Paragraph 994 records that "Whilst administrative controls are the lowest in the hierarchy, they nonetheless may be sufficient to manage some risks." A procedure is a legitimate control for a risk a person can actually reach in time.

Cost is where the ranking becomes concrete. Section 18(e) of the Work Health and Safety Act 2011 (Qld), as reprinted 3 August 2026 and checked as at 26 September 2026, makes what is reasonably practicable turn partly on "the cost associated with available ways of eliminating or minimising the risk, including whether the cost is grossly disproportionate to the risk". The court report, for the decision date of 28 September 2020, records that various engineering control measures were available, "none of which were cost prohibitive", and that these "included a water level sensor to automatically shut down the conveyor where the water level dropped, which could have been implemented for an estimated cost less than $3,000". It also records that the defendant "was aware, from audit recommendations made as early as 2003, of the need to install a single emergency stop at the main control panel".

The outcome, as at 26 September 2026, is as the court report records it for 28 September 2020: the defendant "was convicted and fined $3.6M. The conviction was recorded", against a maximum of $4.5 million available across three charges under section 32 of the Queensland Act, which applies where "the failure exposes an individual to a risk of death or serious injury or illness". Each charge concerned a failure to comply with the primary duty in section 19(2). Section 19(3)(b) makes that duty explicit for "the provision and maintenance of safe plant and structures".

What does this change for an AI or sensing rollout?

Nothing about the legal test, and everything about the design. Detection on this ride would have had to get four things right, and accuracy is only the first:

1. detect the water level starting to drop, as the first available signal;
2. be interlocked to the conveyor rather than controlled independently of it, the fault paragraph 1013 names;
3. stop the related equipment as well, as the model plant code cited below calls for; and
4. behave safely when the detection itself fails.

None is a question of model quality, and the legal test does not move either. Safe Work Australia, announcing its AI and digital technologies guidance on 23 July 2026, put it plainly: "While these technologies can present new and emerging risks, the process for managing those risks remains the same as for any workplace hazard."

The national guidance names the hazard class directly. The managing risks page describes technology that "physically interacts with workers and directly injures them (e.g. automated security gates malfunctioning or a cobot moving unexpectedly and colliding with a worker)". A conveyor belongs to the same class as those examples: plant that moves, with a person inside its reach.

Timing of the duty is the second point. The WHS duties page states that persons conducting a business or undertaking "must identify how AI and digital technologies they implement or use in the workplace might impact health and safety, and control risks as much as they reasonably can". It puts the separate duty to consult workers and their health and safety representatives at the same early point, including "before introducing digital technology that may impact health and safety to help identify WHS risks and decide how to manage them". The reaction window is therefore a pre-deployment measurement, not a post-incident one.

The third point is the review trigger, the one most likely to be missed in an AI program. Regulation 38(2)(b) of the Commonwealth Regulations requires review "before a change at the workplace that is likely to give rise to a new or different risk to health or safety that the measure may not effectively control", and regulation 38(3)(b) includes "a change to a system of work, a process or a procedure". Safe Work Australia applies that to software, naming "a software update" as such a change. A model version change is a change to the process. These guidance pages, announced on 23 July 2026, are current as at 26 September 2026.

The automation is also a hazard in its own right

Installing the sensor is not the end of the analysis. The same regulator names automation failure as its own risk. The example opportunities and risks page lists that "Technology misuse or malfunction from autonomous plant, advanced robotics or automation may create risks such as crushing workers or exposing them to hazardous substances (e.g. safeguards such as proximity sensors failing)". It also lists "System updates which directly create safety issues (e.g. disabling sensors or alarms)" and "Over-reliance on AI or digital technologies to detect hazards".

Both propositions hold at once, which is why the register below carries two columns: what the automatic stop actually stops, and what happens when the detection itself fails.

The model code answers the first. Safe Work Australia's model Code of Practice Managing the risks of plant in the workplace, November 2024 edition, states that "In the case of plant or parts of plant designed to work together, stop controls, including the emergency stop control, should also stop all the equipment related to the plant's operation, where continuing to operate this related equipment may be dangerous". Read that against paragraph 1013 and the design fault names itself.

The coroner supplied the test method as well. At item (a) of the first recommendation, directed to the Office of Industrial Relations, the findings ask that the Regulations make clear the onus on the Registered Professional Engineer of Queensland (RPEQ) conducting an annual inspection or a major risk assessment, and list among that onus the steps to "Observe how the machine handles adverse events. Run trial days where pumps are shut down, water levels decreased (or increased), rafts bottle neck, impact each other, to highlight weaknesses and expose hidden features of the design", and states that "Low probability failures need to be actively considered." Translated to a sensing or AI deployment, that is a commissioning exercise in which the sensor is blinded, the feed cut, the model fed degraded input, and the behaviour of the stop observed rather than assumed.

Build the reaction window register

One artefact carries all of this: a register with one row for each AI, sensing or automated control. The third column fills a row from the findings already cited.

Two prompts populate the reader's own rows from evidence already held, without sending anything identifying to a model.

TheAICommand works to the Verified Draft Method: de-identify the inputs, ground the model in your own source material, keep a person at the decision point, verify against the primary source, and log what happened.

Use only the attached documents. Do not use outside knowledge and do not fill gaps with assumptions.

Attached are the de-identified procedures, control register and incident reports for [EMPLOYER]. Every site, plant, vendor and person name has been replaced with a placeholder, numbered where there is more than one, such as [PLANT_ITEM_1] and [PLANT_ITEM_2].

Task: list every control in the attached documents that depends on a person noticing something and then acting.

For each one, give:
1. the control identifier as written in the register, or [CONTROL_ID] where none is recorded;
2. the hazard it is said to control, in the words of the attached document;
3. the exact line of the attached document showing that a person must notice or act, quoted verbatim, with the document name and the page or clause;
4. whether the document describes any automatic stop, interlock or engineering control for the same hazard, quoted verbatim, or the words "none stated in the attached documents"; and
5. the plant, system or process it applies to, using the placeholder exactly as it appears in the attached document, for example [PLANT_ITEM_1], so each row can be matched back to one item.

Rules: quote rather than paraphrase at item 3. Where you cannot quote a line, do not list the control. Do not rank, score or recommend. Return a table with these columns in this order: Control ID, Hazard, Quoted line requiring a person, Document and page, Automatic control stated, Plant or system. One row per control. Then give a separate list of anything you could not classify and the reason.

What to check: every listed control must trace to a quoted line in the attached documents, and anything without a quote is discarded. Open the cited page and confirm the quote is verbatim. Check the Automatic control stated column against the plant specification rather than the procedure, because a procedure describing an interlock is not evidence that one is installed.

Use only the attached documents. Do not use outside knowledge and do not estimate any number that is not written in them.

Attached are the failure description, the timing evidence and the stop specification for [PLANT_ITEM_1] at [EMPLOYER], all de-identified. Use the plant placeholder exactly as it appears in the attached documents, and run this prompt once for each plant item. The hazard under review is [HAZARD]. The control under review is [CONTROL_ID].

Task: set out the sequence from the first detectable signal to harm.

For each step give:
1. the step, in the words of the attached document;
2. the elapsed seconds from the first detectable signal, and the document, page or clause the number comes from;
3. whether the step requires a person to notice, decide or act, and which [ROLE] that is;
4. whether any automatic stop acts at that step, what it stops, and whether related equipment continues to operate; and
5. what the attached documents say happens if the sensor, model or detection method itself fails.

Then state two totals: the seconds from the first detectable signal to the first exposure of a person, and the seconds the human reaction path takes, each with its source. Where a number is not in the attached documents, write "not evidenced" and do not supply one. Finish with the review trigger recorded in the attached documents, and the date written on the evidence itself. Where the attached documents carry no date, write "not dated".

What to check: every elapsed time must come from the attached evidence with the source named, and any number the model supplies from general knowledge is struck out and replaced with "not evidenced". Confirm the plant response time after the control is operated sits inside the human total, which is incomplete without it. Where the model returns "not evidenced" for the seconds to exposure, that is the finding, and the next step is a measurement rather than a better prompt.

Do this Monday

The artefact is the reaction window register above. The owner is the WHS manager, with the plant or operations manager supplying the timings and the engineering or vendor contact supplying the stop specification.

The first step fits inside an hour. Pick one automated or sensing control, open a blank row, and fill three cells: the seconds from the first detectable signal to the first exposure of a person, the seconds the human reaction path takes end to end, and whether an automatic stop exists, as yes, no or unknown. Commissioning records, factory acceptance tests and incident reports hold the first number. They do not hold the second, so walk it dry with the plant running normally: start the stopwatch at the point on the panel or screen where the indicator would change, walk the operator's path to the control at working pace, stop it as the control would be operated, repeat once with the operator who runs that plant, and add the plant response time from the stop specification. Record it as a dry-run figure. Inducing the fault for real is a separate engineering action, booked with the plant stood down, and it is the same idea as the adverse event testing the findings describe, applied to the plant rather than the person. Where a number cannot be obtained inside the hour, write "not evidenced" and name who can measure it.

The check that proves it worked is a sorting rule rather than a feeling. Sort the register by the difference between the two numbers, and read three branches. Any row where the human reaction time is longer than the time to exposure and the automatic stop cell reads no is an open engineering action with a named owner and a date. Any row where that cell reads unknown is an open question for the engineering or vendor contact, due the same week. Any row whose human number reads "not evidenced" fails until the timing exists, and is an open measurement action for the plant or operations manager, dated inside the week, which is where the worked row above sits. None of the three is a training action, a toolbox talk or a procedure revision, and recording one as such is the error this case documents.

The bottom line

A coroner examined a fatal failure of plant and named the absence of automation as the deficiency, in findings delivered on 24 February 2020. The regulator prosecuted on the basis that the operation relied primarily on administrative controls, and the sentencing on 28 September 2020 sits against an engineering control the court report costed, as at 26 September 2026, at less than $3,000. The hierarchy in regulation 36 of the Work Health and Safety Regulations 2011 (Cth) is not a preference, and Safe Work Australia has confirmed that AI is managed through the same process as any other hazard. Keep a person at the decision point for decisions. Engineer the stop for anything that moves faster than a person can act.