Using Barrier Classification to explore Rollercoaster Dispatch Safety

Many of us have had the pleasure (or not) of riding a theme park attraction, from gentle children’s attractions, to huge rollercoasters that attempt to create ‘world firsts’ or new experiences when compared to previous generations. The amusement park industry is big business, valued at around $70 billion globally, and it goes without saying that people who turn up to these attractions expect not only to have fun, but to have fun safely.

That is a fair expectation, and one that the industry generally delivers upon consistently. In North America, in a typical year, more than 385 million guests enjoy more than 1.7 billion rides at around 400 fixed site attractions.  The chance of a serious injury occurring on a ride at one of these locations is approximately 1 in 15.5 million rides taken (IAAPA, 2026).  

Sometimes things go wrong, and when they do – just like in aviation, rail or other high reliability organisations, they focus our attention and blame often arrives quickly.  However, most of the time things go well, and safety performance goes unnoticed.  That performance does not happen by chance.  It exists because within the complex socio technical system that is a modern amusement park is layer upon layer of safety systems and controls.  Many of these are visible to the customer, whilst others are largely invisible and fully integrated into the ride experience.

Like airline or train departures, rollercoaster dispatches are repeated high consequence operational activities.  The difference is scale.  A single attraction may execute thousands of successful dispatches every week.  The remarkable thing here is not that occasional failures occur, but that thousands of ride cycles are completed successfully through the continuous functioning of physical, functional, symbolic and incorporeal barriers (Hollnagel, 2004). Erik Hollnagel describes these four barrier types within his book, Barriers and Accident Prevention.

This short article attempts to describe and discuss some of the barriers that are present within an amusement park, using the dispatch of a rollercoaster as a practical example of how safety is achieved reliably.

Physical Barriers

Let us first start with perhaps the most tangible form of barrier, the physical barrier. Hollnagel describes these as barriers that physically prevent movement, access, release or harm.  Unlike some of the barrier types discussed shortly, physical barriers are often less dependent on human interpretation or action once they are in place.

In the context of an amusement ride, the most obvious example is the restraint system itself, keeping the rider safely attached to the ride vehicle throughout its journey.  These restraints have changed considerably over the years and depend upon the type (and extreme nature!) of the attraction.  Sometimes a simple lap bar is all that is required.  Other rides may utilise over the shoulder restraints, whilst some modern attractions secure riders at the waist or lower body. There is a balance to be achieved here; completely strapping somebody into a ride vehicle may maximise security, but designs that achieve appropriate restraint whilst still allowing controlled freedom of movement often contribute to a more exciting and ‘free’ ride experience.

Within these physical barriers, there is redundancy too.  Modern ride restraint systems are rarely designed as a single protective device.  Behind what appears to guests as a simple lap bar or over the shoulder restraint are often multiple layers of mechanical redundancy intended to prevent a hazardous (and untimely) release.  Restraints are typically engineered using fail safe principles, whereby a loss of power, hydraulic pressure or control input does not automatically result in the restraint opening.  Multiple locking positions, ratchet mechanisms, independent locking and secondary retention features may be incorporated so that no single component failure results in loss of protection.

In addition, restraint systems must withstand substantial dynamic loading generated by positive and negative g forces, lateral accelerations and repeated fatigue cycles throughout their operational life.  As a result, restraint components are generally designed with significant safety margins and subjected to extensive verification, testing and inspection regimes. What appears to riders as a single restraint is therefore often a collection of independent mechanical design features, each intended to ensure that the physical barrier continues to perform its protective function even in the presence of faults, wear or component failures.

Hollnagel describes physical barriers as those that physically prevent movement, access, release or harm, and modern ride restraint systems provide a useful example of how such protection is achieved through robust mechanical design rather than reliance on operator interpretation or intervention.

In addition, ride vehicles are protected from rolling backwards down a lift hill through anti rollback devices. These often consist of a physical arrangement of teeth and engagement mechanisms which prevent unintended rearward movement should a lift mechanism fail. Whilst often taken for granted by riders, they represent another example of a physical barrier designed to prevent movement through direct mechanical intervention.

Aside from the ride vehicle, physical barriers also keep the public separate from the track system.  The amusement industry often creates innovative ways of blending safety barriers into the environment and theming, something that frequently goes unnoticed by the visiting public.

Functional Barriers

The next form of barrier is the functional barrier, one which achieves its effect through the functioning of a system or technology rather than through physical separation alone. According to Hollnagel, these barriers depend on how a system behaves and responds.

Whilst a ride restraint may physically lock into position, the ride system will also likely provide the operator with confirmation that the restraint has reached its required position. This may be through a control panel indication, a status light or another form of feedback.  Many of these conditions are monitored continuously and, should they not be achieved, dispatch of the train would be prevented.

Another example is the ride block system. Often, multiple ride vehicles move around a complex ride layout at the same time.  Generally, two ride vehicles cannot occupy the same section of track simultaneously, and each section is therefore treated as a block.  The ride safety system prevents a following vehicle entering an occupied block and this is where visitors may notice sections of track fitted with brake units or other locations where a train could be brought safely to a halt if a block was occupied.

This concept will be familiar to those working within the railway industry. Railway signalling systems also prevent trains entering occupied sections of track by protecting the route ahead with red signals and automatically applying braking in some situations.  In both cases, the safety function is achieved not by a physical fence or gate, but by a system designed to constrain operational behaviour.

Whilst a boarding gate itself would generally be considered a physical barrier, whether that gate is closed and correctly secured before dispatch becomes a matter of function. If boarding gates, exit gates or maintenance access doors are not in the required position, the ride will not move.  Equally, ride operators themselves may be required to reach designated places of safety before dispatch becomes possible.

Ride envelope protection provides another example.  In the same way that aircraft and trains operate within defined limits, rides are also designed to function within specific operating envelopes.  Modern attractions may continuously monitor environmental and technical conditions including wind limits, equipment position and system health.  Should these functions detect an exceedance, the ride may stop operating, transition to a safe state or alert an appropriate person.  This can be achieved at both an individual ride level, or at a wider ‘park’ level. 

In short, many rides require numerous conditions to be satisfied before dispatch is possible.  In each case, protection is not provided by a physical barrier alone, but by systems that constrain how the operation can proceed.   This is the essence of a functional barrier.

Symbolic Barriers

This is where things become particularly interesting from a human factors’ perspective.

Physical barriers prevent movement, access, release or harm, whilst functional barriers constrain how a system can operate.  Symbolic barriers, however, achieve their effect through the communication of information. In other words, they require information to be perceived, understood and acted upon correctly.  Hollnagel describes symbolic barriers as those whose protective effect depends upon their meaning.

Within a rollercoaster dispatch sequence, symbolic barriers are everywhere.  Ride operatives receive information from control panels, restraint indicators, dispatch lights, status messages, CCTV systems and other displays that communicate the current state of the attraction.  Operators may exchange hand signals, verbal confirmations or a simple thumbs up to indicate that checks have been completed and dispatch can safely proceed.

None of these barriers physically prevent an unsafe dispatch, yet they provide information which supports safe operational decision making.  Furthermore, rides typically have operating procedures, dispatch sequences, checklists and other documented tools which act as additional constraints on how tasks should be performed.  These materials provide information intended to influence behaviour and reduce the opportunity for error.

Equally, symbolic barriers extend beyond ride staff.  Riders themselves are provided with information throughout their queuing experience.  They are instructed how to sit correctly, where to place their belongings, how to position their arms and legs and what actions should be avoided during the experience.  Whether delivered through signs, operator briefings, recorded announcements or visual displays, these barriers depend upon the information being noticed, understood and followed.

Unlike physical or functional barriers, symbolic barriers are only effective when the information they provide influences behaviour.  Effectiveness depends not only upon the quality of the information presented, but also upon the capability of those receiving it to interpret and act upon it correctly.

Incorporeal Barriers

This final category is what Hollnagel refers to as an incorporeal barrier.  These exist not as physical objects or sources of information, but within people and organisations themselves. They are based upon knowledge, competence, experience, training, supervision, behaviour and the wider organisational environment in which work is carried out.

In many ways, and from an employee perspective, incorporeal barriers provide the capability to make use of symbolic barriers.  Whilst procedures, signs and indications provide information, operators still require the competence and judgement to understand what that information means and determine an appropriate response. The same principle applies to riders. Whilst information may be provided through signs, announcements and safety briefings, guests still require the knowledge and judgement to understand what is being asked of them and comply with those instructions appropriately. Remaining seated correctly, securing loose items and keeping arms and legs within the ride vehicle are all examples where the effectiveness of the barrier depends upon human behaviour.

Training and supervision therefore play a significant role.  Ride operatives are trained and assessed to check restraint systems, identify abnormal situations, challenge uncertainty and follow dispatch procedures consistently.  Supervisors provide oversight, whilst organisational standards establish what constitutes acceptable performance.

Human performance remains an essential element of the system, but barriers relying upon human performance are sometimes more variable and more vulnerable to degradation than engineered barriers.  Fatigue, distraction, workload, experience, environmental conditions and organisational pressures can all influence performance.  This is one reason why effective safety management seeks to combine incorporeal barriers with physical, functional and symbolic controls rather than relying upon one single layer in isolation.

The same principle can be found within other safety critical industries.  Whilst these operational domains require (and depend upon) competent people, they also recognise that people perform most effectively when supported by well-designed systems, clear information and robust engineering controls.

In Summary

Amusement rides are incredibly safe, and that safety is achieved through a suite of barriers working together seamlessly to support both safety and operational performance.  No single barrier delivers this outcome in isolation.

Using Hollnagel's classification, it’s clear that different barriers perform different functions within the system.  Physical barriers constrain movement and energy.  Functional barriers constrain how the system behaves.  Symbolic barriers communicate information intended to influence decisions and actions.  Incorporeal barriers provide the competence, judgement and organisational capability needed to apply that information effectively.

A safe ride dispatch therefore occurs not because a single restraint, procedure or operator performs perfectly, but because multiple forms of protection complement one another. Should one barrier weaken, others remain available to provide additional protection.

Ultimately, safe ride dispatch is not achieved by chance.  It is the product of carefully designed physical, functional, symbolic and incorporeal barriers working together thousands of times each day, enabling riders to enjoy exciting experiences whilst maintaining remarkably high standards of safety.

The same principle can be found across many high reliability industries.  Safe outcomes are rarely the result of a single control.  More often, they emerge from the interaction of multiple barriers, each contributing towards the overall resilience of the system.

What barriers exist within your own operational world that silently support success every day?

This article is based upon Erik Hollnagel's work on barrier systems, illustrated within the book, Barriers and Accident Prevention (Hollnagel, 2004).