Wentworth Institute of Higher Education ICT313 IT Engaged Project · Semester 2, 2026 · Group M D H S
ParkPassRoyal National Park

NSW National Parks and Wildlife Service · Royal National Park

One pass. One map. One place to tell a ranger something is wrong.

Royal National Park carries more than four million visits a year on systems that were never built for it. ParkPass pulls bookings, passes, crowding and field reporting into one place that visitors and rangers both use.

Database connected — MySQL 8.4.10-10

Day PassValid today

Royal National Park

Bonnie Vale Campground · Site 14

Arrive2:30 pm
VehicleCJ 42 QR
People4
Nights2

PP 2026 RNP 004821

The problem

Six things go wrong every weekend, and none of them are anybody's fault

The park is not short of staff who care or visitors who do the right thing. It is short of one place where any of this is written down. We spent the first two weeks of this project working out what actually breaks, rather than what looks broken from the outside. These six came up again and again.

4M+visits a year, on systems never designed for that load
4separate systems a single camping trip touches
Zerolive view of how full any precinct is right now
SDG 15Life on Land, targets 15.1, 15.5 and 15.9
01

A booking and a park pass are two different things

Visitors, gate staff

Someone camping at Bonnie Vale books the site in one system and buys the vehicle entry pass in another. They come away with two emails, two reference numbers, and nothing that proves the pair belong together. At the gate a ranger checks a printed list, because there is nothing better to check against.

02

Nobody knows how full the park is until the carpark is already full

Visitors, rangers, the bushland itself

Garie and Wattamolla fill by mid morning on a summer weekend. There is no live count of what is already inside, so the park cannot warn anyone and people drive an hour to be turned around at the boom gate. Those cars then park along the road verge, and the verge is where most of the vegetation damage actually happens.

03

Damage gets reported on paper, days after someone saw it

Rangers, maintenance crew, visitor safety

A washed out section of the Coast Track goes into a ranger notebook, gets typed up at the end of the shift, and can sit in an inbox for a week. Visitors almost always see the damage first, and they have nowhere to report it, so the park throws away its earliest warning.

04

Wildlife sightings never reach the people who need them

NPWS conservation staff

Visitors photograph a swamp wallaby, a lyrebird, or a feral deer. That last one matters most. Pest sightings and threatened species records are exactly what conservation planning runs on, and at the moment they go to Instagram rather than to anyone who could act on them.

05

Ranger work is planned across four separate spreadsheets

Rangers, area supervisors

Patrol rosters, maintenance jobs, track closures and incident reports each live in their own file, owned by a different person. Nobody can see a whole week on one screen. Two rangers get sent to the same job, and a track that closed on Friday is still showing as open on Sunday.

06

The park cannot show what it is doing to protect itself

NPWS management, the public

Visitor load by precinct, carrying capacity, incident trends over a season. The numbers exist, in fragments, in systems that do not talk to each other. That makes it hard to report against conservation targets and harder still to argue for resting an area under pressure.

None of these is a single large failure. They are six small ones that each cost a few hours a week and a little bit of bushland. Our business case puts the value of fixing them at roughly $327,000 a year in recovered staff time, captured revenue and avoidable repair work, against a first year build of about $214,000. That is a payback of around ten months.

Who uses it

Six roles, and what each one actually does with the system

Every role below is implemented in the prototype with its own screens and its own permissions. Sign in as any of them from the prototype page: there is one demo account per role.

Park visitor

Anyone driving down for the day or the weekend

  • Book a campsite and see which sites are genuinely free
  • Pay once and receive a single pass covering camping and the vehicle
  • Check how busy a precinct is before leaving home
  • Report trail or facility damage with a location
  • Log a wildlife sighting, native or pest
  • Cancel a booking, which voids its pass in the same step

6 use cases

Field ranger

On the ground, usually without reception

  • Work through the damage queue, newest and most severe first
  • Assign a report to themselves so two rangers do not duplicate
  • Raise a maintenance job straight from a report
  • Start and finish the patrols rostered for the week
  • Publish a track closure that visitors see immediately
  • Check a pass at the gate against the vehicle plate

6 use cases

Maintenance officer

Trades and works crew

  • See every job ordered by priority, not by who shouted loudest
  • Take a job so the crew knows who has it
  • Add a job directly for work found in the field
  • Close a job out, which resolves the report behind it automatically

4 use cases

Conservation officer

Species and pest management

  • Read the sightings register that visitors and rangers fill
  • Reclassify a sighting as native, pest or threatened
  • Remove duplicates, with the removal kept in the audit trail
  • Read the sustainability dashboard: average and peak load per precinct
  • Identify precincts peaking above 85% of capacity, which is when verge damage starts

5 use cases

Licensed tour operator

Commercial groups working in the park

  • Lodge a group booking without emailing a ranger
  • See permit status and the issued permit reference
  • Withdraw a booking that is still pending
  • Have group numbers counted into the capacity picture before the day

4 use cases

Park administrator

NPWS area office

  • Create staff and operator accounts, since only visitors self register
  • Change a role, or switch an account off without deleting its history
  • Set the vehicle capacity that drives the public page and the dashboard
  • Add and remove precincts
  • Approve or reject operator permits
  • Read the audit trail of every create, update and delete

6 use cases

The solution

Eight modules, built across five two week sprints

The prototype covers the visitor, ranger, maintenance, conservation, operator and administrator paths end to end.

Book a campsite

Pick your dates, see which sites are actually free, pay once, and carry the pass on your phone.

See how busy it is

A live crowding indicator for each precinct, so visitors can choose a quieter time to arrive.

Report trail damage

Photograph a washed out track, drop a pin, and it reaches the ranger work queue the same minute.

Report wildlife

Sightings logged with a location and a date, feeding straight into NPWS conservation records.

Ranger patrol planning

Patrols, jobs and closures for the whole week on one screen instead of four spreadsheets.

Maintenance requests

Broken gate, blocked amenities, damaged signage. Logged, assigned, and tracked to close out.

Sustainability dashboard

Visitor load measured against carrying capacity, so the park can rest the areas under strain.

Tour operator portal

Licensed operators lodge group bookings and permits themselves, with no ranger in the loop.

The park

What we are building this for

Royal National Park, on the southern edge of Sydney. The second oldest national park in the world.

The build

How it is put together

Plain LAMP, chosen because we have to hand it over and somebody else has to keep it running after we graduate.

1. Browser

  • HTML5, semantic and keyboard reachable
  • CSS3, one stylesheet, no framework
  • JavaScript for validation and live meters
  • WCAG 2.2 AA contrast throughout

2. Application

  • PHP 8.3, no framework
  • Sessions with role checks on every page
  • CSRF token on every write
  • Output escaped at the point of printing

3. Data

  • MySQL 8.0, 16 tables
  • PDO with prepared statements only
  • Booking and pass written in one transaction
  • Audit row for every create, update, delete

4. Outside services

  • Stripe Checkout, sandbox, for fees
  • Leaflet and OpenStreetMap for pins
  • No card data on our server, ever
  • Service worker for offline passes

A booking travels left to right: the browser posts the form, PHP validates it and re-checks availability, then one transaction writes the booking and its pass together and an audit row records who did it. If any part fails the whole thing rolls back, so there is never a booking without a pass.

The plan

Twelve weeks, five sprints, planned in ProjectLibre

Scrum, two week sprints, with a review and a retrospective at the end of each. The team coordinates daily in a WhatsApp group and meets weekly in class.

Sprint 1 · Weeks 3 and 4

Foundations

Repository, hosting, database connection proven, page frame and sign in.

Sprint 2 · Weeks 5 and 6

Data and access

Entity relationship diagram, all tables created, authentication, sessions and role checks.

Sprint 3 · Weeks 7 and 8

Booking and passes

Availability search, the four step booking flow, pass generation, cancellation.

Sprint 4 · Weeks 9 and 10

Field and reporting

Damage reporting, wildlife sightings, ranger work queue, maintenance jobs, closures.

Sprint 5 · Weeks 11 and 12

Capacity and hand over

Capacity monitoring, sustainability dashboard, operator portal, accessibility and security pass.

Final · Week 12

Testing and submission

Full test pass, WCAG 2.2 AA check, security review against the Essential Eight, documentation.

The team

Group M D H S

ICT313 IT Engaged Project · Wentworth Institute of Higher Education

Dipesh Khadka Student 987928 Project Manager and Business Analyst
Shreeya Dangal Student 988118 UX, Front End and Security Lead
Himanshu Shahi Student 983356 Technical Architect and Back End Lead
MD Abdullah Student 985042 Scrum Master and Quality Lead

Get involved

Register your interest in the pilot

This form writes a real row into the project database and reads the count back, so it doubles as our live database connectivity check.

3 people have registered so far

Run the full database test

We store your name, email and park choice, and only for this student project. Handled under the Privacy Act 1988 and the PPIP Act 1998.