The Cave Creek Incident

Abstract

This paper will discuss how pre-existing organisational conditions and managerial practices can combine with local conditions to create a disaster. Drawing upon the work of Reason (1990) the 1995 Cave Creek disaster (New Zealand) will be used to illustrate this process. It will describe how top-level decisions are transmitted through organisational pathways and create local conditions that promote the commission of unsafe acts. The implications of organisational change, the prevailing safety culture, and staff responsibility will be discussed. Practical applications of the theory, in the form of a matrix for exploring defensive failures, will be presented.

Introduction

In high risk environments, as well as complex technologies, we are in the age of the organisational accident (Reason, 1990). That is, incidents occur because pre-existing and often long-standing latent or hidden failures, arising in the managerial and organisational areas, combine with the local conditions to penetrate the systems defences.

A landmark case associated with these factors was investigated in England in 1987. Mr Justice Sheen's judgement on the causes of the capsize of the `Herald of Free Enterprise' (a European `roll-on', `roll- off ' ferry) went beyond the errors of the Master, the Chief Officer and the Assistant Bosun. He wrote, "....a full investigation into the disaster leads inexorably to the conclusion that the underlying or cardinal faults lay higher up in the company" (Sheen, 1987).

Since this time there have been several other reports into catastrophic system failures which have implicated organisation and management decisions leading to fatal consequences: the Air Ontario crash (Moshansky, 1992) and the Challenger Shuttle disaster (Vaughan, 1990).

It is estimated that up to 80% of accidents in hazardous activities and technologies are caused by human error (Hollnagel, 1993). This figure is not new and is discussed by a variety of authors from diverse research backgrounds Chopra, Bovill, Spierdijk & Koornneef (1992), Hawkins (1987), Perrow (1984) and Reason (1990). It has also been revealed that the human cause of major disasters are distributed very widely, both within the organisation and often over several years before the actual event, for example, the fire at the Three Mile Island nuclear plant; the Exxon Valdez oil tanker spill; the Piper Alpha oil platform fire; the Kegworth air accident and the Kings Cross and Clapham Junction rail accidents.

The Incident

Before we explore the theoretical framework which underpins this paper, let us review the incident we will be discussing. On the 28th April 1995 seventeen members of a Polytechnic course from Greymouth and the manager of the Department of Conservation's Punakaiki Field Centre fell about 30 metres from the Cave Creek viewing platform as it collapsed. As a result fourteen young people lost their lives and another four were injured. This from one of the survivors:

"We continued walking and, as the track became narrower walked in pairs. I was in approximately the middle on the group as it reached the platform and stepped into a gap on the left hand side of the platform at the front to have a look. I looked over and went to take a step back because I don't like heights. Suddenly and with no warning except for yells of surprise, the platform was falling under our feet. It began sliding down at approximately 30 degrees and then tipped and fell vertically with everyone falling in front of it."

(Carolyn Smith 1998, p9)

The Theoretical Framework

The theoretical framework which is adopted to help examine the Cave Creek catastrophe was developed by James Reason and published in 1990. This framework rests on the premise that many major disasters have a number of similar important features. These are:

• They occur within complex socio-technical systems, that is, the systems require the precise co- ordination of a number of human and mechanical elements.
  

• These accidents arise from the adverse conjunction of several different causal sequences, each necessary but none sufficient to cause a disaster by itself. Often the main causal factors have been present within the system for a long time before the accident sequence occurs.
  

• Human rather than technical failures play a more dominant role in most of these accidents.
  

As will be seen, the Cave Creek disaster had all the above elements.

A closer examination of several recent disasters; especially Bhopal, Challenger, Chernobyl and Erebus, indicate that there is a need to distinguish the ways in which humans contribute to the breakdown in these systems.

Firstly there are errors and violations which have an immediate adverse effect. These are known as `active failures' and are generally associated with the activities of those in the `front-line'.

Secondly there are errors which are concerned with decisions or actions, the damaging consequences of which may not be apparent, only becoming evident when they combine with local factors, such as active failures, or technical faults. The features of these errors are that they are present within the system sometime before the onset of a recognisable accident sequence. They are also involved with those who are removed in time and space from the structure or machine; such individuals as high-level designers, regulators, managers, and maintenance staff. These are known as `latent-failures'.

Exploring the Theory

In order to explore more closely the Cave Creek accident it is important to look at all the possible elements which were present. All complex groups working in high risk areas posses several elements: organisational processes and their associated cultures, a variety of different workplaces all having a variety of local conditions with defences, barriers and safeguards to protect people, assets, and the environment from the adverse effects of the local hazards. This initial framework is illustrated in figure 1.

Figure 1
Elements common to complex working groups and technologies
(from Maurino, Reason, Johnston & Lee, 1995)

Organisations exist within broad economic political and legislative settings and therefore it would be meaningful to confine the basic theoretical elements to those factors over which the organisation, in this case the Department of Conservation, could reasonably be expected to exercise a measure of direct control.

Organisational behaviour is bound by culture and practices which are often unique to that organisation. Culture is often referred to as comprising those attitudes and beliefs that both emerge from and shape the way in which a group carries out its function. These processes, all of which entail decision making (often at the highest level) include the following activities; policy making, planning, designing/specifying, communicating, financing/budgeting and allocating resources, monitoring, checking, inspecting and managing projects and safety. These are a few examples but as with these and other variables the "ways things are done" (Uttal, 1983) are important to the culture of any organisation. Cultural factors take a long time to develop and are slow to change. These influences are found through the organisation and colour the attitudes and behaviours of the those working in the organisation.

This can certainly be seen in the Department of Conservation and its local conservancy offices. The original structure within the New Zealand Forest Service had various support organisations with which it worked. Most importantly, with regard to this incident, was the former Ministry of Works, with its technical-administrative culture, which carried out structural designs and checks for the New Zealand Forest Service. Created by the Conservation Act in 1987, the Department of Conservation assumed many of the functions previously carried out by the Lands and Survey Department, New Zealand Forest Service and the Wildlife Service, thus changing its original culture. Another change in 1988, following a Coopers and Lybrand report, saw the reduction of management to three tiers and the removal of the district management officer. These changes saw the appointment of managers with inadequate qualifications, that is they were appointed for their conservation background and had no managerial skills.

A lack of money per se was not the cause of the Cave Creek platform collapse but a closer look at the organisational structure and funding demonstrates the rate of change may have been a problem.

In real terms the funding to the department between 1987 and 1995 had been reduced by 9% from the Crown. At a similar time the Coopers and Lybrand report suggested a reduction in staff and as a result the staff was reduced from 2200 to 1250. These issues will again be highlighted when we consider the local working conditions.

As figure 1 indicates the local working conditions with the defences, barriers and safeguards stem from the overall organisational process. Local working conditions are those factors which influence the efficiency and reliability of human performance in a particular working environment, in our example the West Coast Conservancy. The theory asserts that the negative consequences of top-level decisions (eg. deficient planning, under staffing, inadequate budgets and operational time pressures) are transmitted through various organisational pathways to the different workplaces. At this point they can create the local conditions that promote the commission of unsafe acts. Many unsafe acts may be committed, but only very few will penetrate the defences and barriers to bring about an incident with a damaging outcome. In order to examine how local working conditions contribute to unsafe acts, it is necessary to look at both the tasks required, the environment in which the personnel worked and the personnel themselves.

In this regard there seemed to be a lack of management and prioritising of projects. This was seen in the mismanagement of existing resources, with a regional works officer engaged for the majority of his time in building structures when this was not a primary part of his employment. In another case a short term conservation worker was employed to upgrade a track and on his own initiative erected a low-level viewing platform. As well as this ad hoc policy making and planning there were problems in the allocation of resources, where twenty five percent of the total national conservation estate in New Zealand (the West Coast Conservancy) was managed by 9% of the departments personnel.

As well as the obvious pressure with which the department staff worked, of which one estimate was 65 hours per week, there were other considerations associated with the priorities of the department. This was eloquently summarised by a witness at the Commission of Inquiry:-

"If I was to summarise the complaints that I receive, it would be that fewer and fewer staff are expected to perform an ever expanding work load with shrinking funding in an often hostile environment."

(Turner p30: Noble, 1995).

Although it has been said that funding per se was not the cause of this tragedy a closer look at the organisational process regarding the West Coast area indicates an inadequacy in the management of the rate of change. Visitor numbers to the Punakaiki Visitor Centre increased by nearly 67 thousand in the three years to 1994. This centre has the highest number of visitors to the West Coast and the second highest in New Zealand. Members of the West Coast Tai Poutini Conservation Board had voiced their concerns since their first report in 1991. The then chairman said:-

"... the west coast has very active conservation issues which need continued adequate funding for successful management."

(Noble, 1995, p32)

This sentiment was reiterated from 1992 to 1994 when the Chairman said the following:-

"Funding constraints have meant that there has been a fall in maintenance on some areas of the estate .... The continuing cuts to programmes in a period of rapid growth in use of lands administered by the department is a major concern to the board."

(Hamilton, p32; Noble 1995)

The West Coast Conservancy was considered, by Coopers and Lybrand, to need approximately 137 staff to carry out the departments mandate. At the time the platform was designed and constructed, the West Coast Conservancy had 112 staff, 25 fewer than the level originally considered necessary. The evidence at the Commission of Inquiry noted that, because of funding restraints, the actual staff levels had been lower than planned.

The position at the Punakaiki Field Centre illustrated the under resourcing and under staffing dilemma. It was clear from the evidence at the Commission of Inquiry that the prevailing culture was one of seeking to do more with less and of working long hours in order to cope with the changing priorities.

The staff were found to be very committed to the department; often this was the result of the type of individual suitable for such employment, keen conservationists who were hard working, resourceful but continually faced with a lack of resources which finally gave rise to a culture of doing more with less.

It was also apparent from the overall evidence at the Commission of Inquiry that there was a lack of project management at the highest level in the organisation. When the department was created, an appropriate framework for the management of design and construction of structures was never laid down and given to conservancies and then to the field centres. It was also revealed that officers at both regional conservancy and field centres were inadequately instructed regarding the management of design and construction of structures. These last two issues were the key ingredients in the local working conditions which led to the inadequately constructed platform at Cave Creek.

Measures that are designed at removing, mitigating or protecting against operational hazards now play a large part in the resource allocation in organisations engaged in potentially dangerous activities. Defences, barriers and safeguards can be classified within two relatively separate dimensions. Firstly regarding the function it would serve; for example to create an awareness and understanding of the risk and hazards and to protect people and the environment from injury and/or damage. Secondly the ways in which the organisation would deal with such circumstances; for example policies and standards with regard to safe working practices, procedures, instructions and supervision at local level and training of safety awareness.

There is certainly no such thing as a perfect set of defences, barriers and safeguards for all situations and it is known that many shortcomings can be the direct consequence of decisions made in the organisation.

Again let us revisit the Cave Creek situation. There were several things which were lacking as defences, barriers and safeguards both at National and Regional Conservancy level. Most important was the lack of a positive safety climate. This can lead to the breakdown in management philosophy which considers people and their goals as well as production goals. It was unclear from the Commission of Inquiry how strong the Departments commitment was to safety matters which include the appointment of safety officers with good and clear communication links to all level of the organisation. What was clear from the Inquiry was the lack of knowledge regarding project management in the widest sense. This was recognised as a problem at all levels of the Department and led to serious inadequacies regarding the planning of projects and standardised practices which included feedback and follow up evaluation. A lack of training in certain areas also allowed the defences within the organisation to be breached, which will be examined next.

Active and Latent Failures

When people are involved in highly complex systems, there will be failures. These may occur either in the working environment or in relation to the defences within the system.

These failures can be divided into two specific types of error. Firstly `active failures' which usually have an immediate and direct impact on the people and environment and secondly the `latent failures'. Latent failures, or resident pathogens as Reason (1990) would describe, are those failures which lie dormant, often for long periods, in the system and which combine with the active failures to cause the events which breach the systems defences.

Active failures are usually committed by those who are directly involved with the system: members of the Department of Conservation, those people in the West Coast Conservancy and the Punakaiki visitor centre. Human active failures are errors or violations associated with those people actually working in the field. Errors can be classed as slips and lapses or as mistakes associated with the rules of problem solving or inadequate knowledge. Violations are deviations from safe operating practices, procedures, standards or rules. Such deviations may either be deliberate or erroneous. However, usually the consequences of these active failures are caught by the systems defences or by the members of the groups themselves. On some occasions they may occur in conjunction with a breach in the defences which then results in an accident, as in the Cave Creek example. Before we discuss the latent failures let us examine the active failures in the Cave Creek incident.

The staff constructed an unsafe viewing platform with no engineering support which was not checked at the design or construction stages. Staff, unknowingly, did not comply with the statutory requirements of the Building Act which led to a large number of inadequate construction procedures such as the failure of the main and secondary bearers, failure of joist and trimmer connections and failure of the piles which were not aligned or nailed adequately. There was also failure to treat the timber in contact with the ground.

No plans were followed in the construction of this platform and once constructed no notice was erected on sight with loading restrictions. Finally the reported doubts regarding the platform and its security were never investigated.

If we now consider the latent failures in this accident it becomes clear that this incident may not have been avoidable. Latent failures can be described as loopholes in the system's defences, whose potential existed for some time prior to the start of the incident sequence. When these weaknesses combine with both active failures or local triggers there is a trajectory of accident opportunity created (often only momentary) through which some or all of the systems protective layers fail. Figure 2 demonstrates this phenomena.

Figure 2
An event involving the penetration of the systems defences.
(from Maurino, Reason, Johnston & Lee, 1995)

The last part of the model to be discussed is associated with the event itself. An event is defined as a complete penetration of an accident trajectory through the system defences. At this level the active and latent failure pathways come together to create the accident opportunity. These causal pathways can also interact with local conditions or triggers which can compound the potential for injury and damage. In the case of the Cave Creek incident there were several of the these local triggers, namely; the position of the platform over the creek, the number of people on the platform and the lack of a safety notice regarding loading at the site. Figure 2 illustrates the possible trajectory of opportunity through various gaps of weakness. These gaps in the deficiencies can arise for various reasons, three of which can be found in the present accident.

Firstly, there can be gaps created which have been present for a long time. These can be seen in this incident as the weakness in the management of the project and the unrealised shortcomings in the defences. Secondly there can be gaps created by active failures, either unsafe acts or breakdowns of components. This can be seen in the disabling of an engineered safety feature and the violation of safe operating procedures.

Lastly, gaps can be created knowingly during the course of construction or maintenance of a system. In most well-defined systems, the accident trajectory requires the precise alignment of the gaps in all the defence layers. The probability of this happening is usually very small, but in the present situation this was not the case.

A summary of this accident analysis can be found in Figure 3. It can be seen from this figure that the latent failures became the markers of the systems safety health.

Practical Applications of the Theory

The consequences of the present accident were catastrophic and although we can examine the outcome in the above manner, how does this help to mitigate and prevent similar accidents in the future? A pre-requisite for appropriate learning from these tragedies is to produce a safety information system that identifies not only the active failures but also the latent failures and their source within the organisation.

Within the domain of safety health in any organisation there are two main areas of concern which must both be considered; firstly, error producing conditions (EPC's) which include violations as well as slips, lapses and mistakes. When strategic decisions are made in the higher management and organisational levels of a group, there may be some negative consequences which can manifest themselves in some areas of the working environment as error-promoting and violation-enforcing conditions. This was illustrated in the present incident in the areas of time pressure and unawareness of hazards. In performing particular tasks, these local factors can interact with personal factors such as lack of knowledge, skill or motivation problems to produce violations and errors. Secondly the area of defences. These barriers and safeguards help mitigate or block the consequences of violations and errors. They may be grouped according to their function, that is whether they serve as awareness, detection/warning, protection, recovery, containment, escape/rescue or by the way they are implemented, that is training/briefings, procedures/instruction/supervision, standards/policies/rules, engineered safety features, and personnel protection. Assessment of the effectiveness of the defences gives some indication of where the holes in each layer can be found (fig 2) or are likely to appear in the future. Regular checks on the system will hopefully lead to continuous improvement routines in which the worst problems can be identified and corrected.

Having listed the importance of both the error-producing conditions and the defences in this incident the practical ways to prevent a repeat of such a tragedy must be considered.

Firstly from Figure 3 it is possible to list the main problem factors in the Cave Creek incident. These were:

• Planning at National and Regional level
• Commercial and operational pressures
• Training
• Communication
• Rules
• Materials
• Design
• Provision of tools and equipment
• Supervision
• Maintenance

Using a matrix which includes the defences already mentioned it is possible to begin to determine the organisational root causes of this accident.

DEFENSIVE METHODS

Each latent defence failure listed above should then be assessed for its relative contribution to each of the ten problem factors in the incident using a 0-4 rating. The problem factor ratings should be summed to obtain a latent failure profile which permits a visual indication of the relative contribution of each organisation factor to the latent factors identified on the accident.

An example can be seen in the matrix when considering just one problem factor; that of planning at National and Regional level (listed in bold numbers).

The local factors should then be identified to establish the active failures found in this incident. Ratings of the contributions of each problem factor to each local factor should be assessed using the same method as above. The problem factor ratings should then be summed to obtain an active failure profile. This indicates how each of the problem factors contributed to the local factors in this incident.

Again an example is given for the first problem factor in terms of the active failures; (listed in italic numbers).

Thus taking the problem factor of Planning at National and Regional level it is possible to establish a latent defence failure rating of 54, and an active defence rating of 31; cells without numbers indicate these defences were not related in this case with the stated problem factor.

Finally the latent and active failure profiles can be aggregated to obtain an overall organisation profile for the Cave Creek accident; in this case 85 regarding the issues of National and regional planning.

This identifies the problem factors which were most responsible for both the latent and active failure pathways. Again, in our example, it can be seen that the main defence failures occurred as a result of latent organisational problems; the issues regarding Standards, Policies and Rules being the strongest. The active or local defence failures were not as problematic, although of each category the issues of personnel protection were of greatest concern.

The Future

The activity described above is perhaps more difficult to follow using just one example but if many incidents are documented in this format trends will emerge which will allow those working in the organisation to improve the effectiveness of their safety management and ultimately the safety health of the system itself.

This approach to analysing human error has been used in various situations, mostly however in what can be termed high risk endevours, such as nuclear power plants, the petroleum industry and off-shore oil installations (Hudson, Reason, Wagenaar, Bentley, Primrose & Visser, 1994) and in the aftermath of air disasters (B.A.S.I., 1994; Moshansky, 1992; Paries, 1994).

As well as these reactive analyses the proposed model should also be considered as having a proactive application. This would entail identifying the organisational and situational factors contributing to unsafe acts, including; policies, rules, regulations, the methods of practice within the system as well as the personnel themselves. This task should be able to identify the main factors which need remediation and also allows for an ongoing monitoring of these factors. An example of both organisational and local factors is given below. The organisational factors will vary little from industry to industry, the local factors however, will be specific to the industry being considered.

A tragedy of such magnitude as the collapse of the viewing platform at Cave Creek remains with the people of a small country such as New Zealand for many years. In the ensuing years most want answers to the obvious questions of Why? How? and Who was to blame? These questions will remain for many years as do those who still debate the accident of TE901.

Eighteen years ago in November 1979, at Mount Erebus in the Antarctic, an Air New Zealand DC10 collided with the ground; the aircraft was destroyed with the loss of 257 lives. Following this disaster there were two authoritative investigations into the cause of the accident, each reaching radically different conclusions. The findings of one inquiry reflect the then typical investigative conclusion of pilot error; whilst the findings of the second looked more widely at all aspects of the accident. Mr Justice Mahon, the Royal Commissioner writes:

"In my opinion therefore, the single dominant and effective cause of the disaster was the mistake by those airline officials who programmed the aircraft to fly directly at Mt. Erebus and omitted to tell the aircrew. That mistake is directly attributable, not so much to the person who made it, but to the incompetent administrative airline procedures which made the mistake possible." (1981)

Which conclusion is the most helpful to the future and safe practices of an organisation?

Many years ago Cicero observed that `to err is human' however, he also observed that `only a fool perseveres in error'. I hope we can collectively learn from a tragedy such as that which occurred at Cave Creek in April 1995.

References

B.A.S.I. (1994) Piper PA31-350 Chieftain, Young NSW, 11 June 1993. Investigation Report 9301743, BASI, Canberra.

Chopra, V., Bovill, J.G., Spierdijk, J. & Koornneef, F. (1992) Reported significant observations during anaesthesia: A prospective analysis over an 18 month period. British Journal of Anaesthesia, 68, 13-17.

Hawkins, F.H. (1987) Human Factors in Flight. Aldershot: Gower Publishing.

Hollnagel, E. (1993) Human Reliability Analysis; Context and Control. London: Academic Press.

Hudson, P.T.W.,Reason, J., Wagenaar, W., Bentley, P., Primrose, M. & Visser, J. (1994) Tripod Delta: Proactive approach to enhanced safety. Journal of Petroleum Technology, 46, 58-62.

Maurino, D.E., Reason, J., Johnston, N., & Lee, R.B. (1995) Beyond Aviation Human Factors. Aldershot : Avebury Aviation..

Moshansky, The Hon.V.P. (1992) Commission of Inquiry into the Air Ontario Crash at Drydon, Ontario. Ottawa: Ministry of Supply and Services, Canada.

Noble, The Hon G.S. (1995) Commission of Inquiry into the collapse of the viewing platform at Cave Creek, Punakaiki, West Coast. Wellington: The Department of Internal Affairs, New Zealand.

Paries, J. (1994) Investigation probed root causes of CFIT accident involving a new-generation transport. ICAO Journal, 49, 37-41.

Perrow, C. (1984) Normal Accidents: Living with High-Risk Technologies. New York: Basic Books.

Reason, J. (1990) Human Error. New York: Cambridge University Press.

Report of the Royal Commission to Inquire into the crash on Mount Erebus, Antarctica, of a DC10 Aircraft operated by Air New Zealand Limited (1981) Wellington.

Sheen, Mr. Justice (1987) MV Herald of Free Enterprise. report of Court No. 8074. London: Department of Transport.

Uttal, B. (1983) The Corporate culture vultures. Fortune, October 17.

Vaughan, D. (1990) Autonomy, interdependence, and social control: NASA and the Space Shuttle Challenger. Administrative Science Quarterly, 35: 225-257.

Copyright

Comments to Psych.Webmaster@massey.ac.nz
Department of Psychology, Massey University , New Zealand
URL: http://www.massey.ac.nz/~trauma/
last changed Saturday, 13 December 1997 - 01:09:13 PM
Copyright © 1997 Massey University