The Cave Creek
This paper will discuss how pre-existing organisational conditions and managerial practices can combine with local conditions to create a disaster. Drawing upon the work of Reason (1990) the 1995 Cave Creek disaster (New Zealand) will be used to illustrate this process. It will describe how top-level decisions are transmitted through organisational pathways and create local conditions that promote the commission of unsafe acts. The implications of organisational change, the prevailing safety culture, and staff responsibility will be discussed. Practical applications of the theory, in the form of a matrix for exploring defensive failures, will be presented.
In high risk environments, as well as complex technologies, we are in the age of the organisational
accident (Reason, 1990). That is, incidents occur because pre-existing and often long-standing latent
or hidden failures, arising in the managerial and organisational areas, combine with the local conditions
to penetrate the systems defences.
A landmark case associated with these factors was investigated in England in 1987. Mr Justice Sheen's
judgement on the causes of the capsize of the `Herald of Free Enterprise' (a European `roll-on', `roll-
off ' ferry) went beyond the errors of the Master, the Chief Officer and the Assistant Bosun. He wrote,
"....a full investigation into the disaster leads inexorably to the conclusion that the underlying or
cardinal faults lay higher up in the company" (Sheen, 1987).
Since this time there have been several other reports into catastrophic system failures which have
implicated organisation and management decisions leading to fatal consequences: the Air Ontario crash
(Moshansky, 1992) and the Challenger Shuttle disaster (Vaughan, 1990).
It is estimated that up to 80% of accidents in hazardous activities and technologies are caused by
human error (Hollnagel, 1993). This figure is not new and is discussed by a variety of authors from
diverse research backgrounds Chopra, Bovill, Spierdijk & Koornneef (1992), Hawkins (1987), Perrow
(1984) and Reason (1990). It has also been revealed that the human cause of major disasters are
distributed very widely, both within the organisation and often over several years before the actual
event, for example, the fire at the Three Mile Island nuclear plant; the Exxon Valdez oil tanker spill;
the Piper Alpha oil platform fire; the Kegworth air accident and the Kings Cross and Clapham
Junction rail accidents.
Before we explore the theoretical framework which underpins this paper, let us review the incident
we will be discussing. On the 28th April 1995 seventeen members of a Polytechnic course from
Greymouth and the manager of the Department of Conservation's Punakaiki Field Centre fell about
30 metres from the Cave Creek viewing platform as it collapsed. As a result fourteen young people
lost their lives and another four were injured. This from one of the survivors:
"We continued walking and, as the track became narrower walked in pairs. I was in approximately the middle on the group as it reached the platform and stepped into a gap on the left hand side of the platform at the front to have a look. I looked over and went to take a step back because I don't like heights. Suddenly and with no warning except for yells of surprise, the platform was falling under our feet. It began sliding down at approximately 30 degrees and then tipped and fell vertically with everyone falling in front of it."
(Carolyn Smith 1998, p9)
The theoretical framework which is adopted to help examine the Cave Creek catastrophe was
developed by James Reason and published in 1990. This framework rests on the premise that many
major disasters have a number of similar important features. These are:
As will be seen, the Cave Creek disaster had all the above elements.
A closer examination of several recent disasters; especially Bhopal, Challenger, Chernobyl and Erebus,
indicate that there is a need to distinguish the ways in which humans contribute to the breakdown in
Firstly there are errors and violations which have an immediate adverse effect. These are known as
`active failures' and are generally associated with the activities of those in the `front-line'.
Secondly there are errors which are concerned with decisions or actions, the damaging consequences
of which may not be apparent, only becoming evident when they combine with local factors, such as
active failures, or technical faults. The features of these errors are that they are present within the
system sometime before the onset of a recognisable accident sequence. They are also involved with
those who are removed in time and space from the structure or machine; such individuals as high-level
designers, regulators, managers, and maintenance staff. These are known as `latent-failures'.
In order to explore more closely the Cave Creek accident it is important to look at all the possible
elements which were present. All complex groups working in high risk areas posses several elements:
organisational processes and their associated cultures, a variety of different workplaces all having a
variety of local conditions with defences, barriers and safeguards to protect people, assets, and the
environment from the adverse effects of the local hazards. This initial framework is illustrated in
Organisations exist within broad economic political and legislative settings and therefore it
would be meaningful to confine the basic theoretical elements to those factors over which the
organisation, in this case the Department of Conservation, could reasonably be expected to
exercise a measure of direct control.
Organisational behaviour is bound by culture and practices which are often unique to that
organisation. Culture is often referred to as comprising those attitudes and beliefs that both
emerge from and shape the way in which a group carries out its function. These processes,
all of which entail decision making (often at the highest level) include the following activities;
policy making, planning, designing/specifying, communicating, financing/budgeting and
allocating resources, monitoring, checking, inspecting and managing projects and safety.
These are a few examples but as with these and other variables the "ways things are done"
(Uttal, 1983) are important to the culture of any organisation. Cultural factors take a long
time to develop and are slow to change. These influences are found through the organisation
and colour the attitudes and behaviours of the those working in the organisation.
This can certainly be seen in the Department of Conservation and its local conservancy offices.
The original structure within the New Zealand Forest Service had various support
organisations with which it worked. Most importantly, with regard to this incident, was the
former Ministry of Works, with its technical-administrative culture, which carried out
structural designs and checks for the New Zealand Forest Service. Created by the
Conservation Act in 1987, the Department of Conservation assumed many of the functions
previously carried out by the Lands and Survey Department, New Zealand Forest Service and
the Wildlife Service, thus changing its original culture. Another change in 1988, following
a Coopers and Lybrand report, saw the reduction of management to three tiers and the removal
of the district management officer. These changes saw the appointment of managers with
inadequate qualifications, that is they were appointed for their conservation background and
had no managerial skills.
A lack of money per se was not the cause of the Cave Creek platform collapse but a closer
look at the organisational structure and funding demonstrates the rate of change may have
been a problem.
In real terms the funding to the department between 1987 and 1995 had been reduced by 9%
from the Crown. At a similar time the Coopers and Lybrand report suggested a reduction in
staff and as a result the staff was reduced from 2200 to 1250. These issues will again be
highlighted when we consider the local working conditions.
As figure 1 indicates the local working conditions with the defences, barriers and safeguards
stem from the overall organisational process. Local working conditions are those factors
which influence the efficiency and reliability of human performance in a particular working
environment, in our example the West Coast Conservancy. The theory asserts that the
negative consequences of top-level decisions (eg. deficient planning, under staffing, inadequate
budgets and operational time pressures) are transmitted through various organisational
pathways to the different workplaces. At this point they can create the local conditions that
promote the commission of unsafe acts. Many unsafe acts may be committed, but only very
few will penetrate the defences and barriers to bring about an incident with a damaging
outcome. In order to examine how local working conditions contribute to unsafe acts, it is
necessary to look at both the tasks required, the environment in which the personnel worked
and the personnel themselves.
In this regard there seemed to be a lack of management and prioritising of projects. This was
seen in the mismanagement of existing resources, with a regional works officer engaged for
the majority of his time in building structures when this was not a primary part of his
employment. In another case a short term conservation worker was employed to upgrade a
track and on his own initiative erected a low-level viewing platform. As well as this ad hoc
policy making and planning there were problems in the allocation of resources, where twenty five
percent of the total national conservation estate in New Zealand (the West Coast Conservancy)
was managed by 9% of the departments personnel.
As well as the obvious pressure with which the department staff worked, of which one estimate was 65
hours per week, there were other considerations associated with the priorities of the
department. This was eloquently summarised by a witness at the Commission of Inquiry:-
"If I was to summarise the complaints that I receive, it would be that fewer and fewer staff are expected to perform an ever expanding work load with shrinking funding in an often hostile environment."
(Turner p30: Noble, 1995).
Although it has been said that funding per se was not the cause of this tragedy a closer look
at the organisational process regarding the West Coast area indicates an inadequacy in the
management of the rate of change. Visitor numbers to the Punakaiki Visitor Centre increased
by nearly 67 thousand in the three years to 1994. This centre has the highest number of
visitors to the West Coast and the second highest in New Zealand. Members of the West
Coast Tai Poutini Conservation Board had voiced their concerns since their first report in
1991. The then chairman said:-
"... the west coast has very active conservation issues which need continued adequate funding for successful management."
(Noble, 1995, p32)
This sentiment was reiterated from 1992 to 1994 when the Chairman said the following:-
"Funding constraints have meant that there has been a fall in maintenance on some areas of the estate .... The continuing cuts to programmes in a period of rapid growth in use of lands administered by the department is a major concern to the board."
(Hamilton, p32; Noble 1995)
The West Coast Conservancy was considered, by Coopers and Lybrand, to need approximately
137 staff to carry out the departments mandate. At the time the platform was designed and
constructed, the West Coast Conservancy had 112 staff, 25 fewer than the level originally
considered necessary. The evidence at the Commission of Inquiry noted that, because of
funding restraints, the actual staff levels had been lower than planned.
The position at the Punakaiki Field Centre illustrated the under resourcing and under staffing
dilemma. It was clear from the evidence at the Commission of Inquiry that the prevailing
culture was one of seeking to do more with less and of working long hours in order to cope
with the changing priorities.
The staff were found to be very committed to the department; often this was the result of the
type of individual suitable for such employment, keen conservationists who were hard
working, resourceful but continually faced with a lack of resources which finally gave rise to
a culture of doing more with less.
It was also apparent from the overall evidence at the Commission of Inquiry that there was
a lack of project management at the highest level in the organisation. When the department
was created, an appropriate framework for the management of design and construction of
structures was never laid down and given to conservancies and then to the field centres. It
was also revealed that officers at both regional conservancy and field centres were
inadequately instructed regarding the management of design and construction of structures.
These last two issues were the key ingredients in the local working conditions which led to
the inadequately constructed platform at Cave Creek.
Measures that are designed at removing, mitigating or protecting against operational hazards
now play a large part in the resource allocation in organisations engaged in potentially
dangerous activities. Defences, barriers and safeguards can be classified within two relatively
separate dimensions. Firstly regarding the function it would serve; for example to create an
awareness and understanding of the risk and hazards and to protect people and the
environment from injury and/or damage. Secondly the ways in which the organisation would
deal with such circumstances; for example policies and standards with regard to safe working
practices, procedures, instructions and supervision at local level and training of safety
There is certainly no such thing as a perfect set of defences, barriers and safeguards for all
situations and it is known that many shortcomings can be the direct consequence of decisions
made in the organisation.
Again let us revisit the Cave Creek situation. There were several things which were lacking
as defences, barriers and safeguards both at National and Regional Conservancy level. Most
important was the lack of a positive safety climate. This can lead to the breakdown in
management philosophy which considers people and their goals as well as production goals.
It was unclear from the Commission of Inquiry how strong the Departments commitment was
to safety matters which include the appointment of safety officers with good and clear
communication links to all level of the organisation. What was clear from the Inquiry was
the lack of knowledge regarding project management in the widest sense. This was recognised
as a problem at all levels of the Department and led to serious inadequacies regarding the
planning of projects and standardised practices which included feedback and follow up
evaluation. A lack of training in certain areas also allowed the defences within the
organisation to be breached, which will be examined next.
When people are involved in highly complex systems, there will be failures. These may occur
either in the working environment or in relation to the defences within the system.
These failures can be divided into two specific types of error. Firstly `active failures' which
usually have an immediate and direct impact on the people and environment and secondly the
`latent failures'. Latent failures, or resident pathogens as Reason (1990) would describe, are
those failures which lie dormant, often for long periods, in the system and which combine with
the active failures to cause the events which breach the systems defences.
Active failures are usually committed by those who are directly involved with the system:
members of the Department of Conservation, those people in the West Coast Conservancy and
the Punakaiki visitor centre. Human active failures are errors or violations associated with
those people actually working in the field. Errors can be classed as slips and lapses or as
mistakes associated with the rules of problem solving or inadequate knowledge. Violations
are deviations from safe operating practices, procedures, standards or rules. Such deviations
may either be deliberate or erroneous. However, usually the consequences of these active
failures are caught by the systems defences or by the members of the groups themselves. On
some occasions they may occur in conjunction with a breach in the defences which then
results in an accident, as in the Cave Creek example. Before we discuss the latent failures let
us examine the active failures in the Cave Creek incident.
The staff constructed an unsafe viewing platform with no engineering support which was not
checked at the design or construction stages. Staff, unknowingly, did not comply with the
statutory requirements of the Building Act which led to a large number of inadequate
construction procedures such as the failure of the main and secondary bearers, failure of joist
and trimmer connections and failure of the piles which were not aligned or nailed adequately.
There was also failure to treat the timber in contact with the ground.
No plans were followed in the construction of this platform and once constructed no notice
was erected on sight with loading restrictions. Finally the reported doubts regarding the
platform and its security were never investigated.
If we now consider the latent failures in this accident it becomes clear that this incident may
not have been avoidable. Latent failures can be described as loopholes in the system's
defences, whose potential existed for some time prior to the start of the incident sequence.
When these weaknesses combine with both active failures or local triggers there is a trajectory
of accident opportunity created (often only momentary) through which some or all of the
systems protective layers fail. Figure 2 demonstrates this phenomena.
The last part of the model to be discussed is associated with the event itself. An event is
defined as a complete penetration of an accident trajectory through the system defences. At
this level the active and latent failure pathways come together to create the accident
opportunity. These causal pathways can also interact with local conditions or triggers which
can compound the potential for injury and damage. In the case of the Cave Creek incident
there were several of the these local triggers, namely; the position of the platform over the
creek, the number of people on the platform and the lack of a safety notice regarding loading
at the site. Figure 2 illustrates the possible trajectory of opportunity through various gaps of
weakness. These gaps in the deficiencies can arise for various reasons, three of which can be
found in the present accident.
Firstly, there can be gaps created which have been present for a long time. These can be seen
in this incident as the weakness in the management of the project and the unrealised
shortcomings in the defences. Secondly there can be gaps created by active failures, either
unsafe acts or breakdowns of components. This can be seen in the disabling of an engineered
safety feature and the violation of safe operating procedures.
Lastly, gaps can be created knowingly during the course of construction or maintenance of a
system. In most well-defined systems, the accident trajectory requires the precise alignment
of the gaps in all the defence layers. The probability of this happening is usually very small,
but in the present situation this was not the case.
A summary of this accident analysis can be found in Figure 3. It can be seen from this figure
that the latent failures became the markers of the systems safety health.
|LOCAL WORKING CONDITIONS||DEFENCES, BARRIERS & SAFEGUARDS|
|ACTIVE FAILURES||LATENT FAILURES|
Figure 3. The Causal Pathway of the Cave Creek disaster.
The consequences of the present accident were catastrophic and although we can examine the
outcome in the above manner, how does this help to mitigate and prevent similar accidents
in the future? A pre-requisite for appropriate learning from these tragedies is to produce a
safety information system that identifies not only the active failures but also the latent failures
and their source within the organisation.
Within the domain of safety health in any organisation there are two main areas of concern
which must both be considered; firstly, error producing conditions (EPC's) which include
violations as well as slips, lapses and mistakes. When strategic decisions are made in the
higher management and organisational levels of a group, there may be some negative
consequences which can manifest themselves in some areas of the working environment as
error-promoting and violation-enforcing conditions. This was illustrated in the present incident
in the areas of time pressure and unawareness of hazards. In performing particular tasks, these
local factors can interact with personal factors such as lack of knowledge, skill or motivation
problems to produce violations and errors. Secondly the area of defences. These barriers and
safeguards help mitigate or block the consequences of violations and errors. They may be
grouped according to their function, that is whether they serve as awareness,
detection/warning, protection, recovery, containment, escape/rescue or by the way they are
implemented, that is training/briefings, procedures/instruction/supervision,
standards/policies/rules, engineered safety features, and personnel protection. Assessment of
the effectiveness of the defences gives some indication of where the holes in each layer can
be found (fig 2) or are likely to appear in the future. Regular checks on the system will
hopefully lead to continuous improvement routines in which the worst problems can be
identified and corrected.
Having listed the importance of both the error-producing conditions and the defences in this
incident the practical ways to prevent a repeat of such a tragedy must be considered.
Firstly from Figure 3 it is possible to list the main problem factors in the Cave Creek incident.
Using a matrix which includes the defences already mentioned it is possible to begin to
determine the organisational root causes of this accident.
Each latent defence failure listed above should then be assessed for its relative contribution
to each of the ten problem factors in the incident using a 0-4 rating. The problem factor
ratings should be summed to obtain a latent failure profile which permits a visual indication
of the relative contribution of each organisation factor to the latent factors identified on the
An example can be seen in the matrix when considering just one problem factor; that of
planning at National and Regional level (listed in bold numbers).
The local factors should then be identified to establish the active failures found in this
incident. Ratings of the contributions of each problem factor to each local factor should be
assessed using the same method as above. The problem factor ratings should then be summed
to obtain an active failure profile. This indicates how each of the problem factors contributed
to the local factors in this incident.
Again an example is given for the first problem factor in terms of the active failures; (listed
in italic numbers).
Thus taking the problem factor of Planning at National and Regional level it is possible to
establish a latent defence failure rating of 54, and an active defence rating of 31; cells without
numbers indicate these defences were not related in this case with the stated problem factor.
Finally the latent and active failure profiles can be aggregated to obtain an overall organisation
profile for the Cave Creek accident; in this case 85 regarding the issues of National and
This identifies the problem factors which were most responsible for both the latent and active
failure pathways. Again, in our example, it can be seen that the main defence failures occurred
as a result of latent organisational problems; the issues regarding Standards, Policies and Rules
being the strongest. The active or local defence failures were not as problematic, although of
each category the issues of personnel protection were of greatest concern.
The activity described above is perhaps more difficult to follow using just one example but
if many incidents are documented in this format trends will emerge which will allow those
working in the organisation to improve the effectiveness of their safety management and
ultimately the safety health of the system itself.
This approach to analysing human error has been used in various situations, mostly however
in what can be termed high risk endevours, such as nuclear power plants, the petroleum
industry and off-shore oil installations (Hudson, Reason, Wagenaar, Bentley, Primrose &
Visser, 1994) and in the aftermath of air disasters (B.A.S.I., 1994; Moshansky, 1992; Paries,
As well as these reactive analyses the proposed model should also be considered as having a
proactive application. This would entail identifying the organisational and situational factors
contributing to unsafe acts, including; policies, rules, regulations, the methods of practice
within the system as well as the personnel themselves. This task should be able to identify the
main factors which need remediation and also allows for an ongoing monitoring of these
factors. An example of both organisational and local factors is given below. The organisational
factors will vary little from industry to industry, the local factors however, will be specific to
the industry being considered.
|Organisational factors||Local factors|
A tragedy of such magnitude as the collapse of the viewing platform at Cave Creek remains
with the people of a small country such as New Zealand for many years. In the ensuing years
most want answers to the obvious questions of Why? How? and Who was to blame? These
questions will remain for many years as do those who still debate the accident of TE901.
Eighteen years ago in November 1979, at Mount Erebus in the Antarctic, an Air New Zealand
DC10 collided with the ground; the aircraft was destroyed with the loss of 257 lives.
Following this disaster there were two authoritative investigations into the cause of the
accident, each reaching radically different conclusions. The findings of one inquiry reflect the
then typical investigative conclusion of pilot error; whilst the findings of the second looked
more widely at all aspects of the accident. Mr Justice Mahon, the Royal Commissioner writes:
"In my opinion therefore, the single dominant and effective cause of the disaster was the mistake by those airline officials who programmed the aircraft to fly directly at Mt. Erebus and omitted to tell the aircrew. That mistake is directly attributable, not so much to the person who made it, but to the incompetent administrative airline procedures which made the mistake possible." (1981)
Which conclusion is the most helpful to the future and safe practices of an organisation?
Many years ago Cicero observed that `to err is human' however, he also observed that `only
a fool perseveres in error'. I hope we can collectively learn from a tragedy such as that which
occurred at Cave Creek in April 1995.
B.A.S.I. (1994) Piper PA31-350 Chieftain, Young NSW, 11 June 1993. Investigation Report
9301743, BASI, Canberra.
Chopra, V., Bovill, J.G., Spierdijk, J. & Koornneef, F. (1992) Reported significant
observations during anaesthesia: A prospective analysis over an 18 month period. British
Journal of Anaesthesia, 68, 13-17.
Hawkins, F.H. (1987) Human Factors in Flight. Aldershot: Gower Publishing.
Hollnagel, E. (1993) Human Reliability Analysis; Context and Control. London: Academic
Hudson, P.T.W.,Reason, J., Wagenaar, W., Bentley, P., Primrose, M. & Visser, J. (1994)
Tripod Delta: Proactive approach to enhanced safety. Journal of Petroleum Technology, 46,
Maurino, D.E., Reason, J., Johnston, N., & Lee, R.B. (1995) Beyond Aviation Human Factors.
Aldershot : Avebury Aviation..
Moshansky, The Hon.V.P. (1992) Commission of Inquiry into the Air Ontario Crash at
Drydon, Ontario. Ottawa: Ministry of Supply and Services, Canada.
Noble, The Hon G.S. (1995) Commission of Inquiry into the collapse of the viewing platform
at Cave Creek, Punakaiki, West Coast. Wellington: The Department of Internal Affairs, New
Paries, J. (1994) Investigation probed root causes of CFIT accident involving a new-generation
transport. ICAO Journal, 49, 37-41.
Perrow, C. (1984) Normal Accidents: Living with High-Risk Technologies. New York: Basic
Reason, J. (1990) Human Error. New York: Cambridge University Press.
Report of the Royal Commission to Inquire into the crash on Mount Erebus, Antarctica, of a
DC10 Aircraft operated by Air New Zealand Limited (1981) Wellington.
Sheen, Mr. Justice (1987) MV Herald of Free Enterprise. report of Court No. 8074. London:
Department of Transport.
Uttal, B. (1983) The Corporate culture vultures. Fortune, October 17.
Vaughan, D. (1990) Autonomy, interdependence, and social control: NASA and the Space
Shuttle Challenger. Administrative Science Quarterly, 35: 225-257.