Swiss cheese model
Have you ever wondered why complex systems, from airplanes to hospitals, sometimes fail despite numerous safeguards? The Swiss cheese model offers a brilliant and accessible metaphor, illustrating how multiple layers of defense can prevent disaster—until, sometimes, a rare alignment of vulnerabilities creates a "hole" straight through. It's a powerful way to understand how even the most robust systems can be prone to the cumulative effect of small imperfections. The Swiss cheese model visualizes multiple layers of defense, each with inherent weaknesses, against potential system failures. Accidents occur when these weaknesses, or "holes," temporarily align, creating a path for a hazard to bypass all safeguards. The model distinguishes between immediate "active failures" and hidden "latent failures," revealing how organizational flaws can lie dormant until they contribute to a catastrophe.
AI Summary
Have you ever wondered why complex systems, from airplanes to hospitals, sometimes fail despite numerous safeguards? The Swiss cheese model offers a brilliant and accessible metaphor, illustrating how multiple layers of defense can prevent disaster—until, sometimes, a rare alignment of vulnerabilities creates a "hole" straight through. It's a powerful way to understand how even the most robust systems can be prone to the cumulative effect of small imperfections.
- The Swiss cheese model visualizes multiple layers of defense, each with inherent weaknesses, against potential system failures.
- Accidents occur when these weaknesses, or "holes," temporarily align, creating a path for a hazard to bypass all safeguards.
- The model distinguishes between immediate "active failures" and hidden "latent failures," revealing how organizational flaws can lie dormant until they contribute to a catastrophe.
The Swiss Cheese Model
Imagine slices of Swiss cheese, stacked one behind the other. Each slice represents a different layer of defense in a complex system—perhaps a safety procedure, a piece of technology, or a human decision.
Now, picture those characteristic holes in each slice. In our model, these aren't just decorative; they symbolize inherent weaknesses, flaws, or imperfections within that specific defense layer. They could be anything from human error to equipment malfunction or poor design.
The genius of the model lies in its layered approach. In theory, a problem might slip through a "hole" in one slice, but it's immediately caught by the solid part of the next defense layer. This multi-layered strategy aims to prevent any single point of failure from causing a total system breakdown.
A Model for Accident Causation
This ingenious metaphor was formally introduced by Professor James T. Reason of the University of Manchester. Since its inception, the Swiss cheese model has become a cornerstone in the fields of risk analysis and accident investigation, gaining widespread acceptance across various industries.
While incredibly useful for conceptualizing system failures, the model isn't without its critics. Some argue it's applied too broadly without sufficient supporting models, or that its simplicity can sometimes obscure the intricate details of real-world accident chains. Still, its visual power remains undeniable.
Active vs. Latent Failures
The holes in our cheese slices come in two main flavors: "active failures" and "latent failures." Active failures are the immediate, unsafe acts directly linked to an incident—think of a pilot making a navigation error or a surgeon misidentifying a critical structure.
Latent failures, however, are far more insidious. These are pre-existing conditions or hidden flaws within the system, often lying dormant for weeks, months, or even years. They can include poor management decisions, inadequate training protocols, or design shortcomings that only become critical under specific circumstances.
For an accident to occur, a hazard must navigate a "trajectory of accident opportunity." This means that, for a fleeting moment, all the holes—both active and latent—in every single slice of cheese align perfectly, creating an unobstructed path for the hazard to bypass all defenses and lead to failure.
Early attempts to combine the Swiss cheese model with other theories, like Willem Albert Wagenaar's tripod theory, sometimes led to confusion, incorrectly labeling entire cheese slices as "active" or "latent" failures. A more accurate understanding shows active and latent failures as the causes of the holes within each defense layer, rather than the layers themselves.
Applications Across Industries
From the cockpit to the operating room, the Swiss cheese model provides a universal language for understanding safety. It has profoundly influenced fields like aviation safety, various engineering disciplines, and even emergency services, driving the adoption of "layered security" principles.
In healthcare, for instance, the model helped shift perspective. Instead of solely blaming individuals, it revealed how "latent" system flaws—like similarly packaged drugs stored next to each other—can contribute to medical errors. This insight emphasizes that errors often stem from systemic issues, not just personal failings.
The model is also invaluable in process safety, particularly in high-stakes environments such as oil and gas drilling and production. Here, each "slice" often corresponds to a critical safety system, helping professionals visualize vulnerabilities and reinforce asset integrity management.
Even in less obvious applications, like the methodology of experimental studies, the model proves its versatility. Researchers have used its principles to design "layered deceptions," subtly obscuring the true hypothesis from participants through multiple, thin "slices" of misleading information.
Ultimately, the Swiss cheese model reminds us that true safety isn't about perfect individual components. Instead, it's about building robust, resilient systems where each layer of defense is designed to catch what the previous one missed, minimizing the chance of those critical "holes" ever lining up.
Article
Swiss cheese model
The Swiss cheese model of accident causation illustrates that, although many layers of defense lie between hazards and accidents, there are flaws in each layer that, if aligned, can allow the accident to occur. In this diagram, three hazard vectors are stopped by the defenses, but one passes through where the "holes" are lined up.
The Swiss cheese model of accident causation is a model used in risk analysis and risk management. It likens human systems to multiple slices of Swiss cheese, which have randomly placed and sized holes in each slice, stacked side by side, in which the risk of a threat becoming a reality is mitigated by the different types of defenses which are "layered" behind each other. Therefore, in theory, lapses and weaknesses in one defense (e.g. a hole in one slice of cheese) do not allow a risk to materialize, since other defenses also exist (e.g. other slices of cheese), to prevent a single point of failure.
The model was originally formally propounded by James T. Reason of the University of Manchester, and has since gained widespread acceptance. It is sometimes called the "cumulative act effect". Applications include aviation safety, engineering, healthcare, emergency service organizations, and as the principle behind layered security, as used in computer security and defense in depth.
Although the Swiss cheese model is respected and considered a useful method of relating concepts, it has been subject to criticism that it is used too broadly, and without enough other models or support.
Holes and slices
Swiss cheese model
Emmental cheese with eyes. When cut into slices, each slice will have holes of varying sizes and positions.
In the Swiss cheese model, an organization's defenses against failure are modeled as a series of imperfect barriers, represented as slices of cheese, specifically Swiss cheese with holes known as "eyes", such as Emmental cheese. The holes in the slices represent weaknesses in individual parts of the system and are continually varying in size and position across the slices. The system produces failures when holes in each slice momentarily align, permitting (in Reason's words) "a trajectory of accident opportunity", so that a hazard passes through holes in all of the slices, leading to a failure.
Frosch described Reason's model in mathematical terms as a model in percolation theory, which he analyses as a Bethe lattice.
Active and latent failures
Swiss cheese model
The model includes active and latent failures. Active failures encompass the unsafe acts that can be directly linked to an accident, such as (in the case of aircraft accidents) a navigation error. Latent failures include contributory factors that may lie dormant for days, weeks, or months until they contribute to the accident. Latent failures span the first three domains of failure in Reason's model.
In the early days of the Swiss cheese model, late 1980 to about 1992, attempts were made to combine two theories: James Reason's multi-layer defence model and Willem Albert Wagenaar's tripod theory of accident causation. This resulted in a period in which the Swiss cheese diagram was represented with the slices of cheese labelled 'active failures', 'preconditions' and 'latent failures'.
The attempts to combine these theories still cause confusion today. A more correct version of the combined theories is shown with the active failures (now called immediate causes), preconditions and latent failures (now called underlying causes) shown as the reason each barrier (slice of cheese) has a hole in it, and the slices of cheese as the barriers.
Examples of applications
Swiss cheese model
New Zealand's Swiss cheese model for managing COVID-19
The framework has been applied to a range of areas including aviation safety, various engineering domains, emergency service organizations, and as the principle behind layered security, as used in computer security and defense in depth.
The model was used in some areas of healthcare. For example, a latent failure could be the similar packaging of two drugs that are then stored close to each other in a pharmacy. This failure would be a contributory factor in the administration of the wrong drug to a patient. Such research led to the realization that medical error can be the result of "system flaws, not character flaws", and that greed, ignorance, malice or laziness are not the only causes of error.
The Swiss cheese model is nowadays widely used within process safety. Each slice of cheese is usually associated to a safety-critical system, often with the support of bow-tie diagrams. This use has become particularly common when applied to oil and gas drilling and production, both for illustrative purposes and to support other processes, such as asset integrity management and incident investigation.
Lubnau, Lubnau II, and Okray apply the model to the engineering of firefighting systems, aiming to reduce human errors by "inserting additional layers of cheese into the system", namely the techniques of Crew Resource Management.
Olson and Raz apply the model to improve deception in the methodology of experimental studies, with multiple thin layers of cheese representing subtle components of deception which hide the study hypothesis.