Swiss Cheese Model
A model illustrating how accidents occur when holes in multiple layers of defense align, allowing a hazard to pass through all barriers.
Also known as: Reason's Swiss Cheese Model, Cumulative act effect, Defense in depth model
Category: Frameworks
Tags: safety, systems-thinking, mental-models, problem-solving
Explanation
The Swiss Cheese Model, developed by James Reason, is a widely used framework for understanding how accidents and failures occur in complex systems. The model visualizes each layer of defense (policies, procedures, training, equipment, supervision) as a slice of Swiss cheese — each slice has holes representing weaknesses or failures in that layer.
**How the model works**:
- Each defensive layer has imperfections ('holes') that are constantly shifting in size and position
- An accident occurs when holes in multiple layers momentarily align, creating a trajectory of opportunity for a hazard to pass through all defenses
- No single failure is usually sufficient to cause an accident — it takes the alignment of multiple failures across different layers
**Types of failures**:
- **Active failures**: Unsafe acts committed by people in direct contact with the system (errors, violations). These have immediate effects
- **Latent conditions**: Pre-existing organizational factors that create the holes — poor design, inadequate training, budget pressures, management decisions. These may lie dormant for years
**Key insights**:
- Accidents are rarely caused by a single person's error — they result from systemic failures
- Blaming individuals misses the opportunity to fix systemic weaknesses
- Adding more layers of defense reduces risk but never eliminates it entirely
- Latent conditions created by organizational decisions are often more dangerous than individual active failures
- The model supports a systems-thinking approach to safety
**Applications**:
- **Aviation**: Understanding how multiple failures led to crashes, informing safety protocols
- **Healthcare**: Analyzing medical errors and designing safer clinical processes
- **Nuclear safety**: Multiple independent safety barriers
- **Software engineering**: Defense in depth, multiple testing layers, code review processes
- **Incident investigation**: Looking beyond the immediate cause to systemic factors
**Limitations**: The model can oversimplify by suggesting failures are linear and sequential, when in reality complex system failures often involve non-linear interactions and emergent behaviors.
Related Concepts
← Back to all concepts