Swiss Cheese Model (Error Chain)

James Reason's model of accident causation: catastrophic failures don't result from a single error but from MULTIPLE failures aligning—like holes in sequential slices of Swiss cheese lining up to allow a hazard to pass through every defense layer. Each layer has weaknesses (holes), but normally the other layers catch what one layer misses. Catastrophe occurs only when holes in EVERY layer align simultaneously. The layers include: organizational culture, supervision, preconditions, and individual acts. As a mental model: the Swiss Cheese Model reveals that safety depends on REDUNDANT, INDEPENDENT defense layers—and that catastrophic failure requires the simultaneous breakdown of multiple defenses, not just one error.

When to use it

When safety or quality depends on redundant defense layers; when understanding why catastrophes require multiple simultaneous failures; when near-miss analysis would reveal defense layer weaknesses; when defense layer independence needs verification.

How it can help

Design multi-layered defenses and ensure layer independence. The practices: (1) Identify your defense layers: what systems, checks, and safeguards prevent failure? (2) Ensure layers are INDEPENDENT: if one failure can compromise multiple layers simultaneously, they're not truly redundant. (3) Regularly assess each layer's 'holes': what conditions cause this defense to fail? (4) Monitor for alignment: when multiple layers are weakened simultaneously, risk escalates dramatically. (5) After near-misses: analyze which layers held and which had holes—near-misses are evidence of hole alignment that stopped one layer short of catastrophe.