Swiss Cheese Model of System Failure (Reason)

James Reason's influential accident causation model: systems have multiple layers of defense (like slices of Swiss cheese), each with holes (weaknesses). Failure occurs when holes in multiple layers momentarily align, allowing a hazard to pass through all defenses simultaneously. No single failure causes catastrophe—it requires the alignment of multiple failures across multiple layers. The model's power: it shifts analysis from 'who screwed up?' to 'how did multiple defenses fail simultaneously?' The layers include organizational influences (culture, policy), unsafe supervision (inadequate oversight), preconditions for unsafe acts (fatigue, time pressure, poor training), and unsafe acts themselves (errors, violations). The Chernobyl disaster required simultaneous failures in reactor design, safety system disabling, operator training, management pressure, and regulatory oversight—remove any one layer's failure and the catastrophe doesn't happen.

When to use it

During incident investigation and root cause analysis. When designing safety systems with multiple defensive layers. When evaluating whether an organization's defenses are adequate. When arguing for redundancy budgets in risk management.

How it can help

Transforms accident investigation from blame to system improvement. Interventions: (1) identify all defensive layers in your system and assess the 'holes' in each—where are the known weaknesses? (2) design layers to be independent so that a single factor can't create aligned holes in multiple layers simultaneously, (3) when a near-miss occurs, investigate which layers failed and which held—the near-miss reveals hole alignment that almost became catastrophe, (4) ensure no defensive layer depends on perfect human performance (the most unreliable component), (5) regularly test whether layers are still functional—defenses decay over time. The model's greatest practical value: it makes the case for redundancy and independence of safety layers.