Swiss cheese model

For the Swiss Cheese model in physical cosmology, see large-scale structure of the cosmos, galaxy filament, and supercluster.

File:Swiss cheese model of accident causation.png

The Swiss cheese model of accident causation illustrates that, although many layers of defense lie between hazards and accidents, there are flaws in each layer that, if aligned, can allow the accident to occur.

The Swiss Cheese model of accident causation is a model used in risk analysis and risk management, including aviation, engineering, healthcare, and as the principle behind layered security, as used in computer security and defense in depth. It likens human systems to multiple slices of swiss cheese, stacked side by side, in which the risk of a threat becoming a reality is mitigated by the differing layers and types of defenses which are "layered" behind each other. Therefore in theory, lapses and weaknesses in one defense do not allow a risk to materialize, since other defenses also exist, to prevent a single point of weakness. The model was originally formally propounded by Dante Orlandella and James T. Reason of the University of Manchester, and has since gained widespread acceptance. It is sometimes called the cumulative act effect.

Although the Swiss cheese model is respected and considered to be a useful method of relating concepts, it has been subject to criticism that it is used over broadly, and without enough other models or support.

Failure domains

Reason hypothesized that most accidents can be traced to one or more of four failure domains: organizational influences, supervision, preconditions and specific acts. Preconditions for unsafe acts include fatigued air crew or improper communications practices. Unsafe supervision encompasses for example, pairing inexperienced pilots on a night flight into known adverse weather. Organizational influences encompass such things as reduction in expenditure on pilot training in times of financial austerity.

Holes and slices

In the Swiss Cheese model, an organisation's defenses against failure are modeled as a series of barriers, represented as slices of cheese. The holes in the slices represent weaknesses in individual parts of the system and are continually varying in size and position across the slices. The system produces failures when a hole in each slice momentarily aligns, permitting (in Reason's words) "a trajectory of accident opportunity", so that a hazard passes through holes in all of the slices, leading to a failure.

Frosch described Reason's model in mathematical terms as a model in percolation theory, which he analyses as a Bethe lattice.

Active and latent failures

The Swiss Cheese model includes both active and latent failures. Active failures encompass the unsafe acts that can be directly linked to an accident, such as (in the case of aircraft accidents) pilot error. Latent failures include contributory factors that may lie dormant for days, weeks, or months until they contribute to the accident. Latent failures span the first three domains of failure in Reason's model.

Applications

The same framework applies in healthcare. For example, a latent failure could be the similar packaging of two drugs that are then stored close to each other in a pharmacy. Such a failure would be a contributory factor in the administration of the wrong drug to a patient. Such research led to the realization that medical error can be the result of "system flaws, not character flaws", and that greed, ignorance, malice or laziness are not the only causes of error.

Lubnau, Lubnau, and Okray apply the model to the engineering of firefighting systems, aiming to reduce human errors by "inserting additional layers of cheese into the system", namely the techniques of Crew Resource Management.

This is one of the many models listed, with references, in.

See also

• Accident
• Aviation safety
• Iteration
• Proximate cause
• Proximate and ultimate causation
• Root cause analysis
• Safety
• Systems engineering
• Systems modelling

Further reading

• (read online: JSTOR)
• — Westrum and Adamski relate Reason's Swiss Cheese model to Westrum's "human envelope" model, where "around every complex operation there is a human envelope that develops, operates, maintains, interfaces, and evaluates the function of the sociotechnological system" and where the system "depends on the integrity of this envelope, on its thickness and strength". Westrum models latent failures as voids within this envelope, and active failures as factors external to the envelope that are acting to breach it.
• (also available on-line here) — a reminder that while Reason's model extends causation to latent failures, this is not at the expense of eliminating active failure entirely
• — the application of the Swiss Cheese model to a specific case of medical error