Layered-defense accident model
Swiss Cheese Model
Accidents can pass through multiple defensive layers when their active failures and latent weaknesses align.
hazard path x aligned defense gaps -> loss
The slices are a reasoning aid, not independent probabilistic barriers by default. Gaps move with design, maintenance, workload, organization, and environment.
Holes drift independently until a hazard ray finds a complete path. A repair phase closes one systemic gap rather than blaming the final operator.
(%)
The animation runs automatically, pauses on the conclusion, and then repeats. The main control changes the scenario rather than scrubbing the timeline.
- CHANGE
- Average layer weakness
- WATCH
- aligned incident path
- MEANING
- Holes drift independently until a hazard ray finds a complete path. A repair phase closes one systemic gap rather than blaming the final operator.
Defense in depth fails when weaknesses align across layers.
A moving hazard ray meets design, supervision, equipment, procedure, and recovery barriers; blocked and transmitted paths remain visible.
What it actually says
James Reason used layered defenses to explain how frontline acts combine with latent organizational conditions. Most individual weaknesses are intercepted; incidents require a pathway across layers.
The model encourages investigators to look beyond the last person who touched the system, but static cheese diagrams can hide feedback, adaptation, coupling, and migration of work.
"A useful law compresses a pattern. It does not erase the conditions that make the pattern true."
How the idea developed
The modern form emerged through observation, argument, and later refinement. The timeline separates the first insight from the version now used in textbooks and practice.[1]
Reason publishes Human Error.
The model becomes widely used in patient-safety explanation.
Safety science combines it with systems and resilience methods.
How the pattern works
The relation becomes useful only when its mechanism, measurement process, and operating range are visible.
Unsafe acts occur near the event.
Design and management create persistent vulnerabilities.
Maintenance and workload alter protection.
The slices are a reasoning aid, not independent probabilistic barriers by default. Gaps move with design, maintenance, workload, organization, and environment.
Where it earns its keep
Applications are strongest when the law changes a decision, measurement, model, or experiment rather than merely providing an analogy.
Trace defenses and conditions
ApplicationAsk how each layer failed to stop the path.
Avoid hindsight blame.
Build independent barriers
ApplicationDetection, prevention, containment, and recovery should not share one failure.
Test common-mode dependencies.
Where it stops working
The familiar diagram may imply independent, stationary holes even though real defenses interact and are continuously adapted.
"Each slice is a department"
Better: A layer is a function, not necessarily an org chart."Add more layers forever"
Better: Complexity can create new interactions and burden.Sources and further reading
Original publications and serious secondary scholarship are prioritized over summaries.
- Reason - Human ErrorFoundational book.https://doi.org/10.1017/CBO9781139062367
- Reason - Human Error: Models and ManagementAccessible 2000 account.https://www.bmj.com/content/320/7237/768
- AHRQ PSNet - Swiss Cheese ModelPatient-safety systems context.https://psnet.ahrq.gov/primer/systems-approach