When the Holes Align: What the Swiss Cheese Model Tells Us about Human Error
For a long time, accident reports tended to settle on the most visible point of failure. A checklist item was missed. A component was installed incorrectly. A decision was made under pressure and turned out to be wrong.
Findings which, at a first glance, were not incorrect. But the reports left an important question unanswered: why did the system fail to prevent it?
James Reason, British professor of psychology, developed the Swiss Cheese Model in the 1990’s to address the gap between the identification of failure and the understanding of how failure became possible in the first place. The model still addresses human error but does not put it at the centre of investigations.
Why Swiss Cheese Mirrors Safety Gaps
The Swiss Cheese Model illustrates that failures within complex systems occur from multiple aligned weaknesses – or holes – across different layers of safety barriers. All the layers have holes which can be technical, organisational, and operational. If these holes align, they allow hazards to pass through the layers and potentially cause harm.
This image was created using AI
In his model, Reason distinguishes between:
- Latent conditions
- Active failures
Latent conditions exist within the system itself, whereas active failures are the actions which take place at the frontline of operations. More importantly, they reflect how the system is designed. How are the procedures written? How is the work organised? What about resource allocation?
Latent conditions can go unnoticed for a long time as they are an integral part of day-to-day operations. They may even be perceived as “Standard Operating Procedure” until operational circumstances and human actions expose their potential for failure and severe consequences.
In that respect, the notion of “unsafe acts” is shaped by the people who perform the task, the environment in which they work, the actions they perform, and the resources available.
The implication for accident investigation is clear. Identifying the error is necessary, but understanding the system that produced the error to begin with is crucial.
Read more: Pear in Practice: A Framework for Human Factors in Aviation Maintenance
How Failures Move Through the System
The Swiss Cheese Model is often visualised as a series of layers. Each layer represents a form of defence: procedures, training, supervision, technical systems and so on. Each layer is designed to prevent hazards from developing into incidents.
But none of the layers are immune to weaknesses. There is always a flaw in the system.
The weakness can be temporary or embedded. For instance, a certain procedure may be technically sound but difficult to adhere to in times of pressure. Or a training programme may be designed to enhance certain competencies, but not does not take practical deviations into account.
Photo from Canva Pro
Every day, aircrew, maintenance staff, and supervisors must navigate these conditions and try to make the best decision. In the name of safety. The problem is not the isolated events of failure, as systems are designed to tolerate variability. But when the systemic weaknesses across several layers align, the system’s ability to tolerate errors is reduced.
This alignment may allow an active failure to pass through the remaining safety barriers. An active failure can be a wrong decision, a missed step in a checklist, or a misjudgement in a critical situation. The failure itself does not cause an accident. The accident occurs when the barriers are weakened across several layers at the same time.
Essentially, it is the alignment of latent conditions and active failures that allows an accident to emerge. James Reason describes this as an alignment of failures. A moment where the system’s defences no longer operate independently but fail simultaneously.
What Swiss Cheese Reveals About Human Error
The Swiss Cheese Model fundamentally changes how human error is and should be interpreted in accident investigation. In other words, the model forces investigators to keep looking beyond the error itself.
If human error is treated as the root cause, the investigation tends to stop at the point of action. If it is treated as the consequence of deeper flaws within the system, the scope of the investigation expands.
Read more: Is Your SMS Reactive, Proactive, or Predictive?
An error or an unsafe act should always be interpreted within the context in which they occur. All actions are shaped by organisational influences, common practices, and operational constraints – factors which become a point of entry for deeper analysis and investigative inquiry:
- What conditions influenced how the task was carried out?
- How were tasks structured and supported?
- Was the procedure clear in practice, not just in theory?
- Which barriers were intended to prevent the error—and why did they fail?
- Were there signals within the system that indicated vulnerability before the event?
This approach allows investigators to map failures across different layers, rather than isolating a single point of breakdown. If the analysis stops at “human error”, the system can never evolve.
The Swiss Cheese Model does not remove individual accountability. Malicious acts or intentional deviations should never be condoned. Rather, the model recognises that human performance is influenced, constrained, and sometimes degraded by the systems in which they operate.
Shifting the focus from identifying failure to understanding how and why failure was allowed to develop in the first place provides the basis for meaningful change.
Where the Model Has Merit
The Swiss Cheese Model has been widely adopted within the aviation industry because it offers a structured way of thinking about complex problems. It eloquently visualises that small, distributed weaknesses can combine into significant failures. Decisions made within one layer can influence the outcome of another, often with a delay.
It is always easier to point to a flaw in hindsight.
The model, however, requires careful application. Systems are not static, and interactions between factors are not always predictable. The model does not account for every variable, but it offers a framework for identifying where defences are weakened and where intervention is needed.
Safety is not defined by the absence of error, but by how well the system prevents an error from becoming consequential.
Sources
This article draws on James Reason’s work on human error and accident causation, supported by the following scholarly articles which examine how systemic conditions influence human performance and the prevalence of accidents.
- Shappell, S. A., & Wiegmann, D. A. (2000). The Human Factors Analysis and Classification System—HFACS. Retrieved from https://commons.erau.edu/publication/737/?utm_source=commons.erau.edu%2Fpublication%2F737&utm_medium=PDF&utm_campaign=PDFCoverPages
- Shabani, T., Jerie, S. & Shabani T. (2023). A comprehensive review of the Swiss cheese model in risk management. Retrieved from https://www.researchgate.net/publication/374471149_A_comprehensive_review_of_the_Swiss_cheese_model_in_risk_management
