The Swiss Cheese Model

The Swiss Cheese Model of Failure

This week, I was visiting Carmona, a beautiful small town in Andalusia, and this delicious slice of cheese reminded me of a safety model you may have heard of: James Reason’s “Swiss Cheese” model.

The Swiss Cheese model was created in 2000 by Reason in a British Medical Journal (BMJ) article called “Human error: models and management”. It is often used in risk analysis and management, and describes how different layers of protection can theoretically prevent failure. In the model, Reason uses slices of Swiss cheese to demonstrate layers of defence against what he calls active failures and latent conditions. Each layer has “holes,” or weaknesses, and the idea is that it’s unlikely for the holes in all layers to align and allow a hazard to pass through. 

From https://www.ncbi.nlm.nih.gov/pmc/articles/PMC1117770/

The Swiss Cheese model was born out of Reason’s desire to communicate his “Organisational Accident Model” to the medical readership of the BMJ, many of whom were not as familiar with safety concepts from the field of human factors as people in industries such as nuclear power or aviation. It’s now used in everything from construction and patient safety to cybersecurity and power generation. 

Reason’s theory holds that most accidents can be traced to one or more of four levels of failure:

• Organisational influences,
• Unsafe supervision,
• Preconditions for unsafe acts, and
• The unsafe acts themselves.

However, the model itself is, well, full of holes. In fact, Reason himself worried that the model was being applied too broadly and dogmatically, “…the pendulum may have swung too far in our present attempts to track down possible errors and accident contributions that are widely separated in both time and place from the events themselves.” (from Managing Risks of Organizational Accidents, 1997)

Criticisms of The Swiss Cheese Model

Whilst the SCM is useful for describing deterministic and linear systems, it’s maybe less so (or at least, more difficult to do so) for non-deterministic and social systems.

Critics of the Swiss Cheese model point to several key issues with it:

• Complacency: The model can encourage a false sense of security if people believe multiple layers make failure impossible. Reason’s original model included “unsafe acts” but in the majority of cases where the model is applied nowadays, these are omitted.
• Interactions: The layers are often treated as independent, but in real life, they rarely are; failure in one can cause failures in others, particularly if those failures change volume or load on the system, or we’re talking about social systems.
• Complexity: Real-world systems are more complicated than can be captured by a simple, linear, layered model.
• Adaptability: The model does not easily accommodate changes or adaptations in the system. In complex systems, changes can occur that unknowingly create invisible “holes” in various layers, create new layers, or allow failures to bypass entire layers of protection.
• Human Factors: It does not fully account for human psychology, social culture, human error, or human adaptability in solving and preventing failures.
• Resource Intensive: Implementing multiple layers of defence can be costly and time-consuming, and may not be even a good idea. Indeed, as Perrow points out in Normal Accidents – these multiple extra layers can often actually make systems more brittle and introduce new, unexpected, failure states.

Here’s an excellent critique of the SCM from the folks Eurocontrol.

Sydney Dekker also points out in The Field Guide to Human Error Investigations:

“The layers of defence are not static or constant, and not independent of each other either. They can interact, support or erode one another. The Swiss cheese analogy is useful to think about the complexity of failure, and, conversely, about the effort it takes to make and keep a system safe. It can also help structure your search for distal contributors to the mishap. But the analogy itself does not explain:

• where the holes are or what they consist of,
• why the holes are there in the first place,
• why the holes change over time, both in size and location,
• how the holes get to line up to produce an accident.

This is up to you, as investigator, to find out for your situation.“

Effective use of the Swiss Cheese Model

A good example of the Swiss Cheese Model in application is during the Covid-19 pandemic, where Ian Mackay used the swiss cheese model to describe the layers of protection against the disease, including wearing a mask, social distancing and vaccination. Ian is a fantastic science and virology communicator, and this is a powerful illustration. It demonstrates the way different layers of protection act against different threat vectors, and may help people to understand both their personal and shared responsibilities. 

Used in this way, the Swiss Cheese model can prove to be a very effective way of communicating safety concepts and multiple layers of defence against failure. However, it has its limitations. In the example of Covid-19 protections above, it doesn’t explicitly recognise the links between some of the layers (e.g. financial support and quarantine), and may lead some people to feel overconfident that they can skip some of the layers of responsibility (e.g. wearing masks) because there are other layers of defence in place. 

Notes on the Swiss Cheese Model

It’s worth noting that the holes in each layer don’t all need to align at the same time. Holes that align may cause a contributing failure that lingers, unseen, for a long time. When holes in the other layers align, they may come together with the latent failure and cause a catastrophe.

Attempts have been made to show how the SCM describes complexity and non-determinism, such as this video where the slices move and the holes increase and decrease, but sometimes I feel it’s better to use a model whilst being aware of its limitations, rather than try to perfect a model to fit the real world – because a model never will accurately reflect the real world.

The Swiss Cheese Model and Psychological Safety 

We may even make use of the Swiss Cheese model in our own workplaces in respect to psychological safety and preventing accidents and failures. Improving psychological safety is one way to reduce the size of the “holes” in the slices, making it less likely they will align and reducing the risk of errors or accidents occurring. Conversely, when psychological safety is low, the holes in the cheese become larger and more likely to align, making it more likely for an error or accident to occur. And, of course, an environment of higher psychological safety helps individuals to adapt and respond to changing conditions more effectively, mitigating one of the Swiss Cheese model’s limitations – its perceived inadequacy in accommodating changes or adaptations in the system.

Failures come in many sizes, shapes and forms. It’s somewhat naïve therefore to hope that one model or
one type of explanation will be universally applicable. Some failures are really simple, and therefore only require simple explanations and models. Some failures are complex, and require comparably complex models and methods to be communicated, analysed, and prevented.

All models are wrong, and some are useful.

The Swiss Cheese model is wrong, but I also think it’s also very useful in communicating how failures can occur, in analysing some kinds of failure, but only as long as we understand its limitations.

Note: I should mention that Reason created a number of other models of safety, and defined a powerful version of Safety Culture, but it was his Swiss Cheese Model that stuck in the collective mindset, probably due to its graphical representation, ease of understanding and simplicity.

New stickers!

There are three ways that you can get your hands on some of our psychological safety stickers!

1. Buy some at our online shop
2. Attend a workshop
3. Promote psychsafety.com on social media and send us your postal address!

Psychological Safety at Work

Unclear expectations and punishment or humiliation for failing to meet those expectations is a very effective, and very common, way of damaging psychological safety in the workplace. I’ve personally experienced this, and it’s worth highlighting that even competent managers with good intentions can inadvertently be guilty of this, especially in stressful, high-pressure, fast-changing environments. Here’s a great illustration of that effect from the fab folks at Work Chronicles.

A survey of NHS staff has unearthed widespread sexual harassment and assault, including rape, predominantly targeting female surgeons by their colleagues in the NHS. A prevalent psychologically unsafe culture of silence, worsened by hierarchical power dynamics and fear of career backlash, highlights an urgent call for robust systems to guarantee safety and uphold professional standards in surgery in the NHS. Unfortunately, it appears there are some who appear to hold a view that women experiencing this harassment should simply “toughen up“. 

There are many factors that can contribute to feelings of psychological safety, such as the group dynamic and power structures, incentives, our relationships with others, our experiences in the past, and our own unique context. This Masters thesis study by Lisa Ringoir examined the relationship between autism-traits, sensory sensitivity, and feelings of psychological safety in clinical settings, and showed that individuals with autism-traits may experience lower feelings of psychological safety due to their heightened sensory sensitivities.

You may be familiar with the very high-profile Lucy Letby case in the UK recently. We’ll be covering aspects of it in more depth in a future newsletter, with insights from folks inside the NHS and the nursing profession. Here, however, is a useful piece of research showing that psychological safety is a predictor for intention to report safety events among paediatric nurses.

Online Psychological Safety Workshops

We have places left on our upcoming workshops in October and November – you can choose from:

• Intermediate: essential theory and practice to help you level up your knowledge and skills.
• In-depth: examining elements such as cultural impacts on psychological safety, complexity, sociotechnicality, organisational scale and more.
• Practices: From Empathy Mapping to TRIZ. You learn practices and take away canvases and templates too.
• Leadership: Specifically for managers and senior leaders (or folks on that journey): we cover effective management practices, strategic leadership, reporting, 1-1s, work design and flow, managing neurodiverse people and more. 

 Find out more and register here.

This week’s poem:

Sevilla, by Federico García Lorca

Sevilla es una torre
llena de arqueros finos.
 
Sevilla para herir.
Córdoba para morir.
 
Una ciudad que acecha
largos ritmos,
y los enrosca
como laberintos.
Como tallos de parra
encendidos.
 
¡Sevilla para herir!
 
Bajo el arco del cielo,
sobre su llano limpio,
dispara la constante
saeta de su río.
 
¡Córdoba para morir!
 
Y loca de horizonte,
mezcla en su vino
lo amargo de Don Juan
y lo perfecto de Dioniso.
 
Sevilla para herir.
¡Siempre Sevilla para herir!