Swiss Chese Accident Models

An excellent account of this work has been provided by Reason, which emphasises the concept of organisational safety and how defences (protection barriers such as material, human and procedures) may fail. In this approach the immediate or proximal cause of the accident is a failure of people at the "sharp end" who are directly involved in the regulation of the process or in the interaction with the technology . Reason defines accident as situations in which latent conditions (arising from management decision practices, or cultural influences) combine adversely with local triggering events (weather, location, etc.) and with active failures (errors and/or procedural violation) committed by individuals or teams at the sharp end of an organization, to produce the accident. The dynamics of accident causation are represented in the Swiss cheese model of defences (see figure), which shows an accident emerging due to holes (failures) in barriers and safeguards.

Reason's Swiss Cheese Model of Defences

The notion of latent factors supports the understanding of accident causation beyond the proximate causes, which is particularly advantageous in the analysis of complex systems that may present multiple-failure situations. Reason's model shows a static view of the organisation; whereas the defects are often transient i.e. the holes in the Swiss cheese are continuously moving. The whole socio-technical system is more dynamic than the model suggests.

The basic structural elements identified in the model are described as:

The Swiss cheese model is well suited to complex chemical process production systems, where a hierarchical organizational structure tends to exist (managers, front-line personnel, physical and operational barriers, etc).

Structural elements

Decision makers: These include high-level managers, who set goals and manage strategy to maximize system performance (e.g. productivity and safety).

Line management: These include departmental managers, who implement the decision makers' goals and strategies within their areas of operation (e.g. training, sales, etc).

Preconditions: These refer to qualities possessed by people, machines and the environment at the operational level (e.g. a motivated workforce, reliable equipment, organizational culture, environmental conditions, etc).

Productive activities: These refer to actual performance at operational levels.

Defenses: These refer to safeguards and other protections that deal with foreseeable negative outcomes, for example by preventing such outcomes, protecting the workforce and machines, etc.

Accidents occur because weaknesses or "windows of opportunity" open in all levels of the production system, allowing a chain of events to start at the upper echelons of the structure and move down, ultimately resulting in an accident if it is not stopped at any level. Said otherwise, most (if not all) accidents can be traced back to weaknesses in all levels of the system, including the decision makers level.

These weaknesses or "windows of opportunities" can be due to different factors, such as mechanical or technical failures, although, unfortunately, the human factor seems to be the most frequent or most traceable source of most accidents. These weaknesses, thus, map onto the normal structure, and, therefore, are particular to each organizational level. Human weaknesses in the system can be listed as follows:

  • Fallible decisions at decision makers level.
  • Line management deficiencies at line management levels.
  • Psychological precursors of unsafe acts at precondition levels.
  • Unsafe acts at production levels.
  • Inadequate defenses at the defenses level.


Locations of visitors to this page