8. Swiss Cheese?

Just as “all models are wrong but some are useful” has perhaps blinded us to the possibility that some models may be harmful, I think the broad adoption of James Reason’s Swiss Cheese model has predisposed us to think that all accidents result from the failures of multiple independent barriers.

However, just as the financial models in the 2008 housing crisis failed to account for common-cause loan failures, I think there are cases where the Swiss Cheese model doesn’t hold. I think these cases are characterized more by key points of fragility than by combinations of failed barriers.

For example, an erroneous assumption can defeat multiple barriers at once. So can the absence of an expected skill or a key training gap. An initial misinterpretation of a single prominent cue may cause a person to overlook or dismiss other cues that tell a different story. Someone who is poorly equipped to mitigate a minor hazard is probably even less well equipped to mitigate the major hazard it evolves into. In these cases, the barriers are coupled rather than independent, so their combined effectiveness should not be treated as the product of independent probabilities.

So one of the goals of an event tree is to reveal those decision or action points that are potentially susceptible to common human failings, like jumping to the wrong conclusion, reacting instinctively rather than deliberately, persisting with an unproductive action, inattention to the key cues, expectation bias, and so forth. Any competent human factors expert can undoubtedly come up with a list of potential influences that may drive behaviors toward an unsafe path. Finding those key points of fragility can then help us understand how an adverse response may lead to a catastrophic outcome, and suggest ways we can prevent it.

It’s true that many, perhaps most, accidents are well described by the Swiss Cheese model because multiple barrier failures stack up to allow them to happen. But I think there are some accidents that are better described by single points of fragility that set the event onto a hazardous path in which none of the intended barriers can be effective.