Skip to content
Rabin Poudyal
Page 6-1
6-1 Models

6.81Swiss cheese model

Systems and complexity

Accidents happen when the holes in several layers of defence line up at once, so look for the holes, not the last person to touch the system.

James Reason, a psychologist at the University of Manchester, most widely cited from Human error: models and management, in the British Medical Journal (BMJ) in 2000.

  1. 1Read

    A complex system is protected by layers: some engineered, like alarms and automatic shutdowns, some human, like reviewers and operators, and some procedural. Reason's point is that every layer is like a slice of Swiss cheese, full of holes, and the holes keep opening, closing and moving. A hole in one slice does not normally cause harm. An accident needs the holes in many layers to line up for a moment, letting a hazard pass straight through.

    He split the holes into two kinds. Active failures are the slips, lapses and mistakes of people at the sharp end, and they are short-lived and hard to predict. Latent conditions are built in by designers, procedure writers and managers: an untrustworthy alarm, an unworkable procedure, a tool with no limit. They can sit unnoticed for years, but unlike active failures they can be found and fixed before anything goes wrong. His analogy: active failures are mosquitoes you can swat one by one, and the latent conditions are the swamp they breed in.

    The model is a picture, not a measurement. It says nothing about how big a hole is or how likely two holes are to align, and layers are rarely independent: one shared cause, like time pressure, can punch holes in several slices at once. Use it to look for every hole an incident passed through, not to argue that adding one more slice makes a system safe.

  2. 2Note

    Example

    On 19 July 2024 a CrowdStrike content update crashed Windows machines worldwide. Its root cause analysis lists six findings, and the crash needed all of them at once: the sensor did not check the number of input fields at compile time, the interpreter had no runtime bounds check, the tests used a wildcard in the one field that was never supplied, the Content Validator assumed that field existed, the content was not tested inside the interpreter, and the update went to every host at once rather than to a canary first. CrowdStrike's fix closed each hole separately.

  3. 3Apply

    Where it applies

    In a postmortem, list every defence the failure passed through and ask why each one had a hole that day, instead of stopping at the person who ran the command. For an artificial intelligence (AI) system, treat the prompt rules, the output validator, the human reviewer and the rate limit as separate slices, and check that no single shared assumption makes all of them fail together.

  4. 4Think

    Think about it

    Which latent condition in a system you run has been sitting there for years, waiting for an active failure to line up with it?

  5. 5Log

    Applied it to something real? Log it.

  6. 6Check
    Test yourselfIn Reason's Swiss cheese model, what is the difference between an active failure and a latent condition?

    An active failure is a short-lived unsafe act by someone at the sharp end. A latent condition is a weakness built into the system by design, procedure or management decisions; it can lie dormant for years, and it can be found and fixed before an accident.

  7. 7Go

    Related models

  8. 8See

    Seen in an incident

  9. 9Source

    Sources and further reading