Swiss Cheese Model (Reason 1990) — Explained

Origin: James Reason, 'Human Error' (1990)

Reason published the model in his 1990 book Human Error, drawing on aviation, healthcare and nuclear operations research. The model rejects the 'bad apple' theory of accidents (blame the operator) and replaces it with a systemic view: front-line errors are the last step in a chain that started with management decisions made months or years earlier. Reason later refined the model and coined 'latent conditions' vs 'active failures' — vocabulary directly reused by Tripod Beta.

Active failures vs latent conditions

Active failures are unsafe acts at the sharp end — a valve mis-aligned, a step skipped, a warning missed. Latent conditions are decisions made away from the sharp end that create the environment where the active failure becomes possible — a rushed permit process, a training programme cut for cost, a procedure that has drifted from actual practice. Reason's key insight: eliminating active failures without addressing latent conditions is whack-a-mole.

Applied to modern operations

The four barriers most often modelled: (1) organisational influences — the decisions and culture at management level; (2) unsafe supervision — the layer between management and front-line; (3) preconditions for unsafe acts — fatigue, poor tools, unclear procedures; (4) unsafe acts themselves. Tripod Beta operationalises this into eleven General Failure Types — hardware, design, maintenance management, procedures, error-enforcing conditions, housekeeping, incompatible goals, communication, organisation, training, defences.

Case: Deepwater Horizon (2010)

The 2010 Macondo blowout killed eleven and released 4.9 million barrels of oil. Reading it through the Swiss Cheese Model: cement barrier failed (design/quality), negative-pressure test misinterpreted (procedures/training), diverter routed to mud-gas separator not overboard (design), gas migration through HVAC ignited on the drill floor (defences), BOP shear ram misaligned (maintenance). Every barrier had a hole; the holes aligned. No single 'root cause' — a systemic failure pattern that Tripod Beta or BowTie captures cleanly and 5 Whys cannot.

Preguntas frecuentes