DisclaimerThe content of this site has been prepared by the members of the thematic network "S2S - A Gateway for Plant and Process safety". Since the conditions of use are beyond our control we disclaim any liability, including patent infringement, incurred in connection with the use of these products, data or suggestions.
The thematic network S2S is a European Community Project carried out in the "Competitive and Sustainable Growth" programme and funded in part by contract number G1RT-CT-2002-05092.
Swiss Cheese Model
James Reason developed the "Swiss cheese model" to illustrate how analyses of major accidents and catastrophic systems failures tend to reveal multiple, smaller failures leading up to the actual hazard.(1) In the model, each slice of cheese represents a safety barrier or precaution relevant to a particular hazard. For example, if the hazard were mis identification of a chemical, slices of the cheese might include conventions for independent second checking of the materials and its packaging, dedicated vessels and mechanical interlocks. Many more layers exist. The point is that no single barrier is foolproof. They each have "holes"; hence, the Swiss cheese. For some serious events (eg, charging the wrong material), even though the holes will align infrequently, even rare cases of harm (errors making it "through the cheese") will be unacceptable.
While the model may convey the impression that the slices of cheese and the location of their respective holes are independent, this may not be the case. For instance, addition of wrong material may result from a poor management of change, absence of communication and the absence of a robust double check. In the technical parlance of accident analysis, the different barriers may have a common failure mode, in which several protections are lost at once (ie, several layers of the cheese line up). An aviation example would be a scenario in which the engines on a plane are all lost, not because of independent mechanical failure in all four engines (very unlikely), but because the wings fell off due to a structural defect. This disastrous failure mode might arise more often than the independent failure of multiple engines.
In safety management, such failure modes, in which slices of the cheese line up more often than one would expect if the location of their holes were independent of each other (and certainly more often than wings fly off airplanes) occur distressingly commonly. In fact, many of the systems problems discussed by Reason and others?poorly designed work schedules, lack of teamwork, variations in the design of important equipment between and even within institutions?are sufficiently common that many of the slices of cheese already have their holes aligned. In such cases, one slice of cheese may be all that is left between the worker and significant hazard.