Swiss cheese model
What it is for
Use it after something goes wrong, when the search for a culprit starts. James Reason showed an incident never comes through a single hole: it comes through when the holes in every defence line up at the same moment. Looking at the slices in a row moves the question from "who made the mistake" to "which defences had a hole right there".
The defences, first to last
Stopped by: Controllo automatico
What you type stays in this browser and is never sent anywhere.
A defence with no holes does not exist: a slice with zero usually means it has not been looked at closely enough. The useful question is not how to remove the holes, it is whether two neighbouring defences have their holes in the same place, because then the second adds nothing to the first.
Frequently asked questions
How to use this model
Where does the Swiss cheese model come from?
From the British psychologist James Reason, who proposed it in 1990 while studying accidents in complex systems. It became the reference frame in aviation and healthcare safety, where it serves precisely to move the inquiry from one person's error to the conditions that made it possible.
What are the holes in the slices?
They are the cases where that defence does not work: the check skipped under time pressure, the review done by whoever wrote the code, the alert nobody watches at night. Holes move over time, which is why a defence that held for years can suddenly give way.
How many defences are needed?
It is not the number that counts but their independence. Four checks done by the same person at the same moment are one defence drawn four times: they have the same holes in the same places. Two defences that fail for different reasons are worth more than five that fail together.
How many defences are enough to sleep soundly?
It is not the number that counts but their independence. Four checks done by the same person at the same moment are one defence drawn four times, with the same holes in the same places. Two defences that fail for different reasons beat five that fail together.