2.2 Swiss Cheese Model and Error Classification

The Swiss Cheese Model of Accident Causation

James Reason's Swiss Cheese Model (1990) is the foundation for understanding accident causation in patient safety. Reason conceptualized a system as a series of defensive barriers designed to protect patients. In an ideal world, each barrier would be solid. In reality, they are like slices of Swiss cheese, riddled with holes representing system weaknesses.

These holes are not static; they open, close, and shift location over time in response to changing conditions, workloads, and organizational decisions. Under normal circumstances, holes in individual slices do not cause harm because subsequent slices block the hazard. However, an adverse event occurs when the holes in all slices momentarily align, creating a "trajectory of accident opportunity" that allows a hazard to pass through all defenses and reach the patient.

Reason classified the failures that create these holes into two distinct categories: active failures and latent conditions.

Active Failures vs. Latent Conditions

Active failures are the unsafe acts (slips, lapses, mistakes, and violations) committed by frontline clinicians at the "sharp end" of the system—those in direct contact with the patient (such as nurses, physicians, and pharmacists). Active failures have immediate, direct consequences. Examples include administering the wrong drug, making an incorrect incision, or misprogramming a ventilator. Because active failures occur at the point of care, they are the most visible aspect of an accident, often leading to the unfair blaming of individuals.

Conversely, latent conditions are systemic vulnerabilities or design flaws at the "blunt end" of the system, created by decision-makers removed from patient care. Latent conditions can lie dormant for years until they combine with active failures to breach defenses. Examples include chronic understaffing, look-alike drug packaging, and poor software interfaces. Research shows latent conditions are present in up to 90% of adverse events, meaning safety efforts must target these blunt-end flaws.

James Reason's Error Classification Taxonomy

To analyze active failures, Reason developed a taxonomy based on Rasmussen's Skills-Rules-Knowledge (SRK) framework, which describes human performance at the skill-based (automatic), rule-based (procedural), and knowledge-based (analytic) levels. Reason separated active failures into unintentional errors and intentional violations.

Unintentional Errors

Errors are divided into slips, lapses, and mistakes:

• Slips: These are execution failures at the skill-based level of performance. The user has the correct plan, but the action does not go as intended due to an attentional failure or distraction. For example, a nurse intends to grab a vial of normal saline but instead grabs a look-alike vial of concentrated potassium chloride. The plan was correct (saline), but the physical execution failed.
• Lapses: These are memory failures, also at the skill-based level. The user has the correct plan, but a step is forgotten or omitted. For example, a clinician prepares a medication correctly but is interrupted by a phone call and forgets to administer the dose, or forgets to document it in the chart.
• Mistakes: These are planning failures occurring at the rule- or knowledge-based level; the action goes as planned, but the plan is incorrect. There are two types of mistakes:
  • Rule-Based Mistakes: The clinician misinterprets the situation and applies the wrong rule, or applies a bad rule. For example, a physician applies a standard adult dosing protocol to a pediatric patient because they miscalculated the patient's weight class.
  • Knowledge-Based Mistakes: The clinician faces a novel situation for which they have no pre-existing rules or training. They must reason from first principles, but because of incomplete or incorrect knowledge, they make a bad plan. For example, a clinician misdiagnoses an extremely rare drug reaction because they have never seen it and fail to consult reference materials.

Intentional Violations

Violations are deliberate deviations from rules and are categorized as:

• Routine Violations: Accepted shortcuts or workarounds that occur regularly within an organization, often because the rule is seen as impractical or because the violation is tolerated by management (e.g., omitting the double-check process for low-dose heparin because of high workloads).
• Situational Violations: Deviations driven by specific environmental constraints or emergencies (e.g., a nurse administering a medication without scanning the barcode because the scanner is broken or the Wi-Fi signal is down).
• Reckless/Exceptional Violations: Deliberate disregard for safety protocols with conscious awareness that the action is highly dangerous and unjustified (e.g., a surgeon performing a procedure while under the influence of alcohol).

System Barriers and Safeguards

To block error trajectories, systems must implement defense-in-depth, deploying multiple, redundant barriers. These are categorized by reliability. Administrative barriers (policies, guidelines) are the weakest because they rely on human vigilance. Physical barriers and forcing functions (hard constraints preventing incorrect action) are the strongest, reducing error rates by up to 99%.

Hierarchy of System Barriers