6.2 Swiss Cheese Model & System Failures

6.2 Swiss Cheese Model & System Failures

Heinrich's dominos give you a linear chain from background factors to injury. James Reason's Swiss Cheese Model gives you a system picture: organisations try to stop hazards with several layers of defence. Each layer is like a slice of Swiss cheese—mostly solid, but with holes (weaknesses). An accident happens when the holes in successive layers line up, opening a path from hazard to harm.

For ISPON HSE Level 1, you need this model at Basic depth: what the slices and holes mean, the difference between active failures and latent conditions, why multiple defences matter, and how to read a simple multi-failure scenario. You do not need research-level human-factors theory.

Why a Second Model After Heinrich?

Domino Theory focuses attention on immediate unsafe acts and conditions. Swiss Cheese answers a further question: Why did those acts and conditions exist, and why did defences fail to stop them? Modern investigations often find that the worker's final error was only the last hole in a row of organisational weaknesses—missing training budget, unenforced permits, disabled alarms, rushed schedules, or unclear contractor interfaces.

Level 1 exam questions may present either model. Strong candidates can:

• Use Heinrich for the classic five-step chain and 88/10/2 figures
• Use Swiss Cheese when the stem mentions barriers, layers of defence, latent failures, or several things going wrong at once

Both models support the same moral: most accidents are preventable when systems are designed and maintained properly.

Core Idea: Barriers with Holes

Imagine a hazard on the left (for example, energy in a pressurised line, a fall from height, a moving vehicle) and a person or asset to protect on the right. Between them the organisation places defences:

• Engineering controls (guards, interlocks, relief valves, barriers, gas detection)
• Administrative controls (procedures, permits to work, training, supervision, exclusion zones)
• Personal protective equipment (hard hat, harness, gloves, respiratory protection)
• Emergency response capability (alarms, muster, first aid, firefighting)—sometimes treated as a final layer if prevention fails

Each defence is imperfect. Holes appear because of:

• Design flaws
• Maintenance backlogs
• Human error
• Violations (shortcutting rules)
• Poor communication
• Inadequate resources or competence
• Temporary workarounds that become permanent

HAZARD  →  [ Layer 1 ]  →  [ Layer 2 ]  →  [ Layer 3 ]  →  [ Layer 4 ]  →  HARM
              holes           holes           holes           holes
                 \              |               |              /
                  \_____________|_______________|_____________/
                         Alignment of holes = accident path

When holes are offset, a threat blocked by one layer is stopped even if another layer is weak. When holes align, the threat travels through every layer and the accident occurs.

Active Failures vs Latent Conditions

Reason's language is exam-useful. Distinguish these two categories:

Active Failures

Active failures are errors or violations by people at the sharp end—operators, drivers, craft workers, supervisors—whose actions (or inactions) are close in time and space to the accident.

Examples:

• Opening the wrong valve
• Entering a confined space without gas testing
• Driving too fast on a site road
• Removing a guard "just for a minute"
• Signing a permit without visiting the job location

Active failures are visible after the event and often attract blame. They matter—but they are usually not the whole story.

Latent Conditions

Latent conditions are weaknesses built into the system that can lie dormant for a long time until they combine with active failures and local triggers. They are often created by designers, managers, planners, or purchasing decisions far from the final moment of injury.

Examples:

• Procedures that are long, conflicting, or impossible to follow under real production pressure
• Training that was never funded for temporary or contractor staff
• Alarms frequently in "bypass" because of nuisance trips
• Spare parts not stocked, so temporary scaffolding becomes permanent access
• Incentives that reward only speed, never safe work
• Poor lighting design in a workshop
• Unclear responsibility between main contractor and subcontractors on a Nigerian mega-project

Latent conditions create or enlarge the holes in the cheese. Fixing only the last active failure ("tell the worker not to do it again") without closing latent holes invites repeat accidents.

Why Multiple Defences Matter

Single-layer safety is fragile. If the only control is a hard hat, a falling object still reaches the worker when the hat is missing, wrong, or inadequate for the energy. If the only control is a procedure, production pressure or language barriers can empty that layer. Layered defence—aligned with the hierarchy of controls—means:

1. Engineering layers reduce reliance on perfect human behaviour (guards, interlocks, physical barriers, automatic shut-downs)
2. Administrative layers shape behaviour and authorisation (permits, JSA, toolbox talks, competence, supervision)
3. PPE layers provide a last personal barrier when residual risk remains

The Swiss Cheese insight: independence and diversity of barriers matter. Three weak procedures that all depend on the same rushed supervisor are not three real layers—they share the same hole. A physical guard plus a lock-out procedure plus PPE gives different types of protection.

Simple System View (Optional Mental Diagram)

You can sketch Swiss Cheese for study notes as:

flowchart LR
  H[Hazard] --> A[Engineering barrier]
  A --> B[Administrative barrier]
  B --> C[PPE barrier]
  C --> D[Person / asset]
  H -. hole alignment .-> D

Or in plain text for exam revision:

1. Draw 3–4 vertical rectangles (slices)
2. Punch irregular holes in each
3. Draw an arrow from hazard through aligned holes to injury
4. Label one hole "active failure" and others "latent condition"

Nigerian Multi-Failure Scenario — Holes Align

Setting: Hot work on a process pipe rack at a hydrocarbon facility in the Niger Delta region (or a similar high-hazard plant anywhere in Nigeria).

What went wrong (simplified for Level 1):

Analysis with Swiss Cheese:

• The welder's missing FR clothing or the absent fire watch are visible active/local failures
• Incomplete isolation, missing detector, and office-signed permit reflect latent and system conditions as well as active shortcuts
• No single hole alone would necessarily have caused the fire; alignment of several holes created the path from hazard (hydrocarbon + ignition source) to harm

Prevention message: Strengthen each slice—engineering isolation standards, permit discipline, working detectors, competent fire watch, correct PPE—and audit for latent holes before the next campaign. Punishing only the welder leaves the system ready to fail again.

Linking Swiss Cheese to Hierarchy of Controls and Daily Work

Swiss Cheese does not replace the hierarchy of controls; it illustrates why higher-order controls and multiple layers beat reliance on PPE alone:

• Elimination/substitution remove the hazard so fewer slices are needed
• Engineering slices are often more reliable than pure behavioural slices
• Administrative and PPE slices still matter for residual risk and for tasks where engineering is incomplete

A Level 1 worker supports Swiss Cheese thinking when they:

• Follow permits and isolations fully (keep administrative holes closed)
• Report defective guards, alarms, and detectors (expose latent engineering holes)
• Wear correct PPE without treating it as the only defence
• Stop work when a required barrier is missing (refuse to work with an open hole)
• Share near-miss information so latent conditions are fixed before alignment occurs

Common Exam Traps

Exam Focus

Define the model as multiple barriers with holes; alignment causes the accident. Distinguish active failures (sharp-end, immediate) from latent conditions (hidden system weaknesses). Explain why layered defences—engineering, administrative, and PPE—matter more than any single control. In scenarios, look for several simultaneous failures, not only one careless act.