The Swiss cheese model: why disasters never have a single cause
The image that explains how accidents happen: not through one failure, but because several holes lined up. What it is and how it applies to your own mistakes.
Also called: Reason model · defence in depth
James Reason suggested picturing a system's defences as slices of Swiss cheese lined up one behind another. Each slice is a barrier — a rule, a check, an alarm, a person reviewing — and each hole is a weakness in that barrier.
The holes move constantly. An accident happens on the rare day when they all line up and something passes through the entire block. That is why, when you reconstruct a disaster, you never find one cause: you find five or six small things that separately would have amounted to nothing.
Why it happens
Reason distinguishes two kinds of hole. **Active failures** are at the end of the chain: the person who pressed the wrong button. They are visible immediately and they are what ends up in the report.
**Latent failures** are decisions made much earlier by people who were never there: cutting staff, buying the cheapest equipment, approving a procedure that cannot be completed in the time allowed. They cause nothing on their own. They sit and wait, sometimes for years.
That is why hunting for someone to blame is so unproductive. The active failure is the last slice, but the holes that had to line up had been there a long time, and nobody closed them because nothing had ever happened.
What it looks like in real life
The road accident
No single cause is enough: rain, worn tyres, running fifteen minutes late, a badly signed junction, and a phone ringing. Five holes lined up.
The medical error
Two drugs with similar names, a long shift, a pharmacy unstaffed at that hour, and a system that does not force confirmation. Each seemed tolerable on its own.
The data loss
The backup had been failing silently for months, nobody checked the alerts, the spare drive was attached to the same machine, and the warning went to a mailbox no one reads.
Signs this is happening to you
- After a failure, the official explanation comes down to one person or one cause.
- There are alerts that get routinely ignored because they fire too often.
- Some barrier has been broken for a while and everyone knows.
- Near misses are not recorded because nothing actually happened.
- The same task depends on a single check, with nothing behind it.
How to avoid it
- Count how many real barriers you have. Many processes look like they have three and effectively have one, because the other two depend on the same person or the same system. Barriers that fail together count as one.
- Record near misses. They are free information: they show you where the holes are without anyone paying the price. Every organisation that genuinely improved its safety started here.
- Look for latent failures, not for whoever touched it last. Ask which earlier decisions made that day possible. That is where the fixes that prevent a recurrence live.
- Distrust the single barrier. If everything depends on one person remembering or one system not failing, there is no block of cheese — there is one slice.
- Apply it to your own life. Personal errors are usually several holes too: too little sleep, a rush, an app that makes it easy, and no check at all. Closing one is often enough.
Real mistakes from the community
These are not examples we made up. They were written by the people who lived them.
- I moved to a new city without visiting it onceAccepted the job, signed a year lease, packed my life — all based on Google photos and one video call. The neighborhood was nothing like the pictures …
- I waited until rock bottom to try therapyYears of 'I can handle it myself' and 'it's not that bad'. It took a panic attack at work and losing a relationship to finall…
- I lost my entire thesis to one coffee spillNinety pages. One laptop. Zero backups — not even a USB stick. The coffee took four months of work in three seconds. I had to ask for an extension and…
- I co-signed a lease for an acquaintance"Just for the paperwork, nothing will ever happen." He stopped paying month six and left the country. Guess who covered the remaining 4 mont…
Frequently asked questions
Who created the Swiss cheese model?
British psychologist James Reason, in the late 1980s. It is now the most widely used model in aviation, healthcare and industrial safety.
Does it work outside industry?
Yes. It explains just as well why you forgot something important or why a project went wrong: there is almost never a single cause.
What is a latent failure?
A condition created much earlier — a design, a budget cut, a badly conceived procedure — that causes no harm by itself but opens a permanent hole in one of the barriers.
Is the model criticised?
Yes: it can give the impression that barriers are static and independent, when in reality they interact. It remains the clearest way to explain why blaming a person rarely fixes anything.
Related entries
Made this mistake yourself? Writing it down is how someone else avoids it.
Share a mistake of your own