Swiss cheese was never the full picture

Reason's model is useful and limited — what it misses about adaptive, sociotechnical work under real pressure

James Reason's Swiss cheese model is probably the most widely taught concept in safety education. Its central image — multiple defensive layers, each with holes, through which a trajectory of failure can pass when the holes align — is genuinely useful. It communicates the layered nature of defence, the role of latent conditions, and the idea that accidents require multiple contributing factors rather than a single cause. For introducing systems thinking to people who have never encountered it, it remains a powerful starting point.

But a starting point is not a destination. The Swiss cheese model, taken as a complete picture of how accidents happen in complex organisations, leaves out enough that relying on it as the primary analytical framework can actively mislead.

The most significant gap is this: the model is linear and static. It depicts failure as a trajectory — something that moves in a single direction through a series of barriers. Real sociotechnical systems are not linear, and they are not static. They are dynamic, adaptive, and tightly coupled in ways that mean a change in one part of the system can have non-linear effects on entirely different parts. The failure of a complex system often does not look like an arrow passing through aligned holes. It looks like an emergent property of a system that was functioning normally, in conditions that were perfectly routine, up until the moment it was not.

Barriers fail because the system created conditions in which people chose, reasonably, to do something the barrier was not designed to handle.

A second limitation is the model's treatment of human beings. In the Swiss cheese framing, humans are primarily a source of holes — the fallible components whose errors create the gaps through which accidents pass. This is not wrong, exactly, but it is radically incomplete. Human beings are also the primary adaptive mechanism that keeps complex systems functioning. The same flexibility that allows a worker to take a shortcut also allows them to catch an error, compensate for an equipment failure, or recognise an emerging situation before it escalates. Treating human performance as primarily a liability produces safety systems that restrict and constrain, rather than systems that develop and amplify human capability.

Erik Hollnagel's Functional Resonance Analysis Method (FRAM) offers a more complete picture. Rather than modelling systems as barriers against a trajectory, FRAM maps the functions that make up normal work, the variability inherent in each function, and the ways that variability can couple and resonate across the system to produce unexpected outcomes. It treats both successful and unsuccessful outcomes as products of the same underlying system dynamics — which means understanding success and understanding failure require the same analytical approach.

AcciMap, developed by Jens Rasmussen, takes a different but complementary approach: mapping the sociotechnical system across multiple levels — government and regulation, company management, operations — to show how decisions made at each level create the conditions experienced at the levels below. This is particularly useful for understanding organisational and industry-level factors that conventional barrier models leave invisible.

None of this means the Swiss cheese model should be abandoned. It means it should be understood as one tool among several, most useful for its communication value and least useful as a detailed analytical instrument. For the purposes of a safety briefing or an introductory workshop, it remains excellent. For the purposes of understanding why a serious incident occurred in a specific complex system, it is not enough.

The practical implication is this: when your next incident investigation relies on the Swiss cheese model as its primary framework, it will find the holes and it will find the aligned trajectory. What it will probably not find is the systemic, sociotechnical, multi-level picture of why those holes existed, why the trajectory was in motion, and what the organisation needs to do differently. For that, you need tools that match the complexity of the system you are trying to understand.

Reason gave us a valuable starting point. The question is where you go from there.