Het Reason Model is een analyse model dat gebruikt wordt bij ongelukken om de verschillende oorzaken te achterhalen waardoor het ongeluk kon ontstaan. Het staat ook bekend als het Zwitserse Gaten-kaas model. Kortgezegd komt het er op neer dat verschillende omstandigheden een rol spelen bij het ontstaan van een ongeluk. Er bestaan ook verdedigingsmechanismen maar als daar gaten in zitten, en alle gaten elkaar overlappen dan wordt het ongeluk een feit.

http://www.aviation.unsw.edu.au/about/articles/swisscheese.html
 

Seeking and finding organisational accident causes: Comments on the Swiss cheese model

When it comes to understanding incidents and accidents, James Reason’s ‘Swiss cheese model’ has become the de facto template. This has had a positive effect on aviation safety thinking and investigation, shifting the end-points of accident investigations from a ‘pilot error’ explanation to organisational explanations. However, overzealous implementation of a theoretical framework has led to an illusion of management responsibility for all errors. The ‘Swiss cheese model’ of accident causation is now adopted as the model for investigation in many industries. Indeed, in aviation it has become the accepted standard as endorsed by organisations such as the Australian Transport Safety Bureau (ATSB) and the International Civil Aviation Organisation. The Swiss cheese model shows several layers between management decision making and accidents and incidents. The layers are shown below:

An accident or incident occurs where ‘holes’ in these layers align. The holes themselves change over time.

Reason (1990, 1997) made a key distinction between the active, operational errors (‘unsafe acts’) and the latent (organisational) conditions. Reason (1990) stated that “systems accidents have their primary origins in the fallible decisions made by designers and high-level (corporate or plant) managerial decision makers” (p. 203). Active errors were therefore seen as symptoms or tokens of a defective system. It became the duty of incident investigators and researchers to examine the psychopathology of organisations in the search for clues.

One implication of the organisational approach has been the tenacious search for latent conditions leading up to an accident. There are serious flaws in such prescriptive implementation. While the importance of analysing human factors throughout the accident sequence is not in question, the dogmatic insistence on identifying the latent conditions could and should be challenged in cases where active errors played a major part.

From human factors to organisational factors, and back again!

Organisational accident theory and the Swiss cheese model occupy a curious position in accident research and commentary in that they are never challenged. While these developments were clearly landmarks in accident investigation research, this uncritical stance is an unhealthy state of affairs in science. One of the few researchers to question the use of Reason’s Swiss cheese model is Reason himself, who warned that “the pendulum may have swung too far in our present attempts to track down possible errors and accident contributions that are widely separated in both time and place from the events themselves” (1997, p. 234) and that “maybe we are reaching the point of diminishing returns with regard to prevention” (2003).

The human factors and accident investigation community should encourage a holistic view of error and accidents, but one that does not necessarily lead deep into the roots of the organisation. Here is why.

Issue 1: Active errors may be the dominant factors. The Swiss cheese model can lead to the illusion that the roots of all accidents or even errors stem from the organisation’s management. This is not the case. Many errors are simply a by-product of normal, adaptive cognitive processes. ‘Inadequate defences’ would make the errors more dangerous, but even then some errors would overcome even well-planned and maintained defences.

Issue 2: The causal links between distant latent conditions and accidents are often tenuous. The mapping between organisational factors and errors or outcomes, if any such mapping can be demonstrated with an appropriate degree of certainty, is complex and loosely coupled. However, he Swiss cheese model makes it tempting to draw a line back from an outcome to a set of ‘latent conditions’. This invites ‘hindsight bias’, where we overestimate what we knew or could have known before an event occurred. Many ‘latent conditions’ would seem insignificant in the pre-event scenario.

Issue 3: Latent conditions can always be identified – with or without an accident. An organisation can identify its systemic weaknesses with or without an accident. Reason (1997) himself stated that distant factors do not discriminate between normal and abnormal states “…only proximal events - unsafe acts and local triggers - will determine whether or not an accident occurs” (p. 236). Reason (1997) argued that “The extent to which they are revealed will depend not so much upon the ‘sickness’ of the system, but on the resources available to the investigator” (p. 236). It seems that the harder you look, the more latent conditions you’ll find.

Issue 4: Some latent conditions may be very difficult to control, or take many years to address. The factors that can be most easily remedied are the local to the task performer – the working environment and supporting processes. Latent or organisational factors are not so amenable to rapid correction. For instance, an organisation’s ‘safety culture’ – much maligned in the Challenger accident report – cannot be manipulated easily or rapidly. Again, Reason (1997) declared that our main interest must be in the ‘changeable and controllable’.

Issue 5: Misapplication of the model can shift the blame backwards. Just as the focus of accident investigations has changed over the years, the focus of blame has also changed. The ‘blame-the-pilot’ culture swung to a ‘no blame’ culture. This over-swing was corrected by the concept of a ‘just’ culture. Somewhere in the midst of this, a ‘blame-the-management’ culture blossomed. Paradoxically, the organisational approach has sometimes tended to focus on a single type of causal factor – ‘management incompetence’ or ‘poor management decisions’.

Finding the balance

Reason’s Swiss cheese model revolutionised accident investigation worldwide. However, some industries, organisations and professions may have stretched the model too far. The ‘model’ is really a theoretical framework, not a prescriptive investigation technique. And it may not be universally applicable. Investigations can turn into a search for latent offenders when, in some cases, the main contributory factors might well have been active errors with more direct implications for the outcome, and therefore defences should be strengthened to tolerate errors. The search for latent conditions has resulted in recommendations that undoubtedly improve the safety health of the organisations concerned. In some cases, however, these conditions have arguably only tenuous connections to the actual event and should perhaps be reported separately.

Without wanting to return to the dark ages of ‘human error’ being the company scapegoat for all accidents, there is a balance to be redressed in accounting for the role of active errors.