Good and bad reasons: The Swiss cheese model and its critics

Really interesting historical and critical account of Reason’s work, particularly the Swiss Cheese metaphor (SCM).

It was meant to be a mini-post with a few extracts, but, meh, couldn’t be bothered cutting it back. Still not a summary, and skipped HEAPS, so highly recommend reading the free open access article.

Background:

· Reason’s foray into safety science wasn’t intentional – he changed from medicine to psychology

· A focusing event was when he once dolloped cat foot into his tea pot while distracted by a ravenous cat – shifting his focus to naturalistic study of errors (e.g. in natural settings over manipulated lab conditions)

· This error “was anything but random, as it was related to the similarity and concomitance of the two activities”

· “developing a taxonomy of errors may orient prevention towards attempts to identify

· and then eliminate them. On the other hand, the ecological view sees errors as an adaptive feature of cognition. Eliminating them is unrealistic as, in complex dynamic situations, most of the time when they happen, it is possible to recover. In Reason’s words: “We cannot change the human condition, but we can change the conditions under which humans work”

· Study of accidents like Kings Cross, Chernobyl and more suggested “that human error, in itself, appeared to have limited value in making sense of the conditions that triggered disasters … [and] it was in this context that Reason developed a graphical method to conceptualise organisational accidents”

· Reason developed a resident pathogens metaphor (image 2) – latent errors becoming latent conditions to recognise “that a decision could create latent conditions in the system although, in itself, it did not represent an error per se”

· “the principal contribution of his metaphor is not to demonstrate the existence of latent conditions, but to suggest that they must be detected and addressed a priori. It is important to note that this proposition is not equivalent to determinist, accident proneness theory”

· Reason moved from the psychological, micro focus on error to the “acclaimed graphical taxonomy (Fig. 1), to a systemic, macro visualisation of accidents, leading to one of the most popular safety models”

· Various iterations and evolutions existed (not discussed here but see the paper), however, the iterations “showed that a catastrophe could occur in the absence of an active error, “unsafe acts at the sharp end are not essential – though common – for creating defensive gaps and weaknesses”

· It also changed to a vertical orientation from the earlier horizontal, but “the vertical orientation does not suggest causality, but a rather structuralist vision of hierarchical relations between different levels of an organisation”

Next the paper covers some critiques of SCM:

· Why was the SCM so successful? This was largely due to its effective use of metaphors and visual representation of complex phenomenon

· Hence, “The model makes complex ideas easily understandable and, thus, has significantly contributed to promoting the organisational accident paradigm”

· “Several ‘eureka’ moments can be identified when the three minds came together, each being a stepping stone to the final result … But these metaphors would be nothing without the graphical aspect”

· Different the different variations of metaphors, models and concepts, “It seems more appropriate to talk about Reason’s models more than the Reason model”

· Reason noted prior to the release of the SCM “the pendulum may have swung too far in our present attempts to track down possible errors and accident contributions that are widely separated in both time and place from the events themselves”

· Thus, “ironically, it seems that the only person to question the use of Reason’s Swiss cheese model is Reason himself!” (Shorrock et al., 2005), suggesting Reason was the first to publish critiques of these concepts

· “The heuristic power of the SCM, one of the factors of its widespread popularity, also seems to have led to its dogmatic use, “It may be the case now that industries and organisations have latched on to the model in a far too rigid and dogmatic fashion. As a consequence, investigations based on the Reason model can easily turn into a desperate witch-hunt for the latent offenders when, in some cases, the main contributory factors might well have been ‘human error’ in the traditional sense.”

· Criticisms from some authors, like Hollnagel, Dekker and Leveson suggest that the SCM iterations provide “the idea of linear accident causality … while failing to consider the system as a whole”

· “Leveson goes one step further, and describes the SCM as an obsolete descendant of Heinrich’s domino model from the early 1930s. “

· “The natural conclusion of these established safety researchers is that “the Reason’s Swiss cheese is no longer adapted to anticipate today’s accidents”

· Others argued the SCMs are too underspecified and overly generic

· That is, “they claim that its graphical simplicity does not provide any understanding of the links between different causal, organisational, local and individual factors”

· The authors of this paper challenge these critiques – first from Reason’s own perspective of his SCM derivatives: “from an academic perspective the weakness of the SCM is that it is irrefutable by standard scientific methods – a distinction it shares with many other models from Freud’s to Endsley’s. There is no ‘crucial experiment’ that can be used to reject the model. But then it was never intended to be a scientific model on that level.”

· Further, a survey study of practitioner use of an SCM found that “while the intuitive understanding and interpretive flexibility of the SCM is precisely what has made it so successful it is also, for some, a fundamental drawback”

· Nevertheless, the SCM has worked as a boundary object, able to align people from different domains, careers, experiences etc.: “the heuristic, collaborative and performative aspects of the SCM, which are at the heart of its success, should not be neglected. The model has managed to strike a balance between generic, intuitive, normative and underspecified content”

· “We therefore agree with Reason’s own argument that, “‘Swiss cheese’ is primarily about how unsafe acts and latent conditions combine to breach the barriers and safeguards. […] I still think of it as a systemic model […] Just as there are no agreed definitions and taxonomies of error so there is no single ‘right’ view of accidents”

· And “ In our business, the ‘truth’ is mostly unknowable and takes many forms. In any case, it is less important than practical utility”

Next they discuss the relationship between safety concepts and commercialisation:

· The SCM, like many other concepts, were inseparable from commercial arrangements (safety consulting, workshops etc)

· “the SCM can be considered a product that created —and conquered— a market. This makes it a target for commercial strategies that seek to replace it with new alternatives”

· “The SCM was one of the first models to provide its creators, and many other consultants, with a way to earn a living”

In conclusion:

· “this historical and critical review of the SCM by reaffirming the strengths of the model and defending its ongoing relevance”

· “The debate on whether it is linear or systemic must be put to one side, and its contemporary character should be understood in terms of its influence on practice (Underwood, 2013) without neglecting its analytical limitations”

Ref: Larouzee, J., & Le Coze, J. C. (2020). Good and bad reasons: The Swiss cheese model and its critics. Safety science, 126, 104660.