The Swiss Cheese Model: Why Air Accidents Need Many Failures

The Swiss cheese model says that a serious accident happens only when several layers of defence fail at the same time. Each layer, such as a design feature, a maintenance check, a rule or a pilot’s cross-check, is like a slice of Swiss cheese: mostly solid, but with holes. Usually a hole in one slice is blocked by the next. An accident happens when the holes in every slice line up and a hazard passes straight through.

The idea comes from the British psychologist James Reason, who set out his thinking on human error and organisational accidents in his books Human Error (1990) and Managing the Risks of Organizational Accidents (1997). It is now one of the most common ways to explain why accident reports list several causes instead of one.

James Reason’s idea in one picture

Picture a row of slices. The first might be the aircraft’s design. Then come maintenance, the airline’s rules and paperwork, air traffic control, and finally the crew in the cockpit. Each is meant to catch problems the others miss.

The holes are weaknesses. Some open and close from moment to moment, such as a tired pilot missing a checklist item. Others sit in place for years, such as a confusing warning, a missing spare part or a rule nobody enforces. Most of the time the holes do not line up, and nothing happens. The model’s point is that when an accident does happen, the last hole, often a crew’s mistake, is only the final one in the row.

Active failures and latent conditions

Reason sorted the holes into two kinds.

• Active failures are unsafe acts by people at the sharp end: pilots, controllers, mechanics. Their effects show up almost immediately. Pressing the wrong switch or skipping a check is an active failure.
• Latent conditions are weaknesses built into the system by decisions made earlier and further away: by designers, managers, regulators and trainers. They can lie dormant for years until an active failure exposes them.

Investigators use the same language. The Greek investigators of Helios Airways Flight 522 divided their conclusions into “direct causes”, “latent causes” and “contributing factors”.

Worked example 1: the Gimli Glider

On 23 July 1983, Air Canada Flight 143, the Gimli Glider, a nearly new Boeing 767, ran out of fuel at 41,000 feet over northern Ontario. Captain Robert Pearson and First Officer Maurice Quintal glided it to a landing on a disused air force runway at Gimli, Manitoba, and all 69 people on board survived. The Board of Inquiry, led by Commissioner George Lockwood, reported in April 1985. Its findings read like a stack of slices with the holes lined up. See Air Canada Flight 143: The Pounds-for-Kilograms Fuel Error.

1. An equipment fault. The 767’s fuel gauges were driven by a processor with two channels. A fault in it made the gauges go blank.
2. A maintenance workaround. In Edmonton the day before, a technician pulled the circuit breaker for one channel so the gauges worked. In Montreal another technician reset it during a test, the gauges went blank again, and the breaker was not pulled back out. There was no spare processor in Montreal.
3. A dispatch rule not followed. The minimum equipment list did not allow the aircraft to fly with blank fuel gauges. It left Montreal, and later Ottawa, with them anyway.
4. No one owned the fuel calculation. The 767 was the first type in the fleet to measure fuel in kilograms, while the rest of the fleet used pounds. With no flight engineer on the 767, the Board found that nobody had been clearly given the job of calculating the fuel load.
5. The wrong conversion factor, twice. With no gauges, the fuel was measured with a dripstick in litres and converted. The figure used was 1.77, the number of pounds in a litre, instead of about 0.8 kilograms per litre. The same error was repeated in Ottawa. The aircraft left each airport with about half the fuel the crew believed it had.

Any one of these, caught in time, would have stopped the chain. A working gauge, a spare part, a firm refusal under the equipment list, a clear owner for the calculation or a correct conversion factor would each have blocked the hole. The Board’s recommendations aimed at the slices as well as the people: one unit of measurement across the fleet, dripsticks reading directly in kilograms, independent checks of fuel loads, clear responsibility for fuel calculations and more spare fuel-gauge parts.

The same accident shows the model working in the other direction. The last defences held. Pearson was an experienced glider pilot, and Quintal had once trained at Gimli when it was an air force base. Their skill turned a fuel exhaustion into a landing everyone walked away from.

Worked example 2: Helios Airways Flight 522

On 14 August 2005, Helios Airways Flight 522, a Boeing 737-300 flying from Larnaca to Athens and Prague, never pressurised after take-off. The pilots lost consciousness from hypoxia, the aircraft flew on autopilot until its fuel ran out, and it crashed near Grammatiko, Greece, killing all 121 people on board. The final report by the Greek Air Accident Investigation and Aviation Safety Board (AAIASB) sets out the slices in its own words. See Helios Airways Flight 522: Inside the Ghost Plane Inquiry.

• Maintenance. After a pressurisation test during unscheduled overnight maintenance, the pressurisation mode selector was left in MAN (manual) instead of AUTO. The report lists this omission as a contributing factor.
• Three checks. The crew did not notice the selector position during the preflight procedure, the Before Start checklist or the After Takeoff checklist.
• A warning that sounded like another warning. As the cabin climbed through 10,000 feet a warning horn sounded. On the 737 the cabin altitude warning used the same horn as the take-off configuration warning, which pilots heard on the ground. The crew treated it as a configuration problem.
• Missed chances. The captain called the airline’s operations centre about the warning and a cooling light. The engineer asked about the pressurisation panel, but the call ended before the problem was found. Hypoxia was by then making clear thinking harder.
• Latent causes. The report names four: the operator’s deficiencies in organisation, quality management and safety culture, documented in numerous audits; the regulator’s inadequate oversight; inadequate application of crew resource management principles by the crew; and ineffective measures by the manufacturer after previous pressurisation incidents on the type.

Read as a Swiss cheese diagram, the selector was the hazard, the three checklist items were three slices with the same hole, the shared horn was a hole built into the design, and the latent causes explain why the holes were there. The fixes followed the same logic. Eleven days after the accident, the AAIASB recommended better crew training on telling the two warnings apart, and Boeing said it would revise its 737 training manuals in October 2005 to explain the two meanings of the horn.

Why “pilot error” is rarely the whole answer

People often ask whether most plane crashes are caused by pilot error. Human error is involved in most of them. An FAA research report from 2000 opens by noting that human error has been implicated in 70 to 80 percent of all civil and military aviation accidents. But the Swiss cheese model explains why “pilot error” is a starting point for an investigation, not the end of one.

A pilot’s mistake usually happens inside a system that made it more likely or failed to catch it: a confusing display, a rushed schedule, a training gap, a rule that was never enforced. Removing one pilot does not remove those holes. The next crew in the same situation may make the same mistake.

Aloha Airlines Flight 243 shows that the model applies far from the cockpit too. When about 18 feet of the upper fuselage tore away from the Boeing 737 in April 1988, the NTSB found the probable cause in the airline’s maintenance programme, which failed to detect disbonding and fatigue damage. It listed Aloha’s management, the FAA’s oversight and Boeing’s handling of earlier lap-joint problems as contributing. No one in the cockpit caused it, and the crew landed the aircraft.

This is why we tag events with causes such as pilot error only where the investigation found it, and why our event pages give the full probable cause, not just the label.

Criticisms of the model, and HFACS

The Swiss cheese picture is a metaphor, not a method. It shows that defences fail together, but on its own it does not tell an investigator which slices to look at, how to name a hole or how to compare one accident with another. Holes in real systems are also not fixed: they move and grow as people adapt to pressure.

To make the idea usable, researchers built classification systems on top of it. The best known in aviation is the Human Factors Analysis and Classification System (HFACS), described by Scott Shappell and Douglas Wiegmann in an FAA report published in February 2000 (DOT/FAA/AM-00/7). It sorts the causes of an accident into four levels that match Reason’s layers: unsafe acts, preconditions for unsafe acts, unsafe supervision and organisational influences. The FAA report says HFACS had already been used across military, commercial and general aviation to examine human causal factors.

How investigators use it today

You will rarely see the words “Swiss cheese” in a final report, but you will see the thinking.

• Greece’s AAIASB separated direct causes, latent causes and contributing factors on Helios 522.
• Canada’s TSB sorts its findings into findings as to causes and contributing factors, findings as to risk (weak points that did not cause this accident but could cause another) and other findings.
• The NTSB states a probable cause and then lists contributing factors, which often point at training, design or oversight.

All of them make safety recommendations aimed at the system, not only at the people involved. Our guides How Plane Crash Investigations Work and How to Read an Air Accident Final Report show where these findings sit in a report. For more examples of holes that start in the hangar, see Plane Crashes Caused by Maintenance Errors. For how airlines trained crews to catch each other’s mistakes, see What Changed After Tenerife.

Watch in the library

• Air Canada Flight 143: The Pounds-for-Kilograms Fuel Error
• Helios Airways 522: The Switch, the Horn and Andreas Prodromou
• Aloha Airlines Flight 243: Fatigue Cracks and the NTSB Inquiry

Every video on this subject is on the Pilot error page.

Sources

• James Reason, Human Error (Cambridge University Press, 1990) and Managing the Risks of Organizational Accidents (Ashgate, 1997). Books, cited as the origin of the model.
• FAA, DOT/FAA/AM-00/7, The Human Factors Analysis and Classification System (HFACS), February 2000.
• Board of Inquiry into Air Canada Flight 143, Final Report, April 1985.
• AAIASB report 11/2006, Helios Airways Flight 522.
• NTSB/AAR-89/03, Aloha Airlines Flight 243.
• TSB Canada A98H0003, Swissair Flight 111 (finding categories).