Start here: how to use this dashboard
- Describe the scenario below: name the hazard, pick the worst outcome that could credibly happen, say how often the hazard is met in a year, and set your own tolerable harm events per year.
- Work through the five layers of defence. Press One layer at a time if you want to be guided. For each layer enter how many checks you made and how many failed. A layer with no data is counted as always failing.
- Add evidence for your numbers, such as an audit, a near miss or a photo.
- Read the status box. It is deliberately cautious. If it says action needed, it means the evidence does not yet show the risk is under control.
- Press Save data file before you leave. Your entries live only in this browser.
Words used here
- Layer
- One defence between the hazard and harm, such as supervision or a guard.
- Hole
- A weakness in that defence. Active holes are unsafe acts in the moment. Latent holes are underlying causes that can lie dormant, such as poor design or too little time.
- Check
- Any time you looked at whether the layer worked: an audit, an inspection, a walk-round, a near miss review. A failed check is one where it did not work.
- Cautious estimate
- The pessimistic end of the likely range. With few checks the range is wide, so the cautious figure is high.
- Tolerable level
- The number of harm events a year your organisation would accept. You set it, the tool does not. Reducing risk as far as reasonably practicable (ALARP) still applies below it.
- Hierarchy of controls
- Eliminate, substitute, engineer, administrate, then PPE. Higher is stronger.
Choose severity from the worst outcome that could credibly happen, not the usual one. Set the tolerable level from your organisation's own risk criteria, the tool does not choose it for you.
Ownership, review and change log
Change log
Entries can be added but not edited or removed here. Record why you changed numbers, scores or controls.
The layers of defence
Aligned holes show the layers that failed on the rolled day. A solid layer stops the hazard.
How much does this rely on layers failing independently?
Layers often fail together, for example one supervision problem can weaken several layers. The first row assumes they never do, the last assumes the strongest layer is the only one that counts. The 50% row is a judgement setting used for the status, not a measured value. Figures quoted for engineered protection systems are much lower, but people and organisation layers share causes more often, so show a reviewer the whole range.
Events that make evidence out of date
An incident, near miss, process or layout change, failed test or worker concern can make older evidence unreliable. Log it here. Any layer whose latest evidence is dated before the event is flagged until you log newer evidence.
Run 1,000 days
Each day, every layer fails at random using the failure chance worked out from your data. Harm only occurs when all five fail together.
About the model
The Swiss cheese model was put forward by James T. Reason of the University of Manchester. Each defence is a slice of cheese. The holes are weaknesses that keep changing in size and position. Harm happens when the holes in every slice line up for a moment, giving what Reason called a trajectory of accident opportunity.
Active failures are unsafe acts directly linked to an accident, such as a navigation error. Latent failures are contributory factors that can lie dormant for days, weeks or months until they play a part. Use the Type of hole selector on each layer to record which you have found. Latent holes are usually the ones that need a system level fix rather than a reminder to an individual.
Where it is used: aviation safety, engineering, healthcare, emergency services and, in process safety, oil and gas drilling and production. It is also the idea behind defence in depth in IT security. In healthcare it supported the view that errors come from system flaws, not character flaws.
Before and after an event. Used before anything goes wrong, the model helps you find weak layers and make sure your controls overlap, so one hole is covered by a solid part of the next layer. Used after an incident or near miss, you trace which layers failed and why, then record that as evidence here. The same layers serve both uses, so a real event is the best data you can add.
Person approach and system approach. Reason contrasted blaming the people at the sharp end (forgetfulness, tiredness, poor motivation) with asking why the system let the error through. His view is that we cannot change the human condition but we can change the conditions under which people work. In this dashboard, a failed check is a hole in a layer to be fixed, not a person to blame. Blame stops people reporting the near misses that make your numbers honest.
More layers is not always safer. The "hot cheese" model (Li and Thimbleby, 2014) argues that defence layers are dynamic and active, and that adding defences can add hazards, for example a guard that gets in the way and is then bypassed, or a checklist that adds workload. Tick "This layer may create a new hazard" on any layer where that could be true. It raises a flag only, because the tool cannot size a hazard you have not described.
A further criticism is that a row of slices shows one straight path to harm. Real workplaces are interconnected, and harm can travel by routes nobody drew. The model is also strongest looking backwards at what caused a failure and weaker at predicting the next one, so keep a mindset of intelligent wariness and ask what else could go wrong. That is why the layers here are treated as partly linked and why unknown hazards are listed under what the tool cannot tell you.
The model is respected but has been criticised for being used too broadly and without enough support from other models. This dashboard adds a simple probability calculation on top of it, which Reason's model does not itself prescribe, so treat the figures as a way to prioritise and discuss, not as a prediction.
References
- Reason, J. (1990). The Contribution of Latent Human Failures to the Breakdown of Complex Systems. Philosophical Transactions of the Royal Society B, 327(1241), 475-484. doi:10.1098/rstb.1990.0090
- Reason, J. (1990). Human Error. Cambridge University Press.
- Larouzee, J. and Le Coze, J.-C. (2020). Good and bad reasons: The Swiss cheese model and its critics. Safety Science, 126, 104660. doi:10.1016/j.ssci.2020.104660
- Eurocontrol (2006). Revisiting the Swiss cheese model of accidents.
- Reliability Center (n.d.). Ultimate Guide to Swiss Cheese Model and Its Applications. Practitioner article from a training and software provider, not peer reviewed. Used only for the before and after use and the complexity criticism, which the sources above support.
- Reason, J. (2000). Human error: models and management. BMJ, 320(7237), 768-770. doi:10.1136/bmj.320.7237.768
- Li, Y. and Thimbleby, H. (2014). Hot cheese: a processed Swiss cheese model. Journal of the Royal College of Physicians of Edinburgh, 44(2). doi:10.4997/JRCPE.2014.205
- CCPS and Energy Institute (2018). Bow Ties in Risk Management: A Concept Book for Process Safety. AIChE and John Wiley and Sons.
How the numbers work and what it cannot tell you
Best estimate for a layer = (checks failed + 0.5) / (checks made + 1). This is a deliberately gentle figure and always sits beside the cautious one. Cautious estimate = the upper end of a two-sided 95% confidence interval (Wilson) for the same checks. Strictly that makes it a one-sided 97.5% bound, so it errs on the cautious side. A layer with few checks gets a wide, pessimistic figure: with no failures in 20 checks the best estimate is about 2.4% but the cautious figure is about 16%. The combined chance multiplies the layers together, which assumes they fail independently, so look at the linkage table as well.
Status compares harm events per year (times the hazard is met multiplied by the cautious chance, with layers 50% linked) against your own tolerable level. It also flags layers with no data, thin evidence (under 10 checks very weak, 10 to 29 weak, 30 to 59 moderate, 60 or more stronger), no evidence logged, evidence over 12 months old or dated before a logged event, announced checks, layers that share a cause, heavy reliance on procedures and PPE, no owner or reviewer, and a missing second reviewer for severity 4 or 5.
Settings that are this tool's own defaults, not from a standard: the 12 month evidence age, the check tiers, the 50% linkage, treating a layer with no data as always failing, and giving a control credit only from checks made after it went in. They are fixed in the tool. If your organisation's criteria differ, record that in the change log and do not rely on the status.
Count checks that could genuinely fail: unannounced or random checks, near misses and incident data. Counts from announced audits where people knew they were watched will understate failure. Use one consistent definition of a failed check for each layer. A control only earns credit once you enter checks made after it went in.
Not covered: hazards and failure modes nobody has thought of. Severity does not change the calculation, it only raises how much evidence you should demand. This tool supports a risk assessment and does not replace a suitable and sufficient assessment by a competent person, or your site's own procedures and legal duties.