Swiss Cheese Model – Aviation Safety
There are many reasons for accidents in aviation. Accidents don’t usually happen for a single cause – rather, there is generally a chain of errors with some of the causes apparent and some not easily identifiable. The Swiss cheese model is a scientific principle used when evaluating risks in various fields. These fields includes engineering, healthcare, emergency service organizations, cybersecurity and aviation safety.
Introduced by Dante Orlandella and James T. Reason from Manchester University in the early 1990s. The Swiss cheese model of accident causation is used to investigate the causes of complex accidents.
Slices of Swiss Cheese
The model is named after Swiss cheese because it compares complex human systems to several slices of Swiss cheese piled up together, reducing the severity of every threat to it by its different layers and individual defenses which are layered one after another.
According to the model, holes and shortcomings in one layer of defense are not the single cause of an accident, since there are other layers supporting it and although each layer may have imperfections, having multiple defenses against a risk can help lower the risk of accidents in the end.
Many aviation authorities such as International Civil Aviation Organization accept the Swiss cheese model, which proposes that there is not just a single cause of any given accident and threats materialize as a result of cumulative effects and many layers of defenses failing to deal with it.
When it comes to accidents in aviation, the company, technical staff, air traffic controllers, pilots, the pilot’s personal life and physical health, the decisions made by authorities, rules and regulations in place and the various underlying reasons should be discussed collectively in an organized manner to get to the root of the issue and understand the real causes of the incident.
In the Swiss cheese model of accident causation various layers and many imperfections on these layers are defined. At the end of the day, the overlapping of these imperfections cause threats to materialize and accidents to happen. The Swiss cheese model is widely accepted and it is also known as the “cumulative act effect”.
Layers Of Defenses And Weaknesses
The Swiss cheese model aims to help us understand many causes of accidents that are not readily apparent. With this model we can create better systems to deal with threats. According to the theory, separate parts of a system have their unique defense mechanisms and when there is an accident, it is basically because all the weaknesses in each layer of the system align and cause failures.
Normally, each layer of defense should support each other and prevent such failures but when there is an alignment of holes due to errors within all layers of the system, the “accident trajectory” is permitted to pass through the system’s defenses and we end up with undesirable consequences.
Four Layers of Failure
In the context of aviation, the cause of most accidents can be traced back to one of the four layers of failure and these are;
- • Organizational influences. The airline or flight club may have been applying cost-cutting policies that in the end would create a weakness in this layer. Proper regulation by authorities is key to making sure that such practices are swiftly dealt with.
- • Improper and insufficient supervision or training. Just like any industry, proper training and supervision has vital importance in aviation. Providing sufficient training for future pilots and making sure that they get high-quality supervision is one way to ensure that there are no holes in this layer.
- • Preconditions for unsafe acts. Any system where people are involved there will be factors such as fatigue, stress, lack of concentration and these can cause errors in this layer. So it is crucial for pilots to develop strategies to deal with such issues as well as for airline companies to keep a track of pilots’ mental and physical health.
- • The unsafe acts themselves. This is by far the most important layer, which is the way that the actual problem is dealt with and errors regarding this process.
Each of these layers creates a risk for the whole system and when weaknesses in all of the layers align, we end up with a hazardous situation. For example, imagine there is an improperly trained and stressed out pilot who is working for a poorly organized company and combine that with seriously bad weather; it is very easy to say that what we have here is a disaster waiting to happen.
An Imaginary Example of Appliance of The Swiss Cheese Model
The best way to understand a theory is to see it in action. So let’s consider an imaginary disaster and try to understand the Swiss cheese model with a hypothetical example.
Think about two planes colliding on the runway due to a wrong instruction from an air traffic controller working in the control tower at the airport (of course, the reasons for the events may not be so clear and precise). The apparent reason is quite obvious at the first glance. The controller must have given an incorrect instruction that in turn caused the accident. However, when we examine the incident in detail, we can learn that perhaps the controller worked long hours due to lack of personnel and therefore his decision-making ability had been weakened. And when we investigate the reason for the ATC staff shortage, we may find out that the company does not employ enough personnel because of financial concerns. As we examine this attitude of the company, we may also see that the company behaves in this way, perhaps because of insufficient auditing and due to rules of the airspace authority.
Latent conditions
Beyond the apparent causes, there may be many latent conditions that have caused the accident. In this example, there are errors in all four layers of defenses which ended up causing the accident.
As you can understand from this example, the problems experienced in all layers cause accidents. If the airspace authority had set stricter rules and conducted proper controls, perhaps the chain of errors would have ended in that layer without ever passing to the next one. The Swiss cheese model proposes to approach complex events in this way and to handle them in a holistic manner compared to seeing only apparent causes of problems and trying to deal with symptoms instead of real causes.
How Do Authorities Apply Swiss Cheese Model On A Real Incident?
In this section, we will analyze an airplane crash with the Swiss Cheese model, and apply this model to understand the underlying reasons.
The crash we will talk about today is Lion Air Flight 610, which was a regular domestic passenger flight operated by Lion Air from Soekarno-Hatta International Airport in Jakarta to Depati Amir Airport in Pangkal Pinang on October 29, 2018.
According to the Contributing Variables section of the incident report of Flight 610 put together by KNKT, we can see that there are nine factors listed in chronological sequence. These factors begin at the certification stage, but the defenses that should have kept 189 people safe were breached by the faulty sensor repair process, the maintenance procedure for installing it, poor maintenance practices at Lion Air, poor Crew Resource Management, and possibly inadequate training for the captain and first officer.
The recognized defenses in this instance are: flight crew responsiveness, sensor reliability, flight crew training, sensor fault information, proper component repair, appropriate maintenance, knowledge of the aircraft problem history, and crew resource management. These match the Contributing Factors listed in the accident report quite closely, however someone else may have identified them differently.
It’s notable that the first four defenses were mostly overcome by certification-related acts, but the following four defenses were largely the result of other actors. Therefore, bad certification created the issue, but poor maintenance, CRM, communication, and fixes all contributed to the issue growing and eventually leading to the accident.
It’s also important to remember that the previous trip, LNI043, which took place on October 28th, also took place after the installation of the defective sensor, and despite having major issues, managed to land safely. The last line of defense in that situation may have just about succeeded.
How Swiss Cheese Model Helps Us Prevent Accidents
Of course it is valuable to think about theoretical concepts and play around with ideas to figure out what is actually going on behind the scenes. But at the end of the day, when determining the true value of a model, the most important thing to do is to consider the practical applications of the model and ask ourselves how this theory is helping us deal with problems.
The Swiss cheese model of accident causation can teach us valuable lessons about how we look at problems and solutions. And it can also help us prevent future problems by developing strategies to create more robust systems.
The most important idea that we should understand is that most failures are not caused by one major shortcoming. They can be the cumulative result of several different errors happening simultaneously. And the best way to defend against hazardous situations is to diversify the layers of defense against risks.
We should try to look at potential accidents from many different angles and make sure to do everything in our power to prevent them. For example, if the weather is bad, the flight should be delayed, the training to become a pilot should always be high quality and companies should be regulated closely to prevent dangerous strategies that might result in a catastrophe.
Finally, we must remember that in order to fix any problem, we have to first discover the underlying causes.
For Fatigue in aviation click.
Resources
Anon. (n.d.), Swiss cheese model, Wikipedia, Retrieved April 8 2021
< https://en.wikipedia.org/wiki/Swiss_cheese_model >
SKYbrary Editor (25 May 2016), James Reason HF Model, SKYbrary, Retrieved April 8 2021
< https://www.skybrary.aero/index.php/James_Reason_HF_Model >
Thank you for this article! It is so incredible helpful and thorough.