James Reason's classic Swiss cheese model is a vivid and memorable way to visualise how patient harm happens only when all system defences fail. Although Reason's model has been criticised for its simplicity and static portrait of complex systems, its use has been growing, largely because of the direct clarity of its simple and memorable metaphor. A more general, more flexible and equally memorable model of accident causation in complex systems is needed. We present the hot cheese model, which is more realistic, particularly in portraying defence layers as dynamic and active -more defences may cause more hazards. The hot cheese model, being more flexible, encourages deeper discussion of incidents than the simpler Swiss cheese model permits.
KeywORDS education, human error, incident causation model
DeClARATION Of INTeReSTS
THe ORIGINAl SwISS CHeeSe MODelThe SCM has been an extraordinarily good education tool. In formal use, it has been considered useful because of its clarifying role in accident investigation and because it can help identify potential hazards (e.g. missing defences) before harm happens. Notably, instead of focusing blame or investigative efforts on the person who apparently committed the active failure that caused an incident -for example, a nurse who administrated an overdose to a patient -the SCM encourages investigators to view such actions just as one unsafe act in a chain of many, rather than the only cause.The SCM helps us understand active failures and latent conditions (Figure 1). Active failures are generally committed by persons who perform their duty at the so-called sharp end 7 of the system (visualised to the left in Figure 1). Latent conditions are the potential contributing factors that lie dormant in the system and occur upstream at the more remote layers, called the blunt end.7 These latent conditions can be organisational, contextual and diffuse in nature, or they may be designrelated, to do with the system that people work in. Their consequences only become evident when they combine with other factors to breach system defences.Here is an example. Administering the wrong drug is an active failure, but the latent condition might have been the confusingly similar names of two different drugs. In the SCM, both types of failure are represented the same way, as holes in defences. In particular, the SCM gains power by not differentiating between the 'sharp end' failures and the 'blunt end' failures. A hole is a hole, and it does not matter where it is; if an incident occurs, every defence failed, and seeking the root cause is misleading. Thus the SCM helps stop us focusing just on the sharp end active failures, such as the 'nurse pressing the wrong button'. This insight is nicely captured in the slogan 'system flaws, not character flaws'. 8 The SCM makes it clear that blame cannot be placed on problems involving just one slice of cheese; indeed, it would be a system design flaw to rely on only one defence for any critical process.Anything from poorly designed policy, untimel...