The Swiss Cheese Model: A Simple Tool to Understand Complex Failures
As we entered the second week of 2024, Munich found itself in a cold embrace, with temperatures plunging below zero. This icy chill combined with snow mirrored the conditions of early December 2023, when a severe snow blizzard brought the city to a standstill, disrupting daily life in myriad ways. However, despite similar temperatures, the second week of January passed without major incidents, in stark contrast to the early December chaos. What accounted for these vastly different outcomes?
In the case of Munich, the December blizzard was not merely a product of low temperatures but an extreme weather event marked by a record-breaking snowfall of approximately 44 centimeters – the most substantial since 1933, when snow measurements began. This unprecedented event paralyzed the city, causing widespread disruptions: airports closed, train services halted, events canceled, and numerous incidents reported. The absence of such extreme conditions in January explains the stark difference in outcomes. Yet, the question remains: why did Munich, accustomed to snowy winters, succumb to chaos in December?
To unravel this mystery, we turn to the Swiss cheese model. At first glance, comparing a snowstorm in Munich to slices of Swiss cheese might seem peculiar. However, this analogy holds the key to understanding how complex systems and organizations, and even the most prepared systems, can falter under certain conditions when multiple layers of protection fail simultaneously.
The Swiss cheese model, developed by James T. Reason, a professor of psychology who studied human error and accident causation, explains how accidents and disasters happen due to the alignment of multiple factors and failures in different layers of a system or organization. These layers can be technical, procedural, human, or organizational. Each layer has some inherent weaknesses, similar to the holes in the slices of Swiss cheese. Typically, these weaknesses (or holes in the stack of the Swiss cheese) do not align, and the system can function safely and effectively. However, due to a combination of factors, the holes can occasionally line up, creating a trajectory of accident opportunity, allowing hazards to pass through and cause disruption or disaster.
Through the lens of the Swiss cheese model, we will now dissect the cascade of events and factors that culminated in December’s turmoil, offering insights into the delicate balance that keeps a city running smoothly.
Imagine four layers of Swiss cheese slices stacked atop one another. Now, envision each layer as a different facet of Munich’s protection mechanism against unexpected weather events.
Layer 1 – Organizational preparedness: The city’s ability to anticipate and respond to emergencies, including weather forecasts, early warning systems, and readiness for extreme conditions.
- Despite Level 2 and 3 snowfall warnings, actual conditions deteriorated beyond predictions, triggering a series of events and straining the city’s emergency response.
Layer 2 – Technical infrastructure: The physical systems that form the backbone of the city’s functionality – its transportation, power supply, and communication networks.
- The airport, moving 87,000 people daily, and the central train station, handling 450,000 commuters, were forced to shut down. The suspension of trams and S-Bahn services, along with the cancellation of numerous bus routes due to traffic jams and icy roads, shifted the entire burden onto the U-Bahn services and private vehicles. This resulted in unprecedented traffic congestion, with jams stretching for 28 km and nearly 100 other significant jams across Bavaria. Additionally, the power supply was compromised in some areas as downed trees caused widespread outages, leaving many residents without electricity and further compounding the crisis.
Layer 3 – Civil protection: The emergency services and plans designed to protect the city’s inhabitants and facilitate recovery.
- Munich’s emergency services, usually adept at managing typical weather events, were stretched thin by the blizzard’s severity. Prioritizing major routes for clearing, they responded to over 350+ snow and ice-related incidents, showcasing the challenges faced by emergency personnel during extreme conditions.
Layer 4 – Public system: The public’s awareness and behavior in the face of impending disasters.
- A lack of public awareness and preparedness exacerbated the blizzard’s impact. The absence of emergency apps like NINA on many phones created a communication gap, leaving residents more vulnerable to the storm’s effects.
As these layers and their inherent weaknesses aligned, they created a trajectory of accident opportunity, potentially amplifying the snowstorm’s impact. This model serves as both a diagnostic tool for understanding past incidents and a guide for strengthening future responses, providing valuable lessons about safety and resilience. The key takeaways are:
- Accidents and disasters are not caused by a single factor or failure but by a combination of multiple factors and failures, necessitating a systemic approach to improve protection layers.
- Accidents and disasters are not predictable or preventable but manageable and recoverable, highlighting the need for preparedness and adaptability.
- Accidents and disasters are not isolated or individual but interconnected and collective, underscoring the importance of cooperation and shared resources.
Have you ever encountered a situation where the Swiss cheese model could explain the complexity and failure of a system or organization?
Did you know?
- The Swiss cheese model is not the only metaphor that has been used to describe accident causation. Other models include the domino theory, the bow-tie model, the barrier analysis, and the accident iceberg.
- The lowest-ever temperature recorded in Munich was -31.6 °C on February 12, 1929. In comparison, the temperature during the blizzard in December 2023 was around -10 °C.
