Actualités

Professor James Reason’s 1990 book, “Human Error” first put forward the Swiss Cheese Model in relation to accident and incident causation and it has since become a commonly used model in risk analysis and risk management. 

John Ford, Technical Expert, UK

It compares human/machinery/management systems to multiple slices of Swiss Cheese, which has randomly placed and sized holes in each slice, stacked side by side, in which the risk of a threat becoming a reality is mitigated by the differing layers and types of defences which are "layered" behind each other, as illustrated in Figure 1. Therefore, in theory, lapses and weaknesses in one defence do not allow a risk to materialise (e.g. a hole in each slice in the stack aligning with holes in all other slices), since other defences (protections) also exist (e.g. other slices of cheese), to prevent a single point of failure.
The holes show the way in which the defences are not 100% reliable; some holes are due to latent conditions, some due to failures of the defences. Generally barriers are put in place in order to prevent overlapping of the holes to ensure that even if each defence is not 100% effective, the whole system is still safe. However under certain conditions, it may happen that the holes, i.e. the weaknesses of the defences, overlap causing the actual transformation of hazards into an accident.

Recently, I used the Swiss Cheese Model during an investigation of the electrocution of a construction site worker illustrated in Figure 2. During the course of his work, the worker was moving a metal framed portable lighting unit which had developed a “live” to “earth” fault during its transportation around the construction site. The worker was sadly electrocuted when he moved it for the final time. 

Figure 1: The Swiss Cheese Model (AI Generated)

The pictorial nature of the Swiss Cheese Model greatly assisted me, not only during my investigation, but also in explaining to the operators of the construction site, what “slices” (defences) they needed to introduce to prevent a reoccurrence of the fatal accident.

My investigation revealed that:

The worker who was electrocuted was not wearing insulated gloves or insulated footwear. I am of the opinion that because he was not an electrician he should not necessarily have been and the site rules did not require him to do so. However, if he had have been it would have been a “slice” of defence.

The protective earth conductor to the portable lighting unit was not complete between the portable generator and the portable lighting unit. The associated cabling consisted of three cables with the middle cable only being two core (i.e. “live” and “neutral” with no “earth” conductor). Without a complete protective earth conductor of the correct resistance from the supply point (portable generator) to the utilisation point (portable lighting unit), any fault current will tend to flow through anybody in contact with the faulty equipment back to the earthed star point of the secondary winding of the supply point’s transformer’s secondary winding.

The electrical circuit supplying the portable lighting unit was only protected with a moulded case circuit breaker (MCB) which is an overcurrent protection device. This circuit should have incorporated a residual current protection device (RCD). There are many factors that determine if an alternating current (A.C.) electric shock results in electrocution, but the worldwide accepted philosophy is to limit the current that the victim receives as well as the time that they receive it for. (It is well described in IEC 60479-1 - Effects of current on human beings and livestock. General aspects.) The probability is that if a person receives only a small electrical current for a short time period, they will survive. This is where earth leakage protection devices are used; sometimes referred to as residual current circuit breakers (RCCBs) or residual current breakers (RCBs) / residual current devices (RCDs). These are devices that measure the current on the live and neutral conductors. They use Kirchhoff's first law (the algebraic sum of currents in a network flowing to and from a node is zero; what flows in, normally flows out). If the currents are not equal, it suggests there is electrical current leakage to earth. If there is an earth fault and some of the current is flowing in the earth conductor (from either the live or neutral conductor), the RCD will operate and trip out (cut off) the power. It is important to note that earth leakage protection devices do not prevent electric shocks; they prevent electric shocks propagating into electrocutions by limiting the earth fault current to a relatively safe level for a relatively short period of time.

Figure 2: The three "slices" defences (AI Generated)

Ultimately, the Swiss Cheese Model demonstrates that serious incidents rarely stem from a single failure, but rather from a chain of overlooked weaknesses, reinforcing the importance of robust, layered defences to prevent hazards aligning and resulting in harm.

This article was originally written for issue 30 of the Diales Digest. You can view the publication here: https://www.diales.com/diales-digest-issue-30