Architecture & practice·Incidents and what happens after
there were four safeguards and the change slipped through a hole in each of them on the same afternoon.
Swiss cheese model
Also calledlayered defence model
A model of accident causation in which each defence is a slice with holes, and a failure occurs when the holes momentarily line up. It explains why serious incidents rarely have one cause and why removing one hole is still worthwhile even though others remain. It is the conceptual backing for defence in depth, and the reminder that a defence you never verify has holes you cannot see.