Accidents occur when latent weaknesses in successive layers of defence momentarily line up.
Reason's 1990 model, and the practical consequence is that the holes move: each layer's weaknesses shift, so an alignment that was impossible last month becomes possible this month.
In practice
- A patient gets the wrong dose because the prescriber was rushed, the label was ambiguous, the checking nurse was covering two wards, and the alert had been switched off in March.
- A firm that audits each control separately and never tests them together has not tested the model the controls belong to.
- Further reading
- Wikipedia
- Subject
- Risk & Reliability
- Essay
- How accidents actually happen