Two models from safety science show up in emergency management training, after-action reports and conference slides more than any others. One is James Reason’s Swiss cheese model and the other is Charles Perrow’s normal accident theory. Both are routinely misdescribed. The Swiss cheese model gets taught as a chain of events, and Perrow gets quoted as though he said accidents are inevitable in every system. This guide covers where each model came from and what each actually predicts. It reads both against the Piper Alpha disaster of 1988, sets out the serious criticisms of each, and shows how to use them at a working agency.

James Reason and the 1990 book: active failures and latent conditions

James Reason spent most of his career as a professor of psychology at the University of Manchester. Much of his research before the late 1980s concerned ordinary human error, meaning the slips and lapses people make in familiar tasks. His 1990 book Human Error, published by Cambridge University Press, pulled that work together. It separated slips and lapses, where the intention was sound but the execution went wrong, from mistakes, where the plan itself was wrong. That taxonomy is still in use. The part of the book that eventually reached emergency managers, though, was its later material on how errors combine inside large organizations to produce disasters, which drew on the major accidents of the 1980s, Chernobyl and the loss of Challenger among them.

The central distinction is between active failures and latent conditions. Active failures are the unsafe acts of people in direct contact with the system, such as the operator who opens the wrong valve or the pilot who misreads an instrument, and their effects tend to show up quickly. Latent conditions are created by people far from the event in both distance and time. Those people include designers, managers, procedure writers, trainers and regulators, and the conditions they create can sit in a system for years without causing harm. Reason’s early writing called these latent errors or latent failures. He later preferred the term latent conditions, because a design decision or a budget allocation is not necessarily an error at the moment someone makes it. He compared them to resident pathogens in the body, which do no damage until they combine with some other trigger.

Reason developed the organizational side further in Managing the Risks of Organizational Accidents in 1997. He brought it to clinicians in a 2000 article in the BMJ titled Human error: models and management. That article contrasts what he called the person approach, which looks for the individual at fault and treats error as carelessness or inattention, with the system approach, which assumes people will err and asks why the defenses did not catch the error. Aviation safety management and patient safety both adopted the system approach widely. Emergency management absorbed it largely second hand, through those two fields, which is part of why the model so often arrives at an agency as a slide with no source attached.

The Swiss cheese picture: moving holes and the chain-of-events misreading

The familiar diagram shows a hazard on one side, a loss on the other, and a stack of cheese slices between them. Each slice is a defense, such as an engineered safeguard, an alarm, a procedure, a supervisor’s check or a training standard. Ideally each slice would be solid, but in practice each one has holes. Active failures open some of them and latent conditions open others. Reason stressed that the holes are not fixed, because they open, close and shift position as conditions change. An accident happens when holes in every layer line up at the same moment, so that what Reason called a trajectory of accident opportunity passes straight through to a loss. The cheese image itself came after the 1990 book. Reason credited the engineer John Wreathall with contributing to the early layered diagrams, and Justin Larouzee and Jean-Christophe Le Coze traced how the picture evolved in a 2020 history published in the journal Safety Science.

The model makes several practical predictions. Most of the time defenses hold because the holes rarely line up, and that is why a system can run for years with serious latent weaknesses and no loss. When an accident does happen, investigators will usually find several weaknesses, and most of them will have existed before the day of the event. Because latent conditions are present in advance, they can in principle be found and closed before they line up, and that is the model’s main argument for proactive safety work. It follows that disciplining the person who committed the final active failure leaves every latent hole in place for the next trajectory.

The common misreading turns the model into a chain of events, in which one failure causes the next until the last link snaps. That chain picture is older than Reason. Herbert Heinrich’s 1931 book Industrial Accident Prevention used falling dominoes, each knocking down the next, and the domino idea keeps getting grafted onto Reason’s slices. In Reason’s model the holes in different slices generally do not cause each other. A fire pump left on manual control does not cause a gap in a permit system. The two can exist independently for months until some event needs both of them to work at once. What matters is coincidence in time among conditions that different people created separately, often years apart.

The difference changes how an investigation runs. A chain model invites the investigator to start at the loss and walk backward one link at a time, and the walk tends to stop at the first human act that looks like a mistake. A latent-condition model asks the investigator to list every defense that should have stopped the hazard, regardless of order, and to explain why each one had a hole at that moment. The second method finds holes the first one misses, including weaknesses that played no part in the sequence of events but would have stopped the accident if someone had closed them.

Charles Perrow and Three Mile Island: where normal accident theory came from

Charles Perrow was a sociologist of organizations, and he spent most of his later career at Yale. He did not set out to study accidents. By his own account in Normal Accidents, his interest began when he was asked to contribute an analysis connected with the presidential commission that investigated the Three Mile Island accident of March 1979. Much of the early public discussion of that accident centered on operator error. Perrow read the technical material and concluded that blaming the operators missed what was distinctive about the event. The site’s separate article on Three Mile Island covers the public advisories and the health myth, and this section concerns only what Perrow took from the plant sequence.

In the plant sequence, Perrow saw several failures that were each modest on their own. They interacted in ways nobody had designed for, and nobody in the control room could see clearly what was happening. A pilot-operated relief valve stuck open, and its indicator showed that the signal to close had been sent, without showing whether the valve had actually closed. An auxiliary feedwater path had valves that were closed when they should have been open. The operators were reading instruments that gave ambiguous or misleading information about a system whose parts were connected in ways they could not directly observe. Events moved faster than they could build an accurate picture. Perrow argued that the label operator error explained nothing useful, because the operators’ choices made sense given what they could see.

He expanded the argument into Normal Accidents: Living with High-Risk Technologies, published by Basic Books in 1984. The book ranges across nuclear power, petrochemical plants, aviation and air traffic control, marine shipping, dams and mines, space flight and nuclear weapons. It sorts these systems by two properties that Perrow believed determined whether a system was prone to a particular kind of accident. Princeton University Press issued a revised edition in 1999 with an afterword in which he responded to critics and extended the argument. He returned to the subject in The Next Catastrophe in 2007, which argued for reducing the concentration of hazardous materials, energy and population as a way to reduce vulnerability.

Interactive complexity and tight coupling: what Perrow actually predicted

The first property is interactive complexity. In a linear system, components interact in expected and visible sequences, so when something fails the effect is predictable and the operator can see it. In an interactively complex system, components serve more than one function and sit physically close to unrelated components. They share common connections such as a single power supply or cooling loop, and operators monitor them indirectly through instruments instead of observing them. Failures in such a system can interact in sequences nobody planned for, and the people running it may not be able to make sense of those sequences right away, even when they are skilled and alert.

The second property is coupling. A tightly coupled system has time-dependent processes that cannot wait, sequences that must happen in a fixed order and little slack in supplies or equipment. There is essentially one way to reach the goal, so a disturbance in one part spreads quickly into others. A loosely coupled system tolerates delay and allows substitution and improvisation, which gives people time to notice and fix problems before they spread. Perrow put these two properties on axes and placed systems in four quadrants. Nuclear power plants, nuclear weapons systems and space missions sat in the corner that is high on both. Most manufacturing sat in the opposite corner, linear and loosely coupled. Universities, which he described as complex but loosely coupled, sat in another.

The prediction applies to the corner that is high on both axes. In those systems, Perrow argued, unanticipated interactions of multiple failures will eventually occur however well the system is run. Designers cannot foresee every combination, and tight coupling denies operators the time to understand an unfamiliar sequence before it escalates. He called these system accidents or normal accidents and separated them from component failure accidents, in which one part fails in an expected way. He wrote plainly that system accidents are rare and that most accidents, even in high-risk industries, are component failures. The word normal refers to the character of the system, meaning that such accidents are an inherent property of systems built that way, and it makes no claim about how often they happen.

Two further predictions matter for emergency managers. The first is an organizational bind. Interactive complexity calls for decentralized authority, because the person closest to an unfamiliar failure has to improvise. Tight coupling calls for centralized control and rigid procedure, because there is no time to check anyone’s improvisation. A system high on both properties demands contradictory structures, and Perrow saw no reliable way to organize around that contradiction. The second prediction is that adding safety devices and redundancy to such a system can add complexity of its own, creating new interactions and new failure paths, so a fix intended to reduce risk can raise it.

Piper Alpha 1988 read through both models

Piper Alpha was an oil and gas production platform in the North Sea, operated by Occidental Petroleum, about 120 miles northeast of Aberdeen. On the night of July 6, 1988, a sequence of explosions and fires destroyed it. One hundred sixty-seven men died, and that total, which is not in dispute, includes two crew members of a fast rescue craft from a standby vessel. I had no part in any of this, and what follows comes from the published record, chiefly the report of the public inquiry chaired by Lord Cullen, published in 1990, and from accounts based on that report.

The inquiry found that earlier that day a pressure safety valve had been removed from one of two condensate injection pumps for maintenance, and a blank flange had been fitted in its place. The work was not finished when the day shift ended. That evening the other condensate pump tripped, and without a working pump production would have had to be cut. The night shift prepared to start the pump whose valve had been removed, because neither the permit-to-work system nor the shift handover had told them the valve was missing. When the pump started, condensate leaked from the flange and ignited. The explosion breached firewalls that had been designed to resist fire but not blast. The fires that followed were fed partly by oil and gas arriving by pipeline from other platforms, Tartan and Claymore among them, which kept producing for a period after Piper was burning. The rupture of the gas riser from Tartan produced an enormous fire. The control room was knocked out early, and with it went much of the platform’s ability to coordinate an evacuation. The inquiry also found that the diesel fire pumps had been set to manual control, a practice tied to diving operations, so they did not start automatically. Many of the men who gathered in the accommodation block to wait for direction died there.

Read through Reason’s model, the night shift’s decision to restart the pump was the active failure, and the people who made it were acting reasonably on the information in front of them. The latent conditions are what make the case useful for teaching. The inquiry describes several. A permit system and shift handover failed to carry critical information across a change of shift. Routine practice had disabled the automatic start of the fire pumps. The firewalls had been built for one hazard and not another. The emergency arrangements depended on a control room that the first explosion destroyed. The adjacent platforms lacked the information, or the clear authority, to stop sending hydrocarbons quickly. None of these weaknesses caused the others, and each existed independently before July 6, which is exactly the aligned-holes pattern the model describes.

Read through Perrow, Piper shows coupling in a form emergency managers will recognize. Production, gas compression and accommodation shared one structure in close proximity, and the pipeline network tied Piper to other platforms so that a fire on one fed on fuel arriving from the others. Whether Piper qualifies as a normal accident in Perrow’s strict sense is a separate question. I would argue that it mostly does not, because ordinary management could have known about and fixed nearly every hole the inquiry found. That disagreement shows how the two models differ in practice. Reason’s directs attention to preventable latent conditions, while Perrow’s directs it to properties of system design that management alone cannot remove. The inquiry led to a safety case regime for offshore installations in the United Kingdom and to the transfer of offshore safety regulation to the Health and Safety Executive.

Criticisms of the Swiss cheese model: linear, underspecified and prone to hindsight

The best-known criticism comes from Erik Hollnagel, who classifies accident models by the kind of causality they assume. In his scheme, Heinrich’s dominoes are a simple linear model. Reason’s cheese is a complex linear or epidemiological model, more sophisticated because it includes latent conditions but still built on a trajectory passing through layers. Hollnagel argues that in complex sociotechnical systems, accidents can emerge when normal variability in everyday performance combines in unexpected ways, without any layer being broken in the usual sense, and his Functional Resonance Analysis Method is built on that idea. Nancy Leveson at MIT made a related argument in Engineering a Safer World in 2011. She treats safety as a control problem in which accidents arise from inadequate control over interactions, and she developed the STAMP model as an alternative to layered barrier thinking.

A second criticism is that the model is underspecified. It does not say what a hole is or how to find one before an accident. It also gives no way to tell a hole that matters from one that does not, so investigators fill the slices with whatever categories they already favor. In 2006 Reason, Hollnagel and Jean Paries wrote a note for the Eurocontrol Experimental Centre that revisited the model. As I read it, the note treats the model as a heuristic for explaining organizational accidents rather than a detailed account of how they unfold, and anyone citing it should read the original note. Formal schemes have tried to supply the missing detail. The best known is the Human Factors Analysis and Classification System, which Scott Shappell and Douglas Wiegmann developed for U.S. naval aviation and which turned Reason’s layers into a classification of failure types.

A third criticism concerns independence and hindsight. The picture implies separate layers with separate holes. A single budget decision or staffing shortfall, though, can open holes in several layers at once, which makes the defenses less independent than the drawing suggests. Sidney Dekker has written extensively about hindsight bias in accident investigation, which is the tendency to see, after the fact, a clear path that was invisible to the people involved at the time. Holes that look obvious once someone has lined them up on a diagram are especially vulnerable to that bias. Larouzee and Le Coze’s 2020 review is a useful counterweight. It argues that many criticisms target a simplified version of the model rather than what Reason actually wrote, and that the model’s value as a shared vocabulary across industries is real even where its analytical power is limited.

Criticisms of normal accident theory: high reliability research, Sagan and Hopkins

The main challenge to Perrow came from researchers at the University of California, Berkeley, among them Todd La Porte, Karlene Roberts and Gene Rochlin. They studied organizations that ran complex, tightly coupled operations with very few accidents, including aircraft carrier flight decks and air traffic control. Their high reliability organization research argued that such organizations achieve safety through features Perrow had discounted. These include continuous training and redundancy of people as well as equipment. They also include a willingness to let decision authority shift to whoever has the relevant expertise during a fast-moving event, and a constant preoccupation with the possibility of failure. Karl Weick and Kathleen Sutcliffe later carried the approach to general audiences in their book Managing the Unexpected.

Scott Sagan’s The Limits of Safety, published by Princeton University Press in 1993, tested the two schools against each other. He used the record of U.S. nuclear weapons command and control during the Cold War, including incidents during the Cuban missile crisis. Sagan concluded that the evidence fit normal accident theory better. He documented more close calls than the official safety record suggested, along with cases in which redundant safeguards created new risks. High reliability researchers have disputed parts of his reading, and the debate between the two schools has never been formally settled. I find it more useful to read them as describing different parts of the same problem than to pick a winner, since one explains why some systems keep failing and the other explains how some organizations keep the failure rate low anyway.

The Australian sociologist Andrew Hopkins came at Perrow from another direction. His 1999 paper in Safety Science, The limits of normal accident theory, argued that very few major accidents fit Perrow’s definition and that the theory distracts from the management failures behind most of them. Hopkins applied that view in Lessons from Longford, his book on the 1998 Esso gas plant explosion at Longford, Victoria. The explosion killed two workers and cut off much of the state’s gas supply for well over a week. The process upset at Longford involved interacting failures that could be described in Perrow’s terms. Hopkins argued, though, that the hazard of extreme cold in the plant’s equipment was knowable and that the operators had not been trained to recognize it, which made Longford a preventable organizational failure. Other critics have noted that complexity and coupling are hard to measure, so Perrow’s placement of systems in the quadrants rests on judgment, and that the theory offers front-line operators little they can act on.

Both models at a working agency: reviews, radio systems and the comm center

The most direct use of Reason’s model is in after-action and near-miss reviews. A review built on it lists every defense that should have stopped the problem, such as the procedure, the training standard, the supervisory check, the alarm or the backup equipment. For each defense it asks whether there was a hole that day and whether that hole was already there before the day began. Each hole then gets an owner and a date for closing it. A finding of human error or failure to follow procedure is where that analysis starts rather than where it ends, because the next question is why the procedure was not followed, and the answer usually lies in workload, training, design or staffing. A review whose corrective actions are all retraining or counseling for the people on duty has almost certainly stopped at the active failures.

Perrow’s model is most useful where systems are tightly coupled. In emergency communications, the systems that come closest are the shared infrastructure ones. A trunked radio system in which many sites depend on a single core and a shared backhaul network has the properties he described, since a fault in a common component can affect every site at once, faster than a technician can diagnose it. Designers loosen that coupling deliberately with modes such as site trunking and failsoft, which let individual sites keep working in a degraded way after they lose the core. Those modes only help if users know what their radios will do in them. Redundant controllers with automatic failover reduce one risk but add complexity of exactly the kind Perrow warned about, because failover logic has failure modes of its own and rarely gets exercised. When I review a design, the first question I ask about automatic failover is when it was last tested under realistic conditions and who holds the record of that test.

The same lens applies to a communications center. CAD, radio consoles, alerting, phone systems and mapping are increasingly integrated, which raises interactive complexity, and a dispatch floor during a major incident has very little slack in time. Paper run cards, a manual alerting procedure, a printed list of unit assignments and a known console fallback reduce coupling in Perrow’s sense. They give the floor a way to keep working at reduced speed while the automated systems are restored. An EOC, by contrast, is usually loosely coupled, with hours rather than seconds between decisions. Its failures are therefore more often the preventable latent kind Reason describes, such as a contact list nobody has tested or a plan nobody has read.

What to do at your agency

• Have the person who leads after-action reviews pull the last three completed reports and mark every finding that names human error, failure to follow procedure or an individual as the cause. That person should then bring one revised report, listing the latent conditions behind such a finding, to the next scheduled staff meeting.
• Have the radio system administrator write a one-page list of the components whose failure would affect more than one site, such as the core, the backhaul links and the timing source. The list should include a plain description of what field radios do in site trunking or failsoft, and it should go to the training officer by the end of the month.
• Have the radio system administrator ask the system vendor or maintenance contractor for the date and written result of the last controller failover test. If no record exists, the administrator should schedule a test in the next planned maintenance window.
• Have the communications center supervisor run one thirty-minute drill on each shift this month in which dispatchers work a simulated call load from paper run cards with CAD treated as down. The supervisor should log how long it took to dispatch the first calls.
• Have the emergency management coordinator add one paragraph to the communications annex of the existing emergency operations plan. The paragraph should name the manual fallback for each automated alerting path, who performs it, and where the printed contact list is kept.
• Have the training officer review every slide deck in the agency’s library that uses the Swiss cheese diagram, correct any that present it as a chain of events, and add that correction to the instructor notes.
• Have the safety officer add one question to the existing near-miss reporting form asking whether the condition that allowed the near miss existed before that day.

Takeaways

• James Reason’s Swiss cheese model grew out of his 1990 book Human Error, and it separates active failures by front-line people from latent conditions created earlier by designers, managers, trainers and regulators.
• The model describes holes in separate layers of defense that happen to line up at one moment, which is a different idea from a chain of events in which each failure causes the next.
• Charles Perrow’s normal accident theory came out of his analysis of Three Mile Island, and he set it out in his 1984 book Normal Accidents.
• Perrow’s prediction applies only to systems that are both interactively complex and tightly coupled, and he described most accidents as preventable component failures, so citing him to claim accidents are inevitable everywhere misstates the theory.
• Piper Alpha in 1988, which killed 167 men, illustrates both aligned latent conditions and coupling across connected platforms, as documented in the Cullen inquiry report of 1990.
• Hollnagel, Leveson and Dekker criticize the Swiss cheese model as too linear and too loosely specified to guide analysis, while Larouzee and Le Coze argue that many critics attack a simplified version of it.
• High reliability researchers, Scott Sagan and Andrew Hopkins challenged normal accident theory from different directions, and the debate among them has not been settled.
• Neither model is an investigation method, so an agency should use them to frame questions and rely on a real after-action process to answer those questions.