The gaps in the defense arise for two reasons – active failures and latent conditions – occurring either singly or in diabolical combinations. They are devilish because, in some cases, the trajectory of accident liability needs only exist for a very short time, sometimes only a few seconds:
Active failures: these are unsafe acts – errors and/or procedural violations – on the part of those in direct contact with the system (‘sharp-enders’). They can create weaknesses in or among the protective layers.
Latent conditions: in earlier versions of the Swiss cheese model (SCM), these gaps were attributed to latent failures. But there need be no failure involved, though there often is. A condition is not necessarily a cause, but something whose presence is necessary for a cause to have an effect – like oxygen is a necessary condition for fire. However, an ignition source is the direct cause.
Designers, builders, maintainers, and managers unwittingly seed latent conditions into the system. These arise because it is impossible to foresee all possible event scenarios. Latent conditions act like resident pathogens that combine with local triggers to open up an event trajectory through the defenses so that hazards come into harmful contact with people, assets, or the environment. In order for this to happen, there needs to be a lining-up of the gaps and weaknesses creating a clear path through the defenses. Such line-ups are a defining feature of organizational accidents in which the contributing factors arise at many levels of the system – the workplace, the organization and the regulatory environment – and subsequently combine in often unforeseen and unforeseeable ways to allow the occurrence of an adverse event. In well-defended systems, such as commercial aircraft and nuclear power plants, such concatenations are very rare. This is not always the case in healthcare, where those in direct contact with patients are the last people to be able to thwart an accident sequence.
Latent conditions possess two important properties: first, their effects are usually longer lasting than those created by active failures; and, second, they are present within the system prior to an adverse event and can – in theory at least – be detected and repaired before they cause harm. As such, they represent a suitable target for safety management. But prior detection is no easy thing because it is very difficult to foresee all the subtle ways in which latent conditions can combine to produce an accident.
It is very rare for unsafe acts alone to cause such an accident – where this appears to be the case, there is almost always a systemic causal history. An obvious domain where unsafe acts might be the sole factor is healthcare – where the carer appears to be the last line of defence. Three healthcare case studies are among the 10 discussed below. In each, the unsafe actions of the immediate carers are shaped, even provoked, by systemic factors.
Organizational Accidents Revisited, James Reason, 1997
