Hammurabi
Back to the codex

33

Safety

Swiss Cheese Model

Layered Defense and Aligned Holes.

The article

If

Every protective layer (review, test, alert, runbook, rollback) has holes. Accidents happen when holes across multiple independent layers happen to align. No single layer can ever be perfect, so resilience comes from layers that fail in independent ways.

Then

“During an incident review, do not stop at "the one thing that failed." Enumerate every layer that should have caught the failure and ask why each hole was open at exactly that moment. The fix is rarely a single layer; it's plugging the cheapest two.”

Unless

Defense in Depth / Independent Controls / Hole-Audit at Post-Mortem

Four defensive layers, each with holes; an incident happens where the holes line upReviewTestsAlertingRollbackHazardIncidentthe usual case — one layer has no hole here
Every layer has holes, and the holes move. The incident is not the failure of one layer — it is the moment four independent holes happen to align. Which is why the fix is rarely the layer that failed last.

Source

James Reason, Human Error (Cambridge University Press, 1990).

Go to the source

See also

Improve this article on GitHub