On the night of 1 July 2002, a single air traffic controller in Zurich was working two workstations. His colleague was resting next door, as the tolerated night-shift practice allowed. The telephone lines to the neighbouring centres were dead because of maintenance work, the ground-based optical conflict alert was switched off, and over Lake Constance the paths of a Tupolev bound for Barcelona and a DHL freighter bound for Brussels were about to cross. When the controller spotted the conflict, he instructed the Tupolev to descend. Seconds later, the TCAS collision warning system on board ordered the opposite: climb. The crew followed the controller. The freighter followed its TCAS and descended as well. At 23:35 the two aircraft collided at an altitude of more than ten kilometres. 71 people died.
That night became what may be the best-known slide in safety training: slices, holes, an arrow punching through. One controller alone, the alert silent, the phones dead, two cockpits with contradictory instructions: every gap finds its slice. Two years later James Reason sat in a workshop at Eurocontrol, the Swiss cheese analysis of Überlingen in front of him, and asked a question you would not expect from the model’s inventor: is the cheese past its sell-by date?
The Most Successful Image in Safety Science
Credit first where credit is due. When Reason developed the image in Human Error in 1990 and elaborated it in Managing the Risks of Organizational Accidents in 1997, the standard reading of an accident was the search for the single cause, usually a person at the end of the chain. Reason’s cheese slices turned that gaze around: an accident needs many contributors. Each slice is a layer of defence (technology, procedures, training, supervision), and none of them is solid. The holes are active failures at the sharp end and latent conditions that arise far away from it: in budget decisions, planning assumptions, maintenance windows. Only when the holes line up does an event punch through.
With this image you could explain to an executive board in thirty seconds why sacking the last person who touched the system buys no safety at all. It shifted attention from the individual to the organisation, from the question of guilt to the question of conditions. Few images appear as reliably in training courses, slide decks and investigation reports, across aviation, medicine, industry and energy. As an aside: the name is not Reason’s. The Swiss cheese was probably pinned on him by Rob Lee, then head of Australia’s air safety investigation bureau. Reason had drawn layered defences; the Swiss cheese turned them into a brand.
Four Holes, Neatly Named
Überlingen seems to confirm the model brilliantly. The slices can be recited: staffing (one controller for two workstations), technology (telephones and optical conflict alert under maintenance), the warning chain (the aural alert nobody heard), procedures (two training worlds with different answers to the question of whom to follow when in doubt: the controller or the TCAS). Four holes, neatly named, and each one produced a measure. The most important has applied worldwide since the accident: when instructions conflict, TCAS takes priority, always.
That very smoothness should make you suspicious. The cheese reading of Überlingen runs without friction; it delivers holes, slices and measures. And it still misses the essential thing about that night.
What the Cheese Slices Cannot Show
The essential thing is the moment two safety systems contradicted each other. The controller worked: he spotted the conflict and intervened. The TCAS worked: it spotted the conflict and intervened. Both barriers did what they were built to do, and together they sent two aircraft to the same altitude. That is no hole in a slice. A hole would be an absence of protection; here there was protection in surplus. Over Lake Constance two intact barriers collided, and for that occurrence the Swiss cheese has no language. In the picture, the slices stand mute side by side; they do not interact.
Over Lake Constance, holes did not simply line up. Two intact barriers collided – and for that, the Swiss cheese has no language.
There is a second problem: the image is a still. The holes of Überlingen had not been lying in wait for years; they opened and shifted that very evening. The maintenance work was planned and approved, the single-controller staffing a tolerated practice that had harmed nobody in a hundred nights before. Each of these conditions was normal on its own. Whoever draws the cheese draws the result of that movement and freezes it, as if it had been a state. Why the holes lined up on this night of all nights, what dynamic pushed them towards each other: the image cannot ask that question. It shows that an accident needs many contributors. How they arrange to meet, it does not tell.
The Inventor’s Doubt
The remarkable part is how clearly Reason saw this himself. In September 2004, a Eurocontrol workshop analysed the Überlingen case with Reason’s model, and Reason gave his own contribution the title “Is Swiss cheese past its sell-by date?”. The report that grew out of it notes drily: ironically, the only person seriously questioning the use of the model seemed to be Reason himself. In the same report he warned against the pendulum swinging too far: against the hunt for ever more remote latent conditions, until every budget decision from ten years back becomes an accident cause and nobody is responsible for anything any more.
James Reason died in February 2025, and since then the temptation to canonise the model for good has grown. That would be the wrong tribute. Throughout his life, Reason treated his image as what it was: a thinking aid with a scope of validity, not a law of nature. The Swiss cheese myth is therefore not the model itself. The myth is the use: a communication metaphor promoted to an analysis method. In that promotion the image tips over. “An accident has many contributors” turns into a checklist: name the holes, assign the slices, derive the measures, file the report. The slide that was meant to open a discussion about the organisation now closes it. Once every gap has found its slice, the analysis feels finished, and nobody misses the question about the dynamics behind it.
What Takes Its Place
Safety science answered these limits long ago. With FRAM, Erik Hollnagel built a method that looks at the everyday variability of functions rather than at slices and holes, and asks how normal fluctuations amplify each other into an event: resonance instead of a trajectory. Nancy Leveson’s STAMP models safety as a control problem, in which accidents emerge from a loss of control over interactions, including interactions between intact components. Both approaches have a language for what happened over Lake Constance. Both are more unwieldy than the Swiss cheese, and neither fits on a single slide. That is no coincidence: the catchiness of the cheese is precisely the property that disqualifies it as an analysis tool.
Which leaves the Swiss cheese with an honourable job. If you have five minutes to explain to a board why firing the controller would not have solved a single problem, you will not find a better image. As a door-opener into systems thinking, the slide is unbeatable. But once a door is open, you are supposed to walk through it. What that looks like in practice is next week’s topic: a book note on Hollnagel’s FRAM, the method that begins where the slices end.
The Swiss cheese shows that an accident needs many contributors. Why they arranged to meet over Lake Constance on a July night can only be told by those who put the cheese slices aside.
Sources
- James Reason – Human Error, Cambridge University Press 1990
- James Reason – Managing the Risks of Organizational Accidents, Ashgate 1997
- James Reason, Erik Hollnagel & Jean Pariès – Revisiting the ‘Swiss Cheese’ Model of Accidents, Eurocontrol EEC Note No. 13/06, 2006 (main source)
- Bundesstelle für Flugunfalluntersuchung – Investigation Report AX001-1-2/02, 2004 (Überlingen)
- Erik Hollnagel – FRAM: The Functional Resonance Analysis Method, Ashgate 2012
- Nancy Leveson – Engineering a Safer World, MIT Press 2011