Hugh Carson Summary of the
Swiss Cheese Model of Accident
Posted on theysaid 7/26/03 in response to ML
"What's more, I am very tired of reading fatality reports that
place tactical blame for the folks on the ground. The responsibility on
most fatality fires lies not with the on the ground folks who may have made
mistakes, but with the agency administrators and fire managers who to
this day are still not following a policy that all the heads of our agencies
signed in 1995 then reviewed and updated in 2001. All fatality fires
have undoubtedly had elements of mistakes from the folks on the ground, but
we must look at the root cause...why were they there in the first
I was landscaping my yard this afternoon and ML's comment kept bugging me.
Mainly because every time we have a fatality (and I've lost over 40 friends
and acquaintances in this business since 1985), that same question of "Are
we just going to see another largely useless recitation of the 10 and 18"
comes up each and every time.
I couldn't agree with ML more. And the cause of this situation - at least
in part - are the accident investigations themselves. There was a reason
the National Transportation Safety Board (NTSB) became a party to all
DOI/USFS aircraft accidents (other than their expertise, us investigating
ourselves is indeed "the fox watching the henhouse.")
It would seem the same (an outside and hopefully objective, disinterested
party) should also hold true for ground accidents.
The key here is that these investigations should (must) be conducted by
professional accident investigators - a team well-versed not only in the
technical aspects of wildland fire (which is usually true) but also - and in
most cases even more importantly - highly knowledgeable of the human factors
aspect (which is usually not true).
That is not to say that the Salmon Investigation Team lacks these skills:
George Jackson of MDTC stands out as highly experienced (unfortunately) in
accident investigation. But where are the Human Factors experts who can
answer the questions that go beyond the violation of the 10 and 18?
There is a solution. Go to
The Human Factors Analysis and Classification System–HFACS (pdf
The Human Factors Analysis and Classification
System- HFACS article. Yes,
it's lengthy, yes, it takes 2-3 readings to truly understand - but it is
the key to more effective accident investigations, and even more importantly,
reading it and thinking about yourself and your decision-making may save
your life one day.
The HFACS is based upon James Reason's work using the "Swiss
cheese" Model of Accident Causation.
Those of you who have taken "Fireline Leadership" (FL) during
the 2002-2003 training season will (hopefully) remember this model.
I have the honor and pleasure of being part of the Fireline Leadership
contracted cadre that teaches this course. DISCLAIMER: the views in this
post are mine and mine alone and do not reflect those of Mission-Centered
Solutions, the FL course contractor. It is an honor and a pleasure because
I believe this single course is largely responsible for many of the positive
changes in attitude, awareness, and culture that have occurred in the last 5
years. But of course I'm prejudiced, so take that with a grain of salt.
Bear with me while we go through a synopsis of "Accident Causation 101."
The Swiss Cheese model postulates 4 layers of "Swiss Cheese"
by which one
can trace back to the root causes of an accident:
- Unsafe Acts;
- Preconditions for Unsafe Acts;
- Unsafe Supervision; and
- Organizational Influences.
Think of these 4 slices on a cutting board,
randomly placed on top of each other. It is rare that the holes in all four
slices would line up in a random placement so that, staring down, you could
see through 4 holes in the Swiss Cheese to the cutting board. But when the
holes do line up, an accident is only a matter of time (and luck). You
may "get away" with it 999 times out of a 1,000, or even 9999 out
of 10,000, but that accident is waiting to happen.
Slice #1: Unsafe Acts: These relate to those involved at the scene
of the accident (including the victims), and these acts may consist of
Errors involve Perceptual, Decision, and Skill-Based Errors.
One of the
major mistakes of any organization is to NOT recognize that error is in
fact an unavoidable part of the human condition and that there is NO way to
avoid humans making errors. Especially in a high-risk, high-tempo operation
such as wildland firefighting.
Companies tried to not only reduce error but in fact get rid of it in
the 80's with the philosophy of a "zero-defect culture." The
results of the
zero-defect culture were disastrous: all folks did when they committed
an error was hide it (fearing punishment and/or loss of job), leaving the
error uncorrected. These errors "simmered away" along with many
and uncorrected errors - until the situation resulted in an accident.
The key preventive measure is to "trap the error" (i.e.,
identify it through
an open process of incident reporting with no adverse consequences to
the reporter of the error, and use it as a learning tool). The firefighting
agencies engaged in the "zero-defect mentality" big-time after
And I'm not so sure that they as organizations still do not take that
Willful violations of policy and procedures, however, are another sort
of duck. Violations should never be tolerated. However, in the case of
wildfire, wildfire policy itself is either so confusing, or it is not
being conveyed adequately to the ground firefighter, or it is not being
enforced by supervisors or management (I believe this is your point, ML). If
policy is not explained properly or the explanation is confusing because the
policy is confusing, then we've placed the firefighter in a classic Catch-22
Slice #2 Preconditions for Unsafe Acts: This slice involves
- Substandard Practices.
Slice #2 Preconditions for Unsafe Acts: Substandard Conditions: These
are defined as Adverse Physiological States, Physical/Mental Limitations,
and Adverse Mental States.
Slice #2 Preconditions for Unsafe Acts: Substandard Practices are
Personal Readiness and Crew Resource
Only time will tell if any of these are brought out in the Cramer
Fire/Salmon Helitack fatality investigation.
It is interesting to note that, in the 30-Mile fire investigation, the
Swiss cheese Model was used to some extent (see charts and discussion in
that report on rest cycles, fatigue, etc). This was primarily due to the
involvement in the 30-Mile investigation of Tony Kern (Asst Director,
Aviation, USFS) who is committed to HFACs/Swiss Cheese as a means of
identifying root causes that are not immediately obvious. However, lest
you assume I felt the 30-Mile Investigation Report was a good example of a
complete application of Swiss cheese, don't. The 30-Mile Report ignored
a very obvious - at least to me and others - Organizational Influence
#4) root cause of 30-Mile. More on this below.
The 3rd slice of cheese involves Unsafe Supervision, and it has 4
- Inadequate Supervision;
- Planned Inappropriate
Failure To Correct A Known Problem, and
- Supervisory Violations.
a real laundry list under each of these but you might see some that ring a
Slice # 3 Unsafe Supervision: Inadequate Supervision: Supervisory failure to
provide guidance, operational doctrine, oversight, and/or training or to
track qualifications and/or performance.
Slice # 3 Unsafe Supervision: Planned Inappropriate Operations: Supervisory
failure to provide correct data, adequate briefing time; improper
[staffing]; mission not in accordance with rules/regulations; provided
inadequate opportunity for crew rest
Slice # 3 Unsafe Supervision: Failure To Correct A Known Problem:
Supervisory failure to correct document in error; failure to identify
at-risk [firefighter] or report unsafe tendencies; failure to initiate
Slice # 3 Unsafe Supervision: Supervisory Violations: Supervisor authorized
unnecessary hazard; Supervisor failed to enforce rules/regulations;
Supervisor authorized unqualified crew
But again, on Slice #3, let's wait until the accident report is issued and
we hopefully have all the facts before we pass judgment on this slice.
And now to the 4th slice: Organizational Influences. Examining this slice
intensively (and honestly) can be the key to getting away from the
"the victims violated 8 of the 10 Fireline Orders and 14 of the 18
Situations were present and ignored." NOTE: Before the NTSB adopted
HFACS, it was always "Pilot Error." Now if you look at their
investigations, you will see HFACS and Swiss Cheese at work.
We know from the past that there is a fair probability that a number
of violations will usually be the case in a wildfire fatality investigation,
and we should accept those conclusions as a valid application of Slice #1
(Errors and Violations). But now let's get down to brass tacks and find out
what's really wrong. I too am absolutely sick of hearing that litany,
because it only goes so far, and does not present solutions to anything of
consequence. It also avoids advocating any pressing need to effect real
change in the organization. In case you haven't figured it out by now (it
took me "only" 27 years of my career to figure it out!!),
change is anathema
to a bureaucracy. So it takes some real visionaries to adopt HFACS and apply
it honestly and with integrity, regardless of the results or conclusions.
Unfortunately, when one looks at Slice #4, one skates on some pretty thin
ice: agency turf, sacred cow programs, resistance to change, lack of
understanding and knowledge by upper management .... you name it, you are
there when you go looking around at Slice #4.
Organizational Influences consist of
- Resource/ Acquisition Management,
Organizational Climate, and
- Organizational Process.
It is important to
understand that an "Organizational Influence" can be an
influence at the local unit, Regional, National, or interagency Level.
Again, there's a laundry list under each of these sub-slices:
Slice #4: Organizational Influences:
Resources (selection of personnel, staffing/ manning, training);
- Monetary/ Budget (excessive cost-cutting, lack of funding);
- Equipment/ Facilities (poor design, purchase of unsuitable equipment)
Slice #4: Organizational Influences: Organizational Climate:
(chain-of-command, delegation of authority, communication, formal
accountability for actions);
- Policies (hiring/firing; promotion,
- Culture (norms and rules, values and beliefs, organizational
Slice #4: Organizational Influences: Organizational Process:
(operational tempo, time pressure, production quotas, incentives,
measurement/ appraisal, schedules, deficient planning);
(standards, clearly-defined objectives, documentation, instructions);
- Oversight: Risk Management and Safety Programs
Whew!! We're done with Accident Causation 101. But I do encourage you to
download the full HFACs article and read it. Once again:
The Human Factors Analysis and Classification System–HFACS
Adopting HFACS is the ONLY way that I can see that we are going to hold both
the accident investigation teams and the agencies accountable for (1)
determining both the obvious causes but more importantly, the deeper and
much more serious root causes of accidents; and (2) taking meaningful
corrective action. Until they/we do this, these accidents will continue
occur. And no amount of Manuals, Handbooks, and Guides (of which I wrote
"just a few" during my career), as well as Mitigation Measures,
are going to change that. It's that simple.
One caution: the Swiss Cheese model is not meant to deflect the basic,
ultimate responsibility that we all have as firefighters: to maintain
situation awareness (SA) and to make good decisions based upon that
awareness and through sound application of risk management principles.
And those that don't do this sometimes suffer the ultimate consequence, and
unfortunately should and will bear that responsibility.
And let's be honest - at times all of us don't always achieve that goal
good decisions based upon high SA - I know I don't as an Air Ops Director,
but I try my damndest all the time - but later, when I recognize that I
didn't have high SA and made a "less-than-optimal (read
it was just plain luck that the dragon didn't jump out and bite me.
There are deeper root causes to these accidents. In some ways, the 30-Mile
investigation was a start at the application of HFACS and Swiss Cheese.
As an example, the emphasis on looking at preconditions of the crews and
But in my mind, it missed the big organizational influence, that of the
quality of the NWCG training (the "S" courses). The most cogent
and emotionally hard-hitting comment by one of the parents of a firefighter who
perished at 30-Mile was "to give kids new to firefighting a 40-hour
lecture and then put them on the fireline on a fire like 30-Mile is
........" This father's comment is paraphrased and I am unsure
whether he said it was "wrong," or "criminal," or
whatever, but in my mind
he hit the nail on the head.
I spent the last 3 years of my career (1997-2000) at NIFC Training, and I'd
guess 80-90% of the "S" courses are pure classroom lecture, though
maybe a few courses have a few exercises thrown in, but the value of these
is in some cases questionable. There are some notable exceptions to the S
coursework, but they are rare. This is not to say those who work in NWCG
are not intelligent, hard-working individuals. They are. It is a direct
result of the training philosophy and the training approach: more
numbers-oriented ("courses developed/revised and on the
shelf") than quality oriented.
Enough said on that - I could write a book on that subject (and did help
write a 10-page White Paper on a solution - a submission that was completely
ignored by the NWCG Training Working Team). Maybe someone might want to
resurrect that - on the other hand, it advocates a real sea change in
training, so maybe not.
So what's the problem with the "S" courses? I would suggest that
the NWCG Training Working Team just ask any firefighter who has been through
the S100-300 level courses. As I was teaching around the country last year,
I did ask that question on occasion and the answers were blunt and
frequently obscene. I don't ask the question any more. NWCG, they are your
customer, and they are not happy with the majority of what they are being
provided: content, quality of instruction, lack of simulation, the list is
Specifically, it is a very basic training principle that in order to
truly learn - and by this I mean incorporating learning into your subconscious
where it can be called up instantaneously when the chips are down,
you've got to do it as well as hear it.
It's basic: you should train like you fight. The corollary is of course
that you will fight like you've been trained. And if you're training is
ineffective and you have not incorporated it into your subconscious,
your response in real life will be equally ineffective .... and possibly
fatal to you and others.
Bottom line: until the "S" courses are revised to incorporate
true simulation to support classroom learning, we will continue to have
accidents and fatalities.
To end this lengthy missive - and to get back to the Cramer Fire
I have several questions to which I feel we all need and should respectfully
request (demand?) answers:
- Is anyone on the Cramer Fire Accident Investigation knowledgeable of
HFACS and the Swiss Cheese Model of Accident Causation?
- If so, will the accident investigation team utilize HFACS and the
Cheese Model of Accident Causation as their primary investigatory tool?
- If not, why not?
Thanks all for wading through this. Any comments would be appreciated.
-please e-mail a copy of your comment to
Hopefully this type of discussion will lead to some real change rather than
just another bunch of bandages applied to what I see as a dysfunctional and
severely wounded patient - the wildland fire community.
Stay safe. The dragon is real angry this season.