he designed the first SCM, Wreathall chose a representation of superimposed plates.
These plates evokes defense in depth’s levels of protection. Reason then explains
each plate’s failure using his taxonomy and understanding of organizational accidents. The Swiss cheese nickname and representation is late. Still it’s rooted in the
first graphical choice. Wreathall’s contribution overtakes engineering understanding
of a system: it carries the defense in depth thinking.
Defense in depth is clearly mentioned in an early SCM version ([3, p. 208];
Fig. 2a).
2 It incorporates an accidental trajectory of accident opportunity which
provides information on respective contributions of the psychologist and the
engineer. On the left hand, the white plates represent the organizational (managerial
level) and human failures (unsafe acts): contribution of the psychologist. On the
right hand, gray plates represent defense in depth as a block (set of defenses
ensuring the system’s integrity): it’s the engineer contribution. Human variability
may confuse the engineer (which partly explains the historical human error
understanding of accidents). On the other hand, technical and organizational sides
of safety often confuse academic researchers. In the SCM, disciplines collaboration
is used to display the complex interactions between humans and technology and
therefore, emergent properties of system’s security (Fig. 2b). Finally, the differences in graphical complexity between the theoretical and empirical models are to
be noted. In the next section, we will argue that the success of the SCM also lies in
the choice to simplify the drawing in a heuristics release.
3.4 SCM Evolutions
Reason and Wreathall kept working together and using the SCM within Wreathall
& Co’s reports. A little after 1993 Wreathall suggests replacing “latent error”
(referring to organizational failures) by “latent conditions”. This change acknowledges the fact that efficient decision at a given time may have negative outcomes at
another time or place in the system but these decisions may not be wrong at the time
—they are just made under uncertainty. In addition to these semantic changes, SCM
graphically evolves (over 4 times in the 1990s). Its use reached many sectors such
as energy or transportation [11]. During 1990s, Rob Lee, director of the Australian
Bureau of Air Safety Investigation, suggested representing gaped barriers as Swiss
(Footnote 1 continued)
(arrangement of barriers and defensive lines according to structured objective regarding the
potential event’s gravity).
2
If the original version labels defense in depth (Fig. 2a), the 1993 French translation (by an
academic) changes the label for «défenses en série» (serial defenses). Loss of sense due to field
sensitivities’ manifestation.
Human Error and Defense in Depth …
263
These plates evokes defense in depth’s levels of protection. Reason then explains
each plate’s failure using his taxonomy and understanding of organizational accidents. The Swiss cheese nickname and representation is late. Still it’s rooted in the
first graphical choice. Wreathall’s contribution overtakes engineering understanding
of a system: it carries the defense in depth thinking.
Defense in depth is clearly mentioned in an early SCM version ([3, p. 208];
Fig. 2a).
2 It incorporates an accidental trajectory of accident opportunity which
provides information on respective contributions of the psychologist and the
engineer. On the left hand, the white plates represent the organizational (managerial
level) and human failures (unsafe acts): contribution of the psychologist. On the
right hand, gray plates represent defense in depth as a block (set of defenses
ensuring the system’s integrity): it’s the engineer contribution. Human variability
may confuse the engineer (which partly explains the historical human error
understanding of accidents). On the other hand, technical and organizational sides
of safety often confuse academic researchers. In the SCM, disciplines collaboration
is used to display the complex interactions between humans and technology and
therefore, emergent properties of system’s security (Fig. 2b). Finally, the differences in graphical complexity between the theoretical and empirical models are to
be noted. In the next section, we will argue that the success of the SCM also lies in
the choice to simplify the drawing in a heuristics release.
3.4 SCM Evolutions
Reason and Wreathall kept working together and using the SCM within Wreathall
& Co’s reports. A little after 1993 Wreathall suggests replacing “latent error”
(referring to organizational failures) by “latent conditions”. This change acknowledges the fact that efficient decision at a given time may have negative outcomes at
another time or place in the system but these decisions may not be wrong at the time
—they are just made under uncertainty. In addition to these semantic changes, SCM
graphically evolves (over 4 times in the 1990s). Its use reached many sectors such
as energy or transportation [11]. During 1990s, Rob Lee, director of the Australian
Bureau of Air Safety Investigation, suggested representing gaped barriers as Swiss
(Footnote 1 continued)
(arrangement of barriers and defensive lines according to structured objective regarding the
potential event’s gravity).
2
If the original version labels defense in depth (Fig. 2a), the 1993 French translation (by an
academic) changes the label for «défenses en série» (serial defenses). Loss of sense due to field
sensitivities’ manifestation.
Human Error and Defense in Depth …
263