This is the Swiss Cheese Model of accident causation (James Reason, 1990), viewed here side-on in 2D. Each vertical bar is one independent line of defense — a procedure, a piece of equipment, a supervisor, a training standard — drawn as a wall with a few gaps in it. Every defense is imperfect, and a hazard (the small dots, travelling left to right) only turns into an accident if the gaps in every layer happen to line up at the exact height it arrives.
p_i = min(1, N_i · 2r_i / H) — gap coverage of layer i
P = ∏ p_i for i = 1..L — chance all L layers align
N_i is the gap count and r_i the gap half-height on layer i, H is the wall's usable height. The theoretical alignment probability above assumes the gaps are independent and is compared live against the measured breakthrough rate (breakthroughs ÷ attempts) as hazards keep arriving.
- Layers — more independent defenses shrink the alignment probability multiplicatively, even if each one is individually weak.
- Gaps per layer / Gap size — controls how porous a single defense is on its own.
- Drift speed — gaps slowly slide up and down each wall, modeling how latent weaknesses shift over time (staff turnover, changing conditions, wear). A gap that was covered a moment ago can open up later — the core insight of the model is that alignment is usually transient, not permanent.
- Hazard rate — how often a new hazard event is launched at the stack.
Cyan dots are hazards in flight, amber flashes are breakthroughs (accidents), and dim red flashes are hazards absorbed by a layer that had no gap in the right place (near-misses, caught by the system).