Reason's Swiss cheese model of defence in depth: hazards only become accidents when holes in every safety barrier line up. Compliance drifts under production pressure and is restored by training, audits and patching.
Model and sources
This is James Reason's Swiss cheese model (BMJ 320, 2000): every defence layer has holes, and a hazard becomes an accident only when it finds a straight path through a hole in every layer. The red readout "open path now" is the exact fraction of hazard paths that are currently open in all layers, which is the probability that the next hazard gets through.
Compliance of each layer drifts down at a rate set by production pressure and is restored by training, in the spirit of Rasmussen's "migration toward the boundary of acceptable performance" (Safety Science 27, 1997). With no audits the equilibrium compliance of a layer is t / (t + d), drawn as the dashed line. Audits repair 60% of the holes in one layer at a time, and learning from accidents closes a share of all holes after each event. Rates and units are illustrative. The margin curve is −log10(risk)/6.