Swiss cheese and causal chains: why single causes mislead

01A walkway and a chain of decisions

The Hyatt Regency walkway collapse is often summarized by one detail: the hanger rods were changed. That summary is partly correct, but it leaves out much of the chain. A connection with inadequate capacity, a construction change that essentially doubled the load on it, and people standing on the walkways all had to meet.

The National Bureau of Standards report describes both the changed arrangement and the inadequacy of the original design. The changed arrangement essentially doubled the load on the fourth-floor connections, and the original connection design was also found inadequate.

Each link answers a different question. Why did the connection carry that load? Why was its capacity insufficient? Why was the change not caught? A causal chain is useful because it keeps these questions separate.

02Layers with holes

James Reason's model describes accidents in complex systems as passing through layers of defense, such as design rules, procedures, alarms, supervision and the people who operate the system. Each layer is imperfect. Reason distinguished active failures, which are immediate errors at the interface with the system, from latent conditions, which are weaknesses created earlier by design, organization or management decisions.

The image is a stack of slices with holes. Usually the holes are closed off by the next layer. An accident occurs when the holes in successive layers happen to line up, so that a hazard passes through every barrier. The model makes an accident look less like a single broken part and more like the alignment of several weaknesses.

The model is a heuristic, not a formula. It helps organize an investigation, but it does not measure how many holes exist or how likely they are to align. Its main value is to direct attention to the latent conditions that persist between incidents.

The model also explains why investigators look for latent conditions across incidents. Many active failures repeat in different forms because the same latent conditions persist. Fixing the single error that triggered one event leaves those conditions in place for the next.

03Apollo 13: a chain across the design and ground history

The Apollo 13 oxygen-tank failure is a long chain. The tank's heaters and their switches were adapted for 65-volt ground power, but the thermostatic switches were rated for 28 volts and were not upgraded. A ground procedure later ran the heaters for an extended period to boil off oxygen. The switches were probably damaged, and the temperature inside the tank could rise without showing on its gauges.

In flight, the investigation connected damaged wiring insulation with a short inside oxygen tank 2 when the tank's fans were operated. Each link depended on the one before it, and no single link explains the whole event.

The chain also crosses organizations: requirements, ground equipment, test procedures and flight operations. An analysis that stopped at the crew's actions would miss the layers that set the stage.

04Blackout: layers that failed in sequence

The August 2003 blackout involved several layers: vegetation management along transmission corridors, situational awareness among system operators, monitoring and alarm functions, and reliability coordination. The final report groups its causes around these categories rather than around one component.

Tree contacts removed lines from service. Monitoring and alarm failures reduced operators' picture of the grid. The redistributed flows then pushed other paths beyond safe limits. Each layer was a partial defense, and none was the whole explanation.

The conclusion that the event was preventable is a claim about the layers together. A single fix to alarms would not have addressed tree contacts, and a single vegetation program would not have restored operators' awareness.

05Columbia's barriers

The Columbia loss also had layers: a foam strike during launch, a breach in the wing's thermal protection, hot gas entering the wing during re-entry, and an organizational process that treated earlier survival as reassurance. The Columbia board treated the organizational causes as necessary parts of the explanation.

This is why a purely technical account is incomplete. The breach explains how the orbiter was lost. The decision process explains why the recurring risk had not been reopened. Both are links in the chain.

The layered view also avoids a common trap, which is blaming only the last link. The situation at re-entry was the result of earlier barriers that had failed to stop the hazard.

06Building a causal chain

Start from the harm and work backward. For each step, ask what had to be true for the step to happen. Keep each link as a claim with its evidence, so the chain can be checked and revised.

Mark each barrier. For each one, ask whether it was absent, bypassed, degraded or failed under the conditions that actually existed. Then ask why the barrier failed, repeating the question at each level until you reach a condition that persisted or a decision that was made.

Fault-tree and event-tree methods formalize this reasoning. They are most useful when they make alternative branches visible, rather than producing one tidy sequence that hides them.

Each barrier should also be checked for dependence. Two barriers that rely on the same operator, sensor or procedure may not be independent, and the chain should record that dependence rather than counting them as separate protection.

07The limits of the model

Layered models can invite a different oversimplification: treating each defense as independent when the layers share operators, procedures, budgets or information. That is the same weakness that common-mode analysis examines.

Hindsight also distorts the picture. Once the holes have lined up, the path looks inevitable. Before the event, the same holes may have been invisible or considered acceptable.

The open question for each system is which holes are known and which are not. A useful investigation keeps the unknown holes on the list, rather than closing the chain with the most convenient cause.

A clean causal chain is a product of the investigation, not a property of the accident itself. Different investigators may draw the links differently, and a good report makes its chosen links explicit so that others can contest them.