A metaphor about defences
James Reason uses defensive layers containing openings to explain how an accident can pass through several weakened protections. Safety-critical barriers may be technical, human or organisational; their effectiveness should not be assumed merely because they appear in a procedure.
Within the metaphor, the openings are not fixed. They change as working conditions change. Coinciding weaknesses allow a hazard to reach people or assets, even where an individual weakness has not previously produced any visible adverse outcome.
Active failures and latent conditions
Active failures concern actions close to the event, such as errors or omissions during operations. Latent conditions may arise from design, resources, organisation or earlier decisions that encourage error or weaken an existing protective measure.
Distinguishing these levels helps prevent an investigation ending with the last person involved. HSE stresses that performance also depends on tasks and context, including workload, time pressure, communication, available equipment and other relevant conditions of work.
Uses in investigation and prevention
A review can start by identifying the barriers intended to prevent harm, the function of each and the evidence of its actual condition. It then examines how weaknesses developed and why they were not detected or corrected in time.
For example, two checks may appear independent while relying on the same incorrect information. Adding a signature without examining that dependency does not necessarily solve the problem. Improvement needs to address demonstrated conditions, with assigned responsibilities and subsequent verification that the changes work.
Limits of the representation
The drawing does not calculate probabilities or prove an accident’s cause. Nor does it require a fixed number of layers. It is a conceptual aid that must be supported by records, interviews and analysis of actual work.
Investigators should not force evidence into a predetermined diagram. Complex interactions, changes and contradictory information need explicit explanation when they matter. The aim is to strengthen effective controls and learn about the system, rather than create a simple image that hides important uncertainty. A useful report distinguishes established facts from plausible explanations and identifies what further evidence would resolve the remaining questions.
