# Safety layers can fail together even when each one usually works

> Several checks can make a system safer, but the way their failures interact matters more than the number of checks on paper.

Published 2026-11-08

Canonical: https://machines-on-machines.anth.us/posts/reason-swiss-cheese-safety-layers/

One warning may be missed. A second check may use the same faulty information as the first. A third may be unavailable during a busy shift. In a 2000 paper, James Reason illustrated how defects in several safety layers can line up using slices of Swiss cheese.

::image{
  src="assets/reason-swiss-cheese-safety-layers/reason-swiss-cheese-safety-layers.png" srcDark="assets/reason-swiss-cheese-safety-layers/reason-swiss-cheese-safety-layers.dark.png"
  layout="inline"
  alt="One hazard passes through a gap in each of three safeguards. The aligned gaps give the hazard a route to cause harm."
  caption="In Reason’s model, weaknesses across several safeguards can line up and let a hazard reach the people or systems the safeguards protect."
  credit="Drafted by AI. Approved by Ryan. Source: James Reason, Human error: models and management, BMJ, 2000."
}

Reason distinguished immediate mistakes from conditions that make them easier to commit or harder to catch. The latter can include poor design, lack of training or pressures that leave people little room to check their work. A failure investigation that starts and ends with the person closest to the harm can miss those conditions.

For an AI system, the analogy suggests a way to examine a safety plan. An automated check, a human review and a way to undo an action can each help. Their protection depends on whether they can catch different failures in the conditions where the system actually runs.

[Read the source](https://www.bmj.com/content/320/7237/768).
<!-- papyrus-source-version: 3 -->