Flight 4U 9525 and the dynamic Swiss cheese model

The Swiss cheese model

James Reason's Swiss cheese model explains how successive layers of defences can be breached, or weaknesses can line up, in order for an incident to occur.

The traditional depiction of the model is of a static succession of slices of cheese. In this model, closing one of the holes in the sequence prevents the incident.

A better way of visualising the concept is by thinking of a dynamic Swiss cheese model (see video). The weaknesses are not static and closing one weakness may cause another to open elsewhere in the same (or another) "slice".

Flight 4U 9525

The exact circumstances of the crash of the Germanwings Airbus 320 on the 24th of March 2015 have yet to be established. However it seems likely that the co-pilot intentionally flew the plane into the ground. The captain had probably left the flight deck to use the toilet and was then locked out of the cockpit by his first officer.

Post-9/11 cockpit doors

After the 9/11 terrorist attacks, cockpit doors were reinforced in order to prevent forced access. In terms of the Swiss cheese model, this weakness was therefore reduced. Crew could still access the cockpit if the pilot had become incapacitated by entering a keypad code. However, if the pilot was not incapacitated he or she could override the keypad system. Therefore a terrorist in possession of the code could still be prevented from getting into the cockpit.

The dynamic Swiss cheese model

The closing of the weakness in the structural/system layers allowing terrorists access to the cockpit opened a weakness in the set of circumstances where someone may want to access the cockpit for legitimate reasons against the flight crew's wishes. After the loss of Malaysia Airlines flight MH370, Popular Mechanics wrote a prescient article in March 2014 asking "Could Plane Cockpits Be Too Secure? Should pilots be allowed to lock themselves in the cockpit?" After the crash of Flight 4U 9525, in an attempt to close this new weakness, many airlines are now requiring the presence of two crew members on the flight deck at all times. It is unclear what new weaknesses this policy will create.

Lessons for the rest of us

Measures put in place in response to an incident will almost inevitably increase the risk of other, unforeseen incidents occurring. Time spent carrying out analyses and simulations of possible side-effects of the "fix" may allow us to minimise these new weaknesses.