Flight 4U 9525 and the dynamic Swiss cheese model

The Swiss cheese model

James Reason's Swiss cheese model explains how successive layers of defences can be breached, or weaknesses can line up, in order for an incident to occur.

The traditional depiction of the model is of a static succession of slices of cheese. In this model, closing one of the holes in the sequence prevents the incident.

A better way of visualising the concept is by thinking of a dynamic Swiss cheese model (see video). The weaknesses are not static and closing one weakness may cause another to open elsewhere in the same (or another) "slice".

Flight 4U 9525

The exact circumstances of the crash of the Germanwings Airbus 320 on the 24th of March 2015 have yet to be established. However it seems likely that the co-pilot intentionally flew the plane into the ground. The captain had probably left the flight deck to use the toilet and was then locked out of the cockpit by his first officer.

Post-9/11 cockpit doors

After the 9/11 terrorist attacks, cockpit doors were reinforced in order to prevent forced access. In terms of the Swiss cheese model, this weakness was therefore reduced. Crew could still access the cockpit if the pilot had become incapacitated by entering a keypad code. However, if the pilot was not incapacitated he or she could override the keypad system. Therefore a terrorist in possession of the code could still be prevented from getting into the cockpit.

The dynamic Swiss cheese model

The closing of the weakness in the structural/system layers allowing terrorists access to the cockpit opened a weakness in the set of circumstances where someone may want to access the cockpit for legitimate reasons against the flight crew's wishes. After the loss of Malaysia Airlines flight MH370, Popular Mechanics wrote a prescient article in March 2014 asking "Could Plane Cockpits Be Too Secure? Should pilots be allowed to lock themselves in the cockpit?" After the crash of Flight 4U 9525, in an attempt to close this new weakness, many airlines are now requiring the presence of two crew members on the flight deck at all times. It is unclear what new weaknesses this policy will create.

Lessons for the rest of us

Measures put in place in response to an incident will almost inevitably increase the risk of other, unforeseen incidents occurring. Time spent carrying out analyses and simulations of possible side-effects of the "fix" may allow us to minimise these new weaknesses.

Book of the Month: Being Mortal (Illness, Medicine and What Matters in the End) by Atul Gawande (Reviewed by Kirsten Walthall @K_Walthall)

About the author

Atul Gawande is a general and endocrine surgeon based at the the Brigham and Women’s Hospital in Boston, USA. Gawande is also a staff writer for The New Yorker magazine and the author of four best-selling books. His latest work, published in late 2014, is titled “Being Mortal: Illness, Medicine and What Matters in the End”.

Who should read this book?

Everyone – healthcare providers, patients and the lay public. Although several issues are highlighted through a case series of patients with medical problems, the book does not focus on the ins and outs of medical matters, such as the specifics of treatments. Gawande’s easy style of writing makes this book accessible to all. 

In summary

This book explores the concept of mortality and the impact that modern day medicine has had on it.

Using a series of cases, Gawande discusses the experiences of several people as they grow old, some with life-limiting diseases and others who simply become frail. He looks at the struggle to retain independence and autonomy; how care systems often try to provide support in a regimented way. Gawande discusses the concept of  “assisted living”, which helps people to continue to live the lives that they have lived. Furthermore, Gawande explores the belief of healthcare professionals that they have failed when a patient dies. Many find it difficult to accept that medicine cannot fix everything, and therefore may give poor information to their patients about what they realistically expect medical management to accomplish. Gawande discusses the importance of having those hard conversations with patients to find out what matters most to each individual so that therapy and care can be tailored to them. He argues that what we should be striving for is maintaining quality of life until death, rather than just prolonging life itself.

What’s good about this book?

Gawande uses #whatmattersmost on Twitter

The use of case studies and personal experiences to explore the issues involved in growing old and dying engage the reader. Gawande’s writing style makes “Being Mortal” very easy to read despite the potentially heavy subject matter. Mortality was not well covered in my undergraduate training – indeed it was barely touched upon – and I suspect that this is the same across the board in undergraduate medical education. This impression is supported by a study by Bowden et al (2013) who found that Foundation Year doctors expressed a lack of readiness to deliver end of life support and care.  “Being Mortal” really makes the reader think about the latter stages of life and the importance of preserving what matters most to each individual. It gives the reader an understanding of mortality that, for the healthcare professional, will benefit her patients and, for the individual, will benefit her, her relatives and her friends.

 

What’s bad about this book?

This is not a quick read book. It is very thought-provoking and encourages discussion - you will need time to read, absorb and think about its contents.

Final thoughts

This is by far the most inspirational and thought provoking book I have read – a must-read for anyone involved in patient care.

Reference

Bowden, J., Dempsey, K., Boyd. K., Fallon. M. and Murray. S.A. (2013) Are newly qualified doctors prepared to provide supportive and end-of-life care? A survey of Foundation Year 1 doctors and consultants, Journal of the Royal College of Physicians of Edinburgh. 43 pp.24-28 [Online] Available at: http://www.rcpe.ac.uk/sites/default/files/bowden.pdf (Accessed: 02 March 2015)

A view from the ivory tower (by M Moneypenny)

Background

On the 21st of February 2015 there was a brief Twitter exchange between Mark Forrest (@Obidoc) and others regarding the benefits of in situ "applied" simulation versus simulation centres. Although the 140 character limit on Twitter ensures thoughts are distilled, at times this can be difficult to lay out an argument. (The benefits and drawbacks listed below are by no means exhaustive.)

The benefits of in situ

The positives of in situ are manifold. By definition, the participants are in the actual environment (in the resus department, on the ward, at the roadside, under a train) which increases environmental fidelity. They are using their own equipment, guided by their own protocols. One can carry out systems testing and, if the simulation is realistic enough, performance approaches actual performance in real life.

The drawbacks of in situ

If the exercise is taking place in the actual environment there is disruption to the rest of the workplace. This can be minimised by good preparation and planning. Because of this disruption, the number of in-hospital in situ exercises is limited.

For those who extol the realism of in situ, running a simulation in a field or country lane is very different from running a simulation on a busy (and aren't they all nowadays?) hospital ward. The pre-hospital in situ equivalent would be running a simulation alongside a major motorway with a lane closed off.

When is in situ not in situ?

The Uaill Scottish Fire & Rescue Service Training Centre in Glasgow, has its own section of motorway and train track. The fire service runs multi-agency mass casualty simulations here. But the centre, and others like it across the UK, cost millions to build. Is this in situ sim?

Our home, but darn it! Why does it have to be a white tower?

The benefits of sim centres

The sim centre's sole function is as a place where simulation exercises take place. Sim centre personnel are dedicated to certain roles e.g. administrative, technical. Because the sim centre's focus is simulation the faculty are often involved in research and the development of other simulation-based medical educators.

The sim centre can be modified to replicate a "generic" ICU, ward, theatre or resus. The sim centre can accommodate hundreds of undergraduates and other trainees every year which would not be possible on a hospital ward.

The drawbacks of sim centres

Building a sim centre is expensive, although if it is built as part of a new hospital this lessens the expense. If a sim centre solely uses mannequins it is limited by what it can replicate and the "generic" ward or ICU means that it is not actually any ward or ICU. Sim centres may become silos if they don't make and sustain links with other stakeholders such as patient representatives, pre-hospital organisations and higher education institutions.

Final thoughts

A straw man(ikin)

The ivory-towered sim temple which sucks up millions of pounds and doesn't do "real simulation, which takes planning and hard work" is a straw man, which no-one would support. The reality is very different, no-one is throwing millions of pounds at us, with every penny justified and accounted for. Sim centres carry out exercises in the centre and in situ, the SCSC^HF has been in the back of ambulances, in hospital wards, in ICU and paediatric resus. We haven't (yet) been out in a field or at the side of the road, primarily because we feel that colleagues (in the fire service, ambulance service, BASICS) already occupy this niche and do a fantastic job. We use the appropriate technique based on the learning objectives of the learners, this may be high technical fidelity mannequins, part-task trainers, iPad-based sim "monitors" or a cardboard box with a 2-litre reservoir bag inside. 

In conclusion, rather than adopting an "us versus them" attitude, the poor in situ practitioners in the trenches throwing mud at the rich, work-shy inhabitants of the ivory towered temples of simulation, I would suggest an approach which involves communication and cooperation.

Sisyphus and the recurrence of errors

In their book "Managing Maintenance Error: A practical guide" Reason and Hobbs inform us that most errors are predictable:

"...more than half of the human factors incidents in maintenance are recognised as having occurred before, often many times" (p.98)

In healthcare, a similar pattern emerges. For example, a nasogastric tube is wrongly placed into a patient's lungs and the liquid feed is started. In England and Wales, from 2005-2011 twenty-one people died as result of this error. The commonest drug error in obstetric anaesthesia is mistaking thiopentone for an antibiotic and vice-versa. In the UK, there was at least one incident in 2010, two in 2011,  and one in 2012.

These are examples of error traps. In the seascape of human performance, error traps act as whirlpools, seizing the inexperienced, the tired and the distracted. James Reason tells us that the defence against error traps is organisational. In anaesthesia, the Safe Anaesthesia Liaison Group (SALG) publishes patient safety updates which detail adverse incidents and provide suggestions for avoidance and mitigation. The National Patient Safety Agency (NPSA) performed a similar role for the rest of the healthcare system, but it was disbanded in June 2012, its activity subsumed within NHS England. Many individual departments have morbidity and mortality (M&M) meetings where adverse events are discussed and defences created or adjusted. In addition, individuals will create their own personal defences, such as always having the antibiotic in a 30-ml syringe, triply-labelled.

There are problems with all of these solutions. The patient safety updates are not mandatory reading, there is no assessment of the individual or the department or the hospital to ensure that lessons have been learnt. Attendance at M&M meetings can be variable and sharing of the discussions and conclusions may be sporadic. Individual defences may be breached due to performance degradation or by another healthcare worker who is not aware of them.

Sisyphus

Sisyphus (by Titian)

Sisyphus, a deceitful king in ancient Greece, attracted the wrath of Zeus. His punishment: for all eternity he would be forced to roll a boulder up a steep hill, only for it to return to the bottom. In a similar fashion we are doomed to repeat maybe not our mistakes (because we create personal defences) but the mistakes of others. It is extremely likely that the error we were involved with today was made by someone else somewhere else last week or last month.

Solutions

A number of solutions are called for. Nationally, a system for reporting errors, such as the National Reporting and Learning System (NRLS). These error reports need to be analysed by clinicians and human factors experts to reveal error traps. Also nationally, a mandatory requirement for healthcare personnel to inform themselves of adverse events which are occurring in their field. On a local level, a robust reporting system which feeds into the national system as well as a safety culture, including M&M meetings, which encourages and rewards the reporting of adverse events and near misses. Also on a local level, defined responsibility and accountability for maintaining and modifying system defences.

The role of simulation

Simulation has a number of roles to play. First, systems testing using simulated events, such as a major haemorrhage or a fire, if performed correctly, can reveal weaknesses in the defences. Second, the errors that participants make in the simulation centre are likely to occur in the workplace. For example, in the past few years we have had 2 incidents where, in a crisis, a participant has switched off the anaesthetic machine when they meant to switch on the suction. As can be seen from the image, this is an understandable error. The same error occurred in the actual operating theatre. (It is likely that the same error has occurred a number of times across the UK, as the manufacturer has now designed a clear plastic lid for the anaesthetic machine switch, thus creating a physical barrier.) Do we, as simulation centres, have a duty to flag up common errors to the safety agencies? The third role for simulation is to raise awareness of performance limitations and error traps. Although relying on the person "at the sharp end" to defend against all errors is wrong, it is often that person who acts as the final defence when the system breaks down. Making everybody involved more aware of error traps can therefore only be a good thing.