CHI+MED logo banner

The "Hot Cheese Model"
A new way to explore the impact of bad design on incidents

Key points

  • Poor design of medical devices has caused many incidents where patients have been harmed. However, design as such is not prominent in existing models of accident causation, particularly Reason's widely-used Swiss Cheese Model.
  • The new "hot cheese model" highlights the impact of bad design on incidents in a simple, flexible and memorable way.
  • The model sheds light on this hidden issue, and supports risk analysis and risk management in safety critical fields, including aviation, engineering, and healthcare.
  • If it were adopted widely it could lead to further incidents being prevented, saving both lives and money for the healthcare system.

The Swiss Cheese Model for Accident Causation
Adverse incidents are often considered as events that happen by chance or without apparent or deliberate cause. An incident causation model is one of the tools that helps to clarify their causes. There have been many such models, with the Swiss Cheese Model, created by James Reason, being widely adopted, not least because it is clear and memorable.

The Swiss Cheese Model describes systems as multiple slices of swiss cheese, stacked side by side. These slices represent an organisation's defences against failure. The holes in the slices represent weaknesses in individual parts of the system. When the holes in each slice align, this permits a trajectory of accident opportunity, so hazards may pass through all of the slices, leading to an accident.

From Swiss Cheese to Hot Cheese
The Swiss Cheese Model has successfully worked in the accident investigation culture for many years. One of its strengths is its memorable graphical representation: slices of cheese. Unfortunately, the representation is misleading. The model seems to imply that as long as enough layers of defences are in place, at least if the holes are not aligned, the probability of an accident can be minimised. The truth is that system defences are more active. There have been many cases when a defence layer was introduced in the hope of preventing errors and improving system performance, but only ended up provoking new errors and causing more harm.

To highlight the impact of poor design on the system, we created the Hot Cheese Model as an alternative recipe for understanding and talking about error reduction. In the Hot Cheese Model, the slices are stacked vertically and we introduced a new concept, drips. Drips represent new risks introduced by a current system defence layer due to its design flaws. These risks may possibly turn into hazards, which defence layers downstream will have to deal with. For example, suppose a manufacturer has introduced a sensor-enabled history log system to help patients keep track of their medication. The list of skipped medication for one day and the list of scheduled medication for the next may be displayed on the same page in a similar font. But this introduces a new risk of the patient taking two days of medication at once apparently 'as instructed'. If this happens it may cause an overdose, which in some case may be a much bigger hazard than the one the design tried to guard against.

The Hot Cheese Model creatively covers more issues than the original Swiss Cheese Model, while retaining its strengths. It allows a dynamic and active interpretation of complex system components and helps incident investigators and others see the system as a dynamic whole. It has potential to be a powerful tool to provoke thinking and discussion, especially amongst medical device procurers, who may develop a more comprehensive framework to evaluate products even more thoroughly than they have already done, prior to making any purchase and implementation decisions. It can also help incident investigators gain a deeper understanding of incidents. It sheds light on the hidden issues of design that introduce hazards, and supports risk analysis and risk management in safety critical fields, including aviation, engineering, and healthcare.

The Hot Cheese Model has been taught at Swansea University to both undergraduate and postgraduate students across four modules since 2014. We have also given invited talks about it at international workshops, including the Bridging Global Engagements in Research Workshop on Human Factors and Ergonomics in Beijing 2012, and The Workshop of Interactive Technology in Smart Care in Nanjing 2014. If it were adopted widely the new model could lead to further incidents being prevented, saving both lives and money for the healthcare system. Most importantly, hot cheese — because it drips! — stimulates more creative and insightful discussion than the original static Swiss Cheese Model.

Key people
Karen Yunqiu Li, Harold Thimbleby

Li Y., Thimbleby H., Hot Cheese: A Processed Swiss Cheese Model, Journal of Royal College of Physicians Edinburgh 2014; 44:116–21.