Industry-wide acceptance of the concept of the organizational accident was made possible by a simple, yet graphically powerful, model developed by Professor James Reason, which provided a means for understanding how aviation (or any other production system) operates successfully or drifts into failure. According to this model, accidents require the coming together of a number of enabling factors — each one necessary, but in itself not sufficient to breach system defenses. Because complex systems such as aviation are extremely well-defended by layers of defenses in-depth, single-point failures are rarely consequential in the aviation system.

Equipment failures or operational errors are never the cause of breaches in safety defenses, but rather the triggers. Breaches in safety defenses are a delayed consequence of decisions made at the highest levels of the system, which remain dormant until their effects or damaging potential are activated by specific sets of operational circumstances. Under such specific circumstances, human failures or active failures at the operational level act as triggers of latent conditions conducive to facilitating a breach of the system’s inherent safety defenses. In the concept advanced by the Reason model, all accidents include a combination of both active and latent conditions.

A concept of accident causation

Active failures are actions or inactions, including errors and violations, which have an immediate adverse effect. They are generally viewed, with the benefit of hindsight, as unsafe acts. Active failures are generally associated with front-line personnel (pilots, air traffic controllers, aircraft engineers, etc.) and may result in a damaging outcome. They hold the potential to penetrate the defenses put in place by the organization, regulatory authorities, etc. to protect the aviation system. Active failures may be the result of normal errors, or they may result from deviations from prescribed procedures and practices. The Reason model recognizes that there are many error- and violation–producing conditions in any operational context that may affect individual or team performance.