Skip to content

Active Failure

The frontline operator's act at the sharp end that completes a hazard path by aligning with holes latent conditions had pre-positioned in a system's layered defenses — the proximate, visible half of Reason's Swiss cheese model.

Core Idea

An active failure, in Reason's Swiss cheese model, is the frontline operator's act or omission at the sharp end — the syringe push, control input, trade execution — that directly precipitates harm by completing a hazard path through holes that latent conditions pre-positioned in the system's layered defenses. Its defining feature is a time-to-harm asymmetry: active failures are proximate and visible, expressing within seconds, while latent conditions sit silent for months or years until the holes align. It is the analytical partner of latent condition; neither names the accident alone.

Scope of Application

Active failure (with its bound partner, latent condition) lives across the accident-investigation subfields of safety engineering and human factors — the substrate of human operators acting in real time on hazardous, layered-defense sociotechnical systems.

  • Aviation safety — a crew input completing a controlled-flight-into-terrain path.
  • Healthcare quality — a wrong-drug administration whose packaging and absent double-check were the pre-staged holes.
  • Nuclear and process safety — the domain of origin; an operator action closing a loss-of-coolant path.
  • Maritime safety — sharp-end bridge actions completing a grounding path through standing latencies.
  • Financial operations risk — a fat-finger trade converting long-standing supervision gaps into a loss.

Clarity

The concept makes legible that the visible, proximate act is rarely the cause an investigation should rest on. Set against the latent conditions that pre-positioned the holes, it exposes what the blame-the-operator default leaves invisible and forces a sharper question: what already-present weaknesses let this act complete a path to harm, and would the next operator have failed the same way?

Manages Complexity

An accident dissolves into an unmanageable swarm of contributing factors with no natural stopping principle. Naming the active failure, against its partner latent condition, compresses that swarm to one classifying axis — time-to-harm — sorting every contributor as active (proximate, visible) or latent (distal, silent), and routing each to its appropriate remediation.

Abstract Reasoning

Active failure supports an operator-substitution counterfactual (would the next operator have failed the same way? sorts systemic from idiosyncratic), a uniform classification move along the time-to-harm axis, and an interventionist/predictive move: removing this act leaves the latent topology intact and ready, so engineering remediations that block the path even when the operator errs generally dominate individual blame.

Knowledge Transfer

Within safety engineering the active/latent distinction transfers as mechanism, and as a bound pair — the two-stratum apparatus, the operator-substitution counterfactual, and the remediation routing carry unchanged across aviation, medicine, nuclear, and finance because the substrate is constant. Beyond it what generalizes is the abstract pattern — a precipitating event activates pre-staged weakness — owned by the proximate/distal distinction, cascade, and single-point-of-failure. Forced into non-operator domains, "active failure" goes vacuous or metaphorical.

Relationships to Other Abstractions

Local relationship map for Active FailureParents appear above the current abstraction, mutual partners to the right, and children below. Node labels state whether each abstraction is prime or domain-specific; colors identify relation types.Active FailureDOMAINDomain-specific abstraction: Latent Condition — presupposesLatent ConditionDOMAINDomain-specific abstraction: Human Factors Analysis and Classification System — is part ofHuman Factors A…DOMAIN

Current abstraction Active Failure Domain-specific

Parents (1) — more general patterns this builds on

  • Active Failure presupposes Latent Condition Domain-specific

    Active failure presupposes latent condition because a sharp-end act earns this label only when it completes a hazard path through weaknesses already staged in the layered defenses.

Children (1) — more specific cases that build on this

Hierarchy paths (25) — routes to 9 parentless roots

Neighborhood in Abstraction Space

Active Failure sits in a moderately populated region (40th percentile for distinctiveness): it has near-neighbors but no dense thicket of look-alikes.

Family — Unclustered & Miscellaneous (309 abstractions)

Nearest neighbors

Computed from structural-signature embeddings · 2026-07-12