Why Layer Safety Controls?
A dosing decision system may be protected at several points: the information entering it can be checked, its recommendation can be constrained or withheld, the prescribing process can require a further review, and monitoring can prompt action after a dose change. The purpose of layering is not simply to accumulate alerts. It is to make it less likely that one error, or one failed control, carries an unsafe decision all the way to the patient.
This is a system-level question. Input validation and recommendation checks act on different parts of the process, and prescribing and monitoring controls may encounter a problem only after it has passed earlier stages. Earlier material on input validation, hard safety constraints, abstention, clinician escalation, and monitoring triggers describes individual controls. Here the focus is how controls combine, what assumptions support a risk calculation, and how to recognize when several layers are vulnerable to the same failure.
The pathway must be stated precisely before assigning probabilities. For example, the initiating event might be an incorrect weight entering a dosing workflow; the consequence of interest might be that an unsafe dose is prescribed and not corrected before harm occurs. A check that detects the incorrect weight is relevant only if it can intercept that pathway. A general statement such as “the system has four checks” does not specify what any check can prevent.
Combining Barriers: The Basic Calculation
Suppose an initiating hazardous condition occurs with probability \(p_0\) per decision. For barrier \(i\), let \(q_i\) be the probability that it fails to intercept the specified hazardous pathway, conditional on the pathway having reached that barrier. If every barrier must fail for the pathway to continue, then the probability of progression through all barriers is the probability that all of them fail.
The independence condition is substantive. It means that knowing one barrier failed does not change the probability that another barrier fails, once the initiating condition and relevant pathway are specified. Independence is more plausible when barriers use different information sources, logic, people, or operational processes. It is less plausible when they rely on the same incorrect data, shared software, or the same missed alert. Calling checks “separate” does not establish statistical independence.
Even without independence, the chain rule gives an exact expression. Define \(q_i\) instead as the probability that barrier \(i\) fails, conditional on the initiating condition and failure of all earlier barriers in the pathway. Then:
Here \(H\) denotes the initiating hazardous condition and \(F_i\) denotes failure of barrier \(i\). This identity follows by repeatedly applying the definition of conditional probability: \(P(A\cap B)=P(A)P(B\mid A)\). It does not require independence. If each conditional failure probability is known for the relevant pathway, multiplying them is valid; replacing those conditional probabilities with stand-alone failure rates may not be.
Worked Example: Four Barriers on One Hazardous Pathway
Hypothetical data. Suppose an unsafe pathway begins in 2% of dosing decisions, so \(p_0=0.020\). A design has an input check, a recommendation check, a prescribing check, and a monitoring response. For this example, assume that, conditional on the pathway reaching each check, their probabilities of failing to intercept it are respectively \(0.10\), \(0.20\), \(0.25\), and \(0.40\). Also assume conditional independence and that each check can prevent progression of this same pathway.
The probability that the pathway passes all four barriers, given that it begins, is:
Thus, 0.20% of initiating hazardous pathways pass all four barriers under these assumptions. The probability of such progression per dosing decision is:
That is \(0.00400\%\) per decision, or \(0.0400\) expected progressions per 1,000 decisions. This calculation does not claim that all progressing pathways cause harm. It quantifies progression to the defined endpoint only; the chance and severity of harm would need separate information.
Shared Causes and Single-Point Failures
A shared cause can make several barriers fail together. For example, two checks may both use the same erroneous measurement, or an interface fault may prevent both a recommendation warning and a prescribing alert from appearing. In these cases, adding nominal layers can create less protection than a calculation based on independent failures suggests.
A simple sensitivity model makes this concern visible. Let \(c\) be the probability, conditional on the initiating hazardous condition, of a shared failure state in which all barriers fail. Suppose that when this shared state does not occur, the barriers fail independently with probabilities \(q_1,\ldots,q_k\). Then the probability all barriers fail is:
This is a deliberately simplified model: in practice, shared failures may disable only some barriers, or may change their failure probabilities by different amounts. Its value is diagnostic. Even a small shared-failure probability can dominate the residual risk when the product of the independent failure probabilities is very small.
Worked Example: The Effect of a Shared Failure Mode
Hypothetical data. Keep the four failure probabilities from the previous example, whose independent product is \(0.00200\). Now suppose there is a 1.00% chance, conditional on an initiating hazardous pathway, of a shared failure that disables all four barriers. Otherwise, assume the barriers fail independently with the stated probabilities.
The probability that all barriers fail, given the initiating pathway, is:
The probability of pathway progression per decision is therefore:
This is \(0.02396\%\) per decision, or \(0.2396\) progressions per 1,000 decisions. The independent-barrier calculation gave \(0.0400\) per 1,000. The difference arises from the shared failure state, not from changing the individual barriers’ failure probabilities in the non-shared state. These figures are illustrative, not estimates for a real dosing system.
The main design implication is to look for common dependencies, not only to count controls. Two software checks that use the same erroneous input may be less protective than one input check and a genuinely independent clinical review. Conversely, independence should not be assumed merely because barriers occur at different steps: a prescribing check and a monitoring trigger could both depend on the same delayed laboratory result.
Designing Layers Around the Pathway
A useful design starts by mapping the pathway and asking what each barrier can do, when it acts, and what it depends on. A barrier may detect an error, prevent an action, prompt correction, or reduce the consequence after exposure has occurred. These are not interchangeable functions. A monitoring response may mitigate harm after an unsafe dose is given, but it cannot be treated as if it had prevented the prescription.
Name the initiating condition, the unsafe action or exposure of concern, and the endpoint being counted. Avoid combining unrelated failure pathways into one probability.
Identify what each input, recommendation, prescribing, or monitoring control can intercept. Note whether it blocks progression or only reduces consequences later.
Check which data, software, staff, and communication channels the controls share. Use conditional failure probabilities where the failures are dependent; use a product of stand-alone probabilities only with a defensible independence assumption.
Ask whether an override, outage, delayed measurement, or unavailable reviewer can allow the pathway to proceed. A barrier that is routinely bypassed may not provide its intended protection.
Calculate or bound the risk at the stated endpoint, then examine which barrier or shared dependency contributes most. Decide whether a different or more diverse control is needed.
This is a complement to failure mode and effects analysis, not a replacement for it. Failure mode and effects analysis helps identify possible failures and their consequences; a layered analysis asks how a specified pathway may be intercepted across stages. The quantitative calculation is only as credible as its pathway definition, probability inputs, and dependency assumptions.
Worked Example: Choosing Between a Stronger Barrier and a Diverse Layer
Hypothetical data. Suppose a hazardous pathway begins with probability \(0.0100\) per decision. It reaches three barriers whose conditional failure probabilities, in order, are \(0.10\), \(0.15\), and \(0.30\). Assume these values are conditional on the earlier barriers having failed, so the chain-rule product applies without requiring unconditional independence.
The current probability of progression per decision is:
Now compare two hypothetical changes. First, improve the first barrier so its conditional failure probability falls from \(0.10\) to \(0.05\):
Second, keep the existing barriers but add a fourth, diverse barrier with a conditional failure probability of \(0.20\):
Under the stated conditional probabilities, adding the fourth layer gives the lower calculated progression probability. That conclusion is not universal: if the additional barrier shares a failure mode with an existing one, its conditional failure probability after earlier failures may be much higher than \(0.20\). The comparison therefore points to the key design question: not “How many checks are present?” but “What is the probability that the pathway passes this check, given what has already failed?”
Diagnostics, Alternatives, and Limitations
Warning signs include barriers that all rely on one data source, alerts that are often overridden without review, a monitoring process that cannot act promptly, or a risk calculation that uses failure rates from different settings as if they applied to the same pathway. Another warning is a very small calculated residual risk paired with weak evidence for independence. In that situation, the number may reflect the assumption more than the system.
There are several possible approaches to protection. A single strong control may be simpler and easier to maintain, but a failure at that point can be a single-point failure. Duplicated controls can add protection when their failures are sufficiently independent, but copies that share inputs or logic may fail together. Diverse layered controls place different kinds of checks at different stages; they can interrupt different failure mechanisms, but require coordination and can introduce operational burden. These approaches are not mutually exclusive. The appropriate design depends on the pathway, evidence about performance, and the consequences of missed and false alerts.
| Approach | Potential strength | Key limitation to examine |
|---|---|---|
| One strong barrier | Clear ownership and potentially straightforward operation | A single failure or bypass may leave no further interception |
| Duplicated barriers | Can reduce residual risk if failures are sufficiently independent | Shared inputs, logic, or workflow can create correlated failures |
| Diverse layers | May catch different errors at input, decision, prescribing, and follow-up stages | Handoffs, delays, overrides, and maintenance can weaken the chain |
Probability calculations also have limits. The initiating-event probability and conditional barrier-failure probabilities may be uncertain, sparse, or specific to a particular workflow. A single average can conceal differences across patients, settings, or types of error. When probabilities cannot be estimated credibly, a qualitative pathway analysis can still identify shared dependencies and single points of failure; unsupported precision should not substitute for evidence. Finally, progression through a hazardous pathway and resulting clinical harm are distinct endpoints. Estimating harm requires the probability and severity of consequences after progression, including the possibility that later care mitigates them.
Common Mistake
A common mistake is to multiply four reported “success rates” and conclude that the combined system is extremely safe. The reasoning is wrong if those rates refer to different populations, different endpoints, or unconditional performance rather than failure conditional on the same pathway reaching each barrier. It is also wrong if the barriers share a cause of failure. The correction is to define the pathway and endpoint, use conditional failure probabilities for that pathway, and justify independence before multiplying stand-alone rates. If independence is doubtful, model dependencies or report a range of plausible residual risks rather than a falsely precise point estimate.
Check Your Understanding
Use the definitions and conditional-probability reasoning above. Each problem is followed by its solution.
- A hazardous pathway has probability \(0.0300\) per decision. Two barriers have conditional failure probabilities \(0.20\) and \(0.10\), and their failures are conditionally independent. What is the probability of progression per decision?
- In Question 1, what assumption allows the two barrier-failure probabilities to be multiplied? Would the chain rule itself require that assumption?
- A design has an independent failure-product of \(0.00400\). A shared state with probability \(0.0200\) disables every barrier; outside that state, failures are independent. Find the probability that all barriers fail, conditional on the initiating hazardous condition.
- Why might a monitoring trigger not count as preventing an unsafe prescription, even if it can reduce the chance of subsequent harm?
Solutions. (1) The conditional probability of passing both barriers is \(0.20\times0.10=0.0200\). Multiplying by the initiating probability gives \(0.0300\times0.0200=0.000600\), or \(0.0600\%\) per decision. (2) Multiplication of the two stand-alone failure probabilities assumes conditional independence given the initiating pathway. The chain rule does not require independence, but then the second factor must be the probability of its failure conditional on the first barrier having failed. (3) The shared-failure expression gives \(0.0200+(1-0.0200)(0.00400)=0.0200+0.00392=0.02392\), or 2.392% conditional on the initiating condition. (4) The trigger acts after the prescription or dose change; it may mitigate consequences, but it does not necessarily block the prescribing step. The endpoint must distinguish prevention of the prescription from mitigation after exposure.