The delivery of correct, reliable systems has been a concern since time immemorial. Mathematicians and statisticians working with computing engines struggled with this concept. In 1834, Dr. Dionysius Lardner wrote in the Edinburgh Review “the most certain and effectual check upon errors which arise in the process of computation, is to cause the same computations to be made by separate and independent computers; and this check is rendered still more decisive if they make their computations by different methods [1].”

Systems have a tendency to generate errors and service failure. Dependable systems must constantly overcome these challenges and have a method for keeping errors and faults in check. The earliest challenges with dependability were encountered with the advent of the electronic age. Early electronic components and circuits were unreliable. Since component-wise reliability was poor, the problem became one of how to deliver dependable performance with systems with unreliable components? The solution lay in redundancy. The field developed enormously with the digital age and development of information theory by Claude Shannon. At the heart of most of these methods, redundancy is incorporated to detect and correct errors. This can take the form of triple redundant voting architectures developed by John von Neumann [1] or error correcting codes in digital communications where a message of k bits is encoded using N bits (where N > k) to provide for error detection and correction. Dependable systems detect errors; isolate them followed by masking errors so that service delivery is not disrupted. The theory of redundancy to mask individual component failures was developed by W. H. Pierce in the early 1960s. The field was further developed by the pioneering work of Prof. Algirdas Avizienis with the development of fault tolerant systems. This section is based on a review paper by Avizienis et al. [1]. Overview concepts will be discussed here, the interested reader will find a wealth of further information in [1].

The dependability tree is a useful concept for understanding the nature of dependability. The dependability tree studies the subject from the viewpoint of threats to, attributes of and means by which dependability is attained. While the original application of this is in computing, these concepts can be borrowed and applied widely and other processes can be understood in the same manner with potential advantages to dependability. Let us start with some definitions. For a computer system, dependability is the ability to deliver service that can be justifiably trusted by the user [1]. From the dependability tree in Fig. 1.1, the main threats to dependability are faults, errors, and failures. An error is that part of a system state that may result in subsequent failure. Errors may be manifest or maybe latent. A failure happens when an error alters service. A fault is the cause of an error. Therefore faults can lead to errors which lead to failures. The ways in which a system can fail are its failure modes [1].

Toy Example 1: Consider a commonly encountered situation where a patient with atrial fibrillation and mechanical heart valve is on a stable dose of warfarin for many years for stroke prevention. He maintains therapeutic INR for stroke prevention. At a subsequent hospitalization, a physician enters the wrong dose of warfarin or adds a medicine (for example an antiepileptic such as carbamazepine) that interacts with warfarin and increases its hepatic metabolism. This reduces the therapeutic effect of warfarin leading to a subtherapeutic INR which leads to an embolic stroke. In this example, the wrong dose entered or the drug interaction is the initiating “fault.” This led to an altered coagulation system state with reduced therapeutic effect which represents the “error.” The subtherapeutic anticoagulation (“error”) leads to a “failure” of the service of stroke prevention provided by warfarin.

Let us explore the meaning of attributes of dependability further. The availability of a service is the readiness for correct service. Reliability refers to continuous delivery of correct service or time to failure. In the computer science literature this is also defined as “probability of failure free operation of a computer program in a specified environment for a specified period of time” [2, 3]. Safety is the absence of catastrophic consequences of failures on the user or environment. Confidentiality is the absence of unauthorized disclosure of information. Integrity is the absence of improper system state alterations. Maintainability is the ability to undergo repairs and modifications. The emphasis on the different attributes varies from industry to industry and the intended service provided by the system. A system is expected to have dependability requirements imposed on it. A system’s reactions to faults, whether internal or external is important and is a measure of the robustness of the system.

Applying this concept to healthcare, our goal is to borrow from planes, trains, and computers to create a dependable medical practice, whether in the form of a clinic or a hospital. From a patient or user’s perspective, the services provided by the hospital or practice must be reliably trustworthy. Services must be readily available, of high quality. Diagnosis must be accurate, treatment must be safe without errors and at a minimum of side effects. To this we borrow and add one more requirement, frequently overlooked in healthcare but a core component of all industrial projects—costs must be optimum and transparent. Therefore, dependable healthcare, emulating the world of like products and services in engineering provided by our dependable institution must provide service that can be reliably trusted by the user in terms of diagnostic accuracy, optimum treatment, and costs.

From the “means” arm of the dependability tree in Fig. 1.1, the design of a dependable system involves four important aspects [1]:

The life cycle of most typical dependable systems is characterized by alternate periods of correct and incorrect service delivery. A useful index of this principle is failure intensity—which is the number of failures per unit of time. Typically, failure intensity decreases as more common faults are discovered and corrected (period termed reliability growth), then stabilizes (stable reliability) followed by a period of decreased reliability followed by repetition of the cycle. This is usually pictured as a “bathtub,” see Fig. 1.4.

Important measures of reliability, especially in engineering are mean time between failures (MTBF), mean time to failure (MTTF), and mean time to repair (MTTR) [3]. These are connected by the expression:
This is illustrated in Fig. 1.5. MTTF is a measure of how long a system is expected to deliver correct service before failure occurs. MTTR is a measure of how easy or difficult it is to repair a system after a failure occurs. In computer controlled systems, advances in software engineering have reduced the number of deterministic design faults. More difficult to control are latent faults in software and hardware which are state dependent and activated by a particular set of input data and operating conditions [2]. These are highly unpredictable since a system crash is triggered by a specific set of input data which exposes a unique, hidden vulnerability in software and hardware resulting in service failure which may not have been foreseen during system development and testing. Therefore, a latent fault in software and hardware becomes activated when the system state and triggering input sequences come together. Therefore, for many systems, MTTF is dependent on the operating environment. As introduced earlier, this is mitigated in dependable systems by incorporating redundant systems using different hardware and software which very likely have a very different set of state and input vulnerabilities and therefore do not crash under the same circumstances.

The same is applicable to medical knowledge as well. Medical education is verified and validated by rigorous curricula and board certification examinations. However, all knowledge is imperfect and there are regions of vulnerability in each individual’s understanding of health and disease. A hidden, unique vulnerability in a physician or healthcare worker’s knowledge is challenged by a rare, unique clinical circumstance leading to errors in diagnosis and treatment. As in the systems engineering example, redundancy can be used to deliver dependability. The knowledge redundancy is delivered using teamwork, second opinions, and concurrent opinions so that one individual’s unique knowledge vulnerability in a certain clinical situation is masked by another’s strength leading to fault prevention, fault masking, and correct service delivery despite individual failure.

G.S. is a 70-year-old male, s/p pacemaker placement, on anticoagulation with a prior biopsy proven diagnosis of polymyositis. He had been treated with varying doses of prednisone with poor response to treatment. Patient himself provided a limited history but it appears his muscle disease started fairly abruptly after undergoing coronary artery bypass grafting (CABG). Weakness was rapidly progressive leading to difficulty with ambulation in short order. Over the past few years he developed dysphagia. It was not clear if symptoms were related to statin exposure. A review of his biopsy did not show rimmed vacuoles concerning for inclusion body myositis (IBM), however this might have been due to sampling error. He denied any family history of muscular dystrophy. On examination, he had moderate bifacial weakness being unable to whistle. Extraocular movements were otherwise normal. He had severe weakness and wasting of pectoralis major and scapular muscles. Scapular winging was present bilaterally. There was relative preservation of the deltoids bilaterally which were 3+/5. There was severe wasting of the biceps and triceps bilaterally. The wrist extensors were 4/4 bilaterally, the wrist flexors were similar. Patient was unable to make a fist bilaterally with the weakness of flexor pollicis longus (FPL) and deep finger flexors. Hand intrinsics were normal. In the lower extremities hip flexors, knee extensors showed only trace strength. Foot dorsiflexors were 3+/5, plantar flexors were 4/5. At the time of his initial visit, he was on prednisone 10 mg/day for many years.