Conjunctive Path Assurance¶

Map the condition on every edge of a hazardous path, test the joint states that make the whole route conduct, and preserve an independent break before the target becomes reachable.

Overview¶

Conjunctive Path Assurance prevents a system from treating individually harmless conditions as collectively harmless. It applies when a source-to-target failure route is latent under ordinary operation because at least one edge is blocked, but a feasible combination of modes, permissions, timings, environmental states, or human actions makes every edge conduct.

The practical move is to stop asking only, “What does each factor do?” and ask, “Which joint state makes a complete unacceptable path reachable?” The answer is then tested end to end and converted into a structural safety claim: every hazardous path has at least one independent break, or its precursor conjunction is detected early enough to contain it.

Problem and intervention¶

Local audits create false confidence when each team, component, or safeguard is reviewed separately. A route may cross several boundaries, with each edge activated by a different condition. A maintenance bypass may open one edge, a permission exception another, a timing overlap a third, and a degraded sensor state the last. No individual condition explains the outcome, and pairwise tests may still miss it.

Conjunctive Path Assurance builds a state-conditional causal graph, assigns an activation predicate to every edge, and searches for minimal feasible conjunctions that close an entire source-to-target route. Those combinations are then tested, simulated, or formally verified against an end-to-end oracle. The final intervention is not merely a report: the system is redesigned so at least one path edge remains independently blocked, the hazardous conjunction is monitored, and changes automatically reopen the analysis.

Key components¶

Component	Description
Source–Target Hazard Boundary ↗	The analysis begins with a bounded claim: an initiating condition, a protected target, an unacceptable outcome, and a system boundary. This keeps the model tied to a decision. Without it, analysts either stop at local failures or attempt an unbounded model of everything.
State-Conditional Causal Graph ↗	A conventional dependency graph says that one element can affect another. A state-conditional graph says when that edge actually conducts. The graph should include technical, environmental, temporal, human, organizational, and authority-bearing edges, because many real paths cross all of them.
Edge Activation Predicates ↗	Each edge receives a predicate: a mode, threshold, permission, sequence, overlap window, residual state, exception, or environmental condition. Predicates must be specific enough to test or justify. “Abnormal operation” is not a useful predicate; “maintenance bypass active while pressure trip input is suppressed” is.
Joint-State Variable Set ↗	The variable set collects the facts that determine those predicates. It should include hidden shared drivers such as common power, clock, operator, supplier, credential, procedure, or environment. Otherwise several supposedly independent gates may move together.
Minimal Activating Conjunctions ↗	A minimal activating conjunction is the smallest feasible set of conditions sufficient to make every edge on a hazardous route conduct. Minimality matters: it separates causal requirements from incidental context, reduces test burden, and identifies the most direct intervention points.
Combinatorial Coverage Plan ↗	Small state spaces can be fully enumerated. Larger ones may require SAT or SMT solving, model checking, minimal cut-set search, t-wise testing, simulation, or risk-weighted sampling. The chosen method must state what it covers and what it does not. Pairwise coverage cannot be presented as proof when a three-way or higher conjunction is plausible.
End-to-End Activation Oracle ↗	The oracle tells whether the complete route has become live. It includes target-level safety invariants and, where useful, intermediate propagation markers. Local pass/fail checks are not enough; the central question is whether the source can reach the protected target under the joint state.
Independent Path Break ↗	Every unacceptable minimal conjunction needs at least one edge that remains blocked, trips safely, or contains propagation. The break must be independent of the conditions that activate the rest of the path. A software interlock using the same sensor, power, permission, and deployment path as the hazard is not independent merely because it has a different name.
Temporal Overlap and Recovery ↗	Some conjunctions are sequences or overlap windows rather than static Boolean states. The model should include order, duration, lag, and residual state. Protective action must also leave a reachable safe state, preserve evidence, and support controlled restart rather than creating a second failure route.
Monitoring and Lifecycle ↗	Runtime monitoring should look for co-activation, not only marginal threshold breaches. The assurance record must be version-linked, and changes to topology, configuration, staffing, permissions, procedures, or dependencies should trigger reanalysis because a locally harmless change can close the last missing edge.

Common mechanisms¶

Fault trees with AND gates and minimal cut-set enumeration provide a clear logical representation. SAT or SMT solvers and model checkers search symbolic state spaces. Full-factorial and t-wise combinatorial tests exercise bounded combinations. HAZOP and bow-tie reviews expose process and barrier logic. Attack graphs capture adversarial reachability. Joint-condition fault injection and property-based sequence tests validate predicted paths. Runtime co-activation monitors and independent interlocks provide operational control.

No mechanism is sufficient by itself. A fault tree without evidence for its predicates, a t-wise suite without a justified interaction order, or a runtime alert without an independent path break can create the appearance of assurance without the substance.

Parameter dimensions¶

Path scope: one subsystem, cross-service route, whole process, supply chain, or socio-technical workflow.
Interaction order: pairwise, three-way, bounded t-wise, or unrestricted symbolic conjunction.
Predicate type: Boolean mode, categorical configuration, continuous threshold, temporal sequence, authority state, or environmental condition.
Evidence mode: experiment, simulation, formal proof, incident evidence, operator testimony, or conservative exclusion.
Consequence severity: reversible nuisance, material loss, safety-critical harm, catastrophic or irreversible outcome.
Control strategy: prevention, interlock, containment, diversity, monitoring, degradation, or prohibition.
Independence standard: logical independence, separate implementation, separate sensing, separate authority, physical separation, or common-cause tolerance.
Update cadence: release-triggered, configuration-triggered, continuous, periodic, or incident-triggered.
Observation resolution: steady-state snapshots, event traces, high-frequency telemetry, or temporal-logic evidence.

Invariants to preserve¶

No unacceptable source-to-target route is fully live in an admissible state without detection or containment.
Every minimal activating conjunction is tested, formally excluded, structurally broken, or explicitly accepted by an accountable authority.
At least one path break is independent of the conjunction’s shared drivers.
Temporal overlap is observed or modeled at sufficient resolution.
Evidence and assumptions are tied to the exact system version they justify.
Relevant changes trigger renewed path search.
Protective interruption retains a reachable safe state and controlled recovery route.

Target outcomes¶

Successful use reduces rare integrated failures that survive unit tests, local audits, and barrier counting. It improves combinatorial coverage claims, exposes false safeguard independence, places controls at path-level leverage points, detects dangerous precursor combinations earlier, and shortens incident diagnosis because the relevant predicates and evidence are already organized.

Neighbor distinctions¶

Interaction Effect Mapping measures how factors alter one another’s effects, often through factorial or pairwise designs. Conjunctive Path Assurance makes a stronger structural claim: a bounded route becomes reachable only when all its edge predicates are satisfied, and the intervention must break or detect that route.

Failure Mode Anticipation is the broader practice of identifying and prioritizing possible failures. It can use fault trees, but it does not require explicit minimal joint states, end-to-end path oracles, or independence of path breaks.

Causal Mechanism Mapping explains how a cause can produce an effect. This archetype asks under which state assignment that mechanism is actually conducting and whether the hazardous target is reachable.

Phase-Space Mapping and Explicit State Modeling organize possible states and transitions. Conjunctive Path Assurance focuses on specific hazardous source-to-target paths through that state space.

Composability Testing and Validation tests whether components work safely together. It is component-centered; this archetype is path-centered and includes timing, environment, authority, workflow, and human-state predicates.

Common-Mode Failure Analysis is the right parent when shared dependencies among redundant safeguards are the dominant problem. Common-driver gate co-activation is one variant of conjunctive path assurance, but many conjunctive paths do not involve redundancy.

Examples¶

A process plant finds that a maintenance bypass, valve lineup, alarm suppression, and ventilation outage jointly create a release route.
A cloud service finds that a public route, permissive identity mapping, debug parser, and stale token create administrative execution.
A hospital maps an emergency override, renal impairment, delayed lab result, and handoff gap into an unsafe dosing path.
A distributed system identifies a retry, leader handoff, stale cache, and feature-flag sequence that violates exactly-once processing.
A financial institution monitors the conjunction of limit override, stale price, concentrated liquidity, and settlement timing.
A public agency adds an independent appeal hold after finding that exception eligibility, authority handoff, deadline automation, and missing notice jointly create irreversible harm.

Non-examples¶

A single unprotected dependency is not a conjunctive path. A two-treatment synergy study is Interaction Effect Mapping unless it makes a reachability claim. A general state machine is Explicit State Modeling. A fault-tree diagram with no predicate evidence or control redesign is only an artifact. More defensive layers without correlation analysis do not constitute assurance.

Tradeoffs¶

Higher interaction-order coverage improves confidence but grows rapidly in cost. Richer models expose more paths but become harder to validate. Independent controls often duplicate infrastructure or authority. Realistic tests can be hazardous. Conservative blocking can reduce service flexibility. Monitoring can add telemetry burden and privacy risk. Probability estimates help prioritize but may be weakest exactly where rare high-consequence conjunctions matter most.

Failure modes¶

The recurring failures are one-factor-at-a-time blindness, pairwise sufficiency assumptions, omitted predicates, truncated cross-boundary paths, false independence, coarse temporal sampling, invalid end-to-end oracles, combinatorial explosion, stale models, correlated interlocks, risk migration to alternate routes, and false reassurance from a quiet history.

Use guidance¶

Use this archetype when the question is: Which feasible joint state makes a complete unacceptable path live? Start with a source–target boundary, write predicates for every edge, and search for minimal conjunctions. Treat pairwise testing as screening unless the interaction order is justified. Prefer structural path breaks for severe outcomes. Validate control independence. Monitor combinations, not only single thresholds. Re-run the analysis whenever a change can alter state, topology, authority, timing, or dependency.

Common Mechanisms¶

Attack Graph Analysis — Maps the multi-step routes an adversary can chain from an entry point to a protected asset, exposing the sequences of conditions that make a whole attack conduct.
Boolean SAT or SMT Path Search — Encodes the whole conduction logic as a Boolean or SMT formula and lets a solver either exhibit a dangerous state combination or prove that none exists.
Bow-Tie Path Analysis — Puts one unwanted event at the centre and lays out the threat paths into it and the consequence paths out of it, making the barrier on each path explicit.
Common-Cause Dependency Audit — Challenges the independence the redundancy math assumes by hunting the shared upstream driver that would fail several 'separate' barriers in the same instant.
Decision Table or State Matrix — Tabulates every combination of the governing conditions against the action it demands, so the dangerous combination and the guard it must trigger are specified, not left implicit.
Digital-Twin Hazard Rehearsal — Rehearses a specific dangerous conjunction — with its real timing — inside a high-fidelity simulation, so the end-to-end route can be exercised without exposing the live system.
Fault Tree with AND-Gate Logic — Deduces, top-down through AND and OR gates, the combinations of basic failures whose conjunction is sufficient to cause the top event, and enumerates them as minimal cut sets.
Full-Factorial Joint-State Test — Runs every combination of the governing state variables against the system and checks each one for the combination that lets the whole route conduct.
HAZOP Joint-Deviation Review — Walks a multidisciplinary panel through guide-word deviations taken in combination, surfacing the joint deviations a single-parameter review would miss and owning the residual-risk call.
Independent Interlock or Guard — Holds one gate on every hazardous route independently shut, so no conjunction of the other conditions can complete the path.
Joint-Condition Fault Injection — Deliberately forces several fault conditions true at once in a sandbox and watches whether a complete failure path actually lights up.
Minimal Cut-Set Enumeration — Reduces a fault model to the complete list of minimal condition-sets — each the smallest combination that, occurring together, completes a route to the hazard.
Model Checking and Reachability Analysis — Exhaustively explores a system's reachable states to prove the hazard state can never be reached — or returns the exact sequence that reaches it.
Property-Based State-Sequence Testing — Generates thousands of random operation sequences, checks a safety invariant after every step, and shrinks any violation to the minimal history that breaks it.
Runtime Gate Co-Activation Monitor — Watches the live system for the moment too many gates on a route are simultaneously open, and raises the alarm before the last one closes.
Scenario or Monte Carlo Joint-State Sampling — Samples many correlated joint states to estimate how often an entire route conducts at once — the rare-coincidence probability that no single-factor analysis reveals.
t-Wise Combinatorial Interaction Testing — Covers every t-way combination of conditions with a compact test set, on the premise that dangerous conjunctions rarely need more than a few factors aligned at once.

Compression statement¶

Conjunctive Path Assurance applies when no single factor is sufficient for failure, yet a particular combination of configurations, timings, permissions, environmental states, and human actions closes every edge on a latent causal route. The intervention defines the unacceptable source–target claim, models edge activation predicates, identifies minimal activating conjunctions and common drivers, chooses a defensible combinatorial coverage strategy, validates end-to-end conduction with an explicit oracle, and ensures every hazardous path contains an independent interlock, containment point, or monitored break. It replaces factor-by-factor reassurance with path-level evidence about joint-state reachability.

Canonical formula: hazardous path p is live in state s iff every edge e in p satisfies activation predicate g_e(s); assurance requires that for every unacceptable p and admissible s, either some g_e(s) is false, an independent interlock interrupts p, or co-activation is detected before target reachability

Abstractions this archetype builds on — directly (a source ingredient) or as a related pattern. Links follow the typed catalog namespace.

Built directly on (5)

Causality: Cause-effect relationships.
Conjunctive Path Activation: A latent causal path becomes live only when every state-conditional edge along it conducts at once, making the failure invisible to factor-by-factor audit.
Factorial Design: Multiple variables tested together.
Path: An ordered, traversable sequence of edges connecting one node to another through a relational structure.
State and State Transition: Captures system condition and evolution.

Also references 19 related abstractions

Conditional Probability: Re-normalize a probability measure to the information context that is taken as given.
Constraint: Limits possibilities to guide outcomes.
Counterfactual Reasoning: Hypothetical alternatives.
Coupling: Interdependence among subsystems.
Critical Juncture: Moment where small variations produce divergent locked-in paths.
Dependency: Directed relation in which one element relies on another being present, prior, compatible, or supplied, with a specifiable failure mode if the condition is unmet.
Exposure Pathway: The chain of links by which a hazard travels from source to vulnerable target, breakable at any link, turning risk into a graph search over severable routes.
Failure Mode and Effects Analysis (FMEA): Identify failure modes.
Fault Tolerance: Continue operating under failure.
Multi Path Convergence: Multiple distinct trajectories from different starts arrive at the same end-state, with the destination doing the work.

▸ Show 9 more

Variants¶

Narrower or domain-specific specializations that share this archetype's core structure. Recognized variants are established; candidate variants are provisional.

Layered-Hole Alignment Assurance · risk or failure variant · recognized

Find and break the combinations in which vulnerabilities or bypasses in every serial defensive layer align into one traversable hazard route.

Distinct from parent: This variant specializes the parent to serial barrier systems and correlation among barrier holes.
Use when: Protection depends on several serial barriers that are individually imperfect; Barrier weaknesses may share maintenance, staffing, environment, authority, or timing conditions.
Typical domains: aviation safety, healthcare safety, process safety, infrastructure resilience
Common mechanisms: fault tree and gate model, minimal cut set enumeration, common cause dependency audit, independent interlock or guard

Configuration-Conjunction Assurance · implementation variant · recognized

Search versions, feature flags, permissions, routes, defaults, and deployment modes for combinations that make a latent technical failure or abuse path reachable.

Distinct from parent: This variant emphasizes machine-readable configuration spaces, version skew, and automated search.
Use when: System behavior depends on many independently managed configuration dimensions; A dangerous route exists only under a rare combination of versions, flags, permissions, or topology.
Typical domains: software reliability, cloud security, network operations, industrial control systems
Common mechanisms: boolean sat or smt path search, model checking reachability analysis, t wise combinatorial interaction testing, property based state sequence testing

Temporal-Overlap Path Assurance · temporal variant · recognized

Model and test paths that become live only when several gate conditions overlap or occur in a particular order within a bounded time window.

Distinct from parent: This variant makes clocks, overlap windows, sequencing, and residual-state decay first-class parts of the path predicate.
Use when: The path depends on timing, order, duration, lag, or residual state rather than a static configuration alone; Ordinary monitoring samples too slowly to observe the activating overlap.
Typical domains: concurrent software, process control, clinical workflows, financial settlement
Common mechanisms: model checking reachability analysis, property based state sequence testing, joint condition fault injection, runtime gate coactivation monitor

Common-Driver Gate Co-Activation · risk or failure variant · recognized

Identify one hidden driver that simultaneously satisfies several edge predicates and turns an apparently high-order conjunction into a likely common-mode path.

Distinct from parent: This variant emphasizes dependence discovery and safeguard diversity rather than only combination enumeration.
Use when: Several gates are assumed independent because they belong to different teams, layers, or components; A common environment, authority, supplier, sensor, clock, or procedure can move them together.
Typical domains: infrastructure, supply chains, organizational controls, safety instrumented systems
Common mechanisms: common cause dependency audit, fault tree and gate model, scenario or monte carlo joint sampling, independent interlock or guard

Socio-Technical Handoff Conjunction · governance variant · recognized

Map how exceptions, role boundaries, handoffs, incentives, and technical states align to create an end-to-end failure route that no single team owns.

Distinct from parent: This variant makes distributed ownership, local rationality, and handoff evidence central.
Use when: The path crosses organizational and technical boundaries; Each local actor follows a defensible rule, yet the combined handoff state creates the hazardous outcome.
Typical domains: healthcare delivery, aviation operations, financial controls, public administration
Common mechanisms: decision table state matrix, hazop joint deviation review, bow tie path analysis, runtime gate coactivation monitor

Near names: Joint-State Path Assurance, State-Gated Failure-Path Control, Conjunctive Hazard-Path Analysis, Conditional Path Reachability Assurance, AND-Gated Failure-Path Control, Latent Path Closure Testing, Conjunctive Path Analysis and Control.