How many independent layers of defense exist between a trigger and catastrophic failure? - Are the layers truly independent, or are their weaknesses correlated (likely to fail together)? - Which layer has the largest holes (is most likely to fail)?