The oncology problem.

Two curves you already have.

Two survival curves do all the work. Both are the Kaplan–Meier staircases from Module 3, tracking a proportion of patients over time:

• Overall survival (OS) — the proportion of patients still alive at each time point. It only ever falls as patients die.
• Progression-free survival (PFS) — the proportion still alive and free of disease progression. To count here, a patient must be both alive and not yet progressed, so PFS drops whenever a patient either progresses or dies. That means PFS always sits on or below OS — you can't be progression-free without being alive.

These two lines are the raw output of almost every oncology trial. The partitioned survival model's trick is to build an entire economic model out of nothing but these two curves — and the gap between them.

Partition by subtraction.

Here's the idea, and it's genuinely elegant. For a cancer patient there are three states that matter: progression-free (alive, disease controlled), progressed (alive, disease active), and dead. Watch how the two curves hand you all three, at every point in time, by subtraction:

• Progression-free = PFS. The bottom band — everyone still alive and unprogressed is, by definition, under the PFS curve.
• Dead = 1 − OS. The top band — everyone not still alive.
• Progressed but alive = OS − PFS. The band between the two curves. If you're alive (under OS) but no longer progression-free (above PFS), you're progressed. That middle slice is exactly the area between the curves.

So a moment where OS is 0.60 and PFS is 0.35 partitions the cohort as: 0.35 progression-free, 0.60 − 0.35 = 0.25 progressed, and 1 − 0.60 = 0.40 dead — summing to 1, as it must. No transition probabilities, no matrix. You partition the survival experience into states by subtracting one curve from another. That's the whole model, and it's where the name comes from.

Read the states off the curves.

Below are the two survival curves — OS on top, PFS below. Drag the time slider and read off the three states at that moment: progression-free (under PFS), progressed (between the curves), and dead (above OS). Then hit "Break the extrapolation" to see what happens when the two curves are modelled carelessly.

In the sensible mode, the three bands always stack neatly to 100% — the model behaves. Flip to the broken extrapolation and watch the middle band go negative: the model is now claiming more patients are alive-and-progression-free than are alive at all. Nothing in the trial data stopped this, because the two curves were extrapolated independently — and that independence is the whole story of the next few screens.

Now you.

Why oncology loves it.

The partitioned survival model earned its dominance in cancer for good reasons:

• It plugs straight into the trial's endpoints. OS and PFS are exactly what oncology trials are designed to measure and report. The model consumes them directly — no translating curves into transition probabilities and hoping the translation is faithful.
• Each curve is extrapolated on its own terms. You take the standard survival-analysis toolkit from Module 3 — fit a parametric curve, extrapolate beyond the data — and apply it to OS and to PFS separately, using whichever distribution fits each best.
• It's transparent about what it's built from. Anyone can see the two curves and the areas. Compared with a matrix of transition probabilities whose provenance can be murky, "here are the two survival curves" is refreshingly legible.

For an evidence base built on OS and PFS, that's a natural, fast, and honest-looking fit. Which is exactly why its one structural weakness is so easy to miss.

The catch: the curves don't know about each other.

Everything good about the partitioned survival model flows from one choice — modelling OS and PFS independently — and so does everything dangerous. Because the two curves are fitted and extrapolated separately, nothing in the model's structure links them. And that produces two failure modes, both hiding in the unobserved tail:

The curves can cross. You saw it in the interactive. If the extrapolated PFS ever climbs above OS, then OS − PFS turns negative — a negative number of patients in the progressed state. It's logically impossible, yet no rule inside a partitioned survival model forbids it; it has to be caught by eye. A Markov model structurally cannot do this — occupancy is always non-negative — but a partitioned survival model can, and does, when the tails are fitted carelessly.

Post-progression survival is never specified — only implied. This is the deeper problem. The time patients spend alive-after-progression is the residual OS − PFS. You never state it; it just falls out of two independent extrapolations. So the model can quietly imply that progressed patients live implausibly long, or die implausibly fast, and the modeller is never forced to look at that number and defend it.

Contrast a state-transition (Markov) model, which makes you specify a post-progression mortality directly — an assumption a clinician can sanity-check. NICE's own methodological guidance (Technical Support Document 19) makes exactly this critique, and recommends that a state-transition model be presented alongside a partitioned survival model precisely so the implied post-progression survival is dragged into the open. When you appraise a partitioned survival model, that residual is the first place to look.

What is the problem?

Beyond cohorts: discrete event simulation.

Decision trees, Markov models, and partitioned survival models share one thing: they push a whole cohort through the model at once, tracking proportions in states. There's a fourth structure that abandons that entirely — discrete event simulation (DES).

Instead of proportions, DES simulates individual patients, one at a time. Each simulated patient carries their own attributes — age, biomarkers, number of prior relapses, time since diagnosis — and the model advances not in fixed cycles but from event to event in continuous time: time-to-progression, time-to-adverse-event, time-to-death, each sampled from a distribution. Run thousands of patients, average their experiences, and you have your costs and QALYs.

Two consequences are worth holding onto:

• It has memory. Because each patient carries a history, risks can depend on that history — number of prior events, time since surgery — with no need for the tunnel-state contortions Markov required. The memorylessness problem simply doesn't arise.
• There are no cycles. Events happen in continuous time, so there's no cycle length and no half-cycle correction to worry about.

The price is steep: DES is data-hungry, computationally heavy, and far less transparent than a Markov trace or a pair of survival curves — harder for an assessor to open up and check. So it's reserved for problems that genuinely need it: strong history-dependence, competing events, or modelling constrained resources like a queue for a scanner. It's the most flexible tool in the box and the least legible — which is exactly the trade-off this whole module keeps returning to.

Why this matters for HTA

You now have the full landscape of model structures, and the assessor's first job on any submission is to ask whether the manufacturer picked the right one — and then to probe its signature weakness:

• Match structure to disease, then hunt the known failure mode. A decision tree for an acute one-off; a Markov model for chronic recurring disease; a partitioned survival model for oncology; DES when history and events truly demand it. Each has a characteristic weak point — and for the partitioned survival models you'll see most, that point is the tail.
• On any partitioned survival model, check the curves and the residual first. Do the extrapolated OS and PFS curves stay properly ordered (PFS never above OS)? And what post-progression survival does OS − PFS quietly imply — is it clinically plausible, or has an implausible number slipped in unexamined?
• Ask to see the alternative structure. Following NICE's guidance, a state-transition model presented alongside a partitioned survival model exposes the post-progression survival assumption that the partitioned approach leaves implicit. If only one structure is offered, ask why — the answer is often revealing.

A partitioned survival model is two curves and the space between them. Its elegance and its danger are the same fact: the curves are drawn independently, so it's on you to check they still tell a possible story where the data runs out.

Partitioned survival, in one breath.

• A partitioned survival model builds states directly from two survival curves: progression-free = PFS, dead = 1 − OS, and progressed-but-alive = the area between them, OS − PFS. No transition probabilities.
• It dominates oncology because it plugs straight into the OS and PFS endpoints trials already report, and each curve is extrapolated with standard survival methods.
• Its defining weakness is that the curves are modelled independently: nothing links them, so they can cross (negative occupancy) and the implied post-progression survival is a never-specified residual. State-transition models force that assumption into the open — which is why guidance asks to see one too.
• Discrete event simulation goes further still — individual patients, continuous time, full memory — trading transparency and data for realism, and reserved for problems that need it.

Markov made you write down every transition. Partitioned survival lets you skip them and subtract two curves instead — faster, and blind to whether the story it tells is even possible.

We've now built four ways to turn evidence into lifetime costs and QALYs: trees, Markov, partitioned survival, and DES. Which raises the question that hangs over all of them — how do you know a model is any good? A model can run cleanly and still be wrong. Checking that it isn't is the job of the last lesson in this module: model validation.