## [Fault Tree Analysis](/fault-tree-analysis-0) Definition A top‑down, deductive method that models the logical combinations of component failures, human errors, and external events using Boolean gates in a tree structure to identify root causes and compute the minimal combinations of basic events that can produce a specified undesirable top event (system failure). ## Principle Principle System‑level failures can be represented as logical functions of lower‑level events; by decomposing the top event into basic events and combining them with AND/OR (and other) gates, one identifies minimal cut sets whose occurrence suffices to produce the top event, enabling prioritized mitigation. ## Demonstration Demonstration Situation: A safety‑interlock failure is defined as the top event for a chemical reactor — the interlock must disable feed when unsafe conditions are detected. Recognition: Engineers build a fault tree whose top node is an OR gate combining three independent branches: (A) simultaneous failure of both redundant pressure sensors (Sensor1 AND Sensor2), (B) an explicit maintenance/controller override action (Controller_Override), and (C) a power loss occurring at the same time as a fail‑to‑close valve (Power_Loss AND Valve_Failure). Formally: Top_Event = (Sensor1 AND Sensor2) OR Controller_Override OR (Power_Loss AND Valve_Failure). Action: The analyst derives the minimal cut sets by inspection of the Boolean structure; they are {Sensor1, Sensor2}, {Controller_Override}, and {Power_Loss, Valve_Failure}. Quantitative or qualitative assessment of each cut set follows: field data show valve actuators have degraded seals (increasing Valve_Failure likelihood under Power_Loss) and maintenance records show occasional single‑person override entries. The team therefore targets the highest‑risk cut sets rather than spurious combinations. Consequence: Mitigations mapped to the identified minimal cut sets are implemented: add an uninterruptible power supply for the interlock logic and redundant power monitoring (reduces likelihood of the Power_Loss term), replace and requalify valve actuators with diagnostic feedback (reduces Valve_Failure likelihood), and require two‑person authorization plus hardware lockout for maintenance overrides (eliminates the single‑action Controller_Override cut set). Optionally, add sensor diversity and online sensor diagnostics to reduce the joint Sensor1 AND Sensor2 cut set. After these changes the calculated contribution of each minimal cut set to the top‑event probability is reduced, demonstrating how the FTA translated a specified top event into actionable, causally traceable mitigations. ## Misapplication Misapplication Treating an FTA as exhaustive rather than model‑based — for example, assuming absence of a minimal cut set implies impossibility of the top event — is an error. The semantic error is equating a modeled logical structure with complete real‑world coverage; FTAs depend on included assumptions and modeled basic events. ## Consequence Consequence When used properly, FTA clarifies causal chains, supports quantitative probability bounds (when event likelihoods are available), and guides design redundancy and maintenance priorities. Misused FTAs can create false assurance if key failure modes, dependencies, or common‑cause failures are omitted or if assumed independence is unjustified. ## Reversal Reversal The deductive Boolean structure is less appropriate when failures involve complex interactions not representable by static logic gates (e.g., strongly state‑dependent dynamics, software logic that cannot be modeled as independent basic events) or where dependencies and common‑cause failures dominate; in such cases dynamic fault trees, Markov models, or simulation‑based methods are required. ## Boundary Boundary Clearly within: Analysis of hardware safety systems where component failures and simple logical relationships dominate. Boundary case: Systems with software control logic and time‑dependent interactions — an FTA can represent structural relationships but may omit timing and state behaviors without extensions. Clearly outside: Emergent sociotechnical failures driven primarily by organizational processes and latent conditions that cannot be decomposed into binary basic events alone. ## Semantic Tension Semantic Tension Model Completeness ↔ Analytical Tractability: including more events and dependency structure increases realism but reduces clarity and manageability; simplifying assumptions (independence, binary event states) improve tractability but risk excluding critical common causes or dynamic behaviors. ## Synthesis Synthesis FTA is a rigorous way to translate a specified undesirable outcome into minimal logical causes, but its value depends on the fidelity of included events, modeling of dependencies, and recognition of when more dynamic or probabilistic representations are needed; treat FTA as a model for reasoning and prioritization, not as proof of impossibility.