Fault Tree Analysis: Method

Fault Tree Analysis

What the tool does

A fault tree is a deductive model of one undesired event, the top event: it is resolved through logic gates into intermediate faults and finally into basic events (component failures, human errors, external conditions) whose probabilities are known. The tool reads the tree as text, finds its minimal cut sets and minimal path sets, quantifies the top event by three methods, ranks the basic events by five importance measures and adds common-cause failures by the β-factor model. The method follows the NUREG-0492 Fault Tree Handbook (1981) and the NASA Fault Tree Handbook with Aerospace Applications (2002); the default case is the handbook's pressure tank (Chapter VIII, Table VIII-1).

Writing the tree

One gate or one basic event per line. A gate is NAME: GATE(inputs): OR(A, B, G1) passes the fault when any input occurs, AND(A, B) when every input occurs, 2of3(A, B, C) or VOTE(2, A, B, C) when at least k of the n inputs occur, NOT(A) when its input does not occur, XOR(A, B) when exactly one of two inputs occurs. Infix forms are accepted (A + B for OR, A * B for AND) and gates may be nested or referred to by name from other gates. The top gate is the one named TOP, or the single gate that no other gate uses.

A basic event is NAME = value. The value is a probability (0.001, 1e-3, q 0.001), or a failure rate with a time model: lambda 1e-5 t 1000 gives the unavailability 1 − e^−λt (t defaults to the mission time), lambda 1e-5 mttr 24 the steady-state unavailability λτ/(1 + λτ) of a monitored repairable item, lambda 1e-5 test 720 the average unavailability λT/2 (+ λT_R with mttr) of a periodically tested item (NUREG-0492 Table XI-2). NAME = true or false is a house event, a condition that is certain or impossible; a TRUE house event is removed from every cut set it appears in and a FALSE one removes the cut set. A description in double quotes labels the event in the tables; text after # is a comment. A common-cause group is one line, CCF(E3, E4, E5) beta 0.1.

Minimal cut sets

The top event is written as a Boolean function of the basic events by substituting the gate equations from the top down (the MOCUS procedure of Fussell and Vesely): an OR gate turns one candidate row into one row per input, an AND gate adds its inputs to the row, a k/n gate produces one row for every combination of k inputs, and a NOT gate is pushed down to the basic events with De Morgan's laws, where it becomes a complemented literal. The expansion stops when every row holds only basic events. The rows are then reduced with the idempotent law A·A = A, rows holding an event and its complement are discarded, and rows that contain another row are removed by the law of absorption A + A·B = A. What remains is the unique set of minimal cut sets: the smallest combinations of basic events whose joint occurrence is sufficient for the top event (NUREG-0492 Chapter VII, section 4). The table orders them by probability, P(C_i) = Π q over the events of the cut set (independence assumed), with the share of the rare-event sum (the cut-set importance E_i of eq. XI-39) and the cumulative share. Single-event cut sets are the single points of failure; the handbook's design rule is to put AND gates as near the top as the design allows so that none exist.

Large trees can be truncated: by order (candidates with more than the given number of events are dropped) or by probability (a candidate whose probability has fallen below the cutoff is dropped; the expansion only adds events to a candidate, so the test is safe to apply early). Dropped candidates are counted and reported, and the quantities then omit them.

Top-event probability

The top event is the union of its minimal cut sets, T = C₁ + C₂ + … + C_N. Its probability is given three ways.

The rare-event approximation Q ≈ Σ P(C_i) (NUREG-0492 eq. VI-7 and XI-33) ignores the simultaneous occurrence of two cut sets. It is an upper bound, agrees with the true value within about 10 % when Q < 0.1, and is what most fault tree software reports.

The min-cut upper bound Q ≤ 1 − Π[1 − P(C_i)] treats the cut sets as independent events (eq. VI-17 applied to the cut sets). It is exact when no basic event belongs to more than one cut set and otherwise an upper bound tighter than the rare-event sum.

The exact value is the probability of the union. The tool obtains it by conditioning on the basic event that appears in most cut sets, Q = q_x Q(x occurs) + (1 − q_x) Q(x absent), where the two conditional lists are simplified by absorption, and repeats this until the remaining cut sets share no event, where the min-cut upper bound is exact (Shannon or pivotal decomposition). It is exact for independent basic events, handles complemented literals, and is equivalent to the full inclusion–exclusion expansion of eq. VI-6, whose first brackets S₁, S₁ − S₂ and S₁ − S₂ + S₃ are tabulated as the upper, lower and upper bounds they are (Bonferroni). The decomposition has a node budget; when a tree exceeds it, or the cut-set count exceeds the entered limit, the min-cut upper bound is used and the page says so. The method chosen on the form is the one quoted as "the" top probability and the one whose sensitivities give the importance measures.

Importance measures

Let Q(1_x) and Q(0_x) be the top-event probability with basic event x made certain or impossible, everything else unchanged. The NASA handbook (§7.5) defines: Fussell–Vesely FV = [Q − Q(0_x)]/Q, the fraction of the top probability that involves x (the sum of the cut sets containing x, in the rare-event limit); risk reduction worth RRW = Q/Q(0_x), the factor by which the top probability falls if x never occurs, the most that improving x can buy; risk achievement worth RAW = Q(1_x)/Q, the factor by which it rises if x is certain, which points to the events whose occurrence must be prevented; Birnbaum I_B = Q(1_x) − Q(0_x) = ∂Q/∂q_x, the probability that x is critical, independent of q_x itself. The tool adds the criticality importance I_C = I_B q_x/Q, the probability that x caused the top event given that it has occurred, and the NUREG-0492 component importance e_k = Σ_k∈i P(C_i)/Σ P(C_i) (eq. XI-41), the cut-set-sum form the handbook uses in its pressure-tank example (14 % for the tank, 86 % for relay K2). On the absolute scale I_B = [Q(1_x) − Q] + [Q − Q(0_x)], and FV = 1 − 1/RRW. With a NOT gate in the tree the function is non-coherent and a Birnbaum importance can be negative: the occurrence of that event lowers the top probability.

Common-cause failures

Redundant components of the same type fail together far more often than independence predicts: a design flaw, a maintenance error or an environment shared by the group. The β-factor model (NUREG/CR-4780; NASA handbook §5.2 and Chapter 12) attributes a fraction β of each member's failure probability to a cause that fails the whole group at once. The tool replaces every member of a CCF(...) beta β group by an OR of its independent part, (1 − β)q, and one common-cause basic event of probability β q̄ (q̄ the mean member probability) shared by the group; the common-cause event then appears in the cut sets and the importance table like any other. The page compares the top-event probability with and without the groups. The NASA handbook's three seals at q = 10⁻³ go from 10⁻⁹ (independent) to 10⁻⁴ with β = 0.1: a redundant group of n members is dominated by the common cause as soon as β exceeds qⁿ⁻¹. The multiple Greek letter and alpha-factor models, which distinguish the failure of two, three, … members of a larger group, are not applied.

Minimal path sets

Complementing the top event gives the dual tree (every event complemented, AND and OR exchanged, a k/n gate becoming (n − k + 1)/n). Its minimal cut sets are the minimal path sets of the original tree: the smallest sets of basic events whose non-occurrence assures that the top event does not occur, i.e. the success modes of the system (NUREG-0492 Chapter VII, section 5). The probability that none of the path sets is intact is again the top-event probability; the tool evaluates it from the path sets as a cross-check of the exact value from the cut sets.

Reading the results

Look first at the order of the cut sets and the single-event cut sets, then at the ranked importance table: FV and RRW tell where an improvement pays, RAW where a failure must be prevented, I_B which events the system is most sensitive to regardless of their present probability. Compare the three probability values: when the rare-event sum is within a few percent of the exact value the cut sets are nearly disjoint and the handbook's simple sum is adequate; a large gap signals shared events or probabilities that are not small. With common-cause groups, the ratio of the top probability with and without them is the measure of how much of the redundancy is real.

Limits

Basic events are statistically independent except through the explicit common-cause groups; the probabilities are point values with no uncertainty propagation; the tree is static (no priority-AND, sequence or spare gates, no time-dependent system failure rate W(t)); the β-factor model only. The expansion holds at most 200,000 candidate rows and the exact decomposition 400,000 pivot nodes; beyond that, truncate the tree or accept the min-cut upper bound. The NUREG-0492 pressure-tank example prints its rare-event sum as 3.4 × 10⁻⁵; its own five cut-set probabilities add to 3.5016 × 10⁻⁵, which is the value consistent with its printed importances of 14 % and 86 %.