Fault Tree Analysis

Fault tree analysis (FTA) works backward from a specific hazard — a top-level system failure engineers want to prevent — through a tree of logic gates down to the specific combinations of component failures that could actually cause it. It's deductive reasoning applied systematically to reliability engineering: rather than asking "what could go wrong with this component," FTA starts from "this specific bad outcome happened — what combination of failures would have had to occur for that to be true."

AND gates and OR gates give fault trees the logical precision to distinguish between failure combinations that genuinely need every contributing cause present together, versus failures that trigger from any single cause acting alone. An AND gate's output only occurs if every one of its inputs occurs simultaneously — modeling a situation with genuine redundancy, where a hazard only materializes if multiple independent protections all fail at once. An OR gate's output occurs if any single input occurs — modeling a single point of failure, where one specific component failure alone is sufficient to cause the hazard with no redundancy protecting against it. Correctly identifying which gate type applies at each level of the tree is exactly what determines whether the resulting analysis accurately reflects how robust or fragile the real system actually is.

Minimal cut sets are the smallest combinations of basic component failures that, together, are sufficient to cause the top-level hazard — and identifying them is often the single most useful output FTA produces. Rather than simply knowing that some combination of failures could cause the hazard, minimal cut set analysis identifies the specific, smallest sets of failures that would do it — information that directly points toward which specific components or failure combinations deserve the most design or mitigation attention. A single-component minimal cut set reveals a genuine single point of failure; a cut set requiring several simultaneous component failures reveals a much lower-probability failure path, since multiple independent things would all have to go wrong together.

Common cause failures are a specific hazard FTA has to explicitly watch for, because they can silently defeat redundancy that looks robust on paper but shares a hidden shared vulnerability underneath. A system might have genuine redundancy — two independent components, modeled with an AND gate, where both would need to fail for the hazard to occur — but if both components share some common underlying vulnerability (the same power supply, the same manufacturing lot, the same environmental exposure), a single event affecting that shared vulnerability can take out both redundant components simultaneously, defeating the redundancy the AND gate was supposed to represent. Explicitly checking for and modeling these shared dependencies is exactly what separates a genuinely rigorous FTA from one that looks thorough but misses a real, hidden risk.

Quantitative FTA calculates the top event's actual failure probability by combining the probabilities of basic events through the tree's logic structure, turning a qualitative hazard map into a genuine numerical risk assessment. Once basic component failure rates are known (from reliability testing, field data, or published component reliability data), the tree's AND and OR gate logic lets engineers calculate the resulting top-event probability mathematically, rather than relying only on a qualitative sense of which failure paths exist. This quantitative output is what actually supports formal safety certification and risk-based design decisions, rather than just a conceptual map of how failures could combine.

FTA's practical applications span safety certification, hazard analysis, design review, and maintenance planning precisely because the same core deductive structure — hazard at the top, basic causes at the bottom — serves all of these purposes with only the specific hazard being analyzed changing. A safety-critical system undergoing formal certification uses FTA to demonstrate systematically that catastrophic hazards have been identified and their probability adequately reduced. A design review team uses the same technique to identify where a design's current architecture creates unacceptable single points of failure before the design is finalized. Maintenance planning uses FTA's minimal-cut-set output to prioritize which components most urgently need monitoring or preventive replacement. This versatility, applying one consistent analytical structure across such different practical needs, is a major part of why FTA has remained a standard reliability-engineering tool across such a wide range of industries and applications.