Fault tree and event tree analysis

Fault tree analysis (FTA) and event tree analysis (ETA) are the two classic logic-diagram methods for analyzing how failures combine. A fault tree works backwards from an undesired top event to find the combinations of basic failures that cause it. An event tree works forwards from an initiating event to show the possible outcomes, depending on whether safety functions succeed or fail. Fault trees were developed at Bell Laboratories in 1962 for the Minuteman missile launch control system; event trees were developed for the nuclear industry, most famously in the 1975 Reactor Safety Study (WASH-1400). Both are described in IEC 31010, and FTA has its own standard, IEC 61025. This lesson gives you enough to read and check simple trees and do the basic arithmetic; large trees are built with software by specialists.

Fault tree symbols and logic

A fault tree starts with the top event, such as "tank overflows" or "explosion in dryer", drawn as a rectangle at the top. Below it, the analyst asks: what immediate events, alone or together, could cause this? Those events are connected to the top event through logic gates. An OR gate means any one of the input events causes the output. An AND gate means all inputs must occur together. The analysis continues downward until it reaches basic events, drawn as circles, for which failure data exist, such as "level transmitter fails low" or "operator does not respond to alarm". Undeveloped events, drawn as diamonds, are not broken down further.

Fault tree arithmetic

For independent events with small probabilities, the arithmetic is straightforward. For an AND gate, multiply the probabilities of the inputs. For an OR gate, the exact result is one minus the product of the probabilities that each input does not happen, but when the probabilities are small, adding them gives a close approximation (the rare event approximation). When combining a frequency (events per year) with probabilities (per demand), the result is a frequency: an initiating frequency AND a failure probability gives the frequency of the outcome.

Minimal cut sets

A cut set is a combination of basic events that, if all occur, causes the top event. A minimal cut set is one that cannot be reduced: remove any event and the top event no longer happens. In the tank example, the minimal cut sets are {level control fails, switch fails}, {level control fails, operator no response}, {valve sticks, switch fails} and {valve sticks, operator no response}. Each has two events, meaning two independent failures are needed. A minimal cut set with a single event is a single point of failure and a priority for improvement. Cut sets also show which basic events appear most often and contribute most to the top event, guiding where to spend money.

Common cause failure

Fault tree arithmetic assumes that basic events are independent. In reality, a single cause can defeat several components: two pumps fed from the same power supply, two sensors on the same impulse line, two operators misled by the same faulty display, or redundant components installed by the same technician with the same error. Common cause failures can make a redundant system far less reliable than the simple AND calculation suggests. The beta factor model, used in IEC 61508 and IEC 61511, assumes a fraction beta, often 2 to 10 percent, of failures affects all redundant channels at once. Good practice is to look for shared utilities, locations, maintenance and design, and to use diversity: different technologies or suppliers for redundant items.

Event trees

An event tree starts with an initiating event, such as a loss of containment or a pump seal failure, on the left. The analyst lists the safety functions or conditions that affect the outcome, in time order, across the top, such as gas detection, isolation, immediate ignition and delayed ignition. At each heading, the tree branches into success (usually upward) and failure (downward), with a probability for each. Each path through the tree ends in an outcome, and the frequency of that outcome is the initiating frequency multiplied by the branch probabilities along the path.

Data and uncertainty

The numbers in fault and event trees come from equipment failure databases such as OREDA for offshore equipment and the CCPS Process Equipment Reliability Database, from manufacturers' data, from plant maintenance records, and from human reliability methods such as THERP or HEART for human error probabilities. Every number has uncertainty, often a factor of three to ten. Results should be presented as orders of magnitude, with the key assumptions and the dominant contributors stated, rather than as precise figures. Sensitivity analysis, changing the most uncertain inputs to see how much the result moves, is good practice.

Fault and event trees are powerful because they show combinations, quantify the effect of redundancy, and identify the most important contributors. They are limited by the quality of data, the analyst's skill in building the logic and the difficulty of modeling human and organizational factors. In practice, they are used for specific high-consequence scenarios, for the design of safety systems and as building blocks of quantitative risk assessment (Lesson 11). The bowtie of Lesson 8 can be seen as a simplified fault tree and event tree joined at the top event.

In the US, fault tree analysis is a PHA method named in OSHA 1910.119(e), and fault and event trees are central to probabilistic risk assessment at nuclear plants under the Nuclear Regulatory Commission and to the design of safety instrumented systems to ANSI/ISA 61511, the US adoption of IEC 61511.

Building a fault tree step by step

Fault tree construction follows a few simple rules. Define the top event precisely, including the system boundary and operating state, such as "reactor R-1 pressure exceeds 15 bar during normal operation". At each level, ask what immediate, necessary and sufficient causes could produce the event above it, and resist the temptation to jump straight to basic component failures. Write each event as a fault statement describing what is wrong and when. Complete each gate fully before moving down the tree. And stop at events for which reliable data exist or which are outside the scope.

Human errors belong in fault trees as basic events, with probabilities from human reliability analysis. Typical screening values are about 0.1 for failure to respond correctly to an alarm under stress with little time, 0.01 for an error in a routine, well-practiced task, and 0.001 for a simple, highly practiced action with good feedback. These numbers are rough and depend strongly on the conditions, which is why human factors reviews of alarms, displays and procedures matter.