Fault Tree Analysis (FTA)

FTA begins with a single, clearly defined TOP event—the undesired system failure—and works backward to identify all credible fault scenarios. This contrasts with inductive methods like Failure Mode and Effects Analysis (FMEA), which start with component failures and propagate forward. The deductive approach ensures analysts focus exclusively on events relevant to the specific hazard, preventing scope creep.

• TOP event: Must be precisely scoped (e.g., 'Reactor vessel overpressure > 250 bar')
• Immediate causes: Identified and iteratively decomposed until basic events are reached
• Boundary conditions: Define system limits, initial operating state, and external assumptions

FTA structures causal relationships using Boolean logic gates that define how lower-level events combine to produce higher-level failures. The two primary gates model distinct failure propagation patterns.

• AND gate: Output occurs only if all inputs occur simultaneously. Represents redundancy or coincident failures (e.g., primary pump fails AND backup pump fails)
• OR gate: Output occurs if any single input occurs. Represents single-point vulnerabilities (e.g., overpressure caused by relief valve failure OR controller malfunction)
• Inhibit gate: Output occurs if input occurs and a conditional event is true
• Priority AND gate: Output occurs if inputs occur in a specified sequence

Complex trees combine these gates to model intricate failure logic, including voting structures (k-out-of-n gates) for redundant systems.

A cut set is any combination of basic events sufficient to cause the TOP event. A minimal cut set (MCS) is a cut set containing no redundant events—removing any single event renders the set insufficient. MCS analysis reveals the most vulnerable failure pathways.

• Single-event cut sets: Indicate critical single points of failure requiring immediate mitigation
• Multi-event cut sets: Reveal combinations of lower-criticality failures that become catastrophic together
• Order of cut set: Number of basic events in the set; lower-order sets represent higher risk

Quantitative MCS ranking by probability guides resource allocation for safety improvements. A system with 100+ minimal cut sets demands different mitigation strategies than one with only 3.

When failure probability data is available for basic events, FTA enables quantitative risk assessment. Analysts assign probabilities or failure rates to leaf nodes and propagate upward through the Boolean structure.

• AND gate probability: Product of input probabilities (P = P₁ × P₂ × ... × Pₙ)
• OR gate probability: Sum-of-products approximation, or exact calculation using inclusion-exclusion principle for dependent events
• Unavailability vs. unreliability: Distinguishes between repairable systems (unavailability) and mission-critical systems (unreliability)
• Importance measures: Fussell-Vesely, Birnbaum, and risk achievement worth identify which basic events contribute most to TOP event probability

This quantification supports risk-informed decision-making, such as determining if a safety integrity level (SIL) target is met.

Common cause failures (CCF) occur when multiple components fail simultaneously due to a shared root cause, defeating redundancy. FTA explicitly models CCF using beta-factor or alpha-factor parametric models to avoid overestimating system reliability.

• Explicit CCF events: Modeled as basic events feeding multiple branches via OR gates
• Beta-factor model: Assumes a fraction (β) of component failure rate affects all redundant components simultaneously
• Examples of CCF triggers: Shared power supply failure, environmental extremes (flood, heat), design defects replicated across redundant channels, maintenance errors

Without CCF modeling, a triple-redundant system may appear orders of magnitude more reliable than it actually is. Regulatory frameworks like nuclear safety standards mandate CCF inclusion.

Modern FTA implementations leverage manufacturing knowledge graphs to automate tree construction and validation. A causal graph encoded as semantic triples enables dynamic fault tree generation from live asset data.

• Automated tree synthesis: SPARQL queries traverse equipment-to-failure-mode relationships to assemble fault trees on demand
• Ontology-driven consistency: OWL reasoners validate that tree logic conforms to domain constraints (e.g., a pump cannot have an electrical failure mode if it is pneumatic)
• Temporal enrichment: Temporal knowledge graphs track failure sequences over time, distinguishing between 'A caused B' and 'A and B share a common cause'
• Digital thread integration: Links fault tree events to design specifications, maintenance records, and sensor telemetry for evidence-based probability estimation

This semantic approach transforms FTA from a static, document-based exercise into a living analytical capability embedded in the digital twin.

A structured, hierarchical classification of the specific ways an asset or process can fail. This controlled vocabulary standardizes the basic events in a fault tree, ensuring that 'BearingFatigue' means the same thing across design, maintenance, and operations teams. Key characteristics:

• Organizes failure modes into parent-child hierarchies
• Provides a controlled vocabulary for semantic annotation of maintenance logs
• Enables consistent quantitative risk scoring across the enterprise

The mathematical foundation of fault tree analysis. Gates define how lower-level events combine to cause higher-level failures:

• AND gate: The output event occurs only if all input events occur simultaneously. Represents redundancy or multiple necessary conditions.
• OR gate: The output event occurs if any input event occurs. Represents single points of failure.
• K-out-of-N gate: The output occurs if at least K of the N inputs occur. Models voting or partial redundancy systems.
• INHIBIT gate: The output occurs only if the input event occurs and a conditional event is true.

A quantitative technique that identifies the smallest combinations of basic events sufficient to cause the top-level failure. Each minimal cut set represents a unique failure pathway. In a manufacturing knowledge graph, these sets are computed by traversing the fault tree's boolean structure and applying absorption laws to eliminate redundancies. The resulting cut sets are ranked by probability, giving engineers a prioritized list of vulnerability clusters to address.

A knowledge graph that explicitly models the time dimension of facts. When integrated with FTA, it allows engineers to query the state of a manufacturing system at any historical point and analyze the sequence of events leading to a failure. This temporal context transforms a static fault tree into a dynamic diagnostic tool, revealing whether a basic event occurred before or after a contributing condition—critical for distinguishing causation from coincidence.

A software component that applies logical inference rules to a knowledge graph's ontology to derive new, implicit facts from explicitly asserted data. In the context of FTA, a reasoner can:

• Automatically classify a newly observed vibration pattern as a known fault type
• Infer that a specific component failure implies a broader system vulnerability
• Validate the logical consistency of a fault tree against domain constraints defined in OWL or SHACL