Fault Tree Analysis

Why Fault Tree Analysis Matters

Fault Tree Analysis (FTA) is one of the most heavily tested hazard analysis methods on the BCSP Associate Safety Professional (ASP) exam. It appears in the Safety Programs and Concepts domain and also surfaces in questions about risk management, system safety, and incident investigation. The reason is simple: FTA is the primary deductive tool safety professionals use to understand how a serious, undesired event can occur. It forces you to think backward from a catastrophe to its root causes, and it is one of the few qualitative methods that can be converted directly into a quantitative probability estimate.

In practice, FTA is used in aerospace, nuclear power, chemical processing, medical devices, and increasingly in general industry to justify engineering controls, prioritize safeguards, and demonstrate due diligence. On the exam, understanding FTA demonstrates that you can reason logically about system failures, interpret logic diagrams, and perform the basic probability calculations expected of a safety professional.

What Is Fault Tree Analysis?

Fault Tree Analysis is a top-down, deductive analytical technique that begins with a single undesired event (called the top event) and systematically identifies all the combinations of equipment failures, human errors, and environmental conditions that could cause it. The result is a graphical diagram, shaped like an inverted tree, that uses Boolean logic gates (primarily AND and OR gates) to show how lower-level events combine to produce higher-level events.

Key characteristics to remember:

• Deductive reasoning: It moves from the general (the top event) to the specific (basic causes). You start with the effect and ask why or how it could happen.
• Top-down structure: The top event sits at the top of the diagram; causes branch downward.
• Single top event focus: Each fault tree analyzes only one undesired event. Multiple top events require multiple trees.
• Both qualitative and quantitative: The tree can be used simply to visualize failure pathways, or probabilities can be assigned to basic events and propagated upward to calculate the probability of the top event.
• Failure-oriented: FTA looks at what can go wrong, not at normal operation.

Historical Background

FTA was developed in 1962 at Bell Telephone Laboratories by H.A. Watson under a U.S. Air Force contract to evaluate the Minuteman intercontinental ballistic missile launch control system. Boeing later refined and expanded the method, and it became a cornerstone of the system safety discipline codified in MIL-STD-882. The nuclear industry adopted it extensively following the WASH-1400 Reactor Safety Study in 1975. Exam questions occasionally reference this origin, so remember: Bell Labs, 1962, Minuteman missile, system safety.

Fault Tree Symbols You Must Know

The ASP exam frequently presents a fault tree diagram and asks you to interpret it, or describes a symbol and asks what it represents. Memorize the following.

Event Symbols:

• Rectangle: An event that results from a combination of other events through a logic gate. Used for the top event and all intermediate events.
• Circle: A basic event. This is a fundamental initiating fault that requires no further development, such as a component failure or human error. Basic events are the leaves of the tree and are where probability data is entered.
• Diamond: An undeveloped event. A fault that is not developed further, either because it is of insufficient consequence or because information is unavailable.
• House (pentagon shape): An external or normal event. An event that is expected to occur as part of normal operation, such as a pump running or a switch being in the on position. It is not a fault.
• Oval: A conditional event. Specifies conditions or restrictions that apply to a logic gate, most commonly used with an INHIBIT gate.
• Triangle: A transfer symbol. A transfer-in triangle indicates that the tree is developed further at another location (another page); a transfer-out triangle indicates that this portion of the tree is attached elsewhere. Transfers prevent duplication and keep large trees manageable.

Gate Symbols:

• AND gate: The output event occurs only if all input events occur. Drawn with a flat base and a rounded, dome-shaped top. Think of it as requiring everything beneath it to fail simultaneously.
• OR gate: The output event occurs if any one or more input events occur. Drawn with a curved (concave) base and a pointed top. Think of it as any single cause being sufficient.
• INHIBIT gate: A special case of the AND gate, drawn as a hexagon. The output occurs only if the input event occurs and a specified condition (shown in an attached oval) is satisfied.
• Priority AND gate: Output occurs only if all inputs occur in a specific sequence.
• Exclusive OR gate: Output occurs if exactly one (but not more than one) input occurs.
• Voting gate (k-of-n): Output occurs if at least k of n inputs occur, for example 2 out of 3 sensors failing.

For the ASP exam, AND and OR gates account for the overwhelming majority of questions, with INHIBIT gates appearing occasionally.

How Fault Tree Analysis Works: Step by Step

Step 1: Define the system and the top event. Clearly state the undesired event you are analyzing, for example Loss of containment of flammable liquid from storage tank or Worker struck by forklift in warehouse aisle. The top event should be specific, measurable, and significant. Also define the system boundaries, the operating conditions assumed, and the level of resolution you will pursue.

Step 2: Identify the immediate causes. Ask: what events must occur, or could occur, to cause the top event directly? Determine whether these causes must occur together (AND gate) or whether any one of them alone is sufficient (OR gate).

Step 3: Develop each branch downward. Treat each intermediate event as a new top event and repeat the process. Continue until you reach basic events (circles), undeveloped events (diamonds), or normal events (houses). The guiding question at each level is why or how could this happen?

Step 4: Perform qualitative analysis by identifying cut sets. A cut set is any combination of basic events that, if they all occur, will cause the top event. A minimal cut set is a cut set that cannot be reduced; if you remove any single event from it, the top event will no longer occur. Minimal cut sets are the heart of qualitative FTA because:

• A minimal cut set containing only one basic event is a single point of failure, the most critical finding in any fault tree.
• Cut sets with fewer events are generally more likely to occur than cut sets with many events.
• Common cause failures (one event appearing in multiple cut sets) deserve special attention because they can defeat redundancy.

Step 5: Perform quantitative analysis (if data permits). Assign a probability or failure rate to each basic event and propagate upward through the gates using the rules below.

Step 6: Evaluate and recommend corrective actions. Identify where adding redundancy (converting an OR relationship into an AND relationship), improving component reliability, or eliminating a basic event will most reduce the top event probability.

Quantitative Rules: The Math You Must Know

This is the most testable part of FTA. Learn these rules cold.

AND Gate (all inputs must occur):
The probability of the output equals the product of the input probabilities, assuming independence.

P(output) = P(A) × P(B) × P(C) ...

Example: Two independent safeguards must both fail. P(A) = 0.01 and P(B) = 0.05. P(output) = 0.01 × 0.05 = 0.0005. Notice the AND gate always produces a result smaller than any individual input; this is why redundancy reduces risk.

OR Gate (any input is sufficient):
The exact formula uses the complement rule:

P(output) = 1 − [(1 − P(A)) × (1 − P(B)) × (1 − P(C)) ...]

Example: Either of two independent events causes the output. P(A) = 0.10 and P(B) = 0.20. P(output) = 1 − (0.90 × 0.80) = 1 − 0.72 = 0.28.

For two events, this is equivalent to P(A) + P(B) − P(A)P(B) = 0.10 + 0.20 − 0.02 = 0.28.

Rare Event Approximation: When probabilities are very small (generally less than 0.1, and especially less than 0.01), the OR gate can be approximated by simply adding the probabilities: P(output) ≈ P(A) + P(B) + P(C). For example, if P(A) = 0.001 and P(B) = 0.002, the exact answer is 0.002998 and the approximation gives 0.003. The exam may accept either, but always check the answer choices; if the exact value is listed, choose it.

Important caution: Never simply add probabilities at an OR gate when the values are large. If P(A) = 0.6 and P(B) = 0.7, adding gives 1.3, which is impossible. The exact formula gives 1 − (0.4 × 0.3) = 0.88.

INHIBIT Gate: Treated mathematically like an AND gate: multiply the probability of the input event by the probability that the condition is present.

Worked Example

Consider a top event Fire in paint booth connected by an AND gate to two intermediate events: Flammable vapor present and Ignition source present.

Flammable vapor present is an OR gate with two basic events: ventilation fan fails (P = 0.02) and operator sprays with ventilation off (P = 0.03).
P(vapor) = 1 − (0.98 × 0.97) = 1 − 0.9506 = 0.0494.

Ignition source present is an OR gate with two basic events: static discharge (P = 0.01) and electrical arc from non-rated equipment (P = 0.04).
P(ignition) = 1 − (0.99 × 0.96) = 1 − 0.9504 = 0.0496.

Top event (AND gate): P(fire) = 0.0494 × 0.0496 ≈ 0.00245, or roughly 2.4 × 10^-3.

Minimal cut sets for this tree are every pairing of one vapor cause with one ignition cause: {fan fails, static}, {fan fails, arc}, {spray with vent off, static}, {spray with vent off, arc}. There are four two-event minimal cut sets and no single points of failure. The largest contributors are the electrical arc and spraying with ventilation off, so those are the best targets for corrective action.

FTA Compared to Other Methods

The exam loves to contrast FTA with other hazard analysis techniques. Know these distinctions.

• FTA vs. FMEA (Failure Mode and Effects Analysis): FTA is deductive, top-down, starting with an effect and working back to causes. FMEA is inductive, bottom-up, starting with individual component failure modes and working forward to their effects. FTA handles multiple simultaneous failures well; FMEA typically examines single failures one at a time.
• FTA vs. Event Tree Analysis (ETA): FTA works backward from an undesired outcome to its causes. ETA works forward from an initiating event through a sequence of success or failure branches to a range of possible outcomes. ETA is inductive. The two are often combined in a bow-tie analysis, with FTA on the left (causes) and ETA on the right (consequences).
• FTA vs. Job Hazard Analysis (JHA): JHA breaks a job into steps and identifies hazards at each step; it is task-oriented and does not use logic gates or probability.
• FTA vs. HAZOP: HAZOP uses guide words (no, more, less, reverse) applied to process parameters to brainstorm deviations; it is a structured team brainstorming method, not a logic model.
• FTA vs. Root Cause Analysis / Five Whys: FTA can be used as a root cause tool after an incident. The Five Whys is a simpler linear technique; FTA captures branching, multiple contributing causes, and the AND/OR relationships between them.

Advantages of FTA

• Provides a clear visual picture of how failures combine.
• Identifies single points of failure and common cause vulnerabilities.
• Supports quantitative risk estimates when reliability data is available.
• Focuses resources on the most significant contributors.
• Communicates well to engineers, managers, and regulators.

Limitations of FTA

• Analyzes only one top event per tree; a complex system may require many trees.
• Quality depends heavily on the analyst’s knowledge and thoroughness; omitted causes are simply invisible.
• Difficult to model partial failures, degraded states, or time-dependent sequences.
• Quantitative results are only as good as the input failure data, which may be scarce for human errors.
• Large trees become complex and time-consuming to construct and maintain.
• Assumes independence of basic events, which is often violated by common cause failures.

Exam Tips: Answering Questions on Fault Tree Analysis

Tip 1: Lock in the vocabulary of direction. If a question uses the words deductive, top-down, backward from an undesired event, or why did this happen, the answer is FTA. If it uses inductive, bottom-up, forward, or what happens if this component fails, think FMEA or ETA instead. This single distinction resolves a large share of FTA questions.

Tip 2: Identify the gate before you touch the calculator. Read the question carefully for words like both, all, simultaneously, or in conjunction with (AND gate, multiply) versus either, any, or, or at least one (OR gate, use complement formula or approximate by adding). Misidentifying the gate is the most common calculation error.

Tip 3: Multiply for AND, and remember the result gets smaller. If you multiply two probabilities and your answer is larger than either input, you made an error. An AND gate always reduces probability, which is the mathematical reason redundancy works.

Tip 4: For OR gates, check the magnitude of the probabilities. If values are small (0.01 or less), adding is acceptable and the answer choices will usually reflect the approximation. If values are 0.1 or greater, use 1 − (1 − P1)(1 − P2). If adding gives you a value greater than 1, you must use the exact formula.

Tip 5: Know the symbols cold. Expect at least one question asking what a circle, diamond, house, or triangle represents. Circle = basic event (no further development, this is where data goes). Diamond = undeveloped event (could be developed but is not). House = normal or expected event (not a fault). Triangle = transfer to or from another part of the tree. Rectangle = any event produced by a gate, including the top event.

Tip 6: Understand what makes a minimal cut set important. If asked which finding in a fault tree represents the greatest concern, the answer is a single-event minimal cut set, meaning a single point of failure. If asked how to reduce the probability of the top event most effectively, look for the option that converts an OR relationship into an AND relationship by adding an independent safeguard, or that eliminates the highest-probability basic event.

Tip 7: Watch for the word independent. The multiplication and complement rules assume events are statistically independent. If a question states events are dependent or share a common cause, the simple formulas do not apply and the correct answer will typically note that the calculated probability would be underestimated or that common cause analysis is needed.

Tip 8: Remember FTA focuses on one top event. A question asking which method is best suited to analyze all possible failures of every component across a system is pointing to FMEA, not FTA. FTA is the right choice when a specific catastrophic outcome has been identified and you need to understand its causes.

Tip 9: Do not confuse qualitative and quantitative use. FTA does not require probability data to be useful. If a question asks whether FTA can be performed without failure rate data, the answer is yes; qualitative FTA identifies cut sets and failure pathways without any numbers.

Tip 10: Work the tree from the bottom up when calculating, even though it is built top down. Construction is deductive (top to bottom), but probability calculation flows upward from basic events through each gate to the top. Compute each intermediate event first, then combine them at the next gate. Write intermediate results down; do not try to hold them in your head.

Tip 11: Read scenario questions for hidden gate logic. A scenario might say a confined space fatality requires an oxygen-deficient atmosphere and an entrant without a monitor and no attendant present. That is three events under an AND gate. If the scenario says the atmosphere became deficient because of purging with nitrogen or rusting steel or bacterial decomposition, that is an OR gate feeding one intermediate event. Translate the narrative into gates before answering.

Tip 12: Eliminate distractors that describe other tools. Answer choices often include accurate descriptions of FMEA, ETA, HAZOP, or JHA to tempt you. If the question stem clearly describes FTA, immediately discard any option mentioning guide words, risk priority numbers, job steps, or forward-branching outcomes.

Quick Reference Summary

• FTA = deductive, top-down, single top event, logic gates, developed at Bell Labs in 1962 for Minuteman.
• AND gate = all inputs required = multiply probabilities = result decreases.
• OR gate = any input sufficient = 1 − product of complements, or add if probabilities are very small.
• Circle = basic event; diamond = undeveloped; house = normal event; triangle = transfer; rectangle = gate output event; oval = condition for INHIBIT gate.
• Minimal cut set = smallest combination of basic events causing the top event; a single-event cut set is a single point of failure.
• FMEA is the inductive, bottom-up counterpart; ETA is the forward-looking consequence counterpart; together FTA and ETA form a bow-tie.

Master these fundamentals, practice a handful of gate calculations until they are automatic, and FTA questions on the ASP exam will become reliable points rather than sources of anxiety.