How does a fault tree analysis (FTA) work?

The Fault Tree Analysis (FTA) is another tool that supports the assurance of functional safety. The central element is a fault tree that uses logic links to model the various combinations of failures, faults, errors and normal events that lead to the occurrence of a specific undesired event.

Fault tree analysis is used in the aerospace, nuclear power, chemical and process engineering industries, the pharmaceutical and petrochemical industries and other high-risk industries. An FTA is quite complex and is therefore generally only used where it is really necessary. A systems engineer should at least know the basics of FTA.

An example

An FTA usually begins with an adverse event.

For example, a train should not run with the passenger doors open. There are other techniques we can use to identify the undesirable events, for example FMEA (Failure Mode and Effect Analysis).

Since each event requires its own FTA, we should create the list of events carefully. They must not be too general ("train has an accident") or too detailed ("door jammed").

In the next step, we need to analyze to what extent the context is relevant. For example, it could be useful to distinguish whether (1) the train starts with the doors open or (2) whether the doors have opened during the journey.

Now we can construct the fault tree by examining all the causes of failure. In the specific example, it could either be that the system mistakenly assumes that the doors are closed. Or that it mistakenly assumes that the train is not moving. It is sufficient for one of these two cases to occur.

Fault trees are usually graphically with the following notation (Source: Wikipedia):

We can now take this example a step further and investigate how one of these cases could occur. A banal approach would be to simply install two sensors, both of which could fail. In this case, both sensors would have to fail. And in such a way that both report the "door closed" signal in the open state.

We can now illustrate what has been described so far graphically, as shown in the cover picture.

We go to great lengths to make our system more secure. In the first step, we carry out a qualitative analysis with the aim of finding the components responsible for a failure.

Single point of failure and cut sets

Of interest are always "single points of failure", i.e. components whose failure alone would cause the negative event. If we had only installed one sensor, then that would be a single point of failure.

As a rule, we want to avoid single points of failure. In practice, however, this is not always possible. For example, an airplane wing breaking off would be a single point of failure, but it is unrealistic to install a second pair of wings.

In the second step, we look for cut sets. These are sets of components whose joint failure would cause the negative event to occur. There are, of course, many of these. In practice, the "minimal cut sets" are interesting, i.e. sets of as few components as possible.

In qualitative analysis, we work with probabilities of failure. To do this, we have to assign probabilities to elements of the tree. For example, the door sensor has a probability of failure. Unfortunately, reliable figures are often lacking here. Suppliers often have components in their range for which corresponding figures are available. At the corresponding price, of course.

We also have to be careful that we don't just have a general probability of failure, but a specific one. In this case, we are only interested in the case where the sensor reports "door closed". The fault case "Door open with door closed" is not of interest for this FTA.

Once we have collected all the probabilities of occurrence, we can calculate the overall probability of the top event occurring. The math behind this is simple. Due to the rather large fault trees in practice, this can only be done with the appropriate software tools.

FTA in practice

Back to the question: What is an FTA good for and what justifies the effort? There are two main application scenarios:

• FTA in development - Here, the FTA is used to meet compliance requirements, for example in aviation, where very strict regulations apply.
• FTA in the subsequent error analysis - If a certain failure occurs frequently during operation, an FTA can help to eliminate the problem in the long term, at least for systems of a certain complexity. Without an FTA, there is a risk that improvements will be made in the wrong place and the problem will not be eliminated in the long term.

Photo by Finn Mouth on Unsplash