Chapter 5.

Fault Tree Analysis (FTA)

Mary Ann Lundteigen Marvin Rausand

RAMS Group
Department of Mechanical and Industrial Engineering
NTNU

(Version 0.1)

Lundteigen& Rausand Chapter 5.Fault Tree Analysis (FTA) (Version 0.1) 1 / 19

 Introduction

Learning Objectives

The main learning objectives associated with these slides are to:
I Give an overview and brief introduction to fault tree analysis
I Describe the relationship between reliability block diagrams and fault
trees

The slides include topics from Chapter 5in Reliability of Safety-Critical

Systems: Theory and Applications. DOI:10.1002/9781118776353.

Lundteigen& Rausand Chapter 5.Fault Tree Analysis (FTA) (Version 0.1) 2 / 19

 Introduction

Outline of Presentation

1 Introduction

2 Fault Tree Basics

3 Qualitative Analysis

4 Quantitative Analysis

5 Common Cause Failures

6 Importance measures

Lundteigen& Rausand Chapter 5.Fault Tree Analysis (FTA) (Version 0.1) 3 / 19

 Fault Tree Basics

Fault Tree and Fault Tree Analysis

A fault tree (FT) is a top-down logical diagram that displays the

interrelationshos between a critical system event and its causes.

The main elements of a fault tree are:

I TOP event, which is the description of the critical system event
I Basic events, the are the lowest level of identified causes
I Logic gates, such as OR or AND gates, which gives the logical
relationship between the TOP event and the basic events
I There are also some additional symbols which are explained in the
textbook
Fault tree analysis is the qualitative and quantitative analyses that can be
carried out on the basis of a fault tree.

Lundteigen& Rausand Chapter 5.Fault Tree Analysis (FTA) (Version 0.1) 4 / 19

 Fault Tree Basics

Fault Tree Analysis Steps

Fault tree analysis is often carried out in five steps:

1. Definition of the problem, system, and boundary conditions of the
analysis
2. Construction of the fault tree
3. Identification of minimal cut sets
4. Qualitative analysis of the fault tree
5. Quantitative analysis of the fault tree

Lundteigen& Rausand Chapter 5.Fault Tree Analysis (FTA) (Version 0.1) 5 / 19

 Fault Tree Basics

Fault Tree vs Reliability Block Diagram

A fault tree may be converted into a reliability block diagram and vice verse,
as illustrated below.
(i) TOP

1 2 3

1 2 3

(ii) TOP 1

1 2 3 3

(iii) TOP

2
1
1 G1
3

2 3

Lundteigen& Rausand Chapter 5.Fault Tree Analysis (FTA) (Version 0.1) 6 / 19

 Fault Tree Basics

Minimal Cut Sets

Identification of minimal cutsets is one of the most important qualitative

analysis of a fault tree.

Z Cut set: A cut set in a fault tree is a set of basic events whose (si-
multaneous) occurrence ensures that the TOP event occurs.

Z Minimal cut set: A cut set that cannot be reduced without losing its
status as a cut set.

The TOP event occurs if one or more of the minimal cut sets occur.

Lundteigen& Rausand Chapter 5.Fault Tree Analysis (FTA) (Version 0.1) 7 / 19

 Fault Tree Basics

Fault tree modeling

Example

Consider the reliability block diagram of the SIF shown below:

PT1 PT2
SDV1
PT1 PT3 LS
SDV2
PT2 PT3

We can already now, on the basis of the fault tree, identify the minimal cut
sets (denoted Ci ):
C1 = {PT 1, PT 2}
C2 = {PT 1, PT 3}
C3 = {PT 2, PT 3}
C4 = {LS}
C5 = {SDV 1, SDV 2}
Lundteigen& Rausand Chapter 5.Fault Tree Analysis (FTA) (Version 0.1) 8 / 19
 Fault Tree Basics

Fault Tree Example

Consider a SIF that comprises three pressure transmitters (voted 2oo3), one logic solver, and
two shutdown valves (voted 1oo2). The critical event is that the pressure becomes to high,
due to a failure of the SIF. The corresponding fault tree can be as shown below.

Critical high pressure TOP event

in pipeline when description
outlet blocked

OR-gate
We can from this small fault tree identify
the following cut sets:
No signal about high Logic solver does not Shutdown valves
pressure from the transmit signal fail to close on
pressure transmitters about high pressure demand

LS
C1 = {PT 1, PT 2}

SDV 2 fails
C2 = {PT 1, PT 3}
PT 1 and PT 2 fail to PT 1 and PT 3 fail to PT 2 and PT 3 fail to 1
SDV fails to close
signal high pressure signal high pressure signal high pressure to close
C3 = {PT 2, PT 3}
SDV1 SDV2
AND-gate

C4 = {LS }
PT 1 fails to PT 1 fails to PT 1 fails to PT 3 fails to PT 2 fails to PT 3 fails to
signal high
pressure
signal high
pressure
signal high
pressure
signal high
pressure
signal high
pressure
signal high
pressure
C5 = {SDV 1, SDV 2}
Basic events
PT1 PT2 PT1 PT3 PT2 PT3 (description and symbols)

With larger and more complex fault trees we need to use special tools (implementing
algorithms for extraction) of minimal cut sets.

Lundteigen& Rausand Chapter 5.Fault Tree Analysis (FTA) (Version 0.1) 9 / 19

 Fault Tree Basics

Comparison with Reliability Block Diagram

The system on the previous slide may also be represented by reliability block diagram, as
seen below.

PT1 PT2
SDV1
PT1 PT3 LS
SDV2
PT2 PT3

With this simple structure, we identify easily the same minimal cut sets (denoted Ci ):

C1 = {PT 1, PT 2}
C2 = {PT 1, PT 3}
C3 = {PT 2, PT 3}
C4 = {LS}
C5 = {SDV 1, SDV 2}

Lundteigen& Rausand Chapter 5.Fault Tree Analysis (FTA) (Version 0.1) 10 / 19

 Fault Tree Basics

Fault Tree Symbols for koon Systems

The fault tree structure below indicates that the subsystem of pressure transmitters are
voted 2oo3.

Modified with gate symbol for koon:

Original structure:
No signal about high
No signal about high PT pressure from the
pressure from the pressure transmitters
PT
pressure transmitters
2/3

PT1 fails to PT2 fails to PT3 fails to

PT1 and PT2 fail to PT1 and PT3 fail to PT2 and PT3 fail to signal high pressure signal high pressure signal high pressure
signal high pressure signal high pressure signal high pressure
PT1 PT2 PT3

AND-gate

Note that the k/n gate is (n − k + 1)/n

PT1 fails to PT1 fails to PT1 fails to PT3 fails to PT2 fails to PT3 fails to
signal high signal high signal high signal high signal high signal high
pressure pressure pressure pressure pressure pressure

PT1 PT2 PT1 PT3 PT2 PT3 if it represents the failure of koon sys-
tem.

Lundteigen& Rausand Chapter 5.Fault Tree Analysis (FTA) (Version 0.1) 11 / 19

 Qualitative Analysis

Qualitative Analysis

Qualitative analysis of the fault tree may include:

I Analysis of minimal cut sets, including:
• To identify and verify any single points of failure?
• To identify that other main contributors (e.g. for minimal cutsets up to
order 3) seem correct
I Common cause and dependency analysis:
• This may include to check if logical events connected by local
AND-gates are independent
• Review minimal cut sets up to e.g order 3 to check if there are
dependencies and if they must be modelled

Lundteigen& Rausand Chapter 5.Fault Tree Analysis (FTA) (Version 0.1) 12 / 19

 Quantitative Analysis

Quantitative Analysis

I The TOP event occurs if one of the minimal cut sets occurs
I The main challenge is therefore to identify the minimal cut sets
I If all minimal cut sets were independent, we could calculate the the
probability of the top event by:
Yk
Q0 (t) = 1 − [1 − Q̌j (t)]
j=1
where Qj (t) is the failure probability of minimal cut set Cj :
Y
Q̌j (t) = qi (t)
i ∈Cj

Lundteigen& Rausand Chapter 5.Fault Tree Analysis (FTA) (Version 0.1) 13 / 19

 Quantitative Analysis

Upper Bound Approximation

I In reality, the minimal cut sets will not (normally) be independent,

since the same basic event may belong to the several minimal cut sets.
I This type of dependency is called positive dependency, which increases
the reliability.
I This “double counting” of basic events results in a higher failure
probability of the TOP event, and consequently, we can claim that
“true” TOP event failure probability will be lower than:
Yk
Q0 (t) ≤ 1 − [1 − Q̌j (t)]
j=1
and we can therefore use this formula as a conservative approximation
for the calculations.

Lundteigen& Rausand Chapter 5.Fault Tree Analysis (FTA) (Version 0.1) 14 / 19

 Quantitative Analysis

Failure Probabilities at Basic Event Level

Consider the state of the basic event i, Ei . The choice of failure probability is
dependent on the following factors:
I Alternative 1: The item is in continuous operation and non-repairable.

In this case we may be interested in the probability that item i has

failed at time t, qi (t),which is:

qi (t) = Pr[Ei (t)] = Pr (T < t)

If we assume exponential time to failure, qi (t) becomes:

qi (t) = 1 − e−λi t

Lundteigen& Rausand Chapter 5.Fault Tree Analysis (FTA) (Version 0.1) 15 / 19

 Quantitative Analysis

Failure Probabilities at Basic Event Level

I Alternative 2: The item is in continuous operation and repairable.

We assume that the item runs to failure and is then repaired. In this
case, we may want to determine the mean unavailability of the item:
MTTRi
qi = ≈ λ i MTTRi
MTTFi + MTTRi
where MTTRi is the mean time after the failure, and MTTFi is the
mean time to failure.
Note that we here have assumed (again) exponentially distributed time
to failure so that 1/MTTFi = λ i

Lundteigen& Rausand Chapter 5.Fault Tree Analysis (FTA) (Version 0.1) 16 / 19

 Quantitative Analysis

Failure Probabilities at Basic Event Levels

I Alternative 3: The item is normally passive and therefore subject to

regular testing and repair.

In this case, we may want to choose the mean unavailability or mean

downtime due to a hidden failure:
λ iτ
qi = + Pr(Failure found) · Mean repair time
2
λ iτ MRTi
≈ + λ iτ
2 τ
I Note that λ i in this case represents the dangerous undetected (DU)
failures, and that the mean down time due to other failure categories
may need to be added in addition.

Lundteigen& Rausand Chapter 5.Fault Tree Analysis (FTA) (Version 0.1) 17 / 19

 Common Cause Failures

Inclusion of Common Cause Failures (CCFs)

There are mainly three strategies to modeling CCFs in relation to fault tree
analysis:
1. Include in FT (explicit): Model each CCF cause as a separate basic
event that may lead to the failure of several items
2. Include in FT (implicit): Model a CCF as a basic event that covers
several causes that may lead to the failure of several items
3. Exclude from FT: Add the contribution from CCFs in the quantification
after the minimal cut sets have been extracted.
The last option may be favorable when the system complexity is high, and
where dependency may exist between basic events at different levels and
section of the fault tree.

Lundteigen& Rausand Chapter 5.Fault Tree Analysis (FTA) (Version 0.1) 18 / 19

 Importance measures

Important Measures

Several importance measures have been developed to measure the relative

importance of basic events. One of particular importance is the Birnbaum
measure, where the relative importance of basic event i is measures by:

δ Q0 (t)
I B (i|t) =
δ qi (t)

This may also be calculated more easily as:

I B (i|t) = Q0 (t|Ei (t) = 1) − Q0 (t|Ei (t) = 0)

Lundteigen& Rausand Chapter 5.Fault Tree Analysis (FTA) (Version 0.1) 19 / 19