Fault Tree Analysis (FTA): A Deductive approach - Part 1
- Koushik Diwakaruni
- Jul 8
- 4 min read
Before a passenger jet, a nuclear reactor, or a car's braking system is ever trusted with human lives, engineers sit down and ask a simple question: what would have to go wrong for this to fail catastrophically? Not "will it fail," but "what exact combination of smaller faults would it take." Answering that question rigorously is the job of Fault Tree Analysis (FTA), one of the most widely used safety and reliability techniques in engineering.
What is an FTA ?
Fault Tree Analysis is a top-down, deductive method. You start at the top, the failure you most want to avoid, and work backwards to all the ways it could happen. That undesired outcome is called the top event: "loss of braking," "reactor overheats," "drone loses navigation." From there you branch downward through layers of contributing faults until you reach basic events, the root causes you can't or don't need to break down further, like "sensor fails" or "connector corrodes."
The result is a tree-shaped logic diagram that reads from the catastrophe at the top down to the small, concrete failures at the bottom. It's "deductive" because you reason from the general (system failure) to the specific (component faults).
FTA Origin: A technique born from missiles and reactors
FTA was developed originally in 1962 by H.A. Watson at Bell Labs, under a U.S. Air Force contract to evaluate the launch-control system of the Minuteman intercontinental ballistic missile. Boeing engineers quickly saw its broader potential and expanded its use. The method then found a permanent home in the nuclear power industry, especially after the 1979 Three Mile Island accident, which led the U.S. Nuclear Regulatory Commission to publish the landmark Fault Tree Handbook (NUREG-0492) in 1981. Today it's standardized internationally as IEC 61025 and embedded in safety standards across aerospace, automotive, and beyond.
The building blocks: events and gates
A fault tree is built from just two kinds of symbols: events - the shapes that represent things that can happen, and the logic gates that connect them, which define how lower events combine to cause higher ones. Together they form the vocabulary of every fault tree you'll ever read.
Events: the shapes that represent failures
Events describe what goes wrong at each level of the tree.
The top event is the single undesired outcome the whole analysis is built around - the hazard at the very top, drawn as a rectangle (say, "unintended vehicle acceleration").
An intermediate event, also a rectangle, is a failure produced when lower-level events combine through a gate, it's a stepping stone between the top event and the root causes.
A basic event, drawn as a circle, is a root-level fault that needs no further breakdown, for example a component that fails, a human error, an environmental condition.
An undeveloped event, drawn as a diamond, is a fault that could be expanded but isn't, either because information is lacking or because its contribution is too small to matter.
Finally, a transfer symbol (a triangle), links one part of a large tree to another, so a sprawling diagram can be split across pages without losing its logic.
Gates: the logic that connects them
Gates define how lower events combine to produce the event above them, and two of them do most of the work.
An AND gate passes failure upward only if all of its inputs occur, the logic of redundancy: if a system has two independent pumps and needs both to fail before flow is lost, those failures sit under an AND gate.
An OR gate passes failure upward if any single input occurs, like a lone critical sensor, one fuel line, anything where one fault by itself is enough, lives under an OR gate. That one distinction is the heart of reliability engineering: OR gates are where a system is fragile (single points of failure), while AND gates are where it's robust (it takes several faults at once).
A few specialized gates round out the set: a voting (k-out-of-n) gate fires when a set number of inputs fail, such as 2 of 3 redundant channels
An inhibit gate passes failure only when a specific condition is met
A priority-AND gate requires its inputs to fail in a particular sequence.
Cut sets: finding the weak points
Once a tree is built, the real answer comes from finding its minimal cut sets. A cut set is any combination of basic events that, together, cause the top event. A minimal cut set is the smallest such combination, remove any one event from it and the failure no longer happens.
A cut set containing a single basic event is a single point of failure, meaning one fault, on its own, sinks the system. Those are the critical problems every safety engineer hunts for. A cut set requiring four simultaneous failures is, by contrast, unlikely. Listing the cut sets turns a sprawling diagram into a map/table of where a design is weakest.
Comments