Build fault trees with AND/OR gates and calculate minimal cut sets, top event probability, and Birnbaum/FV importance measures in real time. Safety analysis support tool compliant with IEC 61508.
What exactly is a "fault tree"? I see the simulator has a "Top Gate" and "Intermediate Gate" with AND/OR options. Is it like a flowchart of things that can go wrong?
🎓
Basically, yes! It's a top-down diagram that maps out how a system failure (the "Top Event") can be caused by combinations of lower-level failures. The gates you see—AND and OR—are the logic connectors. For instance, a car's airbag failing to deploy (Top Event) might require an AND gate: "Sensor Fails" AND "Igniter Fails". Try setting the Top Gate to AND in the simulator to see how it combines probabilities.
🙋
Wait, really? So if I use an OR gate for the Top Event, does that mean any single failure below can cause the whole system to fail? That seems less reliable.
🎓
Exactly right. An OR gate represents a single-point-of-failure scenario, which is generally less robust. In practice, safety-critical systems are designed to avoid these. A common case is a backup generator: "Power Grid Fails" OR "Backup Generator Fails" causes a blackout. Change the Top Gate to OR and adjust the branch failure probabilities above to see how the top event probability becomes much more sensitive to a single component.
🙋
Okay, I get the gates. But what are these "Minimal Cut Sets" the tool calculates? And what's an "Importance Measure"?
🎓
Great questions! A Minimal Cut Set is the smallest combination of basic failures that, if they all occur, cause the Top Event. It's the core "recipe for disaster." The tool finds these automatically. Importance Measures, like Birnbaum, tell you which basic failure is most critical to fix. It answers: "If I improve this one component's reliability, how much does the overall system safety improve?" Try building a tree with an Intermediate OR gate and watch how the Birnbaum importance values change as you move the probability sliders.
Physical Model & Key Equations
The core of FTA is calculating the probability of the Top Event ($Q_{top}$) based on the probabilities of basic events ($Q_i$) and the logic gates connecting them. For independent events, the formulas are:
$$Q_{top}^{OR}= 1 - \prod_{i=1}^{n}(1-Q_i)$$
This is for an OR gate, where any input event causes the output. The product $\prod(1-Q_i)$ is the probability that none of the events happen, so one minus that gives the probability at least one happens.
For an AND gate, all input events must occur for the output to occur.
$$Q_{top}^{AND}= \prod_{i=1}^{n}Q_i$$
Here, $Q_i$ is the failure probability of basic event $i$. The Birnbaum Importance Measure $I_B^{(i)}$ quantifies the sensitivity of the top event probability to changes in a basic event's reliability. It's the partial derivative of the system failure probability with respect to the component's failure probability.
A high Birnbaum value means that component is a major leverage point for improving system safety.
Frequently Asked Questions
Use an AND gate when the output occurs only if all input events happen simultaneously (e.g., all redundant systems fail), and use an OR gate when the output occurs if any one input event happens (e.g., a single failure causes system shutdown). Selecting the wrong gate can significantly change probability calculation results, so accurately model the system's logical relationships.
A minimal cut set is the smallest combination of basic events required to cause the top event. Since it does not include redundant events, it makes it easier to identify system weaknesses. In this tool, minimal cut sets are automatically enumerated, and by checking the probability contribution of each cut set, you can prioritize efficient risk reduction measures.
Birnbaum importance indicates the sensitivity (impact) of the top event probability to changes in the probability of a basic event, while Fussell-Vesely importance indicates the relative contribution of that event to the top event probability. Generally, use Birnbaum importance for predicting the effect of design changes, and use Fussell-Vesely importance for prioritizing current risk factors.
This tool calculates the top event probability through fault tree analysis, but SIL evaluation requires comparison with target probabilities and consideration of hardware fault tolerance (HFT). By comparing the top event probability obtained from the tool with the SIL tables in IEC 61508 (e.g., SIL3 corresponds to 10^-8 to 10^-7), it can support the determination of the SIL level.
Real-World Applications
Automotive Functional Safety (ISO 26262): Engineers use FTA to determine the Automotive Safety Integrity Level (ASIL) for systems like braking or steering. By modeling fault trees, they can prove that the probability of a hazardous event is below the required threshold, such as 10⁻⁸ failures per hour for the most severe ASIL D.
Aerospace & Defense (MIL-STD-1629A): This military standard formalizes FTA for aircraft and weapon systems. A classic case is analyzing the failure conditions for a flight control computer, identifying which combinations of sensor and processor faults could lead to loss of control.
Process Industry Safety (PHA - Process Hazard Analysis): In chemical plants, FTA models scenarios like reactor overpressure. An AND gate might combine "Pressure Relief Valve Stuck" and "High Temperature Alarm Failure" to find if sufficient independent protection layers exist to prevent an explosion.
Nuclear Power Plant Safety: Probabilistic Risk Assessment (PRA) relies heavily on FTA to quantify core damage frequency. It helps answer questions like, "What is the probability that both the main cooling and the emergency core cooling systems fail simultaneously?"
Common Misconceptions and Points to Caution
First, the assumption that "a low probability means it's okay" is dangerous. For example, if you have five basic events each with a probability of 0.001 (1 in 1000) connected by an AND gate, the top event probability becomes $0.001^5 = 10^{-15}$, which is extremely small. However, if these are connected by an OR gate, the probability jumps to approximately 0.005. Misunderstanding the gate logic can lead to underestimating risk, so be careful.
Next, consider the basis for setting basic event probabilities. Don't just move sliders arbitrarily; set them based on real data (failure rate databases, your company's maintenance records) or expert judgment. Using "0.1 for now because I'm not sure" will make the resulting importance measures unrealistic. When data is lacking, a practical approach is to run simulations using three-point estimates (optimistic/most likely/pessimistic) to see the range of possible outcomes.
Finally, note that "minimal cut sets" are not necessarily "physically independent failure paths". For instance, "power loss" and "software freeze" are different basic events, but they could occur simultaneously due to a common cause (e.g., a lightning surge). An FTA that doesn't consider this "common cause failure" underestimates reality. When you look at the cut set list from the simulator, get into the habit of questioning, "Are these truly independent?"