Fault trees

After all the causal events are listed on a fault tree, the FTA allows the analyst to evaluate each event separately or in combination with other events on the tree. This provides the user with a powerful tool capable of determining, through deduction, which event or set or events led to the top event. When more than one contributing event is identified, as is usually the case, their respective location on the fault tree is referred to as a cut set. Identification and qualification of one or multiple cut sets within a fault tree facilitates the evaluation process. Essentially, the cut set isolates specific events in the system and allows for a qualitative examination of the relationship between the set, as a whole, and its effect on the top event. 

When the likelihood of an event is known and a probability value has been assigned, then analysis of these events on a fault tree will also yield quantitative results. As cut sets are identified, the probability of occurrence as a result of cut set interactions can be quantified and the associated risk can be more readily evaluated. 

---

P. O. Chelsau, ReHabihty Computation Using Fault Tree Analysis, TR32-1542, NASA, Airport, Md., 1971. 

Methods for performing hazard analysis and risk assessment include safety review, checkhsts, Dow Fire and Explosion Index, what-if analysis, hazard and operabihty analysis (HAZOP), failure modes and effects analysis (FMEA), fault tree analysis, and event tree analysis. Other methods are also available, but those given are used most often. 

Fault Tree Analysis. Fault trees represent a deductive approach to determining the causes contributing to a designated failure. The approach begins with the definition of a top or undesired event, and branches backward through intermediate events until the top event is defined in terms of basic events. A basic event is an event for which further development would not be useful for the purpose at hand. For example, for a quantitative fault tree, if a frequency or probabiUty for a failure can be deterrnined without further development of the failure logic, then there is no point to further development, and the event is regarded as basic. 

Figure 4 shows a fault tree for a flat tire on an automobile. The top event, the flat tire, is broken down into two immediate contributing events, road debris and tire failure. The contributing event, road debris, is a basic event. This event, which caimot be broken down into other events unless additional information is provided, is enclosed in a circle to denote it as a basic event. The other event, tire failure, is enclosed in a rectangle to denote it as an intermediate event. 

These two events are related to each other through an OR gate, ie, the top event can occur if either road debris or tire failure occurs. Another type of gate is the AND gate, where the output occurs if and only if both inputs occur. OR gates are much more common in fault trees than AND gates, ie, most failures are related in OR gate fashion. 

Other considerations for fault tree constmction are (/) assume that faults propagate through normally operating equipment. Never assume that a fault is stopped by the miraculous failure of another piece of equipment. (2) Gates are coimected through labeled fault events. The output from one gate is never coimected directly into another. 

It is important in fault tree analysis to consider only the nearest contributing event. There is always a tendency to jump immediately to the details, skipping all of the intermediate events. Some practice is required to gain experience in this technique. 

The principal problem in using fault trees is that for reasonably compHcated processes the analysis is most likely to produce a huge fault tree. Eault trees involving hundreds or even thousands of intermediate events are not uncommon. The effort involved in fault tree development can also be substantial, requiring several years. 

Another problem for fault trees is the uniqueness of the result. Eault trees produced by two different teams of analysts most often show a different stmcture. However, this problem is reduced as the detail in the problem definition increases. 

The resulting fault tree is shown in Figure 6, in which the top event is defined in terms of two intermediate events failure of the tank system or failure of the pumping system. Failure in either system would contribute to the overall system failure. The intermediate events are then further defined in terms of basic events. All of the basic events are related by AND gates because the overall system failure requires the failure of all of the individual components. Failures of the tanks and pumps are basic events because, without additional information, these events cannot be resolved any further. 

Fig. 6. A fault tree for the pumped storage example of Figure 5. For a real system the tank and pump failures would be more precisely defined, or set as intermediate events having further definition by subsequent basic events and more detailed failure modes.

It is not coincidental that the top event of the fault tree is the initiating event for the event tree. The fault tree shows how an event is decomposed into basic events whereas an event tree demonstrates the effect of the various safety functions. The disadvantage of event trees is that the outcomes are difficult to predict. Thus the outcome of interest might not arise from the analysis. 

In the simplest terms, a fault-tree for risk analysis requires the following information probabiUty of detection of a particular anomaly for an NDE system, repair or replacement decision for an item judged defective, probabiUty of failure of the anomaly, cost of failure, cost of inspection, and cost of repair. Implementation of a risk-based inspection system should lead to an overall improvement in the inspection costs as well as in the safety in operation for a plant, component, or a system. Unless the database is well estabUshed, however, costs may fluctuate considerably. 

Process Hazards Analysis. Analysis of processes for unrecogni2ed or inadequately controUed ha2ards (see Hazard analysis and risk assessment) is required by OSHA (36). The principal methods of analysis, in an approximate ascending order of intensity, are what-if checklist failure modes and effects ha2ard and operabiHty (HAZOP) and fault-tree analysis. Other complementary methods include human error prediction and cost/benefit analysis. The HAZOP method is the most popular as of 1995 because it can be used to identify ha2ards, pinpoint their causes and consequences, and disclose the need for protective systems. Fault-tree analysis is the method to be used if a quantitative evaluation of operational safety is needed to justify the implementation of process improvements. 

ETA breaks down an accident iato its contributing equipment failures and human errors (70). The method therefore is a reverse-thinking technique, ie, the analyst begias with an accident or undesirable event that is to be avoided and identifies the immediate cause of that event. Each of the immediate causes is examined ia turn until the analyst has identified the basic causes of each event. The fault tree is a diagram that displays the logical iaterrelationships between these basic causes and the accident. 

The foUowiag symbols are used ia fault tree constmction to display the iaterrelationships between equipment failures and a specific accident ... 

The ENTERNAE or HOUSE event represeats a coaditioa or an event that is assumed to exist as a boundary condition for the fault tree. 

The TRANSFER IN symbol iadicates that the fault tree is developed further at the occurreace of the corresponding TRANSFER OUT symbol. 

Fault Tree Construction. Eault tree constmction begins at the TOP event and proceeds, level by level, until all fault events have been developed to their basic contributing causes (BASIC events). The analyst begins with the TOP event and, for the next level, determines the immediate. 

The immediate causes of the TOP event are shown in the fault tree with thek relationship to the TOP event. If any one of the immediate causes results dkecdy in the TOP event, the causes are connected to the TOP event with an OR logic gate. If all the immediate causes are requked for TOP event occurrence, then the causes are connected to the TOP event with an AND logic gate. Each of the immediate causes is then treated in the same manner as the TOP event, and its immediate, necessary, and sufficient causes are determined and shown on the fault tree with the appropriate logic gate. This development continues until all intermediate fault events have been developed into thek basic causes. 

Fault Tree Solution. Solving the fault tree means obtaining the minimal cut sets. The minimal cut sets are all the combinations of equipment failures that can result in the fault tree TOP event. Computer programs are requked to determine the minimal cut sets for large fault trees (72). The solution method has four steps ... 

J. B. EusseU, E. B. Henry, and H. N. MarshaU, MOCUS A Computer Program to Obtain Minimal Cut Sets from Fault Trees, Report 1156, Aerojet Nuclear Co., Idaho EaUs, Idaho, 1974. 

K. Parsaye and K. Y. Lin, "An Expert System Stmcture for Automatic Fault Tree Generation for Emergency Feedwater Systems for Nuclear Power Plants," in Proceedings of the Second IEEE Westex Conferences Anaheim, Calif., June, 1987. 

Failure Mode and Ejfect Analysis (FMEA) This is a systematic study of the causes of failures and their effects. All causes or modes of failure are considered for each element of a system, and then all possible outcomes or effects are recorded. This method is usually used in combination with fault tree analysis, a quantitative technique. FMEA is a comphcated procedure, usually carried out by experienced risk analysts. 

Fault Tree Analysis Faiilt tree analysis permits the hazardous incident (called the top event) frequency to be estimated from a logic model of the failure mechanisms of a system. The top event is traced downward to more basic failures using logic gates to determine its causes and hkelihood. The model is based on the combinations of fail-... 

Frequency Estimation There are two primary sources for estimates of incident frequencies. These are historical records and the apphcation of fault tree analysis and related techniques, and they are not necessarily applied independently. Specific historical data can sometimes be usehiUy applied as a check on frequency estimates of various subevents of a fault tree, for example. 

Once the fault tree is constructed, quantitative failure rate and probability data must be obtained for all basic causes. A number of equipment failure rate databases are available for general use. However, specific equipment failure rate data is generally lacking and. 

In some instances, plant-specific information relating to frequencies of subevents (e.g., a release from a relief device) can be compared against results derived from the quantitative fault tree analysis, starting with basic component failure rate data. 

---