Fault trees analysis

Fault-tree analysis is one of the most important methods to clarify the logical connection of a disturbance and the events which may have caused it. 

A continuation of this process of asking reversely directed questions aiming for each immediately preceding event or state, yields a variety of possible initiating events, the so-called basic events. In doing so some rules have to be observed  

This kind of plant design is also called single error forgiving or error tolerating design. For this purpose of identifying the error propagating pathways this qualitative use and evaluation of a fault tree analysis is especially suitable. 

In order to use fault trees for the quantitative determination of the probability of occurrence of the top event, probabilities and frequencies are attributed to the individual states and malfunctioning components. But also in this case certain rules must be obeyed  

The construction of fault trees is by far not a trivial task, but requires a lot of expert knowledge and experience. The quantification of fault trees is for the time being extremely problematic, because the available databases for the determination of unreliability data of components and other probability data need significant further development. However, the existing databases and subjective estimated values may be used if two different plant designs are to be compared with each other, as the absolute values at the end of the calculation are not of interest but, instead, their relative comparison. 

Fault tree analysis is a rigorous method that can be used to determine the PFOa g or to supplement better estimates of individual initiating causes or independent protection layers (IPLs) in LORA. Fault tree is a deductive method for identifying ways in which hazards can 

Safety integrity level (SIL) Target average probability of failure on demand (PFDa, g) Target risk reduction Factor (RRF) Target frequency of dangerous failures to perform the SIF (per hour) 

Layer of protection analysis (LOPA) Semi-quantitative 

Fault tree/Event tree analysis Quantitative 

Fault tree analysis (FTA) was developed by Bell Telephone Laboratories for the U.S. Air Force in 1962 and has been used as one of the primary system safety techniques since the system safety effort began. The Boeing Company was also an early pioneer in the use of fault tree analysis. 

Fault tree analysis is a very detailed analytical technique for determining the various ways in which a particular type of failure could occur. Fault tree analysis is based on the negative analytical trees discussed in Chapter 10 and uses the same event and gate symbols (Fig. 15-1). 

Rectangles are used as general event symbols, circles are used to show base events, and diamonds are used to show undeveloped terminal events. And gates are used to indicate that, in order to get an output, all inputs below that gate are required, and or gates are used to indicate that, in order to get an output, any one or any combination of the inputs is required. 

There are two basic approaches to fault tree analysis. The qualitative approach is used to determine, using deductive logic, the ways in which the undesired top event could occur. The quantitative approach adds reliability or probability of failure data. 

Fault tree analysis is one of the most meaningful system safety techniques available for systematically reducing the probability of an undesired event. It can also be one of the more expensive techniques because it requires a skilled and knowledgeable analyst and a considerable amount of time, especially if the project is complex and a quantitative approach is required. 

Fault tree analysis (FTA) provides a logical representation of many events and component failures that may combine to cause one critical event (e.g., pipeline explosion). It uses logic gates to show how basic events may combine to cause the critical top event. The top event would normally be a major hazard such as pipeline SCC as in the example shown in Fig. 12.10. The most commonly used tree symbols and gates used in the construction of fault trees are illustrated in Fig. 12.11 and briefly described here [12]  

Fault event (rectangle) System-level fault or undesired event. 

Conditional event (ellipse) Specific condition or restriction applied to a logic gate (mostly used with inhibit gate). 

Basic event (circle) Lowest event of examination which has the capability of causing a fault to occur. 

Undeveloped event (diamond) Failure which is at the lowest event of examination by the fault tree, but can be further expanded. 

FTA is a systematic, deductive failure analysis that focuses on a particular accident or undesired event called the top event and develops the underlying sequence of events leading to the top event. A separate FTA must be performed for each top event. 

The FTA method was originally developed to supplement a FMEA. Fault trees, in their original usage, were diagrams indicating how the data developed by FMEAs interact to cause a specific event. The FTA method is most effective in analyzing complex systems with a limited number of well-identified hazards. In most cases, FTAs are used to perform in-depth analyses of hazardous events identified by another hazard evaluation method. 

FTA is a deductive method that uses Boolean logic symbols (i.e., AND gates, OR gates) to break down the causes of the top event into basic equipment failures and human errors. The analysts begin with the top event and identify the causes and the logical relationships between the causes and the top event. Each of the causes, called intermediate events, is examined in the same manner until the basic causes for every intermediate event have been identified. 

The fault tree is a graphic representation of the relationships between basic events and the selected top event. Table 4.24 presents the standard symbols used in fault tree construction to show these relationships. 

A fault tree is, itself, a Boolean equation relating basic events to the top event. The equation can be analyzed quantitatively or qualitatively by hand or by using computer code(s). If it is analyzed quantitatively, the probabilities or frequencies of the intermediate events and the top event are calculated. If it is analyzed qualitatively, a list of the failure combinations that can cause the top event is generated. These combinations are known as cut sets. A minimal cut set (MCS) is the smallest combination of basic events that, if they occur or exist simultaneously, cause the top event. These combinations are termed minimal because all of the basic events in a MCS must occur if the top event is to occur. Thus, a list of MCSs represents the known ways the top event can occur, stated in terms of equipment failures, human errors, and associated circumstances. 

The method was developed in the early 1960s at the Bell Telephone Laboratories for performing analysis of fhe Minuteman Launch Confrol 

System [2,3]. Some of the main objectives of conducting FTA are as follows [3]  

There are many prerequisites associated with this method. Some of these prerequisites are as follows [3,12]  

FTA begins by identifying an undesirable event, called top event, associated with a system under consideration. Fault events that can cause the top event occurrence are generated and connected by logic operators such as OR and AND. The operator/gate OR provides a true output (i.e., fault) when one or more inputs (i.e., input faults) are true. Similarly, the operator/gate AND provides a true output (i.e., fault) when all the inputs (i.e., input faults) are true. 

A fault tree s construction proceeds by generating fault events in a successive manner imtil the fault events need not be developed any further. These fault events are known as primary or basic fault events. During the construction of a fault tree, a question that is asked over and over again is, How could this fault event occur  

A fault tree is a grapliic teclmique used to analyze complex systems. The objective is to spotlight conditions tliat cause a system to fail. Fault tree analysis attempts to describe how and why an accident or otlier undesirable event lias occurred. It may also be used to describe how and why an accident or otlier undesirable event could take place. Thus fault tree analysis finds wide application in hazard analysis and risk assessment of process and plant systems.  

Since one of tlie purposes of a fault tree analysis is tlie calculation of tlie probability of the top event, let A, B, and C represent tlie failure of pump A, tlie failure of pump B, and tlie failure of the control valve, respectively. Then if T represents the top event, no water flow, we can write 

Tliis equation indicates tliat T occurs if both A and B occur or if C occurs. Assume tliat A, B, and C are independent and P(A) = 0.01, P(B) = 0.005, and P(C) = 0.02. Tlien application of tlie addition tlieorem in Eq. (19.4.3) yields 

In connection witli fault trees, cut sets, and minimal cut sets are defined as follows. A cut set is a basic event or intersection of basic events that will cause the top event to occur. A minimal cut set is a cut set tliat is not a subset of any other cut set it may also be defined as the smallest combination of 

In tlie example represented by Eq. (20.7.1), AB and C are cut sets because if AB occurs tlien T occurs, and if C occurs then T occurs. Also, AB and C are minimal cut sets, since neitlier is a subset of the other. The event T described in Eq. (19.3.13) can be regarded as a top event represented as a union of cut sets. In Eq. (19.3.13) 

Although the FTA, by its very name, implies that it is primarily a tool for analyzing faults in a system or process, it is important to note that the FTA can also be used to evaluate the actions necessary to result in desired events, such as no accidents. By building a tree depicting all the events which must occur in order to realize that top event, the analyst can use the FTA as a method to construct the foundation of an 

Basic Guide to System Strfety, Third Edition. Jeffrey W. Vincoli. 

Basic Guide to System Safety, by Jeffrey W. Vincoli Copyright 2006 John Wiley Sons, Inc. 

Examples of system safety analyses include routine hazard spotting job safely analysis hazard and operability studies design safety analysis fault-tree analysis and stimulation exercises using a computer. 

Fault tree analysis is a technique that may be utilised to trace back through the chronological progression of causes and effects tirat have contributed to a particular event, whether it be an accident (industrial safety) or failure (system safety). 

The fault-tree is a logic diagram based on the principle of multicausality that traces all the branches of events that could contribute to an accident or failure. 

In constructing a fault-tree to assist in cause analysis, firstly the event - the accident or failure - must be identified. Secondly, all the proximate causes (contributory factors) must be investigated and identified. Thirdly, each proximate cause (i.e. each branch of a contributory factor) must be traced back to identify and establish all the conceivable ways in which each might have occurred. Each contributing factor or cause thus identified is then studied furflier to determine how it could possibly have happened, and so on, until the beginning or source of the chain of events has been highlighted for each branch of the fault-tree. 

Certain standard S5unbols are used in the construction of a fault-tree some of the more common are  

There are numerous methods and techniques developed in areas such as safety, reliability, and quality for conducting various types of analysis [23-25]. Some of these methods and techniques can also be used to perform rail safety analysis. These methods and techniques include fault-tree analysis, hazards and operability analysis, cause-and-effect diagram, interface safety analysis, failure modes and effect analysis, and Pareto diagram. One of these approaches (i.e., fault-tree analysis) is presented below, and information on other methods and techniques is available in Chapter 4 and in the literature [23-25]. 

This is a widely used method to perform safety and reliability analysis of engineering systems in industry. The method was developed in the early 1960s at the Bell Telephone Laboratories to perform safety analysis of the Minuteman launch control system, and it is described in Chapter 4 [24]. 

A Release from tank head B Release from tank wall C Release from midway cover D Tank shell fails due to end impact E Fire-related forces fail tank head F Crush load fails tank head G Puncture probe fails tank head H Accident occurs 

I Puncture load sufficient to fail tank head J Puncture strikes tank head 

A fault tree for the top event Release of liquefied chlorine from rail tank shell. 

The probability of occurrence of an event C depending on the simultaneous realization of two events A and B, that is, behind a logical gate AND , is the conditional probability of A AND B  

Figu re 1.8 Example fault tree analysis for the collision of a car with a deer. 

Since probabilities are comprised between zero and one and should be low figures, the conditional probability usually becomes extremely small. In other terms, an AND gate strongly reduces the probability of the occurrence of an event and it is advisable to design a safety system in order to provide such AND relationships before the top event 

The probability of occurrence of an event C, where only the realization of one parent event from A or B is required (behind an OR gate), the probability is the sum of probabilities of all parent events  

In this expression, the subtraction of the product of probabilities takes into account the fact that the simultaneous realization of both events is still taken into account in the realization of individual events. This correction is usually very small, since individual probabilities are small. 

Nothing is so easy as to deceive one s self for what we wish, that we readily believe. 

It is important to understand that this is not a model of all possible system failures or all possible causes, but rather, a model of particular system failure modes and their constituent faults that lead to the top event. Not all system or component failures are listed, only the ones leading to the top event. Like the other safety analysis techniques discussed previously, only credible faults are assessed. The faults can be events associated with component hardware failures, software glitches, human errors, and environmental conditions—in short, any of the elements that make up the complete system. 

System Safety Engineering and Risk Assessment A Practical Approach 

Dynamic FTA is used more commonly in computer systems fault analysis and involves employing Markov analysis to generate the tree. Dynamic fault trees are also frequently used to model fault-tolerant systems. The challenge is that the size of the tree grows very quickly and can be very cumbersome to manipulate. 

NASA succinctly defines (Stamatelatos et al., 2002) the process of conducting an FTA  

---

P. O. Chelsau, ReHabihty Computation Using Fault Tree Analysis, TR32-1542, NASA, Airport, Md., 1971. 

Methods for performing hazard analysis and risk assessment include safety review, checkhsts, Dow Fire and Explosion Index, what-if analysis, hazard and operabihty analysis (HAZOP), failure modes and effects analysis (FMEA), fault tree analysis, and event tree analysis. Other methods are also available, but those given are used most often. 

Fault Tree Analysis. Fault trees represent a deductive approach to determining the causes contributing to a designated failure. The approach begins with the definition of a top or undesired event, and branches backward through intermediate events until the top event is defined in terms of basic events. A basic event is an event for which further development would not be useful for the purpose at hand. For example, for a quantitative fault tree, if a frequency or probabiUty for a failure can be deterrnined without further development of the failure logic, then there is no point to further development, and the event is regarded as basic. 

It is important in fault tree analysis to consider only the nearest contributing event. There is always a tendency to jump immediately to the details, skipping all of the intermediate events. Some practice is required to gain experience in this technique. 

Process Hazards Analysis. Analysis of processes for unrecogni2ed or inadequately controUed ha2ards (see Hazard analysis and risk assessment) is required by OSHA (36). The principal methods of analysis, in an approximate ascending order of intensity, are what-if checklist failure modes and effects ha2ard and operabiHty (HAZOP) and fault-tree analysis. Other complementary methods include human error prediction and cost/benefit analysis. The HAZOP method is the most popular as of 1995 because it can be used to identify ha2ards, pinpoint their causes and consequences, and disclose the need for protective systems. Fault-tree analysis is the method to be used if a quantitative evaluation of operational safety is needed to justify the implementation of process improvements. 

Failure Mode and Ejfect Analysis (FMEA) This is a systematic study of the causes of failures and their effects. All causes or modes of failure are considered for each element of a system, and then all possible outcomes or effects are recorded. This method is usually used in combination with fault tree analysis, a quantitative technique. FMEA is a comphcated procedure, usually carried out by experienced risk analysts. 

Fault Tree Analysis Faiilt tree analysis permits the hazardous incident (called the top event) frequency to be estimated from a logic model of the failure mechanisms of a system. The top event is traced downward to more basic failures using logic gates to determine its causes and hkelihood. The model is based on the combinations of fail-... 

Frequency Estimation There are two primary sources for estimates of incident frequencies. These are historical records and the apphcation of fault tree analysis and related techniques, and they are not necessarily applied independently. Specific historical data can sometimes be usehiUy applied as a check on frequency estimates of various subevents of a fault tree, for example. 

In some instances, plant-specific information relating to frequencies of subevents (e.g., a release from a relief device) can be compared against results derived from the quantitative fault tree analysis, starting with basic component failure rate data. 

Identification and quantitative estimation of common-cause failures are general problems in fault tree analysis. Boolean approaches are generally better smted to mathematically handle common-cause failures. 

Layer of protection analysis (LOPA) is a simplified form of event tree analysis. Instead of analyzing all accident scenarios, LOPA selects a few specific scenarios as representative, or boundary, cases. LOPA uses order-of-magnitLide estimates, rather than specific data, for the frequency of initiating events and for the probability the various layers of protection will fail on demand. In many cases, the simplified results of a LOPA provide sufficient input for deciding whether additional protection is necessary to reduce the likelihood of a given accident type. LOPAs typically require only a small fraction of the effort required for detailed event tree or fault tree analysis. 

Design teehniques (for example, FMEA or Fault Tree Analysis (FTA))... 

Today there are many tools available to aid in problem solving or f ure analysis. These include the Weibull Analysis, Failure Mode i Effect Analysis, and Fault Tree Analysis, to name a few. One of the m widely accepted is the Weibull analysis. This method can provide accurate engineering analysis based on extraordinary small samples [1]. 

Recognized systematic approaches include hazard operability study (HAZOP) event tree analysis fault tree analysis. 

It is interesting that NASA in their review of WASH-1400 Draft (included in W.ASH-1400 Final Appendix II), indicated that they had discontinued the use of fault tree analysis in fas or of the FMEA. 

This section describes the most commonly used method for complex systems analysis - fault tree analysis. The previous section introduced cutsets as physically cutting through an RED, here, cuiscis. ire presented mathematically. The symbols of fault trees are introduced and a heuristic... 

A simple example of fault tree analysis applied to an internal combustion engine (Figure 3.4.4-2) is the Figure 3.4.4-3 fault tree diagram of how the undesired event "Low Cylinder Compression" may occur. The Boolean equation of this fault tree is in the caption of Figure 3.4.4-3. Let the occurrence of these events be represented by a 7, non-occurrence by 0, and consider that there may he a long history of occurrences with this engine. Several sets of occunrence.s (trials) are... 

A failure modes and effects analysis delineates components, their interaction.s ith each other, and the effects of their failures on their system. A key element of fault tree analysis is the identification of related fault events that can contribute to the top event. For a quantitative evaluation, the failure modes must be clearly defined and related to a numerical database. Component failure modes should be realistically and consistently postulated within the context of system operational requirements and environmental factors. 

Comptete all gate inputs. Beginning a new gate before completing a previous gate leads to confusion and incompleteness. These rules are made concrete by an example of fault tree analysis. 

The branching probability at a node is determined by either fault tree analysis of the event system or by data from operating experience. 

System reliability can be analyzed in a number of other ways. Objections to fault tree analysis are ... 

---