Fault tree analysis (FTA) — top-down, AND - OR gates

This top-down approach contrasts with bottom-up methods (like FMEA) that start with component failures and work upward.

What Is Fault Tree Analysis?

Key components:

• Top Event: The system failure we're analyzing (e.g., "Loss of spacecraft attitude control")
• Intermediate Events: Subsystem failures that contribute to the top event
• Basic Events: Component-level failures (cannot be decomposed further in this analysis)
• Logic Gates: AND/OR/NOT gates showing how events combine

The Three Gate Types

For independent events, the output probability is 1 minus the probability that ALL inputs are safe.

AND Gate: Output occurs only if all inputs occur $P(\text{Output}) = \prod_{i=1}^{n} P_i$

The output probability is the product of all input probabilities (for independent events).

NOT Gate (Inhibit): Inverts the event $P(\text{Output}) = 1 - P(\text{Input})$

WHY these formulas?

• OR gate: The system fails if at least one path fails → complement of "none fail"
• AND gate: All conditions must be true simultaneously → joint probability
• For spacecraft, AND gates represent redundancy (good!), OR gates represent single points of failure (bad!)

How to Build a Fault Tree

Step 1: Define Top Event

[Top Event: Total Power Loss]

Step 2: Identify Immediate Causes (First Level) Total power loss happens if:

• Solar panels fail AND batteries fail (both must fail)

        [Total Power Loss]
               |
            [AND Gate]
           /         \
   [Solar Fail]   [Battery Fail]

WHY AND? We have redundancy—either source can power the craft.

Step 3: Decompose Solar Fail Solar panels fail if:

• Deployment mechanism jams OR
• Solar cells degrade beyond threshold OR
• Sun tracking system fails

    [Solar Fail]
         |
     [OR Gate]
    /    |    \
[Deploy] [Degrade] [Tracking]

WHY OR? Any single failure kills solar power—no redundancy here.

Step 4: Decompose Battery Fail Batteries fail if:

• Cell 1 fails AND Cell 2 fails (both battery banks must die)

    [Battery Fail]
         |
     [AND Gate]
       /     \
  [Cell1]  [Cell2]

Step 5: Reach Basic Events Stop when you hit events with known failure rates:

• [Deploy]: P = 0.001 (deployment mechanism jam)
• [Degrade]: P = 0.01 (solar degradation to <50% over mission)
• [Tracking]: P = 0.005 (sun sensor failure)
• [Cell1]: P = 0.02 (battery bank 1 failure)
• [Cell2]: P = 0.02 (battery bank 2 failure)

Complete Tree:

Quantitative Analysis: Computing Top Event Probability

Solar Fail (OR gate): $P_{\text{Solar}} = 1 - (1-0.001)(1-0.01)(1-0.005)$ $= 1 - (0.999)(0.99)(0.995) = 1 - 0.98405 = 0.01595 \approx 0.016$

Battery Fail (AND gate): $P_{\text{Battery}} = P_{\text{Cell1}} \times P_{\text{Cell2}} = 0.02 \times 0.02 = 0.0004$

Total Power Loss (AND gate): $P_{\text{Top}} = P_{\text{Solar}} \times P_{\text{Battery}} = 0.016 \times 0.0004 = 6.4 \times 10^{-6}$

Interpretation: 6.4 failures per million missions. The AND gate at top level (redundancy between solar/battery) drastically reduces risk!

Architecture:

• Two transponders (A, B) in cold redundancy
• One high-gain antenna (HGA)
• Loss occurs if: (Transponder A fails AND Transponder B fails) OR HGA fails

Fault Tree:

        [Loss of Comm]
              |
          [OR Gate]
         /         \
    [AND Gate]   [HGA Fail]
      /    \
  [Trans-A] [Trans-B]

Given:

• P(Trans-A) = 0.01
• P(Trans-B) = 0.01
• P(HGA) = 0.05

Calculate: $P(\text{Both Transponders}) = 0.01 \times 0.01 = 0.0001$ $P(\text{Top}) = 1 - (1 - 0.0001)(1 - 0.05)$ $= 1 - (0.9999)(0.95) = 1 - 0.94991 = 0.05009$

WHY this structure?

• Transponders in AND: redundancy is good (both must fail)
• OR with HGA: antenna is single point of failure (dominates the risk!)
• Insight: HGA drives 99.8% of the risk (0.05 vs 0.001). Focus reliability improvements there!

Common Mistakes in FTA

Steel-man the mistake: When we say "power fails if solar AND battery both fail," a student thinks "both failing is unlikely." TRUE! That's why we WANT AND gates. The confusion comes when analyzing "solar fails if tracking OR deployment fails"—here, OR means "either one alone kills it," which is WORSE.

The Fix:

• AND gate → Redundancy → Lower probability (multiply small numbers → smaller)
• OR gate → Single points of failure → Higher probability (add probabilities → larger)

Why It Feels Right: The formula is simpler, and we forget about shared dependencies.

The Fix:

• Identify common cause failures (CCF)
• Add separate basic events for shared components
• Example: If both transponders share a power regulator, add "Regulator Fail" as an OR input

Why It Feels Right: We want to finish the analysis.

The Fix: Keep decomposing until you reach events with measurable failure rates from databases (MIL-HDBK-217, NASA parts library). The level of resolution should match available reliability data.

When to Use FTA vs. Other Methods

FTA Strengths:

• Focuses effort on specific critical failures
• Reveals AND gates (good redundancy) vs OR gates (weak points)
• Quantitative probability calculation
• Visual logic structure

FTA Limitations:

• Requires knowing what failure to analyze (assumes you identified the top event)
• Can miss failures not connected to the chosen top event
• Time-dependent failures (sequence matters) hard to model

Connections to Spacecraft Design

James Webb Space Telescope:

• FTA for sunshield deployment (107 release mechanisms)
• Revealed massive OR gate structure (any mechanism fail → mission fail)
• Required per-mechanism reliability of 0.999+

IS Life Support:

• FTA for "Loss of cabin atmosphere"
• Redundant pumps/valves create AND gates
• Quantitative analysis justified triple redundancy in critical paths

Active Recall Practice

Fault Tree Analysis is drawing a picture of all the ways something bad (like a rocket losing power) can happen. You start with the bad thing at the top and keep asking "What would cause that?" until you get to simple parts that just break. Then you use AND and OR to show whether you have good backups (AND) or dangerous single problems (OR). The picture helps engineers see where to add more backups or make parts more reliable.

Redundancy creates AND gates = good armor.
Single points of failure create OR gates = one rupture ends the mission.

Connections

• Failure Modes and Effects Analysis (FMEA) - Bottom-up complement to FTA
• Reliability Block Diagrams - Success-oriented dual of fault trees
• Common Cause Failure Analysis - Handles shared dependencies in FTA
• Boolean Algebra and Logic Design - Mathematical foundation of gates
• Monte Carlo Reliability Simulation - Alternative probabilistic approach
• Spacecraft Redundancy Architectures - Designs that create AND gates
• Minimum Cut Sets - Smallest combinations that cause top event
• Single Point Failure Review - Finding OR gates connected to basic events

#flashcards/physics

What is the primary direction of Fault Tree Analysis? :: Top-down (deductive): starts with an undesired system-level event and works down to component-level causes

For independent events, what is the probability formula for an OR gate with inputs P₁, P₂, .., Pₙ? :: P(Output) = 1 - ∏(1 - Pᵢ), the complement of all inputs being safe

What is a common cause failure (CCF) in FTA? :: A single failure that affects multiple components simultaneously (e.g., shared power supply failure), violating independence assumptions

Concept Map

Hinglish (regional understanding)