Fault tree analysis (FTA) — top-down, AND - OR gates: Exercises

This page is a self-test ladder. Work each problem with pen and paper FIRST, then open the collapsible solution. The difficulty climbs from recognising gates to synthesising whole trees. Every symbol used here is built in the parent FTA note; if a formula feels unfamiliar, re-read that note before continuing.

Definition The Two Gate Symbols (Shape Conventions)

Fault trees are drawn with two standard shapes. You must be able to recognise them by shape, not just colour:

OR gate — drawn as a curved, pointed "shield" shape (a chevron with a curved bottom edge). Mnemonic: the curved bottom looks like a wide-open mouth that swallows any single input. Any input → output.
AND gate — drawn as a flat-bottomed dome (a semicircle / "D" lying on its straight edge). Mnemonic: the flat base is a solid floor that only breaks if every pillar beneath it gives way. All inputs → output.

On the figures in this page each gate box is also labelled in words ("OR" / "AND") and colour-coded, so you never have to rely on colour alone. Colours used: OR = orange, AND = green for inner branches and red for the top event, basic events = blue. The word label inside every box is the authoritative cue.

Look at the figure: the left panel (an AND gate, flat-bottomed dome, labelled "AND") multiplies small numbers so the output shrinks (redundancy = good); the right panel (an OR gate, curved shield, labelled "OR") stacks vulnerabilities so the output grows (single points of failure = bad). Read the word labels, not just the colours. Keep this mental image; every answer below is just this picture, repeated.

Level 1 — Recognition

Exercise 1.1 (L1)

A subsystem fails if either a fuse blows or a relay sticks. Which gate connects these two basic events under the subsystem-failure node — AND or OR?

Recall Solution 1.1

The word "either… or…" means any one alone is enough to cause the failure. That is the OR gate (curved-shield shape). No redundancy exists: a single fault is fatal. Answer: OR gate.

Exercise 1.2 (L1)

Two identical pumps supply coolant. The cooling system only fails if both pumps fail. Which gate?

Recall Solution 1.2

"Both must fail" = all inputs required = AND gate (flat-bottomed dome shape). This is redundancy: one working pump saves the system. Answer: AND gate.

Exercise 1.3 (L1)

A basic event has failure probability $P = 0.02$ . What is its survival probability (probability it does not fail)?

Recall Solution 1.3

Survival = "the complement" = $1 - P$ . WHY: every event either happens or does not, and those two possibilities must sum to $1$ , so "does not happen" is whatever is left after subtracting the failure chance. $1 - 0.02 = 0.98$ Answer: 0.98.

Level 2 — Application

Exercise 2.1 (L2)

An OR gate has two independent inputs with $P_{1} = 0.1$ and $P_{2} = 0.2$ . Compute the output probability.

Recall Solution 2.1

WHAT we do: apply the OR formula. WHY: an OR gate fires if at least one input fails, and "at least one" is easiest to count as the complement of "none fail". The chance that none fail is the product of the survival terms $(1 - P_{i})$ , so the output is $1 - \prod (1 - P_{i})$ . $P_{out} = 1 - (1 - 0.1) (1 - 0.2) = 1 - (0.9) (0.8) = 1 - 0.72 = 0.28$ Answer: 0.28. Sanity check: bigger than either input ( $0.28 > 0.2$ ) — correct, since an OR gate accumulates risk.

Exercise 2.2 (L2)

An AND gate has three independent inputs, each with $P = 0.05$ . Compute the output.

Recall Solution 2.2

WHAT we do: apply the AND formula. WHY: an AND gate fires only when all inputs fail simultaneously. For independent events the probability of several things happening together is the product of their individual probabilities, so we multiply the three inputs. $P_{out} = 0.05 \times 0.05 \times 0.05 = 0.000125 = 1.25 \times 1 0^{- 4}$ Answer: $1.25 \times 1 0^{- 4}$ . Sanity check: far smaller than any single input — correct, AND suppresses risk.

Exercise 2.3 (L2)

An OR gate has three independent inputs: $P_{1} = 0.001$ , $P_{2} = 0.01$ , $P_{3} = 0.005$ . Compute the output (this is the "Solar Fail" branch from the parent note).

Recall Solution 2.3

WHY the OR formula again: the solar branch dies if any one of deploy, degrade, or tracking fails — a classic "at least one" question — so we take $1$ minus the chance that all three survive, i.e. $1 - \prod (1 - P_{i})$ . $P_{out} = 1 - (1 - 0.001) (1 - 0.01) (1 - 0.005)$ $= 1 - (0.999) (0.99) (0.995)$ Multiply step by step: $0.999 \times 0.99 = 0.98901$ , then $0.98901 \times 0.995 = 0.98406...$ $P_{out} = 1 - 0.98406 = 0.01594 \approx 0.016$ Answer: $\approx 0.016$ .

Level 3 — Analysis

Exercise 3.1 (L3)

Communication system (from parent note): Loss of Comm occurs if (Transponder A AND Transponder B) fail, OR the high-gain antenna (HGA) fails. Given $P (A) = 0.01$ , $P (B) = 0.01$ , $P (HGA) = 0.05$ , compute $P_{Top}$ and state which basic event dominates the risk.

Recall Solution 3.1

Step 1 — inner AND, WHY: the two transponders are redundant, so the branch fails only if both fail together → multiply. $P_{branch} = 0.01 \times 0.01 = 0.0001$ Step 2 — outer OR, WHY: the top event fires if either the transponder branch fails or the HGA fails — an "at least one" combination — so use $1 - \prod (1 - P_{i})$ with the branch value feeding in as one input. $P_{Top} = 1 - (1 - 0.0001) (1 - 0.05) = 1 - (0.9999) (0.95)$ $= 1 - 0.949905 = 0.050095 \approx 0.0501$ Answer: $\approx 0.0501$ . Dominant event: the HGA contributes $0.05$ while the whole transponder branch contributes only $0.0001$ — the HGA drives roughly $99.8%$ of the risk. Reliability effort belongs on the antenna. See Single Point Failure Review.

Exercise 3.2 (L3)

For the same tree, suppose we could either (a) halve $P (HGA)$ to $0.025$ , or (b) halve each transponder to $0.005$ . Which change reduces $P_{Top}$ more?

Recall Solution 3.2

Option (a): $P_{Top} = 1 - (1 - 0.0001) (1 - 0.025) = 1 - (0.9999) (0.975) = 1 - 0.9749025 = 0.0250975 \approx 0.0251$ . Option (b): inner AND $P_{branch} = 0.005 \times 0.005 = 0.000025$ ; then $P_{Top} = 1 - (1 - 0.000025) (1 - 0.05) = 1 - (0.999975) (0.95) = 1 - 0.94997625 = 0.05002375 \approx 0.0500$ . Option (a) drops the top from $0.0501$ to $0.0251$ (a huge win); option (b) barely moves it ( $0.0501 \to 0.0500$ ). Answer: Fix the HGA (option a). Improving an already-redundant branch is nearly wasted effort.

Exercise 3.3 (L3)

A tree's top event is an OR of two branches: Branch-1 $= 0.02$ and Branch-2 $= 0.03$ . A designer adds a redundant copy of Branch-1, turning that leg into an AND of two identical $0.02$ events. Compute the new top probability and the fractional risk reduction.

Recall Solution 3.3

New Branch-1 (AND of two $0.02$ ): $P_{branch} = 0.02 \times 0.02 = 0.0004$ . Old top: $P_{Top} = 1 - (1 - 0.02) (1 - 0.03) = 1 - (0.98) (0.97) = 1 - 0.9506 = 0.0494$ . New top: $P_{Top} = 1 - (1 - 0.0004) (1 - 0.03) = 1 - (0.9996) (0.97) = 1 - 0.969612 = 0.030388 \approx 0.0304$ . Reduction: $(0.0494 - 0.0304) /0.0494 = 0.0190/0.0494 = 0.3846 \approx 38.5%$ . Answer: new top $\approx 0.0304$ ; risk cut by $\approx 38.5%$ .

Level 4 — Synthesis

Exercise 4.1 (L4)

Build and quantify a fault tree from this description:

"Attitude control is LOST if the reaction wheels fail AND the thrusters fail. The reaction wheels fail if any of three wheels (W1, W2, W3) fails. The thrusters fail if the fuel line clogs OR both thruster valves (V1, V2) fail." Given $P (W_{i}) = 0.03$ each, $P (clog) = 0.004$ , $P (V 1) = P (V 2) = 0.1$ . Compute $P_{Top}$ .

The tree you should draw looks like this — study it alongside the calculation:

In the figure, the top box (flat-bottomed AND dome, labelled "AND", red) means both major branches must die; each OR box (curved shield, labelled "OR", orange) means any child kills that branch; the inner AND box (labelled "AND", green) combines the two valves. Every box carries its word label, so follow the labels — the colours are only a secondary cue.

Recall Solution 4.1

Step 1 — Wheels branch (OR of 3), WHY: any single wheel failing loses the branch → "at least one" → $1 - \prod (1 - P)$ . $P_{branch,W} = 1 - (1 - 0.03)^{3} = 1 - 0.9 7^{3} = 1 - 0.912673 = 0.087327$ Step 2 — Valves branch (AND of 2), WHY: both valves must fail together → multiply. $P_{branch,V} = 0.1 \times 0.1 = 0.01$ . Step 3 — Thruster branch (OR of clog and valves-branch), WHY: thrusters die if the clog or the valve pair fails → "at least one" → $1 - \prod (1 - P)$ . $P_{branch,T} = 1 - (1 - 0.004) (1 - 0.01) = 1 - (0.996) (0.99) = 1 - 0.98604 = 0.01396$ Step 4 — Top (AND of wheels and thrusters), WHY: attitude is lost only if both independent branches fail together → multiply. $P_{Top} = P_{branch,W} \times P_{branch,T} = 0.087327 \times 0.01396 = 0.0012191 \approx 1.22 \times 1 0^{- 3}$ Answer: $\approx 1.22 \times 1 0^{- 3}$ . Note the wisdom of the design: the top AND gate ties two independent, moderately unreliable branches together, dragging the mission risk down to about one in 820. See Spacecraft Redundancy Architectures.

Exercise 4.2 (L4)

For the tree in 4.1, list the minimal cut sets — the smallest combinations of basic events that alone cause the top event. (A cut set is a set of events whose simultaneous occurrence guarantees the top event; it is minimal if removing any member breaks it.)

Recall Solution 4.2

The top is AND(Wheels, Thrusters). So every cut set must contain (a wheel-failure) and (a thruster-side failure).

Wheels branch is OR(W1,W2,W3) → any single $W_{i}$ fails the wheels.
Thrusters branch is OR(clog, AND(V1,V2)) → either "clog" alone, or "V1 and V2 together".

Combining, the minimal cut sets are: ${W_{1}, clog}, {W_{2}, clog}, {W_{3}, clog},$ ${W_{1}, V_{1}, V_{2}}, {W_{2}, V_{1}, V_{2}}, {W_{3}, V_{1}, V_{2}}$ That is 3 two-element cut sets and 3 three-element cut sets = 6 minimal cut sets total. See Minimum Cut Sets for the formal algorithm.

Level 5 — Mastery

Exercise 5.1 (L5) — Common Cause Failure

Two transponders A and B are in AND-redundancy, each $P = 0.01$ , so naively $P_{branch} = 0.0001$ . But both draw from the same power regulator, which fails with $P_{R} = 0.008$ and guarantees both transponders die. Model this correctly and compute the true branch probability. By what factor does ignoring the common cause understate the risk?

Recall Solution 5.1

WHY the naive number is wrong: $P_{branch} = P_{A} P_{B}$ assumes independence, but the shared regulator makes A and B fail together whenever it dies. That shared path is a common cause failure (CCF). Correct model, WHY OR: the transponder branch fails if (A fails AND B fails independently) OR (regulator fails) — an "at least one" combination of two independent contributors — so we OR them with $1 - \prod (1 - P)$ : $P_{branch} = 1 - (1 - P_{A B}) (1 - P_{R}) = 1 - (1 - 0.0001) (1 - 0.008)$ $= 1 - (0.9999) (0.992) = 1 - 0.99180 = 0.008199 \approx 8.20 \times 1 0^{- 3}$ Understatement factor: $\frac{0.008199}{0.0001} = 81.99 \approx 82$ . Answer: true branch probability $\approx 8.20 \times 1 0^{- 3}$ ; the naive estimate is $\approx 82 \times$ too optimistic. The regulator, not redundancy, now dominates — the whole point of Common Cause Failure Analysis.

Exercise 5.2 (L5) — Design to a Requirement

A single-string branch has an OR of two basic events, $P_{1} = 0.04$ and $P_{2} = 0.04$ . The requirement is $P_{branch} \leq 1 \times 1 0^{- 3}$ . If you make the entire branch $k$ -fold redundant (an AND of $k$ independent identical copies of that OR-branch), what is the smallest $k$ that meets the requirement?

Recall Solution 5.2

Single branch value, WHY OR: the branch fails if either basic event fires → "at least one" → $q = 1 - (1 - 0.04)^{2} = 1 - 0.9216 = 0.0784$ . $k$ -fold AND of identical branches, WHY multiply: with $k$ independent copies the whole thing fails only if all copies fail together → $P_{branch} = q^{k} = 0.078 4^{k}$ . Require $0.078 4^{k} \leq 1 0^{- 3}$ . Take logarithms (log undoes exponentiation, letting us solve for $k$ ): $k \geq \frac{l n ( 1 0 ^{- 3} )}{l n ( 0.0784 )} = \frac{- 6.9078}{- 2.5459} = 2.713$ Since $k$ must be a whole number, round up: $k = 3$ . Verify: $0.078 4^{3} = 4.82 \times 1 0^{- 4} \leq 1 0^{- 3}$ ✓ (while $0.078 4^{2} = 6.15 \times 1 0^{- 3} > 1 0^{- 3}$ ✗). Answer: $k = 3$ (triple redundancy).

Exercise 5.3 (L5) — Full System Roll-up

A power system: Top = AND(Solar, Battery). Solar = OR(deploy $0.001$ , degrade $0.01$ , tracking $0.005$ ). Battery = AND(cell1 $0.02$ , cell2 $0.02$ ). Compute $P_{Top}$ , then decide: to cut the top risk in half, is it better to add a third battery cell (AND) or add a redundant solar array (turning Solar into an AND of two identical solar OR-branches)?

Recall Solution 5.3

Baseline. Solar branch, WHY OR: any of deploy/degrade/tracking loses solar → $1 - \prod (1 - P)$ : $P_{branch,Solar} = 1 - (0.999) (0.99) (0.995) = 0.015940$ Battery branch, WHY AND: both cells must die → multiply: $P_{branch,Battery} = 0.02 \times 0.02 = 0.0004$ Top, WHY AND: power is lost only if both solar and battery branches fail together → multiply: $P_{Top} = 0.015940 \times 0.0004 = 6.376 \times 1 0^{- 6}$ Option A — third battery cell (AND of three $0.02$ ), WHY: a third redundant cell means all three must fail → $P_{branch,Battery} = 0.0 2^{3} = 8 \times 1 0^{- 6}$ . $P_{Top}^{A} = 0.015940 \times 8 \times 1 0^{- 6} = 1.2752 \times 1 0^{- 7}$ Option B — redundant solar (AND of two identical $0.015940$ branches), WHY: two independent solar arrays both must fail → square the branch value: $P_{branch,Solar}^{B} = 0.01594 0^{2} = 2.5408 \times 1 0^{- 4}$ $P_{Top}^{B} = 2.5408 \times 1 0^{- 4} \times 0.0004 = 1.0163 \times 1 0^{- 7}$ Comparison. Half of the baseline is $\frac{1}{2} (6.376 \times 1 0^{- 6}) = 3.188 \times 1 0^{- 6}$ . Both options land far below that threshold: Option A gives $1.28 \times 1 0^{- 7}$ and Option B gives $1.02 \times 1 0^{- 7}$ — each roughly $25 \times$ under the "half" goal, so both easily satisfy the requirement. Option B is marginally lower ( $1.02 \times 1 0^{- 7} < 1.28 \times 1 0^{- 7}$ ), so on pure probability the redundant solar array wins. Answer: baseline $P_{Top} \approx 6.38 \times 1 0^{- 6}$ ; Option A $\approx 1.28 \times 1 0^{- 7}$ ; Option B $\approx 1.02 \times 1 0^{- 7}$ . Both crush the "half" target by about $25 \times$ , with the redundant solar array (B) marginally better on probability alone. In practice the final choice then comes down to mass, cost, and shared-hardware (common cause) risk rather than this tiny probability gap.

Common mistake L5 Trap — Forgetting the common cause after adding redundancy

Wrong path: "I added a third redundant string, so my AND branch is now $q^{3}$ — problem solved, risk is negligible." Why it feels right: The multiplication is real and does slash the independent failure probability. The reality: Redundant copies almost always share something — a bus, a regulator, a software load, a manufacturing lot. As Ex 5.1 showed, one shared regulator can dominate at $\sim 1 0^{- 3}$ no matter how many strings you add. The AND math floors out at the common-cause term, not at $q^{k}$ . Fix: After every redundancy addition, ask "what do these copies share?" and OR in an explicit CCF basic event. Cross-check with Reliability Block Diagrams and Monte Carlo Reliability Simulation to expose hidden couplings the tree structure alone might miss.

Recall One-line self-check before you leave

AND multiplies probabilities (redundancy, risk shrinks); OR uses $1 - \prod (1 - P)$ (single points, risk grows); and any shared component must be added as its own OR'd basic event.

Test yourself in one line:

Gate for "any one fails"

OR gate (curved-shield shape), output

= 1 - \prod (1 - P_{i})

Gate for "all must fail"

AND gate (flat-bottomed dome shape), output

= \prod P_{i}

Why ignoring a shared regulator is dangerous

it is a common cause failure that can dominate the branch, making independence-based AND math (

82 \times

in Ex 5.1) far too optimistic