3.6.30 · D5Spacecraft Structures & Systems Engineering
Question bank — Fault tree analysis (FTA) — top-down, AND - OR gates
Before we start, three things we lean on everywhere.
The picture below shows the two gates that do all the work — memorise the shape of each, not just the letters.
Look at the left panel: an OR gate lights its output if any input light is ON — so its output is at least as bright as the brightest input (risk grows). The right panel is an AND gate: its output lights only when every input is ON — so it stays dark unless all fail (risk shrinks). Keep this two-panel image in your head for every question that follows.
Now watch why the AND formula is a product — the simpler of the two derivations:
An AND gate fires only when every input fails at the same time. For two independent inputs, picture a unit square: input fails on a fraction of the width, input fails on a fraction of the height, and "both fail" is the shaded rectangle where those strips overlap — its area is . Independence is exactly what lets us multiply width by height here. Stacking more inputs multiplies more fractions below 1, so keeps shrinking — the mathematical face of redundancy.
Now the OR formula — why it is a subtraction, not an addition. This is the one derivation the whole page rests on:
Reading left to right: we want "at least one input fails." Counting that directly means adding cases and then removing double-counted overlaps — messy. So we flip the question to its opposite, "every input survives," which (for independent inputs) is a clean product (each bar is a survival, stacked). Whatever probability is left over is failure, so . The shaded sliver on the right is exactly that leftover.
True or false — justify
An AND gate always makes the top event less likely than any single input below it.
True for independent inputs — multiplying two numbers both below 1 gives something smaller than either, so redundancy shrinks risk. It can fail if the inputs share a common cause, where the "AND" collapses toward a single event.
An OR gate output probability is just the sum of its input probabilities.
False — summing overcounts the overlap where several inputs fail together and can even exceed 1. The correct rule is , which only approximates the sum when every is tiny.
If every basic event probability is below 0.01, the top event must also be below 0.01.
False — a wide OR gate stacks many small risks, so ten inputs of 0.01 give roughly 0.096, nearly ten times larger. OR gates grow risk; only AND gates guarantee shrinkage.
In a pure fault tree where all AND inputs are independent, adding more AND inputs can never increase the top event probability.
True inside that mathematical framework — each extra factor only shrinks the product . The premise "independent" is doing all the work; drop it and the guarantee is gone (see next item).
In a real spacecraft, adding more redundant units (more AND inputs) can never increase the top event probability.
False — this leaves the pure-math framework: extra units add mass, wiring, and shared power that introduce common cause failures, an OR-type vulnerability the independence math never modelled. On paper AND inputs help; in hardware a shared cause can quietly hurt. See Common Cause Failure Analysis.
A fault tree and a reliability block diagram describe fundamentally different systems.
False — they describe the same system from opposite viewpoints: FTA models paths to failure, an RBD models paths to success. A series block equals an OR gate; a parallel block equals an AND gate.
The top event is chosen after building the tree from basic components.
False — FTA is top-down: you must name the feared top event first, then deduce downward. Choosing it afterward would be bottom-up, which is what FMEA does instead.
An inhibit (NOT) gate is needed to model normal redundancy.
False — plain AND and OR gates cover redundancy and single points of failure. An inhibit gate passes its input through only when a separate condition holds (truth function: output ON iff input ON AND condition present); it appears for guarded faults like "leak causes fire only if an ignition source is present," and is rare in coherent trees — trees built only from AND/OR gates where adding a failure can never repair the top event (more broken parts never make the system healthier).
Spot the error
The figure below shows the flawed model in the next question — study it, then read the trap.
"Both transponders share one power regulator, so I model them as an AND gate with , where are the two transponders' failure probabilities."
The error is treating a common cause as independent — the shared regulator makes both transponders fail together, so multiplying (which assumes independence) underestimates risk. Pull the regulator out as its own basic event feeding an OR at the top (right side of the figure), so its failure alone can down both paths.
"The gyro is our basic event; its probability is whatever the vendor sheet lists for the assembly."
The error is stopping too early if bearing wear, electronics, and power feeds have their own known rates. Decompose until each leaf has a measurable failure rate matching your data resolution.
"Solar power fails if tracking fails AND deployment fails, so it's safe."
The gate is wrong — either failure alone kills solar output, so it must be an OR gate, not AND. Calling it AND falsely advertises redundancy that doesn't exist.
"The HGA has probability 0.05 and each transponder 0.01, so I'll focus reliability money on the transponders since there are two of them."
The error is ignoring gate structure — the transponders sit behind an AND (their joint failure is 0.0001), while the HGA is a lone OR input dominating the risk. Money belongs on the HGA, the single point of failure.
"Every mechanism on the sunshield is 0.999 reliable, so the deployment is essentially certain."
The error is forgetting the OR gate over ~100 mechanisms — with , roughly a 1-in-10 chance something jams. Large OR fan-ins erode even excellent individual reliability.
"AND means both events must occur, and 'both' is unlikely, so AND gates are the dangerous ones."
The intuition inverts reality — "both must fail" is exactly why AND gates are safe (redundant). OR gates, where any one failure suffices, are the dangerous ones.
Why questions
Why does the OR-gate formula use the complement instead of a direct sum?
Because "at least one fails" is awkward to count directly (you'd add cases then subtract overlaps) but its opposite — "every input survives" — is a clean product of independent survivals. Subtracting that from 1 recovers the failure probability without overcounting, exactly as the OR figure showed.
Why do spacecraft designers deliberately want AND gates high in the tree?
An AND gate near the top means the mission survives unless all redundant paths die simultaneously, multiplying small probabilities into a much smaller one. It is the mathematical signature of redundancy paying off.
Why can FTA miss failure modes that FMEA catches?
FTA is deductive from one chosen top event, so any failure not linked to that event is invisible to the tree. FMEA sweeps every component bottom-up, catching orphans FTA never asks about — which is why the two are used together.
Why can we multiply single-event probabilities inside a gate at all?
Only because we assume independence — that one input's failure gives no information about another's. Multiplication of separate probabilities is exactly the mathematical statement of independence; when it is false the numbers are wrong.
Why does a single OR input with a large probability often "dominate the risk"?
In an OR gate the largest term drives , so one weak link at, say, 0.05 swamps a dozen inputs at 0.001. This is precisely how FTA points your money at the true weak spot.
Why must dependent events not use ?
That product assumes independence; when and share a cause, knowing failed raises the chance failed too, so the true joint probability is larger. Ignoring the dependence hides real risk. See Common Cause Failure Analysis.
Why is a minimum cut set more useful than the full tree for spotting weaknesses?
A minimum cut set is the smallest group of basic events whose joint failure alone triggers the top event — a single-element cut set is literally a single point of failure. It strips the logic down to "what's the fewest things that can kill us?"
Edge cases
What is the top-event probability of an AND gate if one input has probability exactly 0?
Zero — the product contains a factor of 0, so the top event cannot occur. A perfectly reliable redundant leg makes the whole redundant set unfailing.
What is the top-event probability of an OR gate if one input has probability exactly 0?
It reduces to the OR of the remaining inputs — the survival factor drops harmlessly out of the product , so a never-failing input adds no risk. This is the mirror of the AND-with- case below.
What is the AND-gate output if one input has probability exactly 1 (a guaranteed failure)?
It reduces to the other input's probability — with a two-input AND, , so the certain leg drops out and the gate depends entirely on the survivor. This is the mirror image of the OR-with- case below.
What is the OR-gate output if one input has probability exactly 1 (a guaranteed failure)?
Exactly 1 — the survival product contains a factor , so the top event is certain. One guaranteed failure defeats an OR gate no matter how good the others are.
What does a single-input AND gate reduce to?
It reduces to that input's own probability — with one factor, , so nothing is multiplied and the gate simply passes through unchanged. A gate needs at least two inputs before AND and OR behave differently.
If two OR inputs are perfectly correlated (always fail together), what is the true output probability?
It equals a single input's probability , not — perfect correlation means they are effectively one event. The independence formula would overstate the risk here, the mirror image of the AND common-cause trap.
As every basic event probability approaches 0, what does the OR-gate formula approach?
It approaches the plain sum , because cross-terms in the product become negligible (). This is the "rare-event" approximation, valid only when each is tiny.
Recall One-line survival kit
AND multiplies → shrinks → redundancy (good). OR complements-products → grows → single points of failure (bad). Both rules assume independence — shared causes break them, so hunt those down first.