Fault tree analysis (FTA) — top-down, AND - OR gates: Visual walkthrough

Before anything else, one word we will use on every line:

Step 1 — Draw one basic event as an area

WHAT. Take the single simplest thing in the whole tree: one component, either working or failed. Call its failure probability $P_{1}$ .

WHY. Everything above in the tree is built by combining events like this one. If we cannot picture a single event, we cannot picture a combination. So we start at the leaf.

PICTURE. Look at the figure. The full square has area $1$ (the whole box of possibilities). We shade an amber strip of width $P_{1}$ — that shaded area is exactly the chance component 1 fails. The white part, width $1 - P_{1}$ , is the chance it survives.

Step 2 — Two independent events on one square

WHAT. Bring in a second component with failure probability $P_{2}$ , independent of the first (the outcome of one tells you nothing about the other). Copy the naming rule from Step 1 for this new part: let $q_{2} = 1 - P_{2}$ be its survival number.

WHY. A gate always has at least two inputs. To combine them we must first lay them out together so we can see all the overlap regions.

PICTURE. We turn the strip into a full grid. Component 1's failure is the vertical amber band (width $P_{1}$ ); component 2's failure is the horizontal cyan band (height $P_{2}$ ). Because they are independent, the square splits cleanly into four rectangles, and the area of each rectangle is the product of its side lengths. That multiplication-of-sides is the whole reason independence lets us multiply probabilities.

Step 3 — The AND gate = the corner where everyone fails

WHAT. An AND gate outputs "failure" only when all inputs fail. On our grid that is exactly one rectangle: the top-right corner.

WHY. In a spacecraft this is redundancy: solar and battery must both die before you lose power. We want to know how small that corner is, because small = safe.

PICTURE. Only the overlap rectangle is shaded. Its width is $P_{1}$ , its height is $P_{2}$ , so its area — the AND-gate probability — is the product. Multiplying two numbers below $1$ always gives something smaller than either one: that shrinking corner is why redundancy works.

Step 4 — The OR gate = everything except the all-safe corner

WHAT. An OR gate outputs "failure" if any input fails. That is the whole square minus the one white corner where everybody survived.

WHY. This is a single point of failure: solar power dies if deployment jams or cells degrade or tracking fails — any one alone is fatal. No redundancy.

PICTURE. Shade the entire grid, then cut out just the bottom-left "both work" rectangle. What's left is the OR probability. The surviving corner has area $q_{1} q_{2} = (1 - P_{1}) (1 - P_{2})$ , so the shaded remainder is $1$ minus that.

Step 5 — Compute the solar branch (OR of three)

WHAT. Apply Step 4 to the three real solar failures: deploy jam $0.001$ , degradation $0.01$ , tracking $0.005$ . Now the gate has $n = 3$ inputs, so this is the first time we use the OR formula with more than two.

WHY. These three feed an OR gate, so any one sinks solar power. We need this number before we can climb higher.

PICTURE — how three factors live on the picture. With two inputs the "all survive" region was a rectangle (area = two side-lengths multiplied). With three inputs it becomes a box in 3D (volume = three side-lengths multiplied): survival needs part 1 and part 2 and part 3 to all work, so we multiply all three survival widths $0.999 \times 0.99 \times 0.995$ . Rather than draw a hard-to-read cube, the figure lays the three survival factors as stacked slabs — reading the white heights top to bottom and multiplying them is exactly "walk along each axis of the 3D box in turn". Subtract that product from $1$ to get the failure area.

Step 6 — Climb the tree: gates feeding gates

WHAT. The output of the solar OR gate and the output of the battery AND gate become the two inputs of the top-level AND gate.

WHY. A fault tree is recursive — a gate's answer is just another basic-event-sized number to the gate above it. This is the top-down structure the parent promised, evaluated bottom-up.

PICTURE. The tree is redrawn with each gate's computed probability written beside it, flowing upward: leaves → branch gates → top event.

Step 7 — Edge & degenerate cases (never leave a gap)

WHAT. Push every input to its extremes and check the pictures still behave.

WHY. A formula you trust only for "nice" numbers is a formula that will surprise you at $P = 0$ or $P = 1$ . We test the corners.

PICTURE. Four mini-panels: an input at $0$ , an input at $1$ , and both gate types.

One AND input is $0$ (a component that never fails): the failure corner has zero width → $P_{AND} = 0$ . Perfect redundancy makes the branch immune. ✔
One OR input is $1$ (a component that always fails): the "all survive" corner has a zero-width factor → $P_{OR} = 1 - 0 = 1$ . A guaranteed single-point-failure guarantees the whole branch. ✔
One AND input is $1$ : $P_{AND} = 1 \times P_{2} = P_{2}$ — the certain part drops out, leaving only the uncertain one. ✔
One OR input is $0$ : $(1 - 0) = 1$ contributes a factor of $1$ , so a never-failing part changes nothing in an OR. ✔

The one-picture summary

Everything above collapses into one diagram: AND = the tiny overlap corner (multiply, risk shrinks), OR = whole box minus the survival corner (risk grows), and gates stack so each answer feeds the one above. The unit square is the single mental model behind the entire tree.

Recall Feynman retelling — say it in plain words

Picture a square that stands for "everything that could happen", total area one. Shade slivers for each way a part can break. If a gate is AND — meaning both parts must break to hurt you — you only care about the little overlapping corner where the slivers cross; multiply the two widths and the corner is tiny, which is exactly why having a backup keeps you safe. If a gate is OR — meaning either part alone hurts you — you shade the whole square except the one corner where nothing broke; that leftover is big, which is exactly why a single weak link is dangerous. To do a real tree, work these two corner-games at the bottom, write each answer as a number, and feed it up as if it were a new part, until you reach the top. Solar was three weak links in an OR (about 1.6%), battery was two backups in an AND (0.04%), and the top said you need both systems to die — an AND — so multiply and you get about six chances in a million. That's the whole method: two pictures, repeated all the way up.

Recall

On the unit-square picture, which corner is the AND-gate probability? ::: The overlap corner where every input fails at once — area $P_{1} P_{2} \dots$ . Why does an OR gate use $1 - \prod (1 - P_{i})$ instead of adding the $P_{i}$ ? ::: Adding double-counts the overlapping failure corners; subtracting the single "all survive" corner avoids all overlap bookkeeping. What does an AND input of exactly $0$ do to the branch? ::: Zeroes the whole AND output — a never-failing redundant part makes the branch immune. What does an OR input of exactly $1$ do? ::: Forces the OR output to $1$ — a guaranteed single-point failure guarantees the branch fails. Which extra step is needed if two inputs share a component? ::: Break the shared component out as its own basic event; independence no longer holds — see Common Cause Failure Analysis.

See also: Boolean Algebra and Logic Design · Minimum Cut Sets · Reliability Block Diagrams · Single Point Failure Review · Failure Modes and Effects Analysis (FMEA) · Spacecraft Redundancy Architectures · Monte Carlo Reliability Simulation