Worked examples — Fault tree analysis (FTA) — top-down, AND - OR gates

Before anything else, one reminder of what the symbols MEAN, so we never use them un-earned.

The number $(1-P_i)$ keeps appearing — it is the survival probability of event $i$ (the chance it does NOT happen). Keep that phrase in your head; it is the hero of the OR gate.

---

The scenario matrix

Every FTA calculation you will ever meet is one of these cells. The examples below are labelled with the cell they hit, and together they cover the whole grid.

Cell	Case class	What makes it tricky
A	Single OR gate, small $P_i$	approximation vs exact
B	Single AND gate, small $P_i$	how fast the product shrinks
C	Degenerate input $P_i=0$	a perfect part in the tree
D	Degenerate input $P_i=1$	a guaranteed failure in the tree
E	Mixed tree (AND under OR)	order of operations, dominant term
F	Limiting behaviour: many identical OR inputs	$P_{\text{OR}}\to 1$
G	Common cause failure (dependent)	independence assumption breaks
H	Real-world word problem	translate English into gates
I	Exam twist: "which improvement helps?"	sensitivity, dominant path
J	Large probabilities ($P_i$ near 1)	sum-approximation blows up

---

Cell A — Single OR gate, small probabilities

Forecast: Any one of three small failures kills solar. So the answer should be bigger than any single input but still small — guess "roughly the sum, about $0.016$."

1. Write each survival probability. Why this step? The OR formula is built from "did it survive?", so convert every failure into its opposite first. $1-0.001=0.999,1-0.01=0.99,1-0.005=0.995$

2. Multiply the survivals — the chance ALL three stay healthy. Why? Independent parts all surviving is a joint event, and joint = product. $0.999\times 0.99\times 0.995=0.98405$

3. Subtract from 1. Why? "At least one failed" is the complement of "none failed." $P_{\text{Solar}}=1-0.98405=0.01595\approx 0.016$

Verify: Compare with the lazy sum $0.001+0.01+0.005=0.016$. The exact answer $0.01595$ is just below the sum — that tiny gap is the double-counting the sum ignores. Because the $P_i$ are small, sum ≈ exact. Sanity: answer sits between $0$ and $1$. ✓

Recall Why is the exact OR answer always ≤ the sum of inputs?

The sum double-counts the "two fail at once" overlaps ::: the exact OR subtracts them out, so exact ≤ sum, with equality only in the limit of tiny probabilities.

---

Cell B — Single AND gate, small probabilities

Forecast: Both must break — much rarer than one. Guess "way smaller than $0.02$."

1. Multiply the two failure probabilities. Why? AND = all inputs fail together = joint probability = product (for independent banks). $P_{\text{Battery}}=0.02\times 0.02=0.0004$

Verify: $0.0004$ is $50\times$ smaller than either input ($0.02/0.0004=50$). That is redundancy doing its job — the AND gate crushed the risk. Units: still a bare probability, dimensionless. ✓

Look at the figure: the middle bar (OR gate of three inputs) is taller than the yellow reference line marking one single input (risk piles up); the right bar (AND gate of two inputs) is far shorter than that line (risk collapses). Same class of small inputs, opposite behaviour — that contrast is the whole point of the page.

---

Cell C — Degenerate input: a perfect part ($P_i=0$)

Forecast: A zero-probability input contributes nothing to an OR. Guess "answer drops to the OR of just the other two."

1. Survival of the perfect part is $1-0=1$. Why this step? A part that never fails always survives.
2. Multiply survivals: Why? $1$ times anything leaves it unchanged. $1\times 0.99\times 0.995=0.98505$
3. Subtract: $P=1-0.98505=0.01495$.

Verify: Compare to Cell A ($0.01595$). Removing the deployment risk dropped the total by $0.01595-0.01495=0.001$ — essentially the $0.001$ deployment probability. A perfect input in an OR gate is invisible — exactly what we expect. ✓

---

Cell D — Degenerate input: a guaranteed failure ($P_i=1$)

Forecast: A guaranteed input on an OR gate guarantees the OR fires. Guess "$P_{\text{Top}}=1$."

1. AND branch: $0.01\times 0.01=0.0001$ (Why? both transponders must die.)
2. Survival of HGA: $1-1=0$. Why this step? A part that always fails never survives.
3. OR formula: $P=1-(1-0.0001)(1-1)=1-(0.9999)(0)=1-0=1$.

Verify: $P_{\text{Top}}=1$ means certain failure — correct, because HGA alone (an OR input) is a single point of failure that is already broken. A $P=1$ input saturates an OR gate. (In an AND gate it would be invisible: $1\times x=x$ — again exactly opposite to Cell C.) ✓

---

Cell E — Mixed tree (AND nested under OR)

Forecast: Two redundant transponders make the AND branch tiny; the lone HGA is exposed. Guess "HGA dominates, answer ≈ $0.05$."

1. Solve the deepest gate first (AND). Why? You cannot evaluate a gate until its inputs are numbers; work inside-out. $P_{\text{AND}}=0.01\times 0.01=0.0001$
2. Feed that into the OR gate alongside HGA. Why? The AND result is now just one input to the OR. $P_{\text{Top}}=1-(1-0.0001)(1-0.05)$
3. Compute survivals and multiply: $0.9999\times 0.95=0.949905$.
4. Subtract: $P_{\text{Top}}=1-0.949905=0.050095\approx 0.0501$.

Verify: The HGA contributes $0.05$; the whole answer is $0.0501$. So the redundant transponders add only $0.0001$ — the HGA drives $\approx 99.8\%$ of the risk ($0.05/0.0501$). Matches the forecast. This is the payoff of FTA: it points a finger at the single point of failure. ✓

Read the figure top-down: the pink Loss of Comm box sits above a yellow OR junction with two branches. The left blue branch is the AND of the two transponders ($0.0001$); the right pink branch is the lone HGA ($0.05$). The yellow arrow points at the HGA branch — that dominant OR input is where nearly all the risk lives, and it is the box a designer must attack first.

---

Cell F — Limiting behaviour: many identical OR inputs

Before this example we need one more tool, and we build it from zero.

Forecast: Even tiny $0.001$ risks, piled into an OR gate over and over, must creep upward. Guess "107 of them gives a few percent; infinitely many → certain failure."

1. General formula: all identical, so $P_{\text{OR}}=1-(1-0.001{)}^n=1-0.999^n$. Why? The OR formula multiplies the $n$ survival factors $(1-P_i)$; when every factor is the same number $0.999$, multiplying it $n$ times is raising it to the power $n$.
2. $n=1$: $1-0.999=0.001$. (One mechanism = its own risk.)
3. $n=107$: $1-0.999^{107}=1-0.89848=0.10152\approx 0.102$.
4. $n\to \infty$: $0.999^n\to 0$, so $P_{\text{OR}}\to 1$.

Verify: Check $0.999^{107}$ with the logarithm trick just defined. Why logs? Multiplying $0.999$ by itself 107 times by hand is brutal, but the power-slides-out rule turns it into one multiplication: ${\log }_{10}(0.999^{107})=107\cdot {\log }_{10}(0.999)$. Since ${\log }_{10}(0.999)\approx -0.000434$ (the log of a number just below 1 is a small negative), the exponent is $107\times (-0.000434)\approx -0.04648$, and the antilog $10^{-0.04648}\approx 0.8985$, giving $P\approx 0.1015$. ✓ Lesson: an OR gate over many parts is a slow poison — this is why JWST demanded per-mechanism reliability of $0.999+$; with $0.99$ each, $1-0.99^{107}\approx 0.66$, a coin-flip mission. Compare in Reliability Block Diagrams — an OR gate of failures is a series chain of survivals.

The curve in the figure is $P=1-0.999^n$ climbing with the number of OR inputs $n$. The yellow dot marks $n=1$ (risk $=0.001$, barely off the floor); the pink dot marks $n=107$ (risk jumped to $\approx 0.102$); and the dotted line at the top shows the ceiling $P\to 1$ that the curve creeps toward as $n\to \infty$. Watch how a "negligible" per-part risk becomes a real threat once you stack enough of them under one OR.

---

Cell G — Common cause failure (dependence breaks the formula)

Forecast: The naive AND said $0.0001$. But a shared cause creates a "both fail together" shortcut. Guess "much bigger than $0.0001$ — the regulator dominates."

1. Why the naive product is wrong. The formula $P_A\times P_B$ assumes independence. A common cause violates that: one event flips both at once. Multiplying pretends that never happens.
2. Split each transponder's total risk into shared + independent. Each transponder's total $P=0.01$ is made of the shared regulator ($0.008$) PLUS its own independent modes. So the independent-only part is $P^{\prime }=0.01-0.008=0.002$. Why subtract? The $0.008$ is already counted in the shared term; if we also left it in $P^{\prime }$ we would double-count it.
   • Both fail from their own independent causes: $0.002\times 0.002=0.000004$.
3. OR the shared cause with the independent double-failure. Why OR? Either route makes both transponders dead: the regulator dying, OR both independently dying. $P_{\text{both}}=1-(1-0.008)(1-0.000004)=1-(0.992)(0.999996)$
4. Compute: $0.992\times 0.999996=0.99199603$, so $P_{\text{both}}=0.00800397\approx 0.0080$.

Verify: True answer $\approx 0.008004$ vs naive $0.0001$ — the shared regulator makes the "redundant" pair about 80× more likely to both fail ($0.008004/0.0001\approx 80$). The independent double-failure ($0.000004$) is utterly negligible next to the shared $0.008$; the regulator IS the risk. The redundancy is an illusion until you power the two transponders separately. See Boolean Algebra and Logic Design for why we must add the regulator as its own basic event rather than hide it. ✓

---

Cell H — Real-world word problem (translate English → gates)

Forecast: Three redundant wheels → tiny AND. Lone star tracker → the exposed OR input. Guess "≈ $0.02$, tracker-dominated."

1. Translate the English. "At least one wheel needed" = "lost only if all fail" = AND of three wheels. "Star tracker has no backup" = OR input at the top. Why this step? Gates come from redundancy words: all/both → AND, any/either → OR.
2. Wheel AND gate: $0.03^3=0.000027$. Why cube? Three independent wheels all failing is the product $0.03\times 0.03\times 0.03$.
3. Top OR gate: $P=1-(1-0.000027)(1-0.02)$. Why? The wheel-AND result is now one OR input alongside the star tracker.
4. Compute survivals and multiply: $(0.999973)(0.98)=0.97997354$, so $P=1-0.97997354=0.02002646\approx 0.0200$.

Verify: Answer $0.0200$ vs star-tracker alone $0.02$ — the three wheels add only $0.000027$. If a designer wanted to spend money, adding a second star tracker (making it an AND branch, $0.02\times 0.02=0.0004$) would slash the top risk far more than a fourth wheel would. Matches Spacecraft Redundancy Architectures intuition. ✓

---

Cell I — Exam twist: "which single improvement helps most?"

Forecast: The HGA is the dominant term, so fixing it should win by a mile. Guess "(a)."

1. Option (a): HGA becomes AND of two. New HGA branch $=0.05\times 0.05=0.0025$. Why? Two identical antennas both must fail. $P_{\text{Top}}^{(a)}=1-(1-0.0001)(1-0.0025)=1-(0.9999)(0.9975)=1-0.99740025=0.00259975\approx 0.0026$
2. Option (b): transponders improved. AND branch $=0.001\times 0.001=10^{-6}$. $P_{\text{Top}}^{(b)}=1-(1-10^{-6})(1-0.05)=1-(0.999999)(0.95)=1-0.94999905=0.05000095\approx 0.0500$
3. Compare. (a) drops the risk from $0.0501$ to $0.0026$ (a $19\times$ improvement). (b) barely moves it — $0.0501\to 0.0500$.

Verify: Option (a) wins overwhelmingly, confirming the forecast. Exam lesson: always attack the dominant OR input first — improving a term that is already negligible (the transponders) wastes budget. Find dominant paths with Minimum Cut Sets before spending a single dollar. ✓

---

Cell J — Large probabilities ($P_i$ near 1)

Forecast: With numbers this big, the "sum ≈ OR" trick from Cell A must break — the sum $0.6+0.5+0.4=1.5$ is already above 1, which is impossible for a probability. Guess "the true OR is high but stays below 1; the AND is a modest fraction."

1. Survival probabilities. Why? The OR formula still runs on "did it survive?", no matter how big the failure risks are. $1-0.6=0.4,1-0.5=0.5,1-0.4=0.6$
2. Multiply the survivals — chance all three survive. Why? All-survive is still a joint event = product. $0.4\times 0.5\times 0.6=0.12$
3. OR result: $P_{\text{OR}}=1-0.12=0.88$.
4. AND result: multiply the failure probabilities directly. Why? AND = all fail together = product of the $P_i$ themselves. $P_{\text{AND}}=0.6\times 0.5\times 0.4=0.12$

Verify: The lazy sum gives $1.5$ — a nonsense "probability" above 1, so the small-number shortcut has completely failed here; only the exact formula $1-\prod (1-P_i)=0.88$ is trustworthy. Sanity: $0.88$ sits in $[0,1]$. ✓ Notice the OR ($0.88$) is far bigger than the AND ($0.12$) — the same gap-between-gates from Cell B, but now dramatic because the inputs are huge. Lesson: the "OR ≈ sum" rule is only safe when every $P_i$ is small; near $P=1$ you MUST use the survival-product form.

---

Connections to Spacecraft Design

Beyond these cells, FTA feeds directly into Monte Carlo Reliability Simulation (when probabilities themselves are uncertain), Failure Modes and Effects Analysis (FMEA) (the bottom-up complement), and the Single Point Failure Review (which hunts exactly the OR inputs that dominated Cells E, I, and J).

---

Active recall

Recall In an OR gate, what does a

$P_i=0$ input do, and what about $P_i=1$? $P_i=0$ is invisible (survival $=1$, changes nothing). $P_i=1$ saturates the gate to $1$ (certain failure) ::: opposite of an AND gate, where $0$ forces the gate's failure to $0$ (guaranteed success for that branch) and $1$ is invisible.

Recall Two "redundant" units share one power supply. Why is

$P_A\times P_B$ wrong? That formula assumes independence; the shared supply is a common cause that fails both at once ::: model it as a separate basic event OR-ed with the independent double-failure — and remember to subtract the shared risk from each unit's total before squaring the independent part.

Recall Given a mixed tree, which gate do you evaluate first?

The deepest gate (inputs must be numbers before a gate can be computed) ::: work inside-out, bottom-up.

Recall When is the "OR ≈ sum of inputs" shortcut safe?

Only when every $P_i$ is small ::: near $P=1$ the sum can exceed 1 (impossible), so you must use the exact survival-product form $1-\prod (1-P_i)$.