8.3 Fault Tree Analysis (FTA) vs. Event Tree Analysis (ETA)

8.3 Fault Tree Analysis (FTA) vs. Event Tree Analysis (ETA)

In the suite of quantitative risk assessment techniques codified in IEC 31010, Fault Tree Analysis (FTA) and Event Tree Analysis (ETA) represent two complementary, foundational methodologies. While both rely on rigorous probabilistic mathematics, they approach risk modeling from opposite structural directions: FTA is a top-down, deductive methodology focused on root-cause logic, whereas ETA is a bottom-up, inductive methodology focused on chronological consequence progression.

---

1. Fault Tree Analysis (FTA): Top-Down Deductive Logic

Standardized under IEC 61025, Fault Tree Analysis begins with an undesired system-level outcome—the Top Event—and deductively reasons backward to identify all possible combinations of component failures, human errors, and environmental conditions (known as Basic Events) that can cause it.

Boolean Logic Gates

FTA builds visual logic trees using standardized graphical symbols, primarily AND gates and OR gates:

1. AND Gate: The output event occurs if and only if all input events occur simultaneously.

   • Probabilistic Equation (Independent Events): $P(\text{Output}) = P(E_1 \cap E_2 \cap \dots \cap E_k) = \prod_{i=1}^{k} P(E_i)$
   • Interpretation: AND gates represent safety redundancy. Combining independent failure events under an AND gate significantly reduces overall output probability.

2. OR Gate: The output event occurs if at least one input event occurs.

   • Probabilistic Equation (Independent Events): $P(\text{Output}) = 1 - \prod_{i=1}^{k} (1 - P(E_i)) \approx \sum_{i=1}^{k} P(E_i) \quad \text{(for small probabilities)}$
   • Interpretation: OR gates represent single-point vulnerabilities or alternative failure pathways.

   [AND Gate Logic]                   [OR Gate Logic]
     E1 AND E2                         E1 OR E2
   P = P(E1) * P(E2)                 P = 1 - (1-P(E1))*(1-P(E2))

Minimal Cut Sets (MCS)

A central objective of FTA is identifying Minimal Cut Sets (MCS).

• Cut Set: A collection of basic events whose simultaneous occurrence guarantees that the Top Event will occur.
• Minimal Cut Set: A cut set that cannot be reduced further without losing its capability to trigger the Top Event.

Order of Cut Sets: The number of basic events in a minimal cut set defines its order. A 1st-order minimal cut set consists of a single basic event—representing a single point of failure for the entire system. System reliability engineers prioritize eliminating 1st-order cut sets by introducing hardware redundancy or procedural separation.

---

2. Event Tree Analysis (ETA): Bottom-Up Inductive Logic

Standardized under IEC 62502, Event Tree Analysis is an inductive methodology that begins with a single Initiating Event (e.g., pipe rupture, main power grid trip, cyber firewall breach) and models the chronological sequence of safety barriers, automated safeguards, and operator responses designed to mitigate the event.

Structure of an Event Tree

1. Initiating Event ($IE$): The starting event, assigned an annual frequency ($f_{IE}$).
2. Safety Functions / Pivotal Events: Arranged horizontally across the top of the tree in chronological order of activation (e.g., System A auto-start $\rightarrow$ System B isolation $\rightarrow$ Emergency Response).
3. Branching Decision Nodes: At each safety function, the tree splits into two binary paths:
   • Success Branch (Top Path): Probability $= 1 - PFD_i$
   • Failure Branch (Bottom Path): Probability $= PFD_i$
4. End Outcomes: Each complete horizontal path through the tree terminates in a distinct outcome scenario ranging from safe shutdown to catastrophic loss.

Outcome Frequency Calculation

The frequency of any specific outcome path ($f_{path}$) is calculated by multiplying the initiating event frequency ($f_{IE}$) by the conditional probabilities of success or failure at each sequential node along that path:

$f_{path} = f_{IE} \times \prod \text{Node Probabilities along Path}$

The sum of probabilities across all outcome paths originating from a single initiating event must strictly equal 1.0 (100%).

---

3. Integrated Cause-Consequence Modeling

In complex industrial and mission-critical applications, FTA and ETA are combined into Cause-Consequence Analysis:

• FTA is utilized to derive the failure probabilities ($PFD$) of individual complex safety barriers.
• These calculated $PFD$ values are then inserted directly into the binary decision nodes of an ETA.

Worked Quantitative Integration Example

Step A: Fault Tree Analysis for Emergency Injection Pump Failure

An Emergency Injection Pump System (Safety Function 1) fails if:

• Power fails ($E_1$, $P(E_1) = 0.04$) OR Control logic fails ($E_2$, $P(E_2) = 0.01$),
• AND Mechanical valve jams ($E_3$, $P(E_3) = 0.05$).

1. Calculate OR gate probability for Power/Control failure ($P_{OR}$): $P_{OR} = 1 - (1 - 0.04)(1 - 0.01) = 1 - (0.96 \times 0.99) = 1 - 0.9504 = 0.0496$
2. Calculate AND gate probability for Pump System Failure ($PFD_{Pump}$): $PFD_{Pump} = P_{OR} \times P(E_3) = 0.0496 \times 0.05 = 0.00248$

Step B: Event Tree Analysis with Initiating Event

An initiating power surge occurs with frequency $f_{IE} = 1.0 \text{ event/year}$. The event tree evaluates two sequential barriers: Safety Barrier 1 (Pump System, $PFD = 0.00248$) and Safety Barrier 2 (Manual Relief Valve, $PFD = 0.10$).

• Path 1 (Success / Success): Safe Containment $f_1 = 1.0 \times (1 - 0.00248) \times (1 - 0.10) = 1.0 \times 0.99752 \times 0.90 = 0.897768 \text{ /year}$
• Path 2 (Success / Failure): Controlled Venting $f_2 = 1.0 \times (1 - 0.00248) \times 0.10 = 1.0 \times 0.99752 \times 0.10 = 0.099752 \text{ /year}$
• Path 3 (Failure / Success): Degraded Thermal Relief $f_3 = 1.0 \times 0.00248 \times (1 - 0.10) = 1.0 \times 0.00248 \times 0.90 = 0.002232 \text{ /year}$
• Path 4 (Failure / Failure): Severe Rupture / Catastrophic Consequence $f_4 = 1.0 \times 0.00248 \times 0.10 = 0.000248 \text{ /year} \quad (2.48 \times 10^{-4} \text{ /year})$

Comprehensive Comparison: FTA vs. ETA

The table below contrasts the fundamental characteristics of Fault Tree Analysis and Event Tree Analysis: