Fault Tree Analysis
Artifact
Topic overview
Quick facts
- Definition of Fault Tree Analysis in functional safety
- Fault Tree Analysis in depth
- The case for Fault Tree Analysis
- Fault Tree Analysis in practice
- Where teams get Fault Tree Analysis wrong
- Standards related to Fault Tree Analysis
- Fault Tree Analysis by industry
- Ask our team about Fault Tree Analysis
- Fault Tree Analysis: related terms
FTA starts from a defined undesired top event, say, unintended robot motion with a person in the workspace, and decomposes it through AND and OR gates into the combinations of component failures, software faults, human errors, and environmental conditions that could produce it.
The finished tree can be analyzed qualitatively, extracting minimal cut sets, the smallest combinations of basic events sufficient to cause the top event, and quantitatively, computing the top event probability from basic event rates.
Its strengths complement exactly where FMEA is blind. Because FMEA examines one failure at a time, it cannot show that two individually tolerable failures combine catastrophically, or that a claimed redundancy shares a hidden common cause such as a shared power supply or a shared software library.
Single-element minimal cut sets in the tree expose single points of failure directly; short cut sets through supposedly redundant channels expose common-cause vulnerability.
FTA supports quantitative probability estimates for hazardous events and is expected evidence in rail safety cases under and at higher integrity levels generally.
Its main limitation is that it only analyzes the failure paths the analyst thought to include, so tree construction quality, and review by people who know the system's real behavior, determines the value of the result.
The case for Fault Tree Analysis
FTA answers the question executives and assessors actually ask: how could this specific bad thing happen, and how likely is it. It is the analysis that validates or demolishes redundancy claims, and programs that skip it routinely discover in assessment that their two channels share a power supply, a clock, or a software fault and are therefore one channel.
In rail and other safety-case regimes a quantified FTA is often the backbone of the hazard rate argument submitted to the authority, making it directly schedule-critical for approval.
Fault Tree Analysis in practice
Safety lifecycle
A safety engineer constructs the tree during architecture and detailed design, one tree per significant hazardous top event drawn from the hazard analysis, working with designers who know the actual failure behavior of each element. Basic event probabilities come from the , reliability databases, and human error estimates.
Cut sets are extracted and reviewed: any single-element cut set on a high-integrity function demands design change, and short cut sets are examined for common cause. Trees are updated when architecture changes.
Assessors check that top events match the hazard analysis, that the tree structure reflects the real design rather than the intended one, that common-cause failures and shared resources are modeled, and that quantitative claims trace to justified basic event data.
Where teams get Fault Tree Analysis wrong
Standards related to Fault Tree Analysis
Fault Tree Analysis is defined and governed by IEC 61508 - the umbrella functional safety standard defining the safety lifecycle, sil levels, and requirements for electrical, electronic, and programmable systems.
Fault Tree Analysis is defined and governed by EN 50129 - safety-related electronic systems for railway signaling, including the structure of the safety case.
FTA vs FMEA vs FMEDA
| Method | Direction | Question answered |
|---|---|---|
| FTA | Top-down, deductive | What combinations cause this hazard? |
| FMEA | Bottom-up, inductive | What happens if this part fails? |
| FMEDA | Bottom-up, quantified | What are the rates and diagnostic coverage? |
Fault Tree Analysis by industry
In rail & transit, Fault Tree Analysis comes up in nearly every certification conversation: freight and passenger rail signaling, train control, and transit systems.
Industrial Machinery programs lean on Fault Tree Analysis because the sector covers fixed and mobile machinery, packaging lines, and manufacturing equipment.
Ask our team about Fault Tree Analysis
Ben TwomblyFounder & CEOLeads CSA's functional-safety, certification, and engineering programs for safety-critical products and organizations. His assessor-side background informs practical programs that connect standards, engineering work, and credible evidence.
Jeff Twombly, PEExecutive, Rail SafetyProvides executive and technical leadership for rail-safety programs, assessments, and complex transit-system work. His experience spans safety assurance, transportation-safety leadership, signaling, and independent review.
Tom CyrPrincipal Safety Engineer, IFSPSupports industrial and rail functional-safety programs with safety analysis, requirements, lifecycle planning, and certification-readiness guidance.Fault Tree Analysis: related terms
How each connects to Fault Tree Analysis:
FMEA is the natural next concept after Fault Tree Analysis; assessors expect teams to connect the two.
Functional Safety is governed by IEC 61508 as well, which is why the two show up together in audits.
Both Fault Tree Analysis and SIL sit under IEC 61508, so evidence for one usually references the other.
Safety Function is governed by IEC 61508 as well, which is why the two show up together in audits.
IEC 61508 connects the two: Fault Tree Analysis and Safe Torque Off are assessed against the same lifecycle.
Both Fault Tree Analysis and PFH sit under IEC 61508, so evidence for one usually references the other.
Both Fault Tree Analysis and FMEDA sit under IEC 61508, so evidence for one usually references the other.
Safety Case is governed by EN 50129 as well, which is why the two show up together in audits.
Both Fault Tree Analysis and ISA sit under EN 50129, so evidence for one usually references the other.
EN 50129 connects the two: Fault Tree Analysis and CENELEC Rail Standards are assessed against the same lifecycle.
Both Fault Tree Analysis and CBTC sit under EN 50129, so evidence for one usually references the other.
Both Fault Tree Analysis and Verification and Validation sit under IEC 61508, so evidence for one usually references the other.