Fault Tree Analysis¶

Deductive failure-analysis method — instantiates Migration-Resistant Hazard Control

Decomposes a single system-level harm downward through logical gates until the transfer path — and the exact boundary where risk crosses out of the controlled unit — becomes explicit.

Fault Tree Analysis starts from one undesired outcome — the top event — and decomposes it downward through logical AND/OR gates into the combinations of lower-level conditions that could produce it. Its distinguishing contribution in this archetype is to make a specific transfer path explicit: when the top event is defined as "the hazard reappears at another site," the tree exposes the exact conjunction — a control that holds here, a route that stays open, a boundary that is crossed — by which suppression here becomes harm there. Where a causal loop diagram shows the whole regenerating field, the fault tree is narrow and deductive: one bad outcome, traced to the gates that let it happen, including the precise boundary the risk is pushed across.

Example¶

A river authority plans to raise the levee protecting a town on the left bank. Fault Tree Analysis takes as its top event not "the levee fails" but the wider harm the archetype cares about: "a populated area is flooded in a hundred-year storm." Decomposing downward, one branch is the obvious one — the left-bank levee is overtopped. But the deductive discipline forces the other branches into view: the raised levee holds, and the confined floodwater has nowhere to spread, and it therefore rises higher across the channel, and the right-bank community's defences are lower. That conjunction is a transfer path, and the analysis names the exact boundary — the crest of the opposite bank, outside this authority's jurisdiction — where the risk crosses over. The tree turns "we protected the town" into the sharper, checkable statement: we protected the left bank by routing the water onto the right bank, whose defences we never analysed.

How it works¶

Fix the top event at the harm, not the barrier. Defining it as the system-level harm ("area flooded"), not the local failure ("levee overtops"), is what lets displacement branches appear at all.
Decompose deductively through gates. AND gates capture the conjunctions a single-cause story misses; a hazard usually migrates only when several conditions coincide.
Follow branches across the boundary. The analysis deliberately continues a branch past the point where the risk leaves the controlled unit, and names the crossing.
Read the cut sets. The minimal combinations that produce the top event show which transfer paths are cheapest for the hazard to take.

Tuning parameters¶

Top-event scope — the local failure or the system-level harm. Scoping it at the harm is the whole trick; scoping it at the barrier hides displacement by construction.
Resolution / depth — how far basic events are decomposed. Deeper trees find subtler paths but cost effort and can bury the signal.
Qualitative vs. quantitative — cut sets alone versus probabilities on each basic event. Numbers enable ranking but are only as good as the (often scarce) failure data.
Boundary of a "basic event" — where you stop decomposing. Draw it inside the controlled unit and cross-boundary transfer paths never get a leaf to hang on.
Common-cause treatment — whether correlated failures are modelled. Ignoring them makes independent-looking barriers appear stronger than they are.

When it helps, and when it misleads¶

Its strength is that it is systematic where intuition is selective: it forces the conjunctions and the cross-boundary branches into the open, and its cut sets rank the transfer paths a hazard is most likely to take. That makes the boundary-crossing a named, addressable object rather than an unbudgeted surprise downstream.

Its failure mode is that a fault tree is only as complete as the analyst's imagination — a path nobody drew is a path the tree silently declares impossible, so its computed probabilities are best read as a lower bound on risk. It is also static: it assumes fixed failure modes and does not anticipate an adversary who invents a new route, which is why it pairs poorly with adaptive threats. Its classic misuse is to be built backwards from a target — assigning the basic-event probabilities that make the top event land just under the acceptable number. The discipline is to derive probabilities before computing the top event, to treat the tree as falsifiable, and to hand adaptive threats to a red team rather than pretend the gates are exhaustive.^[1]

How it implements the components¶

transfer_path — each branch that runs from a held control to harm at another site is an explicit, gated transfer path.
risk_transfer_boundary — the analysis names the exact gate at which the hazard crosses out of the controlled unit's scope.

It does not model the feedback that regenerates the pressure — that is Causal Loop Diagram — nor does it test whether an adaptive adversary would actually take the path, which falls to Adaptive Circumvention Red Team.

Instantiates: Migration-Resistant Hazard Control — the tree supplies the explicit transfer-path-and-boundary map the other controls must cover.
Consumes: Hazard Analysis — the hazard identification that says which harms are worth a top event.
Sibling mechanisms: Causal Loop Diagram · Adaptive Circumvention Red Team · Mass Balance · Hazard Analysis · Whole-System Impact Map · Before–After–Elsewhere Evaluation · Agent-Based Experiment or Simulation · System-Wide Net-Risk Dashboard · Boundary Expansion Review · Cross-Boundary Hazard Ledger · Cross-Jurisdiction Incident Review · Intervention Displacement Stress Test · Migration Sentinel Network · Pressure-Absorption Redesign Workshop · Source-Reduction or Safe-Dissipation Plan

References¶

[1] A minimal cut set is the smallest combination of basic events that together cause the top event; enumerating cut sets is the core analytical product of fault tree analysis, a method standardised in IEC 61025. Reading the smallest cut sets tells you the cheapest routes to the harm. ↩