Skip to content

Fault Tree with AND-Gate Logic

Model — instantiates Conjunctive Path Assurance

Deduces, top-down through AND and OR gates, the combinations of basic failures whose conjunction is sufficient to cause the top event, and enumerates them as minimal cut sets.

The archetype's central worry — which combination of conditions is jointly sufficient for failure — is exactly what a fault tree is built to answer, and it does so deductively from the top down. Fault Tree with AND-Gate Logic starts from a single undesired top event and decomposes it through logic gates: an AND gate says every input must occur together, an OR gate says any one suffices, and the decomposition continues until it reaches basic events. Its defining move is that the AND gates are the conjunctions the archetype cares about, and Boolean reduction turns the whole tree into an explicit list of minimal cut sets — the smallest combinations of basic failures sufficient to cause the top event — each of which can then be assigned a probability. Where a bow-tie is qualitative and an attack graph is adversarial, the fault tree is the quantitative logic of what ANDs together to cause this.

Example

A reactor's emergency core cooling is modelled with the top event core not cooled after a coolant-line break. Directly beneath sits an AND gate: primary injection fails and backup injection fails — neither alone is enough. Each branch decomposes through OR gates (a pump fails, or its power is lost, or a valve sticks). Boolean reduction yields the minimal cut sets, among them the two-element set {loss of offsite power, backup diesel generator B fails}. Attaching basic-event probabilities makes one striking fact pop out: a two-element cut set that runs through a shared power bus dominates the calculated risk. That result does not close the analysis — it routes straight to a common-cause check on the shared bus, because the tree's independence assumption is exactly what would make that dominant cut set far more likely than the naive product suggests.

How it works

Define the top event; decompose downward through gates (AND for required conjunction, OR for alternatives) until you reach basic events with known failure modes; reduce the resulting Boolean expression to its minimal cut sets — the irreducible sufficient conjunctions; then, optionally, attach basic-event probabilities and compute the top-event likelihood and each cut set's importance. What distinguishes it is the gate structure itself: the AND gate directly encodes conjunction, and cut-set reduction names every minimal combination — the deductive, top-down complement to an attack graph's forward search.

Tuning parameters

  • Resolution / basic-event granularity — how far down the tree is decomposed. Finer trees find subtler cut sets but grow quickly and demand more failure data.
  • Gate discipline — how strictly each AND-versus-OR choice is justified. A lazy OR where an AND belongs (or the reverse) changes everything; the gates are the model's load-bearing claims.
  • Quantitative versus qualitative — stop at the cut sets or attach probabilities. Numbers rank the risk but require basic-event data you may not have.
  • Dependence handling — whether basic events are treated as independent or a common-cause factor is applied. Assuming independence understates the probability of shared-cause cut sets — the classic trap.

When it helps, and when it misleads

Its strength is that it both enumerates and quantifies the sufficient conjunctions, and cut-set importance points precisely at which combination to defend first; the AND-gate view makes "what has to go wrong together" explicit and auditable. Its failure mode is that the tree is only as good as its structure — a missing branch or a mislabelled gate silently drops real cut sets — and the standard rare-event math understates the probability of any cut set whose elements secretly share a common cause, flattering the result. The classic misuse is multiplying independent probabilities for basic events that actually share a driver, or shaping the tree to hit a target number. The discipline is to feed the dominant cut sets to a common-cause audit before trusting their probabilities, and to validate the tree's structure with people who know the real failure modes.[1]

How it implements the components

  • state_conditional_causal_graph — the gate structure from basic events up to the top event is the causal model of how conditions combine to fail.
  • minimal_activating_conjunction_set — minimal cut sets are exactly the minimal activating conjunctions, named by Boolean reduction of the tree.
  • probabilistic_dependence_profile — basic-event probabilities, corrected by a common-cause factor, quantify how likely each conjunction is.

It deduces failures, not attacks: the adversarial_path_search_boundary is Attack Graph Analysis's, the common_driver_and_independence_check that verifies its basic events really are independent is the Common-Cause Dependency Audit's, and the path_break_or_interlock_requirement that breaks a cut set is Independent Interlock or Guard's.

Notes

The fault tree is the model; Minimal Cut-Set Enumeration is the algorithm run over it — build the tree here, and let that sibling extract and rank the cut sets at scale. Either way the cut-set probabilities are trustworthy only after a common-cause audit has tested the independence the reduction assumed.

References

[1] A minimal cut set is the smallest combination of basic events whose joint occurrence is sufficient to cause the top event; single-element cut sets are single points of failure, and small cut sets sharing a common cause are the ones the rare-event approximation most badly underestimates. ↩