Fault Tree with Common-Cause Branching¶
Analytical model — instantiates Common-Mode Failure Analysis
Decomposes a top-level failure through logic gates to its basic causes, then adds shared-cause branches so a single event feeding several 'independent' paths becomes visible.
A fault tree starts at the top — the failure you must not have — and decomposes it downward through AND and OR gates to the basic events that could cause it. A redundant design shows up as an AND gate: the function is lost only if all the backup paths fail, which under the assumption of independent basic events makes the top event vanishingly rare. Fault Tree with Common-Cause Branching is the version that refuses to grant that assumption for free. It adds explicit shared-cause branches so that when a single basic event feeds into several of those "independent" legs, the AND gate collapses toward an OR: one event, all paths down. Its defining move is top-down and structural — it works from the failure back to a shared root and makes visible any single basic event that appears under more than one branch of a supposedly redundant tree.
Example¶
A chemical plant must not lose cooling on an exothermic reactor. The safety case rests on redundancy: a primary cooling pump and an independent backup pump, so loss of cooling requires both to fail — modeled as an AND gate that makes the top event acceptably improbable. The fault-tree-with-common-cause version is built to test whether that AND gate is honest.
Decomposing each pump's failure to basic events, the analysis finds two shared roots. Both pumps' control valves are actuated by the same instrument-air header; lose instrument air and both valves fail closed. And both pumps draw from the same electrical bus. Each shared basic event is drawn as a branch feeding under both legs of the redundancy. The structure now shows what the naive tree hid: two single events — instrument-air loss and bus loss — each of which is a one-item minimal cut set that defeats the entire redundant pair.[n1] The model then propagates probabilities to size the top event honestly, and the reactor's cooling risk turns out to be dominated not by pump reliability but by two shared services nobody had drawn as part of the cooling system at all.
How it works¶
The method extends ordinary fault-tree construction with coupling awareness:
- Build top-down to basic events. Start from the top failure and decompose through AND/OR gates until each leaf is an irreducible basic event.
- Expose the redundancy as AND gates. Represent each set of backups as an AND gate whose low top-probability depends entirely on its inputs being independent.
- Add common-cause branches. Wherever a single basic event feeds more than one leg — a shared power bus, air header, calibration, or operator — draw it explicitly under each leg it affects.
- Recompute the cut sets and the top event. Find the minimal cut sets; a common-cause branch shows up as a one- or few-element cut set that dominates the top-event probability, revealing the true reach of the shared root.
Tuning parameters¶
- Decomposition depth — how far down toward true basic events the tree goes. Deeper reveals shared roots that shallow trees stop above, but grows the model.
- Common-cause modeling detail — from a single shared branch to a parametrized coupling (e.g. a beta-factor on the AND gate). More detail is more faithful and more effortful.
- Quantitative vs. qualitative — whether the tree carries probabilities or only structure. Qualitative cut-set analysis alone already exposes single-event common modes; numbers add prioritization and false-precision risk.
- Boundary of the tree — whether shared support systems (power, air, cooling) are drawn inside the tree or assumed away. Drawing them in is exactly what surfaces common modes; leaving them out is the classic omission.
- Cut-set cutoff — the order of cut sets you enumerate. Low-order cutoffs find the dangerous single points fast; higher orders are more complete but heavier.
When it helps, and when it misleads¶
Its strength is that coupling becomes structural and visible: a shared cause is not a footnote but a branch that mathematically collapses the redundancy, and minimal-cut-set analysis names every single point of failure the design still contains. Where a bottom-up method must remember to ask about a shared cause, the top-down tree makes an un-drawn shared support system conspicuous by its absence.
Its failure mode is the boundary drawn too tight: if the shared power bus and instrument air are assumed outside the tree, the model reproduces the false independence it was meant to expose, and the AND gate reports comfort it has not earned. A classic misuse is quantifying a tree with independent-event probabilities while never adding the common-cause branches — a precise number that is precisely wrong. The guarding discipline is to draw shared support systems inside the boundary and to treat any AND gate over "independent" legs as a hypothesis to be broken, not a given.
How it implements the components¶
common_failure_mode_map— the tree with its cut sets is a structural map from shared basic events to the multiple paths they defeat.blast_radius_model— propagating a shared basic event through the gates quantifies how much of the redundant structure one root removes and how probable the top failure becomes.independence_assumption— the AND gates are the independence assumption written formally; the common-cause branches are where the model tests and often falsifies it.
It reasons top-down over structure and does not scope the protected_function_set element-list or run the shared-origin common_design_lineage_check of its nearest analytical twin, Common-Cause FMEA — which builds bottom-up from each part while this builds down from the failure; nor does it perform the live independence_validation_probe of Backup Independence Test.
Related¶
- Instantiates: Common-Mode Failure Analysis — this model exposes shared roots as structure and sizes their reach.
- Consumes: Credential and Infrastructure Dependency Audit — its shared-substrate map supplies candidate common-cause branches for the tree.
- Sibling mechanisms: Backup Independence Test · Common-Cause FMEA · Correlated Risk Register · Credential and Infrastructure Dependency Audit · Diverse Vendor Review · Supply-Chain Dependency Review · Tabletop Cascade Exercise
Editorial Notes¶
Form Classification¶
Form family: Analysis, Modeling & Optimization
Rationale: Fault Tree with Common-Cause Branching operates as a computation, comparison, model, or analytic representation used to infer, estimate, or choose because it decomposes a top-level failure through logic gates to its basic causes, then adds shared-cause branches so a single event feeding several 'independent' paths becomes visible.
Independent corroboration: The frozen evidence defines Fault Tree with Common-Cause Branching as 'Decomposes a top-level failure through logic gates to its basic causes, then adds shared-cause branches so a single event feeding several 'independent' paths becomes visible', so its operative form is Analysis, Modeling & Optimization.
Review outcome: Independent reviewer agreement; high confidence.
Origin Attribution¶
Primary origin: Engineering & Design
Origin pattern: Single lineage
Present-day reach: Multi-domain
Rationale: Common-cause branches extend fault-tree practice within reliability and safety engineering to represent dependent failures.
Related originating lineages:
- Aviation & Aeronautics — Aerospace system-safety work materially advanced analysis of shared services defeating redundancy.
Review resolution: Both reviewers agree that engineering_design is primary. I retain aviation_aeronautics only as formative origin lineage(s), without treating every later application as an origin. single_lineage is appropriate because the evidence supports one principal professional lineage. Reach is multi_domain as a separate applicability judgment: it does not widen or narrow the recorded provenance. Encyclopedia synthesis is false because the artifact is already established enough that encyclopedia-specific synthesis is not required. The secondary differences are reconciled with no unresolved primary-provenance ambiguity.
Review outcome: Reconciled after independent review; high confidence.
Notes¶
[n1] A minimal cut set is a smallest combination of basic events whose joint occurrence causes the top event. A cut set of size one is a single point of failure; common-cause branching is what turns a shared basic event into such a one-element cut set across a redundant design that otherwise looked protected by an AND gate. ↩