Skip to content

Minimal Cut-Set Enumeration

Analytical method — instantiates Conjunctive Path Assurance

Reduces a fault model to the complete list of minimal condition-sets — each the smallest combination that, occurring together, completes a route to the hazard.

A fault model can hold thousands of ways to reach the top hazard, most of them redundant restatements of a few. Minimal Cut-Set Enumeration reduces the model to its irreducible core: the complete set of minimal cut sets — each the smallest group of basic conditions whose simultaneous truth is enough to make the hazard reachable, with nothing left over. Its defining move is that it works algebraically on the logic, not by testing or sampling: it takes the AND/OR structure of a fault tree and reduces it to the shortest conjunctions that complete a route, then ranks them by order — how many things must go wrong at once. An order-1 cut set is a single point of failure; an order-4 set needs four coincidences. That ranking is the payoff: it converts a tangled model into a shortlist of exactly the conjunctions worth defending against, sorted by how easily they can happen.

Example

A fly-by-wire flight-control system carries three power channels to the elevator actuators, and the top event is "no actuator power at the elevator." On paper this looks robustly triple-redundant. Minimal Cut-Set Enumeration reduces the fault tree and confirms most cut sets are order-3 — you need all three channels down together, reassuringly rare. But the reduction also surfaces one order-1 cut set that no channel-by-channel review saw: a shared power-distribution bus upstream of all three channels. A single fault there defeats the redundancy in one stroke. The enumeration's whole value is in that one line of output — a single point of failure hidden beneath an apparently three-deep defense, promoted to the top of the list precisely because it is order-1.

How it works

The method operates on the model's Boolean structure function, not on the running system. It expands the AND/OR gates and applies logical reduction — absorption and the removal of supersets — so that every surviving term is a minimal conjunction: drop any condition from it and it no longer completes a route. The result is the full disjunction of minimal cut sets, which it then sorts by order and (if probabilities are attached) by likelihood. What distinguishes it from its siblings is that it is exhaustive over the model and static: it does not ask whether a combination is likely or exercise it against reality, only whether the logic admits it, and if so in how few simultaneous conditions.

Tuning parameters

  • Truncation order — the largest cut-set size you bother to enumerate. A low cut-off finds the dangerous shallow sets fast; a high one is complete but can blow up combinatorially.
  • Probability cut-off — discarding sets below a likelihood floor to keep the list workable; set it too aggressively and a rare-but-catastrophic set is silently dropped.
  • Basic-event granularity — how finely components are decomposed into basic events; finer decomposition exposes shared parts that collapse redundancy, but inflates the tree.
  • Failure vs. success framing — enumerating cut sets (ways to fail) versus path sets (ways to keep working); each answers a different design question.
  • Coherence assumption — whether the model is restricted to monotone AND/OR logic or also admits negation; non-coherent trees are more expressive but far harder to reduce.

When it helps, and when it misleads

Its strength is compression with a purpose: it turns a sprawling fault model into a ranked shortlist of the exact conjunctions that matter, and it is the surest way to flush out the order-1 cut set — the single point of failure hiding under an apparently deep defense — that a component-by-component review structurally cannot see.[1]

Its central weakness is that it is only as complete as the model it consumes: a missing edge, a forgotten mode, or an assumed independence that isn't real yields a cut-set list that looks exhaustive but isn't, and combinatorial blow-up forces a truncation that can quietly drop a genuine deep set. It is also easy to run backwards — to pick a truncation or a probability floor that hides the inconvenient cut set and lets a design be declared safe. The discipline that guards against this is to fix the model boundary by independent review before enumerating, and to overlay a common-cause check: a cut set of nominally independent events collapses toward order-1 the moment they share a driver.

How it implements the components

  • minimal_activating_conjunction_set — its primary output: the minimal cut sets are the minimal activating conjunctions, each the smallest combination that lights a complete route.
  • path_enumeration_scope — the truncation order and probability floor define the boundary of what the reduction enumerates and what it leaves unlisted.

It does not build the fault model it reduces — that AND-gate structure comes from Fault Tree with AND-Gate Logic — nor test whether an enumerated set actually conducts, and its independence assumption is exactly what Common-Cause Dependency Audit exists to check.

Notes

Minimal Cut-Set Enumeration is qualitative and structural: it tells you which conjunctions complete a route and how few conditions each needs, but not how likely any of them is. Turning cut-set orders into probabilities requires the dependence structure, which belongs to Scenario or Monte Carlo Joint-State Sampling. Keeping the two apart is what lets a team improve the model — better boundary, a common-cause overlay — without re-arguing the risk numbers.

References

[1] A minimal cut set is the standard fault-tree-analysis object — the smallest set of basic events whose joint occurrence causes the top event (IEC 61025, Fault tree analysis). Ranking cut sets by order is the canonical way to expose single points of failure, which is why order-1 sets are surfaced first. ↩