Fault Tree Handbook (NUREG-0492)¶
Vesely, W. E., Goldberg, F. F., Roberts, N. H., & Haasl, D. F. (1981). Fault Tree Handbook (NUREG-0492).
Cited by¶
9 citations across 9 artifacts.
Each citation links to the sentence it supports in the citing article.
Primes¶
- Counterfactual Proximity Weighting
- The pattern reduces a confused mix of "irrational" behaviours to a single mechanism — the system is responding to a counterfactual-proximity signal the outcome record does not contain — and compresses the intervention space into three families keyed to the direction of the desired change. To dampen the response, suppress the salience of the counterfactual neighbour: regulators removing near-miss displays from gaming machines, debriefings that focus on the actual outcome rather than the avoided one, techniques for interrupting regret rumination. To amplify the response, surface the counterfactual neighbour: safety programmes that publicise close-call statistics, leadership debriefs that walk through "what could have happened." To weight it correctly, ground the proximity weight in an explicit causal model rather than perceptual proximity: fault-tree analysis weights near-misses by failure-mode branching, not by emotional vividness.
This sourceStandard reference for fault-tree analysis, which weights failure events by causal-chain branching and failure-mode probability rather than perceptual salience.
- The pattern reduces a confused mix of "irrational" behaviours to a single mechanism — the system is responding to a counterfactual-proximity signal the outcome record does not contain — and compresses the intervention space into three families keyed to the direction of the desired change. To dampen the response, suppress the salience of the counterfactual neighbour: regulators removing near-miss displays from gaming machines, debriefings that focus on the actual outcome rather than the avoided one, techniques for interrupting regret rumination. To amplify the response, surface the counterfactual neighbour: safety programmes that publicise close-call statistics, leadership debriefs that walk through "what could have happened." To weight it correctly, ground the proximity weight in an explicit causal model rather than perceptual proximity: fault-tree analysis weights near-misses by failure-mode branching, not by emotional vividness.
- Latent Realizable Capacity
- The prime supports several cross-domain reasoning moves. Counterfactual entailment: a disposition warrants conditional claims of the form "if trigger T occurred, manifestation M would occur" — a standing inference license, not merely a generalization from observed cases. Decoupling existence from observation: the capacity is ascribed independently of any observation of manifestation, which is structurally what licenses inference about unobserved physical properties, untested code paths, and unprosecuted breaches. Capacity composition: dispositions combine, filter, and inhibit, so a series of safety interlocks composes capacities such that joint manifestation requires all triggers, and redundant systems compose so that joint failure requires a conjunction.
This sourceStandard reference on the composition of failure dispositions via fault trees and series/parallel reliability logic — series interlocks requiring all triggers (AND-gates) and redundant systems requiring a conjunction of failures.
- The prime supports several cross-domain reasoning moves. Counterfactual entailment: a disposition warrants conditional claims of the form "if trigger T occurred, manifestation M would occur" — a standing inference license, not merely a generalization from observed cases. Decoupling existence from observation: the capacity is ascribed independently of any observation of manifestation, which is structurally what licenses inference about unobserved physical properties, untested code paths, and unprosecuted breaches. Capacity composition: dispositions combine, filter, and inhibit, so a series of safety interlocks composes capacities such that joint manifestation requires all triggers, and redundant systems compose so that joint failure requires a conjunction.
Mechanisms¶
- Fault Tree Analysis
- The discipline is to derive probabilities before computing the top event, to treat the tree as falsifiable, and to hand adaptive threats to a red team rather than pretend the gates are exhaustive.
This sourceQuantitative fault-tree evaluation requires probabilities for the basic events before the top-event probability can be computed.
- The discipline is to derive probabilities before computing the top event, to treat the tree as falsifiable, and to hand adaptive threats to a red team rather than pretend the gates are exhaustive.
- Fault Tree with AND-Gate Logic
- The discipline is to feed the dominant cut sets to a common-cause audit before trusting their probabilities, and to validate the tree's structure with people who know the real failure modes.
This sourceNUREG-0492. U.S. Nuclear Regulatory Commission (1981). Shows that minimal cut sets are inputs to common-cause analysis and can be examined before probabilistic quantification.
- The discipline is to feed the dominant cut sets to a common-cause audit before trusting their probabilities, and to validate the tree's structure with people who know the real failure modes.
- Fault Tree with Repeated-Opportunity Branch
- The discipline is to hunt common-cause explicitly
This sourceFault-tree evaluation explicitly checks common causes, grounds basic-event probabilities in stated data and judgments, and treats results as conditional on assumptions rather than proof of safety.
- The discipline is to hunt common-cause explicitly
- Independence Proof Obligation Template
- Its strength is killing the "they have different names, so they're independent" fallacy: it makes claims auditable and comparable, and it catches common-mode coupling that no per-member numerical test can see, because the coupling lives in a shared cause rather than in the data
This sourceUses fault-tree structure to identify components jointly susceptible to failure from a shared manufacturer, environment, energy source, or human cause.
- Its strength is killing the "they have different names, so they're independent" fallacy: it makes claims auditable and comparable, and it catches common-mode coupling that no per-member numerical test can see, because the coupling lives in a shared cause rather than in the data
- Single-Point-of-Failure Elimination
- Its central trap is common-mode failure: a "redundant" alternate that secretly shares a cause — the same conduit, power bus, cloud region, or firmware — so the single point was never really eliminated.
This sourceDefines common-mode failure as a shared cause disabling nominally redundant alternatives so the single failure vulnerability remains.
- Its central trap is common-mode failure: a "redundant" alternate that secretly shares a cause — the same conduit, power bus, cloud region, or firmware — so the single point was never really eliminated.
- Supplier Diversification
- The covariance test is what separates real diversification from the illusion of it: two suppliers that share an upstream node are one common-mode failure away from going down together
This sourceNUREG-0492. U.S. Nuclear Regulatory Commission (1981). Identifies shared manufacturer, location, environment, or energy-source dependencies as common causes capable of failing multiple components together.
- The covariance test is what separates real diversification from the illusion of it: two suppliers that share an upstream node are one common-mode failure away from going down together
Verification¶
Does it exist? Not checked yet. This entry carries no identifier to resolve. It was extracted from the citation as written in the article, normalized, and deduplicated against the rest of the registry.
Does it back the claim? Not recorded. Neither this nor any other of the 9 citations of this work carries a recorded support check.
Support is checked per citation rather than per work — the same source can be cited soundly in one article and wrongly in another. Per-citation recording began recently, so a citation with no recorded check is a gap in the record rather than evidence it went unchecked.
See how references were verified.
Registry ID ref:bcf7afba6363 · see in the full table