Advanced Failure and Systems Analysis

Introduction

Complex failures rarely arise from a single defective component. They emerge from interactions among equipment, software, people, procedures, organisational decisions, environmental conditions and regulatory constraints. Conventional root cause analysis may identify an immediate technical cause, but high-risk events require methods that explain how hazards were created, how safeguards failed, why decisions appeared reasonable at the time, and how the system permitted the event to develop.

This chapter presents advanced tools for such analysis: fault-tree analysis (FTA), event-tree analysis (ETA), barrier analysis, change analysis, bow-tie models, Kepner–Tregoe (KT) problem analysis and systems-theoretic approaches. These tools are complementary rather than interchangeable. FTA reasons backward from an unwanted event; ETA reasons forward from an initiating event; barrier analysis examines controls; change analysis compares normal and abnormal conditions; KT structures evidence-based problem solving; and systems-theoretic methods examine constraints, feedback and control relationships.

The objective is not merely to produce a longer list of causes. It is to construct a defensible explanation that supports risk reduction, learning and governance.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Construct and interpret fault trees and event trees.
2. Distinguish initiating events, causal factors, consequences and failed barriers.
3. Select suitable methods for complex and interacting failures.
4. Use probability calculations only when assumptions and data justify them.
5. Apply KT analysis, change analysis and systems-theoretic reasoning.
6. Integrate technical, human, organisational and regulatory evidence.
7. Evaluate the limitations, ethical implications and governance requirements of advanced RCA.

1. Failure as a System Phenomenon

A useful analytical distinction is:

• Hazard: a condition with the potential to cause harm.
• Top event: the undesired system state selected for analysis.
• Initiating event: an event that begins an accident sequence.
• Intermediate event: a condition or event linking causes to consequences.
• Consequence: harm, loss or operational impact.
• Barrier: a physical, technical, human or organisational control that prevents, detects or mitigates an event.
• Latent condition: a pre-existing weakness, such as poor design, inadequate training or conflicting objectives.
• Active failure: an unsafe action or immediate malfunction at the operational interface.

A high-quality RCA separates what happened from why it was possible. It also distinguishes causal contribution from blame. A person may be the last actor in a chain without being the most influential cause.

2. Fault-Tree Analysis

2.1 Purpose and logic

FTA is a deductive, top-down method. The analyst begins with a defined top event and decomposes it into combinations of lower-level events using logical gates. The principal gates are:

• OR gate: the output occurs if any input occurs.
• AND gate: the output occurs only if all inputs occur.
• Priority AND gate: all inputs occur in a specified temporal order.
• Inhibit gate: an input produces the output only when a condition is present.

A tree should describe events, not vague conditions. “Pump fails to deliver required flow” is more useful than “pump problem.” Event definitions should include operating context, time frame and performance threshold.

2.2 Minimal cut sets

A cut set is a combination of basic events sufficient to produce the top event. A minimal cut set contains no unnecessary event. Minimal cut sets reveal vulnerabilities: a single-event cut set indicates a particularly weak point, while a large AND combination may indicate dependence on several failures.

For independent basic events, the probability of an AND combination is the product of the event probabilities:

For independent events in an OR gate, the exact probability is:

Here, P(·) denotes probability, and A and B are events. The formulas assume statistical independence and a common, clearly defined mission or exposure period. If events are dependent—for example, a shared power supply causes both failures—these formulas can materially underestimate risk.

For rare, independent events, the OR probability is approximately the sum of the individual probabilities:

This approximation is appropriate only when the neglected product term P(A)P(B) is very small.

2.3 Worked example: protection failure

Suppose loss of containment occurs if either:

1. both isolation valves fail to close, or
2. the automatic trip fails and the operator fails to initiate manual isolation.

Let the probabilities during the defined demand period be:

• P(V₁)=0.01 and P(V₂)=0.01,
• P(T)=0.02 for automatic-trip failure,
• P(O)=0.10 for failure of manual intervention.

Assume independence solely for illustration. The first pathway has probability:

The second pathway has probability:

If the two pathways are also independent, the top-event probability is:

Correctly expressing the result without an invalid symbol substitution:

The top event is the OR of the pathways, so, naming them C₁ and C₂:

Thus the illustrative probability is approximately 0.00210 per demand, or 0.210%. In practice, common-cause failure, dependence between operator response and alarm performance, and uncertainty in the probabilities must be examined before using the result for a safety decision.

2.4 Strengths and limitations

FTA is valuable for safety cases, critical equipment, design reviews and quantitative risk assessment. It exposes combinations that ordinary brainstorming may miss. Its limitations include boundary-definition errors, omitted dependencies, difficulty representing adaptive human behaviour and the temptation to treat uncertain probabilities as precise facts. A fault tree is a model of reasoning, not proof that the system behaves independently as the tree assumes.

3. Event-Tree Analysis

ETA is an inductive, forward method. It begins with an initiating event and follows successive safety functions or barriers. Each branch represents success or failure. The terminal nodes describe possible consequences.

If an initiating event has probability P(I) and a sequence contains conditionally dependent branch probabilities, the sequence probability is:

The notation P(B₂ | I,B₁) means the probability that barrier 2 succeeds or fails given the preceding conditions. Multiplication of unconditional probabilities is valid only when independence or the relevant conditional relationships have been established.

ETA is especially useful for comparing mitigation strategies. For example, after a cooling-system initiating failure, branches may represent alarm detection, automatic shutdown, emergency cooling and operator recovery. The analysis can show that a nominally redundant set of barriers is not truly independent if all rely on the same sensor, power source or control-room decision.

FTA asks, “What combinations can produce this top event?” ETA asks, “Given this initiating event, what outcomes can develop?” Used together, they provide complementary backward and forward perspectives.

4. Barrier Analysis and Bow-Tie Models

Barrier analysis identifies controls between a threat and an unwanted event, and between that event and its consequences. Barriers may be:

A bow-tie model places the top event at the centre. Threats appear on the left, preventive barriers lie between threats and the top event, and consequences appear on the right with mitigative barriers between the top event and harm. Escalation factors explain why a barrier may be weakened—for example, corrosion, alarm flooding, maintenance backlog or unclear authority.

The bow-tie is not simply a graphic summary. Each barrier should have an owner, performance standard, verification method, failure mode and recovery provision. “Training” alone is rarely a sufficient barrier unless competence, opportunity and supervision are demonstrated.

Barrier quality can be assessed using questions such as:

1. Is the barrier independent of the initiating cause?
2. Is it effective against the specific threat?
3. Is its performance measurable?
4. Can degradation be detected before demand?
5. Is there a credible recovery barrier if it fails?

5. Change Analysis

Change analysis compares the conditions before an event with the conditions during or immediately before it. It is particularly effective when the process normally operates safely but fails after a modification, unusual demand or organisational transition.

A disciplined comparison examines changes in:

• equipment, materials and software;
• procedures, staffing and competence;
• workload, production rate and operating envelope;
• maintenance, inspection and configuration;
• suppliers, contractors and interfaces;
• management priorities, incentives and reporting arrangements;
• external conditions, regulation and customer requirements.

The analyst should distinguish difference from cause. A change is causally relevant only when evidence shows that it altered exposure, barrier performance or system control. Useful evidence includes work orders, configuration records, shift logs, interviews, alarm histories, training records and management-of-change documentation.

A practical change matrix includes columns for “normal condition,” “event condition,” “difference,” “mechanism,” “evidence” and “control required.” This discourages hindsight reasoning and makes assumptions visible.

6. Kepner–Tregoe Problem Analysis

KT problem analysis provides a structured method for distinguishing facts from assumptions. The central tool is the Is/Is Not matrix:

The analyst then asks what is different about the “is” compared with the “is not,” generates possible causes, tests each against the evidence, and verifies the most probable cause. KT also distinguishes deviation analysis from decision analysis. Deviation analysis explains an unwanted departure from standard performance; decision analysis evaluates alternatives against objectives, musts, wants and risks.

KT is valuable because it imposes evidential discipline. However, it can become mechanistic if the analyst assumes that every problem has one discrete cause. Complex failures may involve interacting causes, feedback loops and changing system boundaries.

7. Systems-Theoretic Approaches

Systems-theoretic approaches treat safety as an emergent property of relationships and control, not merely as the absence of component failures. In the Systems-Theoretic Accident Model and Processes (STAMP), accidents result from inadequate enforcement of safety constraints within a control structure. The structure may include regulators, executives, designers, operators, maintenance personnel and automated controllers.

A simplified control loop contains:

1. a controller with objectives and process models;
2. a control action;
3. a controlled process;
4. feedback about the process state;
5. disturbances that may be internal or external.

Failures may arise because:

• a safety constraint was never specified;
• the controller’s process model was incorrect or incomplete;
• feedback was delayed, inaccurate or unavailable;
• control actions were unsafe under the actual conditions;
• responsibilities and authority were misaligned;
• adaptation to production pressure gradually eroded safety margins.

Functional Resonance Analysis Method (FRAM) similarly examines how normal performance variability can combine across functions. It is useful where work is adaptive and tightly coupled, and where no single component failure explains the outcome.

These methods broaden the investigation from “which component failed?” to “which constraints, information flows and adaptations allowed the hazardous state?” They are particularly appropriate for healthcare, aviation, software-intensive systems, infrastructure and multi-organisation operations.

8. Integrating the Methods

No single method is sufficient for every investigation. A staged strategy is often effective:

1. Define the event, scope and operational boundary.
2. Establish a verified timeline.
3. Use change analysis and KT Is/Is Not analysis to identify discriminating evidence.
4. Build a bow-tie to map threats, barriers and consequences.
5. Use FTA for a critical top event requiring backward decomposition.
6. Use ETA to examine credible initiating events and outcome pathways.
7. Apply systems-theoretic analysis where control, coordination or adaptation is central.
8. Validate the model with subject-matter experts and independent evidence.
9. Convert findings into corrective actions with owners, due dates and effectiveness measures.

The methods should not be combined merely to make a report appear sophisticated. Each model must answer a clear question. Conflicting models should be treated as useful evidence about uncertainty or competing system boundaries.

9. Illustrative Case: Solvent-Transfer Fire

Background

The following fictional case is illustrative. A chemical plant transfers solvent from a storage vessel to a blending tank. The transfer line includes a pump, an automated isolation valve, a vapour-extraction system and a high-level alarm.

Problem

During a night shift, the blending tank overflowed. Vapour accumulated near an ignition source and a flash fire occurred. Two workers sustained minor injuries and production stopped for three days.

Analysis

The initial explanation—“the operator failed to stop the transfer”—was incomplete. Timeline reconstruction showed that:

• the high-level alarm was acknowledged but not understood as a rising-level alarm because its label had been changed during a software upgrade;
• the automated isolation valve had been left in manual mode after maintenance;
• the vapour-extraction fan was operating below design capacity because of a blocked filter;
• the night shift had one fewer operator than the staffing assumption in the emergency procedure;
• the blending recipe had recently increased solvent volume by 12%.

The bow-tie identified the overfill as the top event. Preventive barriers included correct recipe control, level indication, high-level alarm, automatic isolation and operator monitoring. Mitigative barriers included vapour extraction, ignition-source control, emergency shutdown and evacuation.

The FTA top event “solvent release with ignition potential” was reached through an OR relationship between overfill and line rupture. The overfill pathway required failure of automatic isolation and ineffective operator response after alarm. The analysis identified dependence: the operator response was weakened by the alarm-label change, and automatic isolation was unavailable because maintenance configuration was not restored.

ETA showed that, after overfill, the outcome depended on vapour extraction and ignition-source control. The blocked filter increased the likelihood of a flammable atmosphere, while a temporary electrical heater created an additional ignition source.

Change analysis identified the recipe increase, software modification, maintenance status, staffing reduction and filter blockage. KT analysis showed that the event occurred only on the modified recipe and only in the affected line, narrowing the investigation to configuration and change-control weaknesses.

A systems-theoretic review found inadequate control constraints: management-of-change approval did not require a barrier review; maintenance close-out did not provide positive confirmation of valve mode; and production targets encouraged recipe throughput without an equivalent review of tank capacity and staffing.

Approach and solution

Corrective actions were prioritised as follows:

1. restore and independently test automatic isolation;
2. redesign alarm wording and validate it with operators;
3. interlock solvent volume with verified tank capacity;
4. introduce positive maintenance handback and configuration control;
5. establish filter differential-pressure monitoring;
6. remove or permit-control temporary ignition sources;
7. require barrier review for recipe, software and staffing changes;
8. audit effectiveness through simulated demands rather than document review alone.

Outcome and learning points

The case demonstrates that the operator’s action was a contributing event, not an adequate root-cause conclusion. Multiple weak barriers aligned, and several were connected through common changes in configuration and management control. The most important learning is that “independent safeguards” must be tested for actual independence, not merely listed as separate rows in a risk register.

10. Limitations, Ethics and Governance

Advanced RCA involves uncertainty. Probabilities may be estimated from sparse data; interviews may be affected by fear or memory distortion; and models may reflect the assumptions of the investigation team. Analysts should record confidence levels, data sources, excluded evidence and alternative explanations.

Ethically, investigators must protect interviewees from retaliation, distinguish accountability from blame, and avoid hindsight bias. Confidentiality should not be used to conceal systemic risk. In regulated industries, records must satisfy applicable reporting, retention and evidence requirements. Where criminal, environmental or public-safety implications exist, the investigation should be coordinated with legal and regulatory authorities without compromising technical integrity.

AI can assist with timeline extraction, document comparison, anomaly detection and barrier-register maintenance. It should not independently assign blame or infer causation from correlations. Sensitive operational data require access controls, provenance, validation and human review. An AI-generated causal hypothesis is a prompt for investigation, not evidence of root cause.

11. Best-Practice Checklist

A defensible advanced RCA should:

• define the top event and system boundary precisely;
• preserve evidence before normal conditions are restored;
• construct a time-ordered factual timeline;
• identify dependencies and common-cause failures;
• examine normal work, adaptations and production pressures;
• represent barriers by performance, not by nominal existence;
• test proposed causes against disconfirming evidence;
• state assumptions and uncertainty explicitly;
• include technical, human, organisational and external factors;
• assign corrective actions at the level of the system that can control the risk;
• verify effectiveness under realistic demand conditions.

Chapter Summary

Advanced failure analysis recognises that high-consequence events are usually produced by interacting technical and organisational conditions. Fault-tree analysis decomposes a top event backward through logical combinations; event-tree analysis follows initiating events forward through barrier successes and failures. Barrier analysis and bow-tie models connect threats, preventive controls, consequences and mitigations. Change analysis identifies meaningful differences between normal and event conditions, while Kepner–Tregoe analysis disciplines evidence through Is/Is Not comparisons. Systems-theoretic approaches examine safety constraints, control structures, feedback and adaptive performance.

Quantitative calculations are useful only when event definitions, data quality, dependence assumptions and exposure periods are explicit. The strongest investigations integrate several methods selectively, test alternative explanations, protect fairness and convert findings into measurable, verified risk controls.

Key Terms

Hazard: A condition with the potential to cause harm.

Top event: The undesired system state selected for analysis.

Initiating event: An event that begins an accident sequence.

Barrier: A control that prevents, detects or mitigates an unwanted event.

Latent condition: A pre-existing system weakness that may enable failure.

Active failure: An unsafe action or immediate malfunction at the operational interface.

Fault-tree analysis: A deductive method that decomposes a top event using logical gates.

Event-tree analysis: An inductive method that follows outcomes from an initiating event.

Minimal cut set: The smallest combination of basic events sufficient to produce a top event.

Common-cause failure: Failure of multiple elements due to one shared cause.

Bow-tie model: A model linking threats and preventive barriers to consequences and mitigative barriers.

Change analysis: Systematic comparison of normal and event conditions.

Kepner–Tregoe analysis: Evidence-structured problem and decision analysis.

STAMP: A systems-theoretic model focusing on safety constraints and control structures.

FRAM: A method analysing interactions among variable functions and performance resonance.

Process model: A controller’s internal representation of system state and behaviour.

Escalation factor: A condition that weakens or defeats a barrier.

Independence: The absence of causal dependence between events or safeguards.

Safety constraint: A condition that must be enforced to prevent unacceptable system behaviour.

Review Questions

Short Answer Questions

1. What is the difference between an initiating event and a top event?
2. Distinguish an AND gate from an OR gate in fault-tree analysis.
3. What is the purpose of an Is/Is Not matrix?
4. Define a common-cause failure and give one example.
5. Why should barriers be assessed for independence?

Long Answer Questions

1. Explain how FTA and ETA provide complementary perspectives on the same accident scenario.
2. Describe the construction and uses of a bow-tie model.
3. Discuss the strengths and limitations of quantitative probability calculations in FTA.
4. Compare KT analysis with systems-theoretic analysis.
5. Explain how organisational conditions can become latent contributors to technical failure.

Analytical / Application Questions

1. Construct a small fault tree for loss of emergency cooling and identify possible minimal cut sets.
2. For a manufacturing incident following a software upgrade, design a change-analysis matrix and specify the evidence required.
3. A safety system has three nominally independent barriers that share one power supply. Analyse the implications using bow-tie and systems-theoretic reasoning.

Multiple Choice Questions with Answers

Question 1

Which method primarily reasons backward from an undesired top event?

A. Event-tree analysis

B. Fault-tree analysis

C. Change analysis

D. FRAM

Correct Answer: B. Fault-tree analysis

Question 2

An AND gate produces its output when:

A. Any one input occurs

B. No input occurs

C. All specified inputs occur

D. Inputs occur in alphabetical order

Correct Answer: C. All specified inputs occur

Question 3

For independent events A and B, which expression gives the exact probability of their union?

A. P(A)P(B)

B. P(A)+P(B) in all cases

C. 1−(1−P(A))(1−P(B))

D. P(A)−P(B)

Correct Answer: C. 1−(1−P(A))(1−P(B))

Question 4

In a bow-tie model, preventive barriers are located:

A. Between consequences and recovery

B. Between threats and the top event

C. Only after the accident

D. Outside the system boundary

Correct Answer: B. Between threats and the top event

Question 5

What is the main purpose of change analysis?

A. To assign blame to the last operator

B. To compare normal and event conditions

C. To calculate only equipment reliability

D. To replace evidence with expert opinion

Correct Answer: B. To compare normal and event conditions

Question 6

Which feature is central to Kepner–Tregoe problem analysis?

A. The Is/Is Not matrix

B. The priority queue

C. The control chart only

D. The balance sheet

Correct Answer: A. The Is/Is Not matrix

Question 7

Systems-theoretic analysis places particular emphasis on:

A. Component age alone

B. Safety constraints and control relationships

C. Eliminating all human involvement

D. Random sampling only

Correct Answer: B. Safety constraints and control relationships

Question 8

If two independent failures each have probability 0.01, the probability that both occur is:

A. 0.0001

B. 0.001

C. 0.01

D. 0.02

Correct Answer: A. 0.0001

Question 9

Which is an example of an escalation factor?

A. A verified independent shutdown

B. A blocked filter weakening vapour extraction

C. A correctly completed test

D. A clearly defined safety constraint

Correct Answer: B. A blocked filter weakening vapour extraction

Question 10

Why may multiplying unconditional branch probabilities be inappropriate in an event tree?

A. Event trees never use probabilities

B. Branches may be conditionally dependent

C. Initiating events have no consequences

D. Barriers cannot fail

Correct Answer: B. Branches may be conditionally dependent