Fault tree analysis

A fault tree starts with a single undesired event and decomposes its causes through Boolean logic: this happens if A and B, or if C alone. The gates keep going down until they reach basic events — component failures, human errors — whose probabilities can, if you have the data, be combined to estimate the top event's frequency and to find minimal cut sets: the smallest combinations of failures that get you there.

That logical rigour is FTA's gift. AND-gates make redundancy explicit; cut sets expose the single points of failure hiding inside apparently layered systems. It is the standard tool where quantification is demanded — nuclear, aerospace, safety-instrumented systems — and it earned its keep long before bowties existed.

The trade is legibility. A serious fault tree is specialist reading, and it covers only the causal side. A bowtie is, structurally, a simplified fault tree on the left married to a simplified event tree on the right, with the logic gates traded away for something an operations team can own: named barriers, effectiveness, ownership, and verification.

Use FTA when you must prove a number or find cut sets; use the bowtie to manage and communicate the controls. On major hazards, mature organisations do both and keep the top event definitions aligned.