How FTA Studio Computes — Methods & Verification

The conservative guarantee

FTA Studio never under-states risk.

Every quantification the engine reports is exact or conservative. Where a method approximates, it over-estimates risk by a stated, bounded amount — and the one historical configuration where a standard formula could under-count (mutually-exclusive events spread across cut sets) is closed by an automatic guard that switches to a provably conservative bound and says so in the UI.

Qualitative analysis

Minimal cut sets — MOCUS

Top-down MOCUS substitution with idempotent reduction and minimality absorption: exact and complete for coherent trees built from AND, OR, VOTE(k/n) and INHIBIT gates, including repeated events and transfer references. VOTE gates expand to exactly the C(n,k) combinations. Verified against brute-force truth-table enumeration — an independent oracle that shares no code with the engine.

Quantification

Exact inclusion-exclusion, bounded approximations

Exact — full inclusion-exclusion over the minimal cut sets (up to 22 cut sets), shared events de-duplicated per term.
Approximate — the min-cut upper bound 1−Π(1−Q_i) (Esary–Proschan): rigorously conservative, and equal to exact whenever cut sets share no events. The auto-degrade above 22 cut sets is always shown, never silent.
Non-coherent logic — trees with XOR, NOT, NAND or NOR gates are quantified exactly by truth-table enumeration of the structure function (up to 20 basic events), including importance measures. No silent approximation of non-coherent logic.

Failure models

Time-dependent basic events

Data	Model	Status
Direct Q	used as-is	exact (per-demand or precomputed)
λ, mission time T	1 − e^(−λT)	exact (non-repairable)
λ, per flight hour (ARP4761)	λ·T	conservative linear convention
λ, proof-test interval τ	PFDavg = λτ/2	IEC 61508 low-demand result — PFDavg computed, not hand-entered
λ, repair rate μ	λ/(λ+μ)·(1−e^(−(λ+μ)T))	exact transient unavailability

Dependence & simulation

Common cause, disjoint events, Monte Carlo

β-factor CCF — the standard (1−β) split with an explicit common-cause term, geometric-mean generalisation for non-identical members (cf. NUREG/CR-5485). Limiting cases β=0 and β=1 behave exactly.
Disjoint groups — cut sets violating mutual exclusivity are removed exactly; the automatic conservative-method guard covers the residual case.
Monte Carlo — seeded, reproducible xoshiro128** simulation of the structure function, with common-cause groups sampled as coupled shocks and a Wilson 95% confidence interval. Simulated and analytic Q(top) describe the same model.

Integrity levels

Your industry's currency, not just SIL

Verdicts follow the project standard and state their scheme, metric and table beside every claim — on the Analysis panel, the compliance checklist, analytics, PDF reports and signed exports.

Standard	Scheme	Quantitative targets
IEC 61025 / IEC 61508	SIL 1–4	PFH (Table 3) or PFDavg (Table 2), switched by demand mode
EN 50126 (rail)	SIL from THR	tolerable hazard rate per hour
ARP4761 (aerospace)	DAL A–E	CS/FAR 25.1309 failure-condition targets per flight hour
ISO 26262 (automotive)	ASIL A–D	PMHF targets, explicitly labelled informative — ASILs are assigned by hazard analysis, verified here
ISO 13849 (machinery)	PL a–e	PFHd ceilings

Proof, not promises

The ground-truth battery

Every method above is pinned by an executable 130-check correctness suite that runs on every change. It never compares against a previous implementation — only against external truth:

Hand-calculated inclusion-exclusion trees with the arithmetic written out for review.
Published results — 2-out-of-3 voting logic, the classic five-component bridge network's minimal cut sets.
A brute-force truth-table oracle (independent code) confirming cut sets, minimality and exact probabilities.
Adversarial high-probability cases pinning each approximation's bound and conservative direction.
Every band edge of the SIL, THR, DAL, ASIL and PL tables.

The full method statement — including every assumption and its magnitude — ships with the product as a versioned document, and cryptographically signed IEC 61025 exports embed the method identifiers used, so any recipient can audit a specific artifact against it.

Try it on your own tree — free →