# Fault Tree Uncertainty Analysis > Use when you must quantify the epistemic uncertainty band around a quantified fault-tree probability: convert each basic-event lognormal error factor to a lognormal sigma with the 90 percent normal quantile, combine the per-event sigmas into the lognormal sigma of the tree probability weighted by the Fussell-Vesely fractions, form the two-sided 90 percent lognormal-confidence-band around the top probability, compute the exceedance-probability of the true value above a target probability, and decompose the variance of the spread into per-event uncertainty-variance-shares. Produces the per-event sigmas, the combined sigma, the band bounds, the exceedance probability and the variance shares that gate confidence in a top-event number. Trigger: fault-tree uncertainty analysis, lognormal error factor, lognormal confidence band, uncertainty variance share. - Skill: `ashfordeou/fault-tree-uncertainty-analysis` (Agent Skill, multi-file: 3 files) - Install (CLI): `npx skillmds@latest add ashfordeou/fault-tree-uncertainty-analysis` - Raw SKILL.md: https://api.skillmd.com/api/skills/ashfordeou/fault-tree-uncertainty-analysis/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Coding & Dev Tools - License: Apache-2.0 - Author: ashfordeOU (https://skillmd.com/u/ashfordeou) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/ashfordeou/fault-tree-uncertainty-analysis --- # Fault Tree Uncertainty Analysis (systems-engineering-safety/arp4761a/fault-tree-uncertainty-analysis) Use when you must quantify the epistemic uncertainty band around an already-quantified fault-tree top probability. Each basic event carries a lognormal error factor EF from the failure data; the leaf converts each EF into a lognormal sigma with the 90 percent normal quantile, combines the per-event sigmas into the lognormal sigma of the tree probability using the Fussell-Vesely fractions as weights, forms the two-sided 90 percent lognormal-confidence-band around the top probability, computes the exceedance probability of the true value above a target probability, and decomposes the variance of the spread into per-event shares. The band bounds and shares gate how much confidence to place in a top-event number. It consumes the quantified top probability from systems-engineering-safety/arp4761a/fta-fmea and the Fussell-Vesely fractions from systems-engineering-safety/arp4761a/ fault-tree-importance-measures; it never derives either input itself. ## Domain quick reference - Lognormal error factor: EF is the multiplicative factor such that the 90 percent band of the event probability runs from q / EF to q * EF in the underlying lognormal model; EF >= 1.0 by definition. - Error factor to sigma: sigma = ln(EF) / NORMAL_QUANTILE_90 with NORMAL_QUANTILE_90 = 1.645, the two-sided 90 percent normal quantile (error_factor_to_sigma). - Combined lognormal sigma: sigma_lnq = sqrt(sum_i (fv_i * sigma_i)^2), the Fussell-Vesely-weighted first-order lognormal combination of the basic-event sigmas (combined_log_sigma). Weights are used as-is and never renormalized: a partial set is the analyst's stated representation of the tree. - 90 percent lognormal-confidence-band: multiplicative and geometric-mean centered at q_top, lower = q_top * exp(-1.645 * sigma_lnq) and upper = q_top * exp(+1.645 * sigma_lnq) (confidence_band). At sigma_lnq = 0 the band collapses to [q_top, q_top]. - Exceedance probability: 1 - Phi((ln(target) - ln(q_top)) / sigma_lnq) with Phi the standard normal CDF via math.erf; the chance the true top probability exceeds the target (exceedance_probability). At target = q_top it is exactly 0.5, the median property of the lognormal. - Variance shares: share_i = (fv_i * sigma_i)^2 / sum_j (fv_j * sigma_j)^2, aligned to the input order and summing to 1.0; zero total variance returns all-zero shares (variance_decomposition). - This leaf quantifies the spread of an already-quantified tree. It does not rank basic events by importance measures (owned by fault-tree-importance-measures), derive the top probability from the tree structure (fta-fmea), fit statistical bounds to demonstration data (failure-rate-estimation), or combine measured quantities under a generic metrology recipe (cross-cutting/numerics/ uncertainty-propagation). - ARP4761A frames the safety assessment context; the lognormal error-factor model and combination are implemented summary-only. ## Workflow 1. Gather the tree inputs: the quantified top probability q_top from the fta-fmea quantification, the Fussell-Vesely fraction of every basic event from fault-tree-importance-measures, and the lognormal error factor EF of every basic event from the failure data. 2. Convert each error factor to a lognormal sigma with error_factor_to_sigma(ef): sigma = ln(EF) / NORMAL_QUANTILE_90, so an EF of 3 gives sigma 0.667849. 3. Combine the per-event sigmas into the lognormal sigma of the tree probability with combined_log_sigma(fv_weights, sigmas): sigma_lnq = sqrt of the Fussell-Vesely-weighted squared sum. 4. Form the two-sided 90 percent lognormal-confidence-band around the top probability with confidence_band(q_top, sigma_lnq): read the lower and upper band bounds that frame the epistemic uncertainty. 5. Compute the exceedance probability of the true value above a target probability with exceedance_probability(q_top, sigma_lnq, target). 6. Decompose the variance of the lognormal spread into per-event uncertainty-variance-shares with variance_decomposition(fv_weights, sigmas), read which events drive the band, and gate the confidence placed in the top-event number. 7. Confirm the deterministic checks with the contract test: python3 scripts/test_fault_tree_uncertainty_analysis.py. ## Worked example Aircraft function with quantified top probability q_top = 2.5e-6 and three basic events carrying FV fractions [0.62, 0.31, 0.07] and error factors [3, 5, 10]: - Step 2 sigmas: EF 3 gives 0.667849, EF 5 gives 0.978382, EF 10 gives 1.399748. - Step 3 combined lognormal sigma: 0.522534. - Step 4 band: lower 1.05836e-6 and upper 5.90535e-6, multipliers 0.423345 and 2.362140; the point estimate 2.5e-6 sits strictly inside the band, geometric-mean centered (lower * upper = q_top^2). - Step 5 exceedance: against target 1e-7 (25 times below the estimate) 0.99999999964, against target 1e-5 (4 times above) 0.00398872; the targets straddle the 50 percent line because 1e-7 < q_top < 1e-5, and at target = q_top the exceedance is exactly 0.5. - Step 6 shares: event 1 (EF 3) 0.627931, event 2 (EF 5) 0.336908, event 3 (EF 10) 0.035161, summing to 1.0: the largest share is the small-EF event with the big FV fraction, not the widest-EF event. ## Verification - Confirm error_factor_to_sigma returns 0.667849, 0.978382 and 1.399748 for EFs 3, 5 and 10 within 1e-6, and exactly 0.0 for EF 1.0; EFs below 1.0 (0.999, 0.0) raise ValueError because they would reverse the band. - Confirm combined_log_sigma on the worked example gives 0.522534 within 1e-6, the single-event identity (FV weight 1.0 returns that event sigma), and all-zero inputs give 0.0; length mismatch, a negative weight and a negative sigma raise ValueError. - Confirm confidence_band gives lower 1.05836e-6 within 1e-10 and upper 5.90535e-6 within 1e-10 with keys exactly lower and upper, the geometric-center identity lower * upper = q_top^2, and the collapse to [q_top, q_top] at sigma 0; q_top 0, q_top 1.5 and sigma -0.1 raise ValueError. - Confirm exceedance_probability gives 0.99999999964 within 1e-10 and 0.00398872 within 1e-8 on the two worked targets, exactly 0.5 at target = q_top, and that targets below q_top exceed 0.5 while targets above sit below; sigma 0, target 0 or negative, and q_top outside (0, 1] raise ValueError. - Confirm variance_decomposition shares 0.627931, 0.336908, 0.035161 within 1e-6 summing to 1.0 within 1e-12, order-preserving under permutation, equal for equal weights and sigmas, and all-zero for zero total variance; a length mismatch or negative input raises ValueError. - Run the contract test offline: python3 scripts/test_fault_tree_uncertainty_analysis.py (35 tests, deterministic). ## Related leaves - systems-engineering-safety/arp4761a/fta-fmea: derives the minimal cut-set structure and the quantified top event probability q_top this leaf frames with a band. - systems-engineering-safety/arp4761a/fault-tree-importance-measures: supplies the Fussell-Vesely fractions used as weights here; its point importance measures rank events, a different question from the spread decomposition this leaf computes. - systems-engineering-safety/arp4761a/failure-rate-estimation: the demonstration statistics and error-factor style inputs behind each basic-event EF. - systems-engineering-safety/arp4761a/common-cause-analysis: the shared-cause dependency modeling that the independence assumption of the combination can break. - cross-cutting/numerics/uncertainty-propagation: generic first-order combination of spreads on measured quantities; it never composes fault-tree structure with importance weights. ## Pitfalls - Reading the largest variance share as the most probable driver of the top event: the share is a fractional contribution to the spread of the lognormal model, weighted by the FV fraction squared; a wide-EF event with a tiny FV fraction (EF 10 at 0.035161 in the example) contributes little band even though its sigma is the largest. - Renormalizing a partial weight set: the FV fractions from fault-tree-importance-measures are used as-is; a partial set is the analyst's stated representation of the tree, and renormalizing would overstate the spread of the events actually included. - Treating the band as a frequentist confidence interval: the band quantifies epistemic uncertainty from the stated error factors, so its width is only as good as the EFs and the FV representation behind it. - Quoting the exceedance probability without its target: the number is a comparison of the lognormal model against one stated target probability, and it moves from 0.99999999964 at 1e-7 to 0.00398872 at 1e-5 in the worked example. - Reporting sigma_lnq = 0 as proof of certainty: an EF of 1.0 only records that no spread was stated for the event; the band then collapses by convention, not by evidence. - Forgetting the model edge at q_top near 1: the multiplicative band is geometric-mean centered on the estimate and can push the upper bound past 1.0 for probabilities close to 1; the band is a spread statement around the estimate, not a re-bounding of the probability scale. ## Behavior contract (gate 3) Run the deterministic contract test (stdlib unittest, offline): python3 scripts/test_fault_tree_uncertainty_analysis.py The test covers the worked sigmas 0.667849, 0.978382 and 1.399748 within 1e-6, the combined sigma 0.522534, the band bounds 1.05836e-6 and 5.90535e-6, the geometric-center and collapse identities, the exceedance anchors 0.99999999964 and 0.00398872 with the exact 0.5 median identity at target = q_top, the variance shares 0.627931, 0.336908 and 0.035161 summing to 1.0, order preservation, the zero total variance convention, determinism across calls, and ValueError rejection of every non-physical input listed in the spec. ## Compliance - Standards referenced, not reproduced: ARP4761A is a SAE standard (sae.org/standards); the lognormal error-factor uncertainty model is implemented summary-only per standards-map.yaml. - compliance: STANDARDS-REF, gated: false.