Actual causality in fault trees

Abstract: Fault trees are a widely used as effective risk models for complex systems, answering the question "what can go wrong?", especially through minimal cut set analysis. We study fault trees from the perspective of Halpern & Pearl's theory of actual causality. This allows us to use fault trees to answer the question "why has it gone wrong?", which is fundamental to failure diagnostics. We give a complete classification of each of the different notions of actual causality in terms of the fault tree's graph structure and logical structure, and show how minimal cut sets give rise to actual causes.

• The paper establishes a unified framework integrating actual causality with fault tree analysis by mapping FTs to structural causal models.
• It formalizes original, updated, and modified AC definitions, correlating minimal cut sets with actual causes for precise fault diagnosis.
• Efficient algorithms leverage FT structure to reduce computational complexity, enabling scalable, algorithmic incident diagnosis in engineering systems.

Actual Causality in Fault Trees: A Technical Review

Introduction and Motivation

Fault trees (FTs) are classical, logic-based models for system-level failure analysis across high-reliability engineering domains, capturing the logical propagation of basic event failures via AND/OR gate structures. Traditional FT analyses address the “what can go wrong?” question, most notably through minimal cut set (MCS) analysis, but are less well-suited to rigorous forensic “why did it go wrong?” reasoning in specific scenarios. Addressing this gap, the paper "Actual causality in fault trees" (2607.01840) systematically integrates Halpern and Pearl’s actual causality (AC) formalism with fault tree methodology, providing a unified, rigorous foundation for incident diagnosis, intervention reasoning, and the computational aspects of causality in fault models.

Mapping Fault Trees to Structural Causal Models

The foundation of the study is the canonical interpretation of a static, coherent FT as a structural causal model (SCM). Every Boolean variable in an FT (basic events, intermediates, top event) is mapped to endogenous SCM nodes, with exogenous variables for the root causes and explicit functional relationships derived recursively from FT logic gates.

A key insight is that the strictly monotonic, non-negated Boolean structure of FTs—together with their DAG topology—enables tighter theoretical characterizations than in arbitrary SCMs. This structural mapping enables the direct application of the AC framework, supporting precise queries about actual causes under observed contexts.

Figure 1: FT with basic and intermediate events, context $\vec{u}$, and graph structure reflecting causal dependencies.

The result is a framework in which each FT status vector directly lifts to a context in the causal model, allowing cause-effect interventions, counterfactual queries, and the algorithmic investigation of minimality and uniqueness conditions for causes.

Formal Characterization of Actual Causality in FTs

Three pivotal AC definitions are addressed:

• Original AC (HP01)
• Updated AC (to handle contingencies with more refined sufficiency conditions)
• Modified AC (focused on minimality/actual assignments for tractable analysis)

Each definition is given a precise combinatorial classification in terms of the FT’s topological and logical properties, with the following core findings:

Original AC in FTs always yields singleton causes—there is always a unique node, and the “path” to the top event must exclusively traverse nodes valued 1, with further exclusion criteria for nontrivial gate sharing. This property is proven formally and is robust to the exact context.

Figure 2: Path-centric causality identification in FTs, highlighting the impact of context and the structure function.

Updated AC imposes more stringent checks: not only must a singleton path exist, but “competing” children of each OR-gate in the path must be set to 0 without altering the top event's outcome, tightening the set of causal nodes.

Modified AC departs sharply, focusing purely on the structure function: here, (minimal) sets of basic events responsible for failure are those whose removal flips the top-event, supporting multi-element causes reflecting criticality under the actual context. Notably, the minimal path set (MPS) duality plays a role in the characterization.

Cut Sets, Minimality, and Causal Sufficiency

A central investigation concerns the relationship between minimal cut sets (MCS)—minimal sets of failures sufficient for top event failure—and ACs. The major theoretical results can be succinctly captured:

• Sufficiency: Every element of a realized MCS in a given context is an actual cause under original and updated AC; this relation is tight for tree-structured FTs or FTs in disjunctive normal form (DNF).
• Necessity: For modified AC, actual causes correlate exactly with minimal sets whose removal reverts the top event, regardless of topology.

Such results formalize when and how classical FT diagnosis via MCS analysis aligns or diverges from the AC perspective, providing theoretical guarantees for the validity of interventions and causal attributions.

Computational Complexity and Algorithms

The computational tractability of AC in FTs is significantly improved relative to general SCMs. The paper proves:

• Original/Updated AC: Deciding if a node is an actual cause is NP-complete, but special-purpose algorithms exist exploiting typical FT structure and forbidden subgraph properties, as formalized in Algorithm 1.
• Modified AC: Decidable in polynomial time as the problem reduces to combinatorial checks over MPSs in the positive part of the FT, enabled by the absence of graph-theoretic constraints.

  Figure 3: Example construction for reduction from 3-SAT, illustrating the encoding of logical complexity in FT topology for NP-completeness proofs.

Moreover, algorithms are provided for computing actual causes under all three definitions. The positive part extraction and forbidden pair propagation algorithm achieves efficient enumeration for large-scale FTs typical in engineering, while dual-structure approaches are leveraged for modified AC.

Practical and Theoretical Implications

The integration of AC with FT analysis yields several far-reaching implications:

• Design-for-Causality: By formalizing not just which failures are possible, but which are actualized and necessary in a specific incident, system designers and diagnosticians gain more precise tools for root-cause analysis, intervention planning, and safety certification.
• Algorithmic Diagnostics: Efficient enumeration algorithms open the path to embedding actual causality checks in reliability tooling, supporting large system diagnoses.
• Epistemic Modeling: The finding that equivalent FTs (in terms of structure function) may manifest different causal explanations highlights the sensitivity of causal attributions to representation—a key concern in model validation, risk certification, and AI explanation.

The approach also lays a foundation for extending causal fault analysis to more complex graphical models, e.g., dynamic FTs, Bayesian networks, and stochastic reliability models.

Conclusion

This work establishes a rigorous, comprehensive linkage between actual causality and the FT formalism, providing combinatorial and algorithmic characterizations for all major AC definitions. The results clarify under what conditions minimal cut sets correspond to actual causes, how FT structure impacts causal inferences, and how algorithmic diagnosis can be rendered tractable for FT-based systems. Future research directions include scaling these analyses to dynamic/probabilistic FTs, integrating causal responsibility and probabilistic thresholds, and applying these techniques to design-time failure mitigation and certification pathways.

(2607.01840)