Common cause failure - Revision history

Jan: Add 4 watermarked SVG illustrations from the Expert visual plan

2026-11-02T16:39:03Z

Add 4 watermarked SVG illustrations from the Expert visual plan

← Older revision		Revision as of 17:39, 2 November 2026
Line 14:		Line 14:

	Pumps, mains, standpipes and tanks of the [[fire water supply]] can serve several suppression systems at once, so their failure can disable all of them together.<ref name="BA-203" /><ref name="NO-13-7">Nowlen et al. (2005b), p. 13-7.</ref> For nuclear plants, NUREG/CR-6850 asks analysts to assess the seismic ruggedness of fire pumps, firefighting water piping, standpipes and water storage tanks or basins. A failure of these items in an earthquake could cause a common-cause failure of multiple fire suppression systems.<ref name="NO-13-7" /> At the World Trade Center towers in 2001, the aircraft impacts severed the sprinkler and fire hose water supply systems. The investigation of this single event found that the damage negated any possible fire suppression efforts.<ref name="NIST-183">National Institute of Standards and Technology (2005), p. 183.</ref>		Pumps, mains, standpipes and tanks of the [[fire water supply]] can serve several suppression systems at once, so their failure can disable all of them together.<ref name="BA-203" /><ref name="NO-13-7">Nowlen et al. (2005b), p. 13-7.</ref> For nuclear plants, NUREG/CR-6850 asks analysts to assess the seismic ruggedness of fire pumps, firefighting water piping, standpipes and water storage tanks or basins. A failure of these items in an earthquake could cause a common-cause failure of multiple fire suppression systems.<ref name="NO-13-7" /> At the World Trade Center towers in 2001, the aircraft impacts severed the sprinkler and fire hose water supply systems. The investigation of this single event found that the damage negated any possible fire suppression efforts.<ref name="NIST-183">National Institute of Standards and Technology (2005), p. 183.</ref>
			[[File:fse-common-cause-failure-v4.svg\|thumb\|upright=1.5\|alt=Schematic: one water tank and pump house feed a main that supplies three deluge systems; flood, freezing and earthquake act on the shared part.\|One fire water supply serving several suppression systems: a single cause acting on the shared part disables all of them. Based on Barry (2002), p. 5-203 and Nowlen et al. (2005b), p. 13-7.]]

	Detection and control equipment is another shared element. NUREG/CR-6850 names the fire protection control panel of a gaseous suppression system as the best example of a dependency.<ref name="NO-P12" /> The panel detects the fire, actuates the suppression system and closes a damper, so the failure of certain circuits can disable both detection and suppression. A failure of other circuits to close the damper can make the suppression ineffective and cause a fire barrier to fail.<ref name="NO-P12" /> In buildings, the fire indicator panel interacts with many other fire protection systems. Its total failure could disable them or start inappropriate actions, unless redundancy or fail-safe features are provided.<ref name="DS-C3-99">Australian Building Codes Board (2020a), Data Sheet C3, p. 99.</ref>		Detection and control equipment is another shared element. NUREG/CR-6850 names the fire protection control panel of a gaseous suppression system as the best example of a dependency.<ref name="NO-P12" /> The panel detects the fire, actuates the suppression system and closes a damper, so the failure of certain circuits can disable both detection and suppression. A failure of other circuits to close the damper can make the suppression ineffective and cause a fire barrier to fail.<ref name="NO-P12" /> In buildings, the fire indicator panel interacts with many other fire protection systems. Its total failure could disable them or start inappropriate actions, unless redundancy or fail-safe features are provided.<ref name="DS-C3-99">Australian Building Codes Board (2020a), Data Sheet C3, p. 99.</ref>
Line 23:		Line 24:
	== Effect on redundancy ==		== Effect on redundancy ==
	Redundancy lowers the probability of losing a function only as far as the redundant parts fail independently. For independent parts, the probability that all of them fail is the product of their individual failure probabilities, as in a parallel system.<ref name="MJ-32">Modarres and Joglar-Billoch (2002), p. 5-32.</ref><ref name="HA-184" /> A common cause adds one event that fails all parts together. In a fault tree, this event joins the independent failures through an OR gate.<ref name="BA-204" /> Barry's tree for the failure on demand of a fire protection system has this form, with design-related and external common cause failures beside ordinary subsystem failures.<ref name="BA-204" />		Redundancy lowers the probability of losing a function only as far as the redundant parts fail independently. For independent parts, the probability that all of them fail is the product of their individual failure probabilities, as in a parallel system.<ref name="MJ-32">Modarres and Joglar-Billoch (2002), p. 5-32.</ref><ref name="HA-184" /> A common cause adds one event that fails all parts together. In a fault tree, this event joins the independent failures through an OR gate.<ref name="BA-204" /> Barry's tree for the failure on demand of a fire protection system has this form, with design-related and external common cause failures beside ordinary subsystem failures.<ref name="BA-204" />
			[[File:fse-common-cause-failure-v1.svg\|thumb\|upright=1.5\|alt=Fault tree: function lost through an OR gate over a common cause event and an AND gate of two independent part failures.\|A common cause enters the fault tree as a single event beside the AND gate of the independent failures, so it bypasses the redundancy. Based on Barry (2002), p. 5-204 and Modarres and Joglar-Billoch (2002), p. 5-32.]]

	The common cause can be added to the gate formulas of a fault tree. For <math>n</math> redundant parts that fail independently with probabilities <math>p_i</math>, and a common cause with probability <math>q</math>, the function is lost if the common cause occurs or if all parts fail. The probability <math>P</math> of this OR combination is one minus the probability that neither branch occurs:<ref name="HA-184" />		The common cause can be added to the gate formulas of a fault tree. For <math>n</math> redundant parts that fail independently with probabilities <math>p_i</math>, and a common cause with probability <math>q</math>, the function is lost if the common cause occurs or if all parts fail. The probability <math>P</math> of this OR combination is one minus the probability that neither branch occurs:<ref name="HA-184" />
Line 50:		Line 52:

	This is about 24 times the independent estimate, and the shared supply accounts for about 96% of it. On the same supply, a single system would fail with a probability of 1 − (1 − 0.00913)(1 − 0.02) ≈ 0.0290. The second system therefore lowers the failure probability from 0.0290 to 0.00953, a factor of about 3, instead of the factor of 50 that independent failures would give. The generic value of 0.02 excludes maintenance unavailability and dependent failures, which is why the shared supply must be added as a separate event.<ref name="NO-P6">Nowlen et al. (2005b), p. P-6.</ref>		This is about 24 times the independent estimate, and the shared supply accounts for about 96% of it. On the same supply, a single system would fail with a probability of 1 − (1 − 0.00913)(1 − 0.02) ≈ 0.0290. The second system therefore lowers the failure probability from 0.0290 to 0.00953, a factor of about 3, instead of the factor of 50 that independent failures would give. The generic value of 0.02 excludes maintenance unavailability and dependent failures, which is why the shared supply must be added as a separate event.<ref name="NO-P6">Nowlen et al. (2005b), p. P-6.</ref>
			[[File:fse-common-cause-failure-v2.svg\|thumb\|upright=1.5\|alt=Log-scale bar chart: one system 0.02 or 0.029 with shared supply; two systems 0.0004 if independent, 0.0095 with shared supply.\|Probability of losing sprinkler protection for one and two systems, with independent failures and with a shared water supply. Based on Parkinson et al. (1994), as cited in Nowlen et al. (2005b), p. P-6, and Barry (2002), p. 5-201.]]

	== Design and regulation ==		== Design and regulation ==
Line 57:		Line 60:

	The handbook illustrates the check with a building in which one fire detection system raises the alarm, activates the smoke control systems, alerts the fire brigade and releases smoke doors held open by hold-open devices.<ref name="HB-100" /> The probability of a total failure of this detection system was estimated at about 20%. In that case no alarm would sound, the brigade would not be alerted automatically, smoke control would not start and the smoke doors would not close. The design was changed to early automatic suppression instead of active smoke control, with the smoke doors released by local detectors independent of the main detection system.<ref name="HB-100" />		The handbook illustrates the check with a building in which one fire detection system raises the alarm, activates the smoke control systems, alerts the fire brigade and releases smoke doors held open by hold-open devices.<ref name="HB-100" /> The probability of a total failure of this detection system was estimated at about 20%. In that case no alarm would sound, the brigade would not be alerted automatically, smoke control would not start and the smoke doors would not close. The design was changed to early automatic suppression instead of active smoke control, with the smoke doors released by local detectors independent of the main detection system.<ref name="HB-100" />
			[[File:fse-common-cause-failure-v3.svg\|thumb\|upright=1.5\|alt=Two panels: left, one detection system feeds alarm, brigade call, smoke control and smoke doors; right, sprinklers and local door detectors added.\|Left: one detection system controls four functions, so its failure removes all of them. Right: revised design with early automatic suppression and smoke doors on local detectors. Based on Australian Building Codes Board (2020b), p. 100.]]

	Typical mitigation measures named in the handbook are monitored sprinkler control valves on each floor and independent detection systems for the alarm and for smoke control. Additional fire safety measures can also reduce the dependence on any single part of the fire safety system.<ref name="HB-102">Australian Building Codes Board (2020b), p. 102.</ref> Fail-safe facilities serve the same purpose, such as smoke doors that close when their release signal is lost.<ref name="DS-C3-99" /><ref name="HB-100" /> The data sheets also list common mode failures among the typical matters to consider when the reliability of a fire protection system is determined.<ref name="DS-C1-59" />		Typical mitigation measures named in the handbook are monitored sprinkler control valves on each floor and independent detection systems for the alarm and for smoke control. Additional fire safety measures can also reduce the dependence on any single part of the fire safety system.<ref name="HB-102">Australian Building Codes Board (2020b), p. 102.</ref> Fail-safe facilities serve the same purpose, such as smoke doors that close when their release signal is lost.<ref name="DS-C3-99" /><ref name="HB-100" /> The data sheets also list common mode failures among the typical matters to consider when the reliability of a fire protection system is determined.<ref name="DS-C1-59" />

Mark: FSE wiki: corrections after independent fact-check (written by Claude Opus 5.5)

2026-11-01T23:01:36Z

FSE wiki: corrections after independent fact-check (written by Claude Opus 5.5)

Mark: New FSE wiki article: Common cause failure (written by Claude Opus 5.5)

2026-11-01T22:13:54Z

New FSE wiki article: Common cause failure (written by Claude Opus 5.5)

New page

A '''common cause failure''' ('''CCF''') is the failure of several components or systems that results from one shared cause.<ref name="IS-F16">Iqbal and Salley (2004), p. F-16.</ref> In fire protection, typical shared causes are the loss of a power supply or a water supply, and external events such as mechanical damage, earthquake or flood.<ref name="BA-203">Barry (2002), p. 5-203.</ref> Fire protection designs use redundancy, such as two independent injection paths that can each control a fire, to reduce the chance of losing a protection function.<ref name="MJ-36">Modarres and Joglar-Billoch (2002), p. 5-36.</ref> A common cause can defeat all redundant parts at once. The probability of losing the whole function can then be far higher than the product of the individual failure probabilities, which is valid only for independent failures.<ref name="HA-184">Hall (2002a), p. 1-184.</ref><ref name="NO-P12">Nowlen et al. (2005b), p. P-12.</ref>

Engineers therefore model common causes as separate events in a [[fault tree analysis]] and include them when they estimate the [[reliability of fire protection systems]].<ref name="BA-204">Barry (2002), p. 5-204.</ref><ref name="DS-C1-59">Australian Building Codes Board (2020a), Data Sheet C1, p. 59.</ref> Performance-based design methods also address them directly.<ref name="HB-100" /> In New Zealand, design scenario RC of C/VM2 (second edition, 2025) checks a design for the failure of its key fire safety systems. It considers one system failing at a time, and multiple failures only when they have a single common cause.<ref name="MBIE-59">Ministry of Business, Innovation and Employment (2025b), p. 59.</ref>

== Definition and terminology ==
The glossary of NUREG-1805, a report of the U.S. Nuclear Regulatory Commission, defines a common-mode failure as multiple failures that are attributable to a common cause.<ref name="IS-F16" /> Barry uses the term common cause failure for the same idea in his treatment of fire protection systems in industrial plants. He separates design-related common cause failures, such as the loss of a power or water supply, from external ones, such as mechanical damage, earthquake or flood.<ref name="BA-203" /> The fire safety verification method of the Australian Building Codes Board uses the term common mode failure.<ref name="HB-100">Australian Building Codes Board (2020b), p. 100.</ref>

The concept is closely tied to statistical independence. Two events are independent when the probability that both occur equals the product of their separate probabilities, and dependent when it does not.<ref name="HA-184" /> Hall points out that two events can be dependent without either being the cause of the other, for example because both depend on a third variable. In a fire protection system, a shared water tank, power supply or actuating device plays this role and links failures that look independent on paper.<ref name="MJ-37">Modarres and Joglar-Billoch (2002), p. 5-37.</ref>

The fire probabilistic risk assessment (PRA) methodology for nuclear power plants, NUREG/CR-6850, describes the same problem in terms of dependencies and common elements. Each fire protection system of a plant may be highly reliable on its own, yet when redundant systems are considered as a whole, the analyst sometimes finds common elements.<ref name="NO-P12" /> The failure of such an element may hardly affect the reliability of one system, but it can be very significant for the failure of more than one fire protection capability.<ref name="NO-P12" />

== Causes in fire protection systems ==
Barry's examples from industrial plants show how ordinary operating conditions become common causes.<ref name="BA-203" /> At one plant, the control valves of a sprinkler system protecting the oil-fired burner of a boiler were shut for four months each year for fear of freezing. The corporate safety director was unaware of this practice, and the annual probability that the system was down was 0.33. At a chemical plant, the fire pump house was flooded three times in five years. Each time the pump controllers were shut off, and clean-up and repair took 32 hours on average. Because these fire pumps supplied numerous deluge water spray systems, the flooding was a common cause failure for all of them.<ref name="BA-203" />

Pumps, mains, standpipes and tanks of the [[fire water supply]] can serve several suppression systems at once, so their failure can disable all of them together.<ref name="BA-203" /><ref name="NO-13-7">Nowlen et al. (2005b), p. 13-7.</ref> For nuclear plants, NUREG/CR-6850 asks analysts to assess the seismic ruggedness of fire pumps, firefighting water piping, standpipes and water storage tanks or basins. A failure of these items in an earthquake could cause a common-cause failure of multiple fire suppression systems.<ref name="NO-13-7" /> At the World Trade Center towers in 2001, the aircraft impacts severed the sprinkler and fire hose water supply systems. The investigation of this single event found that the damage negated any possible fire suppression efforts.<ref name="NIST-183">National Institute of Standards and Technology (2005), p. 183.</ref>

Detection and control equipment is another shared element. NUREG/CR-6850 names the fire protection control panel of a gaseous suppression system as the best example of a dependency.<ref name="NO-P12" /> The panel detects the fire, actuates the suppression system and closes a damper, so the failure of certain circuits can disable both detection and suppression. A failure of other circuits to close the damper can make the suppression ineffective and cause a fire barrier to fail.<ref name="NO-P12" /> In buildings, the fire indicator panel interacts with many other fire protection systems. Its total failure could disable them or start inappropriate actions, unless redundancy or fail-safe features are provided.<ref name="DS-C3-99">Australian Building Codes Board (2020a), Data Sheet C3, p. 99.</ref>

Smoke control systems depend on detection in the same way. A detection system that fails to signal activation, or to identify the location of the fire for a zone pressurisation system, is an example of a common mode failure.<ref name="DS-C4-131">Australian Building Codes Board (2020a), Data Sheet C4, p. 131.</ref> Fire doors with hold-open devices are a further case. Estimates based on Tokyo Fire Department data give a reliability of 97% for fire doors with automatic closers and 91% for doors that also have an interlock.<ref name="FR-216">Frank et al. (2014), as cited in Australian Building Codes Board (2020a), Data Sheet C7, p. 216.</ref> The data sheet infers a reliability of about 94% for each interlock. It notes that it is unclear whether these estimates allow for common mode failures of the detection system, and it advises assuming that they do not.<ref name="DS-C7-217">Australian Building Codes Board (2020a), Data Sheet C7, p. 217.</ref>

Fire itself can be the common cause. In the equipment response analysis of a nuclear fire PRA, Siu identifies the fragility of electrical cables as the key concern, because of the common cause failure potential of cable fires.<ref name="SIU-220">Siu (2002), p. 5-220.</ref> At the time of writing, fire PRA treated such damage simply: failure was generally assumed once a representative temperature, such as the surface temperature of a cable, exceeded a threshold value.<ref name="SIU-220" />

== Effect on redundancy ==
Redundancy lowers the probability of losing a function only as far as the redundant parts fail independently. For independent parts, the probability that all of them fail is the product of their individual failure probabilities, as in a parallel system.<ref name="MJ-32">Modarres and Joglar-Billoch (2002), p. 5-32.</ref><ref name="HA-184" /> A common cause adds one event that fails all parts together. In a fault tree, this event joins the independent failures through an OR gate.<ref name="BA-204" /> Barry's tree for the failure on demand of a fire protection system has this form, with design-related and external common cause failures beside ordinary subsystem failures.<ref name="BA-204" />

The common cause can be added to the gate formulas of a fault tree. For <math>n</math> redundant parts that fail independently with probabilities <math>p_i</math>, and a common cause with probability <math>q</math>, the function is lost if the common cause occurs or if all parts fail. The probability <math>P</math> of this OR combination is one minus the probability that neither branch occurs:<ref name="HA-184" />

<math display="block">P = 1 - (1 - q)\left( 1 - \prod_{i=1}^{n} p_i \right) \approx q + \prod_{i=1}^{n} p_i</math>

The approximation holds when <math>q</math> and the product are both small. Because the product of several small probabilities is very small, even a modest common cause probability can dominate the result. The formula also assumes that the common cause and the independent failures do not influence each other.

{| class="wikitable"
! Symbol !! Description !! Unit
|-
| <math>P</math> || probability that the protected function is lost || dimensionless
|-
| <math>q</math> || probability of the common cause event || dimensionless
|-
| <math>p_i</math> || probability that redundant part <math>i</math> fails from independent causes || dimensionless
|-
| <math>n</math> || number of redundant parts || dimensionless
|}

The fault tree of a two-path water-based extinguishing system in the SFPE Handbook shows the same effect. The water tank, the detector, alarm and actuator device and the electric power for the pumps are shared by both injection paths.<ref name="MJ-37" /> Modarres and Joglar-Billoch treat these shared items as physical dependencies in the quantification of the tree.<ref name="MJ-37" />

== Worked example ==
Two wet-pipe sprinkler systems protect the same area. NSAC 179L, a data report used in nuclear fire PRA, recommends an unreliability of 0.02 for a wet-pipe sprinkler system.<ref name="PA-P6">Parkinson et al. (1994), as cited in Nowlen et al. (2005b), p. P-6.</ref> If the two systems failed independently, the probability that both fail would be 0.02 × 0.02 = 0.0004, fifty times lower than for one system. In this example, both systems draw on one water supply that is off-line for 80 hours per year, the downtime that Barry uses as an example for inspection, maintenance and testing.<ref name="BA-201">Barry (2002), p. 5-201.</ref> The probability that the shared supply is unavailable is then 80/8,760 = 0.00913, and the probability of losing both systems is:

<math display="block">P = 1 - (1 - 0.00913)(1 - 0.0004) \approx 0.00953</math>

This is about 24 times the independent estimate, and the shared supply accounts for about 96% of it. The second system now lowers the failure probability by a factor of only 2.1, instead of 50. The generic value of 0.02 excludes maintenance unavailability and dependent failures, which is why the shared supply must be added as a separate event.<ref name="NO-P6">Nowlen et al. (2005b), p. P-6.</ref>

== Design and regulation ==
In New Zealand, C/VM2 (second edition, 2025) contains a design scenario, RC, that checks how a design performs when a key fire safety system fails. It requires a demonstration that, if a single fire safety system fails where that failure is statistically probable, people can still escape and fire spread to other property is limited.<ref name="MBIE-58">Ministry of Business, Innovation and Employment (2025b), p. 58.</ref> The check applies where the failure of a key fire safety system could expose more than 150 people to untenable conditions, or smaller numbers in sleeping, care or detention occupancies.<ref name="MBIE-58" /> Each key fire safety system is rendered ineffective in turn. Multiple system failures need only be considered when they have a single common cause.<ref name="MBIE-59" />

In Australia, the Fire Safety Verification Method handbook includes a check of scenarios in which one critical part of the fire safety system fails while the other measures work as designed.<ref name="HB-99">Australian Building Codes Board (2020b), p. 99.</ref> The handbook states that common mode failures are an essential part of this check and must be fully evaluated.<ref name="HB-100" /> A systematic review, normally carried out during hazard identification, identifies the fire safety measures, their failure modes and probabilities, and the common mode failures. The reference scenarios must include the outcomes of the common mode failures identified, and they must reflect realistic failure modes rather than abstract constructs.<ref name="HB-101">Australian Building Codes Board (2020b), p. 101.</ref> A scenario in which a failed detection system does not warn the occupants but still alerts the fire brigade is given as an example of an inappropriate assumption.<ref name="HB-101" />

The handbook illustrates the check with a building in which one fire detection system raises the alarm, activates the smoke control systems, alerts the fire brigade and releases smoke doors held open by hold-open devices.<ref name="HB-100" /> The probability of a total failure of this detection system was estimated at about 20%. In that case no alarm would sound, the brigade would not be alerted automatically, smoke control would not start and the smoke doors would not close. The design was changed to early automatic suppression instead of active smoke control, with the smoke doors released by local detectors independent of the main detection system.<ref name="HB-100" />

Typical mitigation measures named in the handbook are monitored sprinkler control valves on each floor and independent detection systems for the alarm and for smoke control. Additional fire safety measures can also reduce the dependence on any single part of the fire safety system.<ref name="HB-102">Australian Building Codes Board (2020b), p. 102.</ref> Fail-safe facilities serve the same purpose, such as smoke doors that close when their release signal is lost.<ref name="DS-C3-99" /><ref name="HB-100" /> The data sheets also list common mode failures among the typical matters to consider when the reliability of a fire protection system is determined.<ref name="DS-C1-59" />

== Treatment in risk analysis ==
In a quantitative analysis, common causes appear as explicit events. Barry's fault tree for failure on demand contains two common cause branches: design-related failures within the subsystems, and common cause failures outside normal design.<ref name="BA-204" /> His list of failure data inputs places common cause failures beside equipment failure rates, human error rates and external event frequencies.<ref name="BA-205">Barry (2002), p. 5-205.</ref> When an [[event tree analysis]] or a set of design scenarios is used, the outcome of each identified common mode failure must be evaluated for every part of the fire safety system that it affects.<ref name="HB-101" />

NUREG/CR-6850 lists five dependencies that can be important in a suppression analysis.<ref name="NO-P13">Nowlen et al. (2005b), p. P-13.</ref> They link automatic suppression with automatic detection, with actuated barriers, with safe shutdown capability and with manual suppression, and they link manual detection with suppression actions. Where suppression is actuated by smoke detectors, the probability of detection failure must be included in the probability that automatic suppression fails.<ref name="NO-P6" /> Human error probabilities for successive suppression actions should also include the dependencies on earlier actions, worsening fire conditions and the arrival of the fire brigade.<ref name="NO-P13" />

The same idea applies to fire frequency data. If several fires at a plant share a common cause that has not been identified and corrected, NUREG/CR-6850 recommends a plant-specific fire frequency instead of generic values.<ref name="NO-6-9">Nowlen et al. (2005b), p. 6-9.</ref> Barry's performance integrity measures, used to adjust generic failure data to plant conditions, include redundancy and the potential for common cause failure.<ref name="BA-207">Barry (2002), p. 5-207.</ref> He notes that such scores give only a first-order estimate, and that internal and external common cause failures may still need separate treatment.<ref name="BA-207" />

== Limitations and uncertainty ==
Generic reliability data may leave common causes out. The unreliability values of NSAC 179L used in nuclear fire PRA exclude dependent failures, maintenance unavailability and plant-specific data.<ref name="NO-P6" /> For fire doors with hold-open devices, the data sheets cannot tell whether the published reliability includes failures of the detection system.<ref name="DS-C7-217" /> Records may also hide common causes, as in Barry's freezing example, which was unknown to the corporate safety director.<ref name="BA-203" />

Hall notes that two events can be dependent without either being the cause of the other and without any apparent logical connection.<ref name="HA-184" /> In nuclear fire PRA, the routine search for combinations of fire-induced spurious operations stays within system boundaries. This is in line with the usual treatment of common cause failures in the internal events models of nuclear plants.<ref name="NO-2-4">Nowlen et al. (2005b), p. 2-4.</ref> Known vulnerabilities across systems are to be added by the analyst, and further combinations across systems are found when the model is solved.<ref name="NO-2-4" />

Checks of this kind simplify the problem by failing one system at a time. Their result therefore depends on whether all single common causes have been identified, which the Australian handbook expects from a systematic review of failure modes.<ref name="MBIE-59" /><ref name="HB-101" /> The check also depends on realistic assumptions about how a failure propagates through the connected systems.<ref name="HB-101" />

== See also ==
* [[Quantitative risk assessment]]
* [[Uncertainty analysis]]
* [[Fire risk assessment]]
* [[Fire safety concepts tree]]

== Notes ==
<references />

== References ==
* Australian Building Codes Board. (2020a). ''Data sheets: Fire Safety Verification Method'' (Handbook annex, Print version 1.1).
* Australian Building Codes Board. (2020b). ''Handbook: Fire Safety Verification Method'' (Print version 1.1).
* Barry, T. F. (2002). Quantitative risk assessment in chemical process industries. In P. J. DiNenno, D. Drysdale, C. L. Beyler, W. D. Walton, R. L. P. Custer, J. R. Hall Jr., & J. M. Watts Jr. (Eds.), ''SFPE handbook of fire protection engineering'' (3rd ed., pp. 5-176–5-213). National Fire Protection Association; Society of Fire Protection Engineers.
* Hall, J. R., Jr. (2002a). Probability concepts. In P. J. DiNenno, D. Drysdale, C. L. Beyler, W. D. Walton, R. L. P. Custer, J. R. Hall Jr., & J. M. Watts Jr. (Eds.), ''SFPE handbook of fire protection engineering'' (3rd ed., pp. 1-182–1-192). National Fire Protection Association; Society of Fire Protection Engineers.
* Iqbal, N., & Salley, M. H. (2004). ''Fire Dynamics Tools (FDTs): Quantitative fire hazard analysis methods for the U.S. Nuclear Regulatory Commission Fire Protection Inspection Program'' (NUREG-1805). U.S. Nuclear Regulatory Commission, Office of Nuclear Reactor Regulation.
* Ministry of Business, Innovation and Employment. (2025b). ''Verification Method C/VM2: Framework for fire safety design'' (2nd ed.).
* Modarres, M., & Joglar-Billoch, F. (2002). Reliability. In P. J. DiNenno, D. Drysdale, C. L. Beyler, W. D. Walton, R. L. P. Custer, J. R. Hall Jr., & J. M. Watts Jr. (Eds.), ''SFPE handbook of fire protection engineering'' (3rd ed., pp. 5-24–5-39). National Fire Protection Association; Society of Fire Protection Engineers.
* National Institute of Standards and Technology. (2005). ''Final report on the collapse of the World Trade Center towers'' (NIST NCSTAR 1).
* Nowlen, S. P., Najafi, B., Wyant, F. J., Forester, J., Kazarians, M., Kolaczkowski, A., Joglar, F., Funk, D., Hannaman, G., & Anoba, R. (2005b). ''EPRI/NRC-RES fire PRA methodology for nuclear power facilities: Vol. 2. Detailed methodology'' (NUREG/CR-6850; EPRI 1011989). Electric Power Research Institute; U.S. Nuclear Regulatory Commission, Office of Nuclear Regulatory Research.
* Siu, N. (2002). Fire risk assessment for nuclear power plants. In P. J. DiNenno, D. Drysdale, C. L. Beyler, W. D. Walton, R. L. P. Custer, J. R. Hall Jr., & J. M. Watts Jr. (Eds.), ''SFPE handbook of fire protection engineering'' (3rd ed., pp. 5-214–5-226). National Fire Protection Association; Society of Fire Protection Engineers.

[[Category:Fire Risk Analysis]]

← Older revision		Revision as of 00:01, 2 November 2026
Line 17:		Line 17:
	Detection and control equipment is another shared element. NUREG/CR-6850 names the fire protection control panel of a gaseous suppression system as the best example of a dependency.<ref name="NO-P12" /> The panel detects the fire, actuates the suppression system and closes a damper, so the failure of certain circuits can disable both detection and suppression. A failure of other circuits to close the damper can make the suppression ineffective and cause a fire barrier to fail.<ref name="NO-P12" /> In buildings, the fire indicator panel interacts with many other fire protection systems. Its total failure could disable them or start inappropriate actions, unless redundancy or fail-safe features are provided.<ref name="DS-C3-99">Australian Building Codes Board (2020a), Data Sheet C3, p. 99.</ref>		Detection and control equipment is another shared element. NUREG/CR-6850 names the fire protection control panel of a gaseous suppression system as the best example of a dependency.<ref name="NO-P12" /> The panel detects the fire, actuates the suppression system and closes a damper, so the failure of certain circuits can disable both detection and suppression. A failure of other circuits to close the damper can make the suppression ineffective and cause a fire barrier to fail.<ref name="NO-P12" /> In buildings, the fire indicator panel interacts with many other fire protection systems. Its total failure could disable them or start inappropriate actions, unless redundancy or fail-safe features are provided.<ref name="DS-C3-99">Australian Building Codes Board (2020a), Data Sheet C3, p. 99.</ref>

	Smoke control systems depend on detection in the same way. A detection system that fails to signal activation, or to identify the location of the fire for a zone pressurisation system, is an example of a common mode failure.<ref name="DS-C4-131">Australian Building Codes Board (2020a), Data Sheet C4, p. 131.</ref> Fire doors with hold-open devices are a further case. Estimates based on Tokyo Fire Department data give a reliability of 97% for fire doors with automatic closers and 91% for doors that also have an interlock.<ref name="FR-216">Frank et al. (2014), as cited in Australian Building Codes Board (2020a), Data Sheet C7, p. 216.</ref> The data sheet infers a reliability of about 94% for each interlock. It notes that it is unclear whether these estimates allow for common mode failures of the detection system, and it advises assuming that they do not.<ref name="DS-C7-217">Australian Building Codes Board (2020a), Data Sheet C7, p. ~~217~~.</ref>		Smoke control systems depend on detection in the same way. A detection system that fails to signal activation, or to identify the location of the fire for a zone pressurisation system, is an example of a common mode failure.<ref name="DS-C4-131">Australian Building Codes Board (2020a), Data Sheet C4, p. 131.</ref> Fire doors with hold-open devices are a further case. Estimates based on Tokyo Fire Department data give a reliability of 97% for fire doors with automatic closers and 91% for doors that also have an interlock.<ref name="FR-216">Frank et al. (2014), as cited in Australian Building Codes Board (2020a), Data Sheet C7, p. 216.</ref> The data sheet infers a reliability of about 94% for each interlock. It notes that it is unclear whether these estimates allow for common mode failures of the detection system, and it advises assuming that they do not.<ref name="DS-C7-217">Australian Building Codes Board (2020a), Data Sheet C7, pp. 216–217.</ref>

	Fire itself can be the common cause. In the equipment response analysis of a nuclear fire PRA, Siu identifies the fragility of electrical cables as the key concern, because of the common cause failure potential of cable fires.<ref name="SIU-220">Siu (2002), p. 5-220.</ref> At the time of writing, fire PRA treated such damage simply: failure was generally assumed once a representative temperature, such as the surface temperature of a cable, exceeded a threshold value.<ref name="SIU-220" />		Fire itself can be the common cause. In the equipment response analysis of a nuclear fire PRA, Siu identifies the fragility of electrical cables as the key concern, because of the common cause failure potential of cable fires.<ref name="SIU-220">Siu (2002), p. 5-220.</ref> At the time of writing, fire PRA treated such damage simply: failure was generally assumed once a representative temperature, such as the surface temperature of a cable, exceeded a threshold value.<ref name="SIU-220" />
Line 49:		Line 49:
	<math display="block">P = 1 - (1 - 0.00913)(1 - 0.0004) \approx 0.00953</math>		<math display="block">P = 1 - (1 - 0.00913)(1 - 0.0004) \approx 0.00953</math>

	This is about 24 times the independent estimate, and the shared supply accounts for about 96% of it. The second system ~~now~~ lowers the failure probability by a factor of ~~only 2.1~~, instead of 50. The generic value of 0.02 excludes maintenance unavailability and dependent failures, which is why the shared supply must be added as a separate event.<ref name="NO-P6">Nowlen et al. (2005b), p. P-6.</ref>		This is about 24 times the independent estimate, and the shared supply accounts for about 96% of it. On the same supply, a single system would fail with a probability of 1 − (1 − 0.00913)(1 − 0.02) ≈ 0.0290. The second system therefore lowers the failure probability from 0.0290 to 0.00953, a factor of about 3, instead of the factor of 50 that independent failures would give. The generic value of 0.02 excludes maintenance unavailability and dependent failures, which is why the shared supply must be added as a separate event.<ref name="NO-P6">Nowlen et al. (2005b), p. P-6.</ref>

	== Design and regulation ==		== Design and regulation ==
Line 61:		Line 61:

	== Treatment in risk analysis ==		== Treatment in risk analysis ==
	In a quantitative analysis, common causes appear as explicit events. Barry's fault tree for failure on demand contains two common cause branches: design-related failures within the subsystems, and common cause failures outside normal design.<ref name="BA-204" /> His list of failure data inputs places common cause failures beside equipment failure rates, human error rates and external event frequencies.<ref name="BA-205">Barry (2002), p. 5-205.</ref> When ~~an [[event tree analysis]] or a set of~~ design scenarios is used, the outcome of each identified common mode failure must be evaluated for every part of the fire safety system that it affects.<ref name="HB-101" />		In a quantitative analysis, common causes appear as explicit events. Barry's fault tree for failure on demand contains two common cause branches: design-related failures within the subsystems, and common cause failures outside normal design.<ref name="BA-204" /> His list of failure data inputs places common cause failures beside equipment failure rates, human error rates and external event frequencies.<ref name="BA-205">Barry (2002), p. 5-205.</ref> When design scenarios are used, the outcome of each identified common mode failure must be evaluated for every part of the fire safety system that it affects.<ref name="HB-101" />

	NUREG/CR-6850 lists five dependencies that can be important in a suppression analysis.<ref name="NO-P13">Nowlen et al. (2005b), p. P-13.</ref> They link automatic suppression with automatic detection, with actuated barriers, with safe shutdown capability and with manual suppression, and they link manual detection with suppression actions. Where suppression is actuated by smoke detectors, the probability of detection failure must be included in the probability that automatic suppression fails.<ref name="NO-P6" /> Human error probabilities ~~for successive suppression actions~~ should also include the dependencies on earlier actions, worsening fire conditions and the arrival of the fire brigade.<ref name="NO-P13" />		NUREG/CR-6850 lists five dependencies that can be important in a suppression analysis.<ref name="NO-P13">Nowlen et al. (2005b), p. P-13.</ref> They link automatic suppression with automatic detection, with actuated barriers, with safe shutdown capability and with manual suppression, and they link manual detection with suppression actions. The branch probabilities of the detection and suppression [[event tree analysis]] in the methodology must reflect these dependencies.<ref name="NO-P6" /><ref name="NO-P13" /> Where suppression is actuated by smoke detectors, the probability of detection failure must be included in the probability that automatic suppression fails.<ref name="NO-P6" /> Human error probabilities in the event tree model should also include the dependencies on earlier actions, worsening fire conditions and the arrival of the fire brigade.<ref name="NO-P13" />

	The same idea applies to fire frequency data. If several fires at a plant share a common cause that has not been identified and corrected, NUREG/CR-6850 recommends a plant-specific fire frequency instead of generic values.<ref name="NO-6-9">Nowlen et al. (2005b), p. 6-9.</ref> Barry's performance integrity measures, used to adjust generic failure data to plant conditions, include redundancy and the potential for common cause failure.<ref name="BA-207">Barry (2002), p. 5-207.</ref> He notes that such scores give only a first-order estimate, and that internal and external common cause failures may still need separate treatment.<ref name="BA-207" />		The same idea applies to fire frequency data. If several fires at a plant share a common cause that has not been identified and corrected, NUREG/CR-6850 recommends a plant-specific fire frequency instead of generic values.<ref name="NO-6-9">Nowlen et al. (2005b), p. 6-9.</ref> Barry's performance integrity measures, used to adjust generic failure data to plant conditions, include redundancy and the potential for common cause failure.<ref name="BA-207">Barry (2002), p. 5-207.</ref> He notes that such scores give only a first-order estimate, and that internal and external common cause failures may still need separate treatment.<ref name="BA-207" />

	== Limitations and uncertainty ==		== Limitations and uncertainty ==
	Generic reliability data may leave common causes out. The unreliability values of NSAC 179L used in nuclear fire PRA exclude dependent failures, maintenance unavailability and plant-specific data.<ref name="NO-P6" /> For fire doors with hold-open devices, the data sheets cannot tell whether the published reliability includes failures of the detection system.<ref name="DS-C7-217" /> ~~Records may~~ also ~~hide common causes, as in~~ Barry's freezing ~~example~~, ~~which was unknown to~~ the corporate safety director.<ref name="BA-203" />		Generic reliability data may leave common causes out. The unreliability values of NSAC 179L used in nuclear fire PRA exclude dependent failures, maintenance unavailability and plant-specific data.<ref name="NO-P6" /> For fire doors with hold-open devices, the data sheets cannot tell whether the published reliability includes failures of the detection system.<ref name="DS-C7-217" /> Common causes can also go unnoticed by management. Barry's freezing practice was found from plant records and interviews, yet the corporate safety director was unaware of it.<ref name="BA-203" />

	Hall notes that two events can be dependent without either being the cause of the other and without any apparent logical connection.<ref name="HA-184" /> In nuclear fire PRA, the routine search for combinations of fire-induced spurious operations stays within system boundaries. This is in line with the usual treatment of common cause failures in the internal events models of nuclear plants.<ref name="NO-2-4">Nowlen et al. (2005b), p. 2-4.</ref> ~~Known~~ vulnerabilities across systems ~~are to be added by the analyst~~, and further combinations across systems are found when the model is solved.<ref name="NO-2-4" />		Hall notes that two events can be dependent without either being the cause of the other and without any apparent logical connection.<ref name="HA-184" /> In nuclear fire PRA, the routine search for combinations of fire-induced spurious operations stays within system boundaries. This is in line with the usual treatment of common cause failures in the internal events models of nuclear plants.<ref name="NO-2-4">Nowlen et al. (2005b), p. 2-4.</ref> The inclusion of known vulnerabilities across systems is encouraged, and further combinations across systems are found when the model is solved.<ref name="NO-2-4" />

	Checks of this kind simplify the problem by failing one system at a time. Their result therefore depends on whether all single common causes have been identified, which the Australian handbook expects from a systematic review of failure modes.<ref name="MBIE-59" /><ref name="HB-101" /> The check also depends on realistic assumptions about how a failure propagates through the connected systems.<ref name="HB-101" />		Checks of this kind simplify the problem by failing one system at a time. Their result therefore depends on whether all single common causes have been identified, which the Australian handbook expects from a systematic review of failure modes.<ref name="MBIE-59" /><ref name="HB-101" /> The check also depends on realistic assumptions about how a failure propagates through the connected systems.<ref name="HB-101" />