Skip to content
Upcoming courses

Common cause failure

Tools
From Fire Safety Academy Wiki
(Redirected from Common-cause failure)
Contents
  1. 1Definition and terminology
  2. 2Causes in fire protection systems
  3. 3Effect on redundancy
  4. 4Worked example
  5. 5Design and regulation
  6. 6Treatment in risk analysis
  7. 7Limitations and uncertainty
  8. 8See also
  9. 9Notes
  10. 10References

A common cause failure (CCF) is the failure of several components or systems that results from one shared cause.[1] In fire protection, typical shared causes are the loss of a power supply or a water supply, and external events such as mechanical damage, earthquake or flood.[2] Fire protection designs use redundancy, such as two independent injection paths that can each control a fire, to reduce the chance of losing a protection function.[3] A common cause can defeat all redundant parts at once. The probability of losing the whole function can then be far higher than the product of the individual failure probabilities, which is valid only for independent failures.[4][5]

Engineers therefore model common causes as separate events in a fault tree analysis and include them when they estimate the reliability of fire protection systems.[6][7] Performance-based design methods also address them directly.[8] In New Zealand, design scenario RC of C/VM2 (second edition, 2025) checks a design for the failure of its key fire safety systems. It considers one system failing at a time, and multiple failures only when they have a single common cause.[9]

Definition and terminology

The glossary of NUREG-1805, a report of the U.S. Nuclear Regulatory Commission, defines a common-mode failure as multiple failures that are attributable to a common cause.[1] Barry uses the term common cause failure for the same idea in his treatment of fire protection systems in industrial plants. He separates design-related common cause failures, such as the loss of a power or water supply, from external ones, such as mechanical damage, earthquake or flood.[2] The fire safety verification method of the Australian Building Codes Board uses the term common mode failure.[8]

The concept is closely tied to statistical independence. Two events are independent when the probability that both occur equals the product of their separate probabilities, and dependent when it does not.[4] Hall points out that two events can be dependent without either being the cause of the other, for example because both depend on a third variable. In a fire protection system, a shared water tank, power supply or actuating device plays this role and links failures that look independent on paper.[10]

The fire probabilistic risk assessment (PRA) methodology for nuclear power plants, NUREG/CR-6850, describes the same problem in terms of dependencies and common elements. Each fire protection system of a plant may be highly reliable on its own, yet when redundant systems are considered as a whole, the analyst sometimes finds common elements.[5] The failure of such an element may hardly affect the reliability of one system, but it can be very significant for the failure of more than one fire protection capability.[5]

Causes in fire protection systems

Barry's examples from industrial plants show how ordinary operating conditions become common causes.[2] At one plant, the control valves of a sprinkler system protecting the oil-fired burner of a boiler were shut for four months each year for fear of freezing. The corporate safety director was unaware of this practice, and the annual probability that the system was down was 0.33. At a chemical plant, the fire pump house was flooded three times in five years. Each time the pump controllers were shut off, and clean-up and repair took 32 hours on average. Because these fire pumps supplied numerous deluge water spray systems, the flooding was a common cause failure for all of them.[2]

Pumps, mains, standpipes and tanks of the fire water supply can serve several suppression systems at once, so their failure can disable all of them together.[2][11] For nuclear plants, NUREG/CR-6850 asks analysts to assess the seismic ruggedness of fire pumps, firefighting water piping, standpipes and water storage tanks or basins. A failure of these items in an earthquake could cause a common-cause failure of multiple fire suppression systems.[11] At the World Trade Center towers in 2001, the aircraft impacts severed the sprinkler and fire hose water supply systems. The investigation of this single event found that the damage negated any possible fire suppression efforts.[12]

Schematic: one water tank and pump house feed a main that supplies three deluge systems; flood, freezing and earthquake act on the shared part.
One fire water supply serving several suppression systems: a single cause acting on the shared part disables all of them. Based on Barry (2002), p. 5-203 and Nowlen et al. (2005b), p. 13-7.

Detection and control equipment is another shared element. NUREG/CR-6850 names the fire protection control panel of a gaseous suppression system as the best example of a dependency.[5] The panel detects the fire, actuates the suppression system and closes a damper, so the failure of certain circuits can disable both detection and suppression. A failure of other circuits to close the damper can make the suppression ineffective and cause a fire barrier to fail.[5] In buildings, the fire indicator panel interacts with many other fire protection systems. Its total failure could disable them or start inappropriate actions, unless redundancy or fail-safe features are provided.[13]

Smoke control systems depend on detection in the same way. A detection system that fails to signal activation, or to identify the location of the fire for a zone pressurisation system, is an example of a common mode failure.[14] Fire doors with hold-open devices are a further case. Estimates based on Tokyo Fire Department data give a reliability of 97% for fire doors with automatic closers and 91% for doors that also have an interlock.[15] The data sheet infers a reliability of about 94% for each interlock. It notes that it is unclear whether these estimates allow for common mode failures of the detection system, and it advises assuming that they do not.[16]

Fire itself can be the common cause. In the equipment response analysis of a nuclear fire PRA, Siu identifies the fragility of electrical cables as the key concern, because of the common cause failure potential of cable fires.[17] At the time of writing, fire PRA treated such damage simply: failure was generally assumed once a representative temperature, such as the surface temperature of a cable, exceeded a threshold value.[17]

Effect on redundancy

Redundancy lowers the probability of losing a function only as far as the redundant parts fail independently. For independent parts, the probability that all of them fail is the product of their individual failure probabilities, as in a parallel system.[18][4] A common cause adds one event that fails all parts together. In a fault tree, this event joins the independent failures through an OR gate.[6] Barry's tree for the failure on demand of a fire protection system has this form, with design-related and external common cause failures beside ordinary subsystem failures.[6]

Fault tree: function lost through an OR gate over a common cause event and an AND gate of two independent part failures.
A common cause enters the fault tree as a single event beside the AND gate of the independent failures, so it bypasses the redundancy. Based on Barry (2002), p. 5-204 and Modarres and Joglar-Billoch (2002), p. 5-32.

The common cause can be added to the gate formulas of a fault tree. For n redundant parts that fail independently with probabilities pi, and a common cause with probability q, the function is lost if the common cause occurs or if all parts fail. The probability P of this OR combination is one minus the probability that neither branch occurs:[4]

P=1−(1−q)(1−∏i=1npi)≈q+∏i=1npi

The approximation holds when q and the product are both small. Because the product of several small probabilities is very small, even a modest common cause probability can dominate the result. The formula also assumes that the common cause and the independent failures do not influence each other.

Symbol Description Unit
P probability that the protected function is lost dimensionless
q probability of the common cause event dimensionless
pi probability that redundant part i fails from independent causes dimensionless
n number of redundant parts dimensionless

The fault tree of a two-path water-based extinguishing system in the SFPE Handbook shows the same effect. The water tank, the detector, alarm and actuator device and the electric power for the pumps are shared by both injection paths.[10] Modarres and Joglar-Billoch treat these shared items as physical dependencies in the quantification of the tree.[10]

Worked example

Two wet-pipe sprinkler systems protect the same area. NSAC 179L, a data report used in nuclear fire PRA, recommends an unreliability of 0.02 for a wet-pipe sprinkler system.[19] If the two systems failed independently, the probability that both fail would be 0.02 × 0.02 = 0.0004, fifty times lower than for one system. In this example, both systems draw on one water supply that is off-line for 80 hours per year, the downtime that Barry uses as an example for inspection, maintenance and testing.[20] The probability that the shared supply is unavailable is then 80/8,760 = 0.00913, and the probability of losing both systems is:

P=1−(1−0.00913)(1−0.0004)≈0.00953

This is about 24 times the independent estimate, and the shared supply accounts for about 96% of it. On the same supply, a single system would fail with a probability of 1 − (1 − 0.00913)(1 − 0.02) ≈ 0.0290. The second system therefore lowers the failure probability from 0.0290 to 0.00953, a factor of about 3, instead of the factor of 50 that independent failures would give. The generic value of 0.02 excludes maintenance unavailability and dependent failures, which is why the shared supply must be added as a separate event.[21]

Log-scale bar chart: one system 0.02 or 0.029 with shared supply; two systems 0.0004 if independent, 0.0095 with shared supply.
Probability of losing sprinkler protection for one and two systems, with independent failures and with a shared water supply. Based on Parkinson et al. (1994), as cited in Nowlen et al. (2005b), p. P-6, and Barry (2002), p. 5-201.

Design and regulation

In New Zealand, C/VM2 (second edition, 2025) contains a design scenario, RC, that checks how a design performs when a key fire safety system fails. It requires a demonstration that, if a single fire safety system fails where that failure is statistically probable, people can still escape and fire spread to other property is limited.[22] The check applies where the failure of a key fire safety system could expose more than 150 people to untenable conditions, or smaller numbers in sleeping, care or detention occupancies.[22] Each key fire safety system is rendered ineffective in turn. Multiple system failures need only be considered when they have a single common cause.[9]

In Australia, the Fire Safety Verification Method handbook includes a check of scenarios in which one critical part of the fire safety system fails while the other measures work as designed.[23] The handbook states that common mode failures are an essential part of this check and must be fully evaluated.[8] A systematic review, normally carried out during hazard identification, identifies the fire safety measures, their failure modes and probabilities, and the common mode failures. The reference scenarios must include the outcomes of the common mode failures identified, and they must reflect realistic failure modes rather than abstract constructs.[24] A scenario in which a failed detection system does not warn the occupants but still alerts the fire brigade is given as an example of an inappropriate assumption.[24]

The handbook illustrates the check with a building in which one fire detection system raises the alarm, activates the smoke control systems, alerts the fire brigade and releases smoke doors held open by hold-open devices.[8] The probability of a total failure of this detection system was estimated at about 20%. In that case no alarm would sound, the brigade would not be alerted automatically, smoke control would not start and the smoke doors would not close. The design was changed to early automatic suppression instead of active smoke control, with the smoke doors released by local detectors independent of the main detection system.[8]

Two panels: left, one detection system feeds alarm, brigade call, smoke control and smoke doors; right, sprinklers and local door detectors added.
Left: one detection system controls four functions, so its failure removes all of them. Right: revised design with early automatic suppression and smoke doors on local detectors. Based on Australian Building Codes Board (2020b), p. 100.

Typical mitigation measures named in the handbook are monitored sprinkler control valves on each floor and independent detection systems for the alarm and for smoke control. Additional fire safety measures can also reduce the dependence on any single part of the fire safety system.[25] Fail-safe facilities serve the same purpose, such as smoke doors that close when their release signal is lost.[13][8] The data sheets also list common mode failures among the typical matters to consider when the reliability of a fire protection system is determined.[7]

Treatment in risk analysis

In a quantitative analysis, common causes appear as explicit events. Barry's fault tree for failure on demand contains two common cause branches: design-related failures within the subsystems, and common cause failures outside normal design.[6] His list of failure data inputs places common cause failures beside equipment failure rates, human error rates and external event frequencies.[26] When design scenarios are used, the outcome of each identified common mode failure must be evaluated for every part of the fire safety system that it affects.[24]

NUREG/CR-6850 lists five dependencies that can be important in a suppression analysis.[27] They link automatic suppression with automatic detection, with actuated barriers, with safe shutdown capability and with manual suppression, and they link manual detection with suppression actions. The branch probabilities of the detection and suppression event tree analysis in the methodology must reflect these dependencies.[21][27] Where suppression is actuated by smoke detectors, the probability of detection failure must be included in the probability that automatic suppression fails.[21] Human error probabilities in the event tree model should also include the dependencies on earlier actions, worsening fire conditions and the arrival of the fire brigade.[27]

The same idea applies to fire frequency data. If several fires at a plant share a common cause that has not been identified and corrected, NUREG/CR-6850 recommends a plant-specific fire frequency instead of generic values.[28] Barry's performance integrity measures, used to adjust generic failure data to plant conditions, include redundancy and the potential for common cause failure.[29] He notes that such scores give only a first-order estimate, and that internal and external common cause failures may still need separate treatment.[29]

Limitations and uncertainty

Generic reliability data may leave common causes out. The unreliability values of NSAC 179L used in nuclear fire PRA exclude dependent failures, maintenance unavailability and plant-specific data.[21] For fire doors with hold-open devices, the data sheets cannot tell whether the published reliability includes failures of the detection system.[16] Common causes can also go unnoticed by management. Barry's freezing practice was found from plant records and interviews, yet the corporate safety director was unaware of it.[2]

Hall notes that two events can be dependent without either being the cause of the other and without any apparent logical connection.[4] In nuclear fire PRA, the routine search for combinations of fire-induced spurious operations stays within system boundaries. This is in line with the usual treatment of common cause failures in the internal events models of nuclear plants.[30] The inclusion of known vulnerabilities across systems is encouraged, and further combinations across systems are found when the model is solved.[30]

Checks of this kind simplify the problem by failing one system at a time. Their result therefore depends on whether all single common causes have been identified, which the Australian handbook expects from a systematic review of failure modes.[9][24] The check also depends on realistic assumptions about how a failure propagates through the connected systems.[24]

See also

Notes

  1. ↑ 1.0 1.1 Iqbal and Salley (2004), p. F-16.
  2. ↑ 2.0 2.1 2.2 2.3 2.4 2.5 Barry (2002), p. 5-203.
  3. ↑ Modarres and Joglar-Billoch (2002), p. 5-36.
  4. ↑ 4.0 4.1 4.2 4.3 4.4 Hall (2002a), p. 1-184.
  5. ↑ 5.0 5.1 5.2 5.3 5.4 Nowlen et al. (2005b), p. P-12.
  6. ↑ 6.0 6.1 6.2 6.3 Barry (2002), p. 5-204.
  7. ↑ 7.0 7.1 Australian Building Codes Board (2020a), Data Sheet C1, p. 59.
  8. ↑ 8.0 8.1 8.2 8.3 8.4 8.5 Australian Building Codes Board (2020b), p. 100.
  9. ↑ 9.0 9.1 9.2 Ministry of Business, Innovation and Employment (2025b), p. 59.
  10. ↑ 10.0 10.1 10.2 Modarres and Joglar-Billoch (2002), p. 5-37.
  11. ↑ 11.0 11.1 Nowlen et al. (2005b), p. 13-7.
  12. ↑ National Institute of Standards and Technology (2005), p. 183.
  13. ↑ 13.0 13.1 Australian Building Codes Board (2020a), Data Sheet C3, p. 99.
  14. ↑ Australian Building Codes Board (2020a), Data Sheet C4, p. 131.
  15. ↑ Frank et al. (2014), as cited in Australian Building Codes Board (2020a), Data Sheet C7, p. 216.
  16. ↑ 16.0 16.1 Australian Building Codes Board (2020a), Data Sheet C7, pp. 216–217.
  17. ↑ 17.0 17.1 Siu (2002), p. 5-220.
  18. ↑ Modarres and Joglar-Billoch (2002), p. 5-32.
  19. ↑ Parkinson et al. (1994), as cited in Nowlen et al. (2005b), p. P-6.
  20. ↑ Barry (2002), p. 5-201.
  21. ↑ 21.0 21.1 21.2 21.3 Nowlen et al. (2005b), p. P-6.
  22. ↑ 22.0 22.1 Ministry of Business, Innovation and Employment (2025b), p. 58.
  23. ↑ Australian Building Codes Board (2020b), p. 99.
  24. ↑ 24.0 24.1 24.2 24.3 24.4 Australian Building Codes Board (2020b), p. 101.
  25. ↑ Australian Building Codes Board (2020b), p. 102.
  26. ↑ Barry (2002), p. 5-205.
  27. ↑ 27.0 27.1 27.2 Nowlen et al. (2005b), p. P-13.
  28. ↑ Nowlen et al. (2005b), p. 6-9.
  29. ↑ 29.0 29.1 Barry (2002), p. 5-207.
  30. ↑ 30.0 30.1 Nowlen et al. (2005b), p. 2-4.

References

  • Australian Building Codes Board. (2020a). Data sheets: Fire Safety Verification Method (Handbook annex, Print version 1.1).
  • Australian Building Codes Board. (2020b). Handbook: Fire Safety Verification Method (Print version 1.1).
  • Barry, T. F. (2002). Quantitative risk assessment in chemical process industries. In P. J. DiNenno, D. Drysdale, C. L. Beyler, W. D. Walton, R. L. P. Custer, J. R. Hall Jr., & J. M. Watts Jr. (Eds.), SFPE handbook of fire protection engineering (3rd ed., pp. 5-176–5-213). National Fire Protection Association; Society of Fire Protection Engineers.
  • Hall, J. R., Jr. (2002a). Probability concepts. In P. J. DiNenno, D. Drysdale, C. L. Beyler, W. D. Walton, R. L. P. Custer, J. R. Hall Jr., & J. M. Watts Jr. (Eds.), SFPE handbook of fire protection engineering (3rd ed., pp. 1-182–1-192). National Fire Protection Association; Society of Fire Protection Engineers.
  • Iqbal, N., & Salley, M. H. (2004). Fire Dynamics Tools (FDTs): Quantitative fire hazard analysis methods for the U.S. Nuclear Regulatory Commission Fire Protection Inspection Program (NUREG-1805). U.S. Nuclear Regulatory Commission, Office of Nuclear Reactor Regulation.
  • Ministry of Business, Innovation and Employment. (2025b). Verification Method C/VM2: Framework for fire safety design (2nd ed.).
  • Modarres, M., & Joglar-Billoch, F. (2002). Reliability. In P. J. DiNenno, D. Drysdale, C. L. Beyler, W. D. Walton, R. L. P. Custer, J. R. Hall Jr., & J. M. Watts Jr. (Eds.), SFPE handbook of fire protection engineering (3rd ed., pp. 5-24–5-39). National Fire Protection Association; Society of Fire Protection Engineers.
  • National Institute of Standards and Technology. (2005). Final report on the collapse of the World Trade Center towers (NIST NCSTAR 1).
  • Nowlen, S. P., Najafi, B., Wyant, F. J., Forester, J., Kazarians, M., Kolaczkowski, A., Joglar, F., Funk, D., Hannaman, G., & Anoba, R. (2005b). EPRI/NRC-RES fire PRA methodology for nuclear power facilities: Vol. 2. Detailed methodology (NUREG/CR-6850; EPRI 1011989). Electric Power Research Institute; U.S. Nuclear Regulatory Commission, Office of Nuclear Regulatory Research.
  • Siu, N. (2002). Fire risk assessment for nuclear power plants. In P. J. DiNenno, D. Drysdale, C. L. Beyler, W. D. Walton, R. L. P. Custer, J. R. Hall Jr., & J. M. Watts Jr. (Eds.), SFPE handbook of fire protection engineering (3rd ed., pp. 5-214–5-226). National Fire Protection Association; Society of Fire Protection Engineers.
Retrieved from "https://fire-safety.academy/w/index.php?title=Common_cause_failure&oldid=2435"