System Safety: Fault Trees, FMEA and MIL-STD-882E questions for the CSP
CSP11 Domain 3: Risk Management (3.2 Risk analysis methods (FTA, FMEA, PHA); 3.3 Risk assessment). 3 free questions below. Every answer quotes and links the regulation paragraph it rests on.
Regulations covered
- MIL-STD-1629A, Procedures for Performing a Failure Mode, Effects and Criticality Analysis (DoD, 1980; cancelled 1998) MIL-STD-1629A FMECA
- MIL-STD-882E, DoD Standard Practice: System Safety (2012) MIL-STD-882E System Safety
- NUREG-0492, Fault Tree Handbook (U.S. NRC, 1981) Fault Tree Handbook
Text pulled from the eCFR, current as of .
Question 1
A fault tree team is analyzing a rupture of a steel air receiver rated for pressures up to and including its design pressure. Investigators find the receiver burst at a pressure below its rated design pressure because of a defective weld. The team must classify this basic event correctly in the tree. How should the fault be classified?
Show answer and source
Answer: A. Primary fault, because the component failed in an environment for which it was qualified
The receiver failed below its design pressure, so the environment was within what it was qualified for, and that makes it a primary fault. It is not secondary because the stress did not exceed the design conditions, and not a command fault because the component did not operate properly at the wrong time.
Answer A rests on
NUREG-0492, Fault Tree Handbook (U.S. NRC, 1981), PDF p. 47(opens ecfr.gov in a new tab)“A primary fault is any fault of a component that occurs in an environment for which the component is qualified; e.g., a pressure tank, designed to withstand pressures up to and including a pressure Po, ruptures at some pressure p,;;; Po because of a defective weld.”
Question 2
A program office has contracted a vendor to develop a ground vehicle. The solicitation says MIL-STD-882E is required, but it lists no specific system safety tasks from the task section. The vendor's program manager asks which parts of the standard are contractually binding. What is the correct answer?
Show answer and source
Answer: C. Only Sections 3 and 4 apply, because no specific tasks were included
When the standard is required but no specific tasks are listed, only Sections 3 and 4 apply. These set the minimum mandatory definitions and requirements. The distractors are wrong because the definitions are mandatory, the standard is not void without tasks, and tasks are not applied by default.
Answer C rests on
MIL-STD-882E, DoD Standard Practice: System Safety (2012), PDF p. 15(opens ecfr.gov in a new tab)“When this Standard is required in a solicitation or contract, but no specific tasks are included, only Sections 3 and 4 apply.”
Question 3
A fault tree for the top event "Reactor cooling pump stops" has an OR-gate with three inputs: loss of bus power, controller output fault, and seized bearing. During an event review, the team finds that bus power was lost and, at the same moment, the controller output had also faulted. The bearing was healthy. The pump stopped. How should the analyst treat this in the tree logic?
Show answer and source
Answer: A. The top event is consistent with the tree, because any one or more OR-gate inputs occurring is enough to cause the output event
For an OR-gate, any one or more of the input events must occur to cause the output event, so two inputs occurring together is fully consistent with the tree. Requiring all inputs describes an AND-gate, and requiring exactly one input is not how an OR-gate works.
Answer A rests on
NUREG-0492, Fault Tree Handbook (U.S. NRC, 1981), PDF p. 83(opens ecfr.gov in a new tab)“Any one or more of the input events must occur to cause the event above the gate to occur.”
26 more system safety: fault trees, fmea and mil-std-882e questions in the full CSP bank
Related topics
Original practice questions, not real exam items. PassCited is not affiliated with or endorsed by BCSP.