1 Fault Tree Analysis Register ¶

This registry holds the risks obtained from a Fault Tree Analysis (IEC 61025 style) of the product. FTA is a deductive, top-down technique: an undesired top event is postulated, and the combinations of basic events that can cause it are worked out through AND and OR gates. Two top events were analysed.

1.1 Fault Trees ¶

The first tree analyses the permanent loss of user data. The AND gate expresses that data is only lost for good when the primary copy is lost while, at the same time, no usable backup exists.

Fault tree TOP-1: permanent loss of user data

The second tree analyses the delivery of a misleading report. The OR gate expresses that every basic event is a first-order cut set: any one of them alone is enough to cause the top event.

Fault tree TOP-2: misleading report delivered

1.2 From Cut Sets to Records ¶

Each record of this register corresponds to one minimal cut set — the smallest combination of basic events that triggers a top event. A cut set whose criticality is already in the acceptable band is screened out and carries no record.

Cut Set	Basic Events	Record
{E1, E4}	Disk hardware failure while the backup job fails silently	FTA-001
{E2, E5}	Silent write corruption replicated into backups that were never restore-tested	FTA-002
{E3, E6}	Accidental bulk deletion discovered after the retention window	FTA-003
{E7}	Unit conversion fault	FTA-004
{E8}	Report served from stale cache	FTA-005
{E9}	Rounding drift in aggregation	screened out: criticality 8, acceptable

1.3 Scales ¶

Severity and Likelihood are scored on a ten-point scale; Likelihood reflects the estimated order of magnitude of the cut set's occurrence, so an AND-gated pair scores lower than either of its events alone.

Value	Severity	Likelihood
1	No noticeable effect	Practically never
4	Degraded or misleading output	Possible within a product lifetime
7	Loss of function	Expected within a year
10	Irrecoverable data loss	Persistent

The Criticality is Severity times Likelihood, computed for the cut set as first analysed. The Residual criticality uses the Residual Severity and Residual Likelihood sections, scored with the mitigation in place; a record without residual scores has not been mitigated yet and its Residual cell stays blank.

A criticality of 15 or below is acceptable, 35 or above is unacceptable and blocks the release until mitigated; the band between is tolerable while a mitigation is in progress.

1.4 Lifecycle ¶

Records move through Identified, Analysed, Mitigating, Accepted, and Closed. Every record whose current status is not Closed counts as open in the registries summary.

#	Title	Top Event	Minimal Cut Set	Severity	Likelihood	Mitigation	Affected Documents	Status	Criticality RPN	Residual RPN
FTA-001	Disk Failure With Silently Failing Backup	Permanent loss of user data (TOP-1)	{E1, E4} — disk hardware failure while the backup job has been failing silently	10	4	Alert the user when a scheduled backup has not completed successfully within its configured period, so a failing backup leg is repaired long before a disk failure can coincide with it.	REQ-021	Mitigating	40	20
FTA-002	Corruption Replicated Into Untested Backups	Permanent loss of user data (TOP-1)	{E2, E5} — silent write corruption replicated into backups whose restore was never tested	10	3	Verify every completed backup by restoring it to a scratch area and comparing record checksums against the primary copy, so corrupted backups are detected at backup time, not at restore time.	REQ-020	Mitigating	30	10
FTA-003	Bulk Deletion Discovered After Retention	Permanent loss of user data (TOP-1)	{E3, E6} — accidental bulk deletion noticed only after the retention window has expired	9	2	Retain deleted records for at least 30 days and require an explicit second confirmation for any bulk deletion, so the accidental deletion is both less likely and recoverable within the discovery time observed in support cases.	REQ-022	Accepted	18	9
FTA-004	Unit Conversion Fault in Reports	Misleading report delivered to the user (TOP-2)	{E7} — unit conversion fault; a first-order cut set, one basic event suffices	7	5	Carry the measurement unit with the value from the data model into every report column, so a unit can never be reattached by the presentation layer.	REQ-023	Mitigating	35	14
FTA-005	Report Served From Stale Cache	Misleading report delivered to the user (TOP-2)	{E8} — report served from stale cache; a first-order cut set, one basic event suffices	5	4	Proposed: invalidate cached report data when the underlying records change and stamp every report with the time of its data snapshot.	REQ-024	Analysed	20