Journal of Experimental Psychology:Human Perception and Performance1978, Vol. 4, No. 2, 330-344

Fault Trees: Sensitivity of Estimated Failure Probabilitiesto Problem Representation

Baruch Fischhoff, Paul Slovic, and Sarah LichtensteinDecision Research, A Branch of Perceptronics

Eugene, Oregon

Fault trees represent problem situations by organizing "things that could gowrong" into functional categories. Such trees are essential devices for ana-lyzing and evaluating the fallibility of complex systems. They follow manydifferent formats, sometimes by design, other times inadvertently. The presentstudy examined the effects of varying three aspects of fault tree structure onthe evaluation of a fault tree for the event "a car fails to start." The faulttrees studied had four to eight branches, including "battery charge insuffi-cient," "fuel system defective," and "all other problems." Major results wereas follows: (a) People were quite insensitive to what had been left out of afault tree, (b) increasing the amount of detail for the tree as a whole or justfor some of its branches produced small effects on perceptions, and (c) theperceived importance of a particular branch was increased by presenting itin pieces (i.e., as two separate component branches). Insensitivity to omis-sions was found with both college student subjects and experienced garagemechanics. Aside from their relevance for the study of problem solving, suchresults may have important implications for (a) how best to inform thepublic about technological risks and to involve it in policy decisions and(b) how experts should perform fault tree analyses of the risks from techno-logical systems.

Many problems involve some form of sible causes. The problem solver's repre-troubleshooting: Something goes wrong, and sentation of the problem (and possiblethe problem solver attempts to figure out causes) can be constructed from scratch,why by first listing and then checking pos- retrieved from memory, or adopted from an

external source, perhaps with supplementary... ,, ... , ., . D , _ , , information from memory. A common rep-We would like to thank Barbara Combs and . , , . . ,

Gerry Hanson for their help in conducting these resentation for such problems is a faultexperiments; David Collins for technical advice tree," which organizes possible sources ofon designing fault trees; and Nancy Collins, trouble into a branching structure. Figure 1Phyllis Kemper, and Peggy Roecker for drafting presents a fault tree for the event «a carthe many versions of the fault tree that we used. £ .. . . , . ,. , .

This research was supported by the Advanced falls to start long enough to delay the driverResearch Projects Agency of the Department of for 1 minute." The top row presents theDefense and was monitored by the Office of problem, and the next row indicates theNaval Research under Contract N00014-76-C-0074 • systems whose failure might be rele-to Oregon Research Institute (ARPA Order No. \ „ , , . , ,. , ,2449) from Decisions and Designs, Inc., and to vant- Below each maJor system are Ilsted

Perceptronics (ARPA Order No. 30S2) from De- specific contributing failures. Sources usedcisions and Designs, Inc. (Subcontract 76-030- in constructing this particular tree were0714). . Petersen's Basic Auto Repair Manual, The

Requests for reprints should be sent to Baruch n / r it c • j/r ; T; n nFischhoff, Decision Research, A Branch of Per- Dod9e Colt Service Manual, The Chevelleceptronics, Inc., 1201 Oak Street, Eugene, Oregon Owner's Guide, and several experienced97401. mechanics. Using analogous sources of ex-

Copyright 1978 by the American Psychological Association, Inc. 0096-1523/78/0402-0330$00.75

330

BATTERY CHARGEINSUFFICIENT

— 1. Faulty ground connections- 2. Terminals loose or corroded

3. Battery weak

1. Faint

3. Dirt4. Looae connections

1. Lights left on, motor off

3. Cold weather4. Defective generator5. Lone or broken fanbelt6. Electrolyte fluid low or

improper7. Cable wires broken

. 8. Alternator defective9. Voltage regulator defective

10. Internal short circuit11. Too many electric

accessories operating

13. Continuous small drain(package on front seat of1974 models)

14. Battery too small

STARTING SYSTEMDEFECTIVE

— 1. Switches defective r-2. Transmission not in park

or neutralr 3. Seat belt problem

5. Starter drive defective

, 2. Starter relay3. Neutral start switch

1. Belts not fastened2. Driver's belt switch

defective*• 3. Heavy object on front seat

with belt unfestened4. Belt fastened before driver

FUEL SYSTEMDEFECTIVE

I— 1. Insufficient fuel— 2. Excess fuel (flooding)f 3. Defective choke

4. Defective air filter

2. Clogged fuel line

4. Dirt in fuel tank„ 5, Fuel line frozen

7 Defective fuel pump8. Cracked carburetor bowl

loose

1. Fuel pump pressure too high2. Leaking inlet valve3. Float out of adjustment4. Excess pumping of

5. Excess fuel pressure onhot day

6. Electric fuel pump floodscarburetor (foreign cars)

1. Choke valve open2. Valve linkage sticks

*" 3. Failure to choke4. Electric choke misfuoction

(Volkswagen)

IGNITION SYSTEMDEFECTIVE

11. Coil faulty r

— 2. Distributor faulty3. Spark plugs defective4. Defective wiring between

components

1. Cap cracked

3. Improper point gap. , 4. High point resistance

7. Timing off

1. Gap incorrect or fouled. 2. Plug shorting

3. Loose or defective wiring4. Plugs firing in wrong order

OTHER ENGINEPROBLEMS

1— 1. Oil too thickl~~ ' 2. Pistons frozenp 3. Poor compression

2. Weather too cold

1. Broken ring2. Excess heat3. Ring groove damaged.

1. Leaking head gasket2. Cracked cylinder head3. Valve burnt, improperly

adjusted, or sticking

cylinder worn or broken5. Gas washdown on cylinders

ALL OTHERPROBLEMS

Figure 1. A possible fault tree for discovering why a car won't start.

332 B. FISCHHOFF, P. SLOVIC, AND S. LICHTENSTEIN

pertise, one could construct a tree headed by"3-month old infant cries more than 5 min-utes," "bank statement does not matchcheckbook," "star pitcher fails to report forspring training," "SAC bomber recall sys-tem fails," or "nuclear power reactor coremelts."

Once constructed, the tree serves as aguide for the problem solver who mightask: Which system is more likely to be thesource of trouble? What information wouldallow me to check out the fault mostquickly? How well do I know this system(i.e., how authoritative is the fault tree),and should I be tinkering with it myself?Fault trees are used not only in analyzingsystems that have gone astray but also inattempting to design fail-safe systems.Knowing how things go wrong is a pre-requisite to drafting directives on what todo right. Fault trees have been instrumentalin the design of technological systems fromspaceships to nuclear power plants (AtomicEnergy Commission, 1975; Green &Bourne, 1972; Bryan, Note 1).

Fault trees are also used to estimate fail-ure rates for complex systems when histori-cal data for the system as a whole are un-available. Probabilities are assigned to eachof the pathways to failure and are thencombined to provide an overall failure rate.Such analyses were the primary methodo-logical tools in the $3 million Rasmussenstudy, which assessed the probability of acatastrophic loss-of-coolant accident in anuclear power reactor (Atomic EnergyCommission, 1975). Fault tree analysis has,however, come under attack from criticswho question whether it is methodologicallysound enough to be used as a basis for de-cisions of great consequence (e.g., Bryan,Note 1). One major concern of the criticsis that omission of relevant pathways dueto ignorance, poor memory, or lack of imagi-nation would lead to an underestimation offailure probabilities (Kendall, 1975).

As with many other kinds of problems(Newell & Simon, 1972), any troubleshoot-ing situation can be represented in a varietyof ways. For example, in constructing thefault tree in Figure 1, it was necessary to

decide how much detail to provide for eachsystem; whether to present minor systemslike "mischievous acts" separately or tolump them with "all other problems";whether the four items grouped in "fuelsystem defective" actually belong togetheror whether the last two might best be listedseparately with a heading like "carburetionproblems"; whether to use the graphic dis-play or an outline; and whether to use thislevel of specificity, or more, or less. Makingthese decisions will depend on considera-tions like the purpose of the analysis, theamount of knowledge available about theissue in question, and how much of an effecteach of these aspects of presentation has onthe way people evaluate the system.

The studies reported here look at theimpact of three such "arbitrary" aspects ofthe way in which fault trees are presentedand the way in which they are evaluated.These are: (a) what is listed specificallyand what is left to all other problems, (b)how much detail is presented for the vari-ous "branches" (systems) of the fault tree,and (c) how various systems are groupedinto branches.

Aside from their interest for students ofproblem solving, such questions may be im-portant for those concerned with the man-agement of risks in our society. The laypublic is increasingly called upon to decidewhether the risks from various technologicalsystems are acceptable in the light of theaccompanying benefits. The risks from manyproposed projects (e.g., nuclear power,liquid natural gas, recombinant DNA re-search) are varied and complex. Typically,they are presented to the public by technicalexperts who in one way or another usefault tree representation. In preparing theirpresentation, they must make arbitrary de-cisions like those listed above.

Understanding what difference these de-cisions make might help us understand (a)whether the public is being properly in-formed (e.g., Is risk information being pre-sented in ways leading to its subjective over-estimation or underestimation?), (b) howtechnical information can be communicatedso that it is perceived most veridically, and

FAULT TREES 333

(c) what possibilities exist for manipulatingperceptions through judicious fault tree pre-sentation. If the perceptions of experts arealso affected by variations in tree representa-tion, we might learn something about howto improve the basic methodology of a tech-nique used for momentous decisions.

Experiment 1: Pruning the Tree

However exhaustive one would like to bein the design of a fault tree, at some pointit is necessary to stop listing alternativesand combine the remainder into a categorylabeled something like all other problems.In theory, listing every possible cause is anendless chore, and in practice, listing manyimplausible causes could overwhelm thefault tree's designers and viewers with bi-zarre possibilities that might divert atten-tion from the primary possibilities. In Ex-periment 1, we studied the sensitivity ofan evaluator to fault tree components thathave been omitted. In this initial investiga-tion, we looked for gross effects, those ob-tained by deleting substantial portions of atree without specifically indicating their ab-sence. In the real world of design and dis-aster, elements can be left out either inad-vertently (the designer lacks the appropriateknowledge or imagination) or consciously(the designer collapses certain categoriesinto the "other" category for simplicity;the designer omits certain pathways to makethe system appear safer).

Two contrary hypotheses can be advancedfor the impact of deleting major compo-nents of a fault tree on a viewer's judgmentof its completeness.

One hypothesis suggests that when majoritems are deleted, it is quite likely that theabsence of at least one item will be detected.Once such an omission has been uncovered,the entire analysis is discredited and theproportion left out is exaggerated. (Imagineyour reaction to discovering that a pur-ported fault tree for "car won't start" con-tains no mention of battery failure.) Manypublic discussions regarding nuclear powerand other technological risks would seem tosupport this hypothesis. Members of the

public scrutinize a fault tree prepared by atechnical expert, discover (what seems tothem to be) an important omission, anddoubt the quality of the entire analysis andthe competence of the analyst (e.g., Bar-rager, Judd, & North, 1976; Birnbaum,Wong, & Wong, 1976; Settle & Golden,1974).

In contrast with this "credibility" hypoth-esis, the "availability" hypothesis (Tversky& Kahneman, 1973) suggests that what isout of sight is also out of mind. Problemsthat are not mentioned explicitly may not bethought of. People may not realize what ismissing and, therefore, may overestimatethe completeness of the analysis. Suspectingthis to be the case, critics of technologicalprojects who discover omissions in faulttrees have cast doubt not on the competencebut on the integrity of the analysts, chargingthe analysts with deliberately omitting prob-lems to induce the public to underestimatethe total risks associated with the project.

A third hypothesis is that people havesuch well-defined frequency representationsin their minds (Howell, 1973) that they willappropriately realize what is missing. It isalso possible that availability and credibilityeffects might cancel one another, producingappropriate judgments of all other problems.

Method

Stimulus, The basic stimulus for all studiesreported here is the car won't start fault tree ofFigure 1. It was constructed by consulting avariety of shop and repair manuals, mechanics, andcar buffs to make it as complete as possible.1

We distinguish between three levels of detail:Level 1, which presents just the system names(e.,g., "battery charge insufficient"); Level 2,which lists three to five component problems foreach system (e.g., (a) faulty ground connections;(b) terminal loose or corroded; (c) batteryweak) ; and Level 3, which provides fuller detailfor each of the component problems that could beelaborated, that is, everything shown in Figure 1.

1 To our chagrin, the first starting failure en-countered by anyone connected with this study wasnot included in our fault tree: an ignition key notturning because the steering wheel lock had caughtthe ignition switch.

334 B. FISCHHOFF, P. SLOVIC, AND S. LICHTENSTEIN

Subjects in Experiment 1 were presented withLevel 2 detail.

Design. Four separate groups of subjects par-ticipated. Two groups received the full, unprunedtree of Level 2. They differed only in that theexperimenter read aloud the entire tree to onegroup (w — 5 8 ) ; the other group (» = 3S) readthe tree by themselves, without an enforced amountof time for examining it. Each of the two othergroups was given a different pruned tree; onegroup (» = 29) saw a tree that was missing thestarting, ignition, and mischief branches, and theother group (»= 26) saw a pruned tree thatlacked the battery, fuel, and other engine branches.Since the first two groups showed no difference inresponse measures, the self-paced read-to-oneselfadministration was used for the two pruned treegroups.

Procedure. Before studying the fault tree, sub-jects were told:

Every day, across the United States, millions ofdrivers perform the act of getting into an auto-mobile, inserting a key in the ignition switch,and attempting to start the engine. Sometimesthe engine fails to start, and the trip is delayed.We'd like you to think about the various prob-lems that might be serious enough to cause acar to fail to start so that the driver's trip isdelayed for at least 1 minute.

The chart on the next page is intended to helpyou think about this problem. It shows six[threel major deficiencies that cause a car'sengine to fail to start. These major categoriesprobably don't cover all possibilities, so we'veincluded a seventh [fourth] category, All OtherProblems.

Please examine this diagram carefully and an-swer the following question:

For every 100 times that a trip is delayed dueto "starting failure," estimate, on the average,how many of those delays are caused by each ofthe seven [four] factors. Make your estimateson the blank lines next to the factors named be-low. Your estimates should sum to 100.

The numbers above in brackets were given tosubjects who saw the pruned trees.

After assigning proportion, all subjects wereasked:

Please answer the following question: Overthe next 1,000 times in the U.S. that drivers at-tempt to start their cars, how many times willthe drivers experience delays in starting theengine serious enough to delay their departureby at least 1 minute ?

Answer: times out of 1,000

They were also asked a number of questionsabout the extent of their current and past ex-perience with cars.

Subjects. One hundred forty-eight persons whoresponded to an advertisement in the Universityof Oregon student newspaper participated. Theywere assigned to an experimental group accordingto their preference for experiment date and hour.

Results

The difference in the mean proportion ofproblems assigned to each branch for theself-paced group and the read-aloud groupwas minimal. (Mean absolute differenceacross the seven branches was .018.) Resultsfor these groups were combined.

If pruned tree subjects were sensitive towhat had been omitted in the trees theystudied, the proportion of problems thatthey attributed to "other" would equal thesum of the proportions of problems attrib-uted to the pruned branches and to "other"by subjects who saw the full tree. If theavailability hypothesis were correct, "other"would be assigned a lower proportion in thepruned tree; if the credibility hypothesiswere correct, that proportion would begreater.

Table 1 presents the mean proportion ofstarting failures attributed to each branchand to "other." Pruned tree subjects clearlyfailed to appreciate what had been left out.For pruned tree Group 1, "other" shouldhave increased by a factor of six (from .078to .468) to reflect the proportion of failuresdue to starting, ignition, and mischief. In-stead, "other" was only doubled, whereasthe importance of the three systems thatwere mentioned was substantially increased.A similar picture emerged with the secondpruned tree. Although these results clearlyfavor the availability over the credibility hy-pothesis, subjects did show some sensitivityto what had been omitted. The proportionof problems attributed to "other" was sig-nificantly greater for both pruned treegroups than for the unpruned tree group.(For both t tests, p < .001.) In addition,pruned tree Group 2, which saw a tree withmore important branches deleted, assigneda higher proportion of problems to "other"

FAULT TREES 335

Table 1Results from Experiment 1: Pruning the Tree

Mean proportion of starting failures attributed to

Group

Unpruned treePruned tree 1Pruned tree 2

n

932926

Battery

.264

.432

Startingsystem

.195

.357

Fuelsystem

.193

.309

Ignitionsystem

.144

.343

Engine

.076

.116

Mis-chief

.051

.073

Other

.078

.140"

.227b

Mdn no.startingfailuresin 1,000

755976

Note. A dash indicates that the branch was deleted.» Should be .468.b Should be .611.

than did pruned tree Group 1, £(53) = 2.59.Only 1 subject of the 55 in the two

pruned tree groups assigned to "other" aproportion of problems greater than orequal to the sum of the proportions of prob-lems assigned to the missing branches(plus "other") by the unpruned tree group.There was no tendency for subjects whorated themselves higher in expertise (on a5-point scale) to assign a higher proportionof problems to "other" in any of the groups.

There were no significant differences be-tween the pruned and unpruned tree groupsin the median likelihood that a randomly se-lected car would not start. This is a bit sur-prising, because the support for the avail-ability explanation noted above would sug-gest that mentioning more specific sources ofdifficulty to unpruned tree subjects wouldincrease the availability of starting failure.Medians were used because of the presenceof some extremely high estimates (e.g., 600starting failures in 1,000 tries), which wouldhave unduly affected the means. The relativefrequency of such unrealistic estimates(even among experienced drivers) suggeststhat this measure was not entirely success-ful, making results obtained with it some-what dubious.

Discussion

Pruned tree subjects clearly did not ap-preciate how much had been left out, and,as a consequence, they overestimated theexhaustiveness of the branches they saw.One could speculate that this effect would

be even more pronounced with fault treesconcerning technical systems less familiarthan the present.

Although the enormity of the present ef-fect suggests that it may be quite robust,one might wonder whether it was due, atleast in part, to unpruned tree subjectseither (a) assuming that the experimenterswere competent and thus had provided areasonably complete tree or (b) not attend-ing sufficiently to the "other" branch. Ex-,periment 2 was conducted to explore thesepossibilities.

Experiment 2: Focusing on All OtherProblems

Method

Experiment 1 was repeated with several changes.To focus subjects' attention on what was left out,a paragraph was added to the instructions saying,"In particular, we'd like you to consider its com-pleteness. That is, what proportion of the possiblereasons for a car's not starting are left out, to beincluded in the category all other problems?"Their proportion estimation task was reduced toanswering:

For every 100 times that a trip is delayed dueto "starting failure," estimate, on the average,how many of those delays are caused by factorsnot included in the chart. out of every100 cases would fall in the category all otherproblems.

Because of the difficulty that Experiment 1subjects seemed to have had in assessing thelikelihood of starting failure with a randomlyselected car, the question was expanded by (a)asking them not only about a randomly selectedcar but also about their own car and (b) asking

336 B. FISCHHOFF, P. SLOVIC, AND S. LICHTENSTEIN

not only for an absolute judgment (how manytimes out of 1,000 attempts) but also for a rela-tive judgment. (How many times more or lesslikely is a starting failure than a flat tire?)

Eighty-two subjects were recruited as in Ex-periment 1. The fault trees and instructions wereread aloud.

Results

Focusing subjects' attention on the"other" branch of the unpruned tree hadlittle effect on the unpruned tree group. Themean proportion of starting failures assignedto "other" was actually slightly smaller thanthe proportion in Experiment 1 (.067 vs..078), f(121) = .71. It did, however, in-crease by about 50% the proportion of prob-lems that subjects who saw the pruned treesattributed to "other." For pruned treeGroup 1, the proportion attributed to"other" increased from .140 to .217, i(49)= 1.88; for pruned tree Group 2, from .227to .346, i(58) = 1.81. In both cases, though,the proportion attributed to "other" wasstill much less than it should have been.These results are shown in Table 2.

Subjects who received the unpruned treewith its full panoply of problems thoughtthat the absolute likelihood of a starting

failure was greater than did subjects whosaw the pruned trees (Mann-Whitney Utest, ,ss = 2.42 and 1.77, for others' carsand own car, respectively). About 90% ofthe subjects who saw the unpruned treethought that starting failure was more likelythan a flat tire, compared with about 75%of subjects who saw the pruned tree (p <.10 for difference in proportions, both forothers' car and for own car). Whereas themedian pruned tree subject thought that astarting failure was 5 times as likely as aflat (for either kind of car), subjects whosaw the unpruned tree thought that a start-ing failure was 20 times more likely for arandomly selected car and 60 times morelikely for their own car (Mann-Whitney Utest, £S = 2.26 and 4.26, respectively). See-ing the unpruned tree apparently made astarting failure seem more likely.

Discussion

Focusing subjects' attention on what ismissing improved their awareness, but onlypartially. Because it did not lead to an exag-gerated estimate of what was missing, suchfocusing would appear to be a valuable pro-cedure whenever confronted with a fault

Table 2Effects of Focusing Subjects' Attention on "All Other Problems"

Frequency of starting failures

Proportionof problemsattributed

Group nOb-

servedShould

be

Other's car

Morethan

<ySub-jects

likelya flat

. _ , ...

re- out ofsponse 1,000

Own car

Morethan

°7Sub-jects

likelya flat

Mdnre-

sponse

Mdnout of1,000

Experiment 1

Unpruned treePruned tree 1Pruned tree 2

932926

.078

.140

.227.468.611

755976

Experiment 2Unpruned treePruned tree 1Pruned tree 2

302234

.067

.217

.346.468.611

88.975.076.5

20 553 25

10 21

90.483.372.7

605

10

473520

Note. Subjects in Experiment 2 were instructed to focus on the other category. Data from Experiment 1are included here for comparison.

FAULT TREES 337

tree or a similar representation. It remainsto be seen how fault tree designers and eval-uators can be brought to a fuller apprecia-tion of how adequate a problem presentationis, particularly when the missing elementsare ones of which they are totally orpartially unaware. Perhaps a useful rule ofthumb would be: The proportion of missingsources of trouble is proportional to thenumber of things I can think of that aremissing multiplied by a measure of my gen-eral familiarity with the system (wheregreater familiarity is assigned a lowerscore). In other words, if I don't knowmuch but still can detect something miss-ing, then this fault tree representation isquite incomplete.

Experiment 3: Level of Detail

Another discretionary decision faced bysomeone designing a fault tree for publicdisplay is how much detail to present. Adesigner must consider whether additionaldetail serves to inform the viewer or leadsto confusion, feelings of incompetence, orundue apprehension over the large numberof sources of trouble presented. Experiments1 and 2 showed that omitted branches areessentially out of mind. Experiments 3 and4 examined the effect on problem evaluationof exposing more or less detail for the dis-played branches.

Method

The car-won't-start fault tree was presentedto four different groups of subjects with threedifferent levels of detail, Levels 1 and 3 describedabove (system names only and full detail) andanother called Level 2/plus. This intermediatelevel included everything in Level 2 along withfull (Level 3) detail for just one branch. Subjectsreceiving such a fault tree were told that a simi-larly detailed analysis could be performed forother branches. One group at Level 2/plus re-ceived full detail on the fuel system; another re-ceived full detail on the battery system.

One hundred ten new subjects were recruitedas in Experiments 1 and 2. Questionnaires weredistributed in a group setting, and subjects readthem at their own pace.

In this and all subsequent experiments, the pro-portion estimation task of Experiment 1 (subjectsgave proportions to all Level 1 categories) and

the four final questions from Experiment 2 (num-ber of failures out of 1,000 and comparison witha flat tire for both others' cars and own car) wereused.

Results

The upper half of Table 3 presents resultsfrom Experiment 3, along with the resultsfor the corresponding group given Level 2in Experiment 1. The effects of the variousmanipulations of detail seem quite modest.

One might expect that when just one sys-tem receives more detail than the others, asin the two Level 2/plus groups, that sys-tem's proportion of problems would be ele-vated. However, neither battery nor fuel,when given a greater detail, received a pro-portion significantly (a = .05) larger thanthese systems received in the other groups.

Similarly, one might expect a lowerproportion of problems attributed to mis-chievous acts at Level 3, when it is theonly branch without additional detail (seeFigure 1), than for the other detail levels.No such effect was found.

The battery and fuel systems, which hadmore detail at Level 3 than did the othersystems, were judged more likely by thatgroup than by other groups (for battery,t — 2.95 compared with Level 2 and t = .86compared with Level 1; for fuel, t = 1.14compared with Level 2 and t = 2.49 com-pared with Level 1; dj = 70 in all tests).

Finally, the proportion of problems at-tributed to all other problems decreasedmonotonically as level of detail increased,for linear trend, F(l, 141) = 7.40, p < .01.

Despite the expectation that the probabil-ity of a starting failure would increase asthe level of detail increased, none of the fourmeasures of this probability showed this ef-fect. Indeed, the only such measure, shownin Table 3, starting failures out of 1,000 forothers' cars, showed a nonsignificant trendin the opposite direction.

Experiment 4

Before concluding that detail has only amodest effect, we explored the possibilitythat mode of presentation mattered here

CM00

Table 3Effect of Presenting Varying Degrees of Detail

Level of detail n

Mean proportion of starting failures attributed to

Battery Starting Fuel Ignition Engine Mischief Other

Mdn no.startingfailuresin 1,000(others'cars)

Experiment 3 — Self-paced

System names alone (Level 1)Minimal detail (Level 2)a

One branch with full detailBatteryFuel

Full Detail (Level 3)

3535

191937

.303

.231

.284b

.224

.337

.162

.205

.184

.256

.126

Experiment 4 — Read

System names alone (Level 1)Minimal Detail (Level 2)"One branch with full detail

BatteryStartingFuel

Full detail (Level 3)

3558

22262367

.330.284

.347b

.260

.304

.294

.152.189

.185

.241b

.189

.198

.149

.194

.182

.174b

.232

aloud

.136.192

.175

.120

.184b

.186

.156

.151

.180

.140

.125

.172.139

.124

.144

.127

.151

.062

.083

.066

.067

.061

.067.072

.052

.076

.067

.080

.052

.046

.039

.051

.057

.060.054

.051

.062

.054

.038

.116

.092

.065

.088

.062

.083.070

.066

.095

.076

.053

112100

100100

70

2728

50509050

w

cnOwHIO

ensI — I_O

Ot/)

rnHwenHW

a Unpruned self-paced group from Experiment 1.b Single branch presented in full detail.° Unpruned read-aloud group from Experiment 1.

FAULT TREES 339

(although it had not mattered in Experi-ment 1). We speculated that subjects pre-sented the rather voluminous fault trees forLevels 2/plus and 3 may have s;kimmedover them, not attending to the greater de-tail they offered. Experiment 4 replicatedExperiment 3 with fault trees read aloudto 173 new subjects. A third Level 2/plusgroup was added, giving full detail on thestarting system.

Results

The lower portion of Table 3 presents theresults from Experiment 4, along with theappropriate Level 2 results from Experi-ment 1. With Levels 1 and 2, the differencesbetween Experiments 3 and 4 were negli-gible. The mean absolute differences in pro-portions for the seven branches were .016and .018, respectively. With Level 2/plus,there was somewhat more of a difference.As a highlighted branch, the battery systemincreased from .284 in Experiment 3 to .347in Experiment 4, t( 39) = 1.33; the fuelsystem, however, changed little (.174 vs..184), f(40) = .34.

Unlike Experiment 3, here the batterysystem received a somewhat (but nor enor-mously) greater share of attributed prob-lems when it was highlighted (Level 2/plus) than in all other conditions. So didthe starting system. However, the fuel sys-tem again failed to show this effect.

Unlike Experiment 3, mischievous actsdid show a significantly smaller proportionof problems at Level 3, where it is theonly branch lacking full detail (z — 2.95compared with Level 1; z = 2.17 comparedwith Level 2).

Again in contrast to Experiment 3, thebattery and fuel systems, the ones withthe greatest detail, were not more likely inLevel 3, where this detail is most apparent,than in other levels.

The proportion of problems attributed toall other problems in Experiment 4 showedthe same tendency to decrease as detail in-creased, as found in Experiment 3, exceptfor one reversal: The weighted mean acrossthe three Level 2/plus groups was .080,rather than a value between .053 and .070.

Despite the one reversal, the linear trend ina one-way analysis of variance was signifi-cant, F(l, 227) = 4.44, p < .05.

In Experiment 4, the median startingfailure rate for others' cars was similar forLevels 1 and 2 (Mann-Whitney U test, z— .56) but somewhat higher for Levels 2/plus and 3 than for Levels 1 and 2 (Mann-Whitney U test, s - 1.83). No such differ-ences, even marginally significant, were ob-served for "one's own car" (not shown),suggesting that subjects' judgments regard-ing their own cars were less susceptible tothis manipulation. Subjects in Experiment4 also showed some effect due to detail onthe likelihood of starting failure comparedwith that of a flat tire for both their ownand others' cars. For Level 1, roughly 75%of subjects thought that starting failure wasmore likely; for Levels 2, 2/plus, and 3,approximately 90% thought so. The differ-ence in proportions was significant (z —2.12 for others' cars; z = 2.47 for own car).

Discussion

Compared with the enormous availabilityeffect found in Experiments 1 and 2, thepresent results are modest. Only one of sev-eral hypothesized effects due to variationin detail was found in both Experiments 3and 4: The proportion of problems attrib-uted to all other problems decreased as de-tail increased. Further research with greaterpower is needed to explore the other effectsthat were found in one but not in both ex-periments. Even if real, these possible effectsare probably small.

One must conclude that amounts of de-tail did not produce large changes in peo-ple's perceptions. The mere mention of abranch (Level 1) appeared to allow sub-jects to make a fairly accurate estimate ofhow troublesome that branch would lookwhen fully detailed. Level 2/plus subjectswere somewhat (although not completely)successful in compensating for the detailmissing on the more minimally presentedbranches. The relatively small effect of in-creased detail on estimated starting failurerate suggests that subjects given little de-tail realize their own ignorance.

340 B. FISCHHOFF, P. SLOVIC, AND S. LICHTENSTEIN

Experiment 5: Splitting and FusingBranches

A third area in which the designer of afault tree must make discretionary decisionsis in organizing the various sources oftrouble into branches. Although functionalrelationships introduce some constraints,the designer must -make decisions likewhether "disruptions of wiring" belongs un-der mischievous acts or "ignition system de-fective." A common dilemma is broad ver-sus narrow categorization. Starting systemdefective and ignition system defectivecould be lumped together. Ignition systemdefective could be split into ignition systemdefective (Items 1 and 3 in Figure 1) and"distribution system defective" (Items 2 and4). Experiment 5 examines the effect onfault tree evaluation of the way in which afixed amount of information is organized,specifically, whether broader or narrowercategorization is used.

Method

The effect of breadth of categorization on faulttree evaluation was studied by creating four newversions of the Level 2 fault tree (Figure 1). Twowere created by splitting different existingbranches into two branches containing (betweenthem) the same information. In one, ignition sys-tem defective was split into ignition system de-fective with Items 1 and 3 (coil faulty and sparkplugs defective) and distribution system defec-tive, with Items 2 and 4 (distributor faulty anddefective wiring between components) ; in thesecond version, "fuel system defective" was splitinto fuel system defective (Items 1 and 2) and"carburetion defective" (Items 3 and 4). Thus,these two trees each had eight branches (count-ing other). Two additional trees were created byfusing two branches of the full tree. In one, start-ing system defective and ignition system defectivewere combined into one branch; in the second,fuel system defective and "other engine .problems"were combined. Thus these fused versions eachhad six branches (counting other).

One hundred fifteen subjects were recruited asbefore. Each subject saw only one tree. The tasksfor the subjects were the same as in Experiments3 and 4. The trees were read aloud.

Results

Table 4 presents the proportion of start-ing failures attributed to each of the ma-

nipulated branches, along with comparabledata from Experiment 1. In every case,a set of problems was perceived as moreimportant when it was presented as twobranches than when presented as one. Themean increase over the four cases was .066;in general, a set of problems was attributedabout a third greater portion of the totalnumber of starting failures when presentedas two branches. The number of subjectsgiven eight-branch trees who assigned thetwo new branches a combined proportionhigher than the mean assigned by subjectsin Experiment 1 to the comparable singlebranch was 20 out of 27 (sign test, p —.010) for the fuel-system-split group and 19out of 26 (p = .014) for the ignition-sys-tem-split group. The number of subjectswho assigned a proportion to the new fusedbranch lower than the corresponding meansum in Experiment 1 was 24 out of 33 (/> =.007) for the starting-ignition-combinedgroup and 23 out of 29 (p = .001) for thefuel-engine-combined group.

There were no differences in either therelative (compared to a flat tire) or abso-lute likelihood of a starting failure for ownor others' cars for subjects seeing the in-formation presented in six- or eight-branchfault trees (not shown in table).

Discussion

Experiment 5 showed that the morepieces into which a system of failure path-ways is organized, the more important thatsystem seems. One possible explanation isthat people tend to assign some minimumprobability to any category with which theyare faced. A branch that is split in two re-ceives two portions of this minimum prob-ability, either because the smallest nonzeroestimate allowed by the response mode was.01 or because of an assumption that "if theydecided to include this branch, it must havesome minimal import." An indirect way toevaluate this hypothesis is to estimate whatproportion of problems is attributed to acategory of "minimal import." For the 93subjects in Experiment 1 who saw the un-pruned Level 2 tree, the mean proportion of

FAULT TREES 341

Table 4Experiment 5: Effects of Splitting and Fusing Branches

Separate Together

Problem

FuelCarburetion

n = 27IgnitionDistribution

n = 26

StartingIgnition

w = 33

FuelOther engine

n = 29

M proportion of M proportion ofstarting failures Sum starting failures

Splitting existing branches

;JS -260 .193

.082 1n, ...j j j .193 .144

Fusing existing branches105

;J*4 .339 .248

103:o?o -269 -213

Difference4

.067

.049

.091

.056

Note. In all places in which the number of subjects is not indicated, the results are those from the unprunedtree (Level 2) subjects in Experiment 1 (Table 1), for which n — 93.• Separate sum minus together.

problems assigned to the least importantbranch was .033; the mean lowest propor-tion excluding zero responses was .040.(Only 11% of subjects ever assigned a zeroproportion of problems to any branch.) Bythis criterion, the increased importance(.066) garnered by splitting a branch wasabout twice that which might be attributedmerely to increasing the number of cate-gories.

Experiment 6: Experts

Our discussion so far has been concernedwith lay persons' evaluations of fault treespresented to them by technical experts. Onemight wonder, though, whether the effectswe have found also affect the technical ex-perts themselves. Fischhoff (1977) listsmany incidents in which experts designingfault trees for important technological sys-tems were apparently unaware of majoromissions; they therefore greatly overesti-mated the exhaustiveness of their own anal-yses. Experiment 6 examined whether thatwhich is out of sight is also out of mind fortechnical experts.

Experiment 6 replicated Experiment 1using as subjects experienced mechanics inEugene, Oregon. Thirty copies of PrunedTree 1 (lacking the starting system, igni-tion system, and mischief branches) and 30copies of the unpruned tree (Level 2) weredistributed to experienced mechanics at sixmajor garages.

In the accompanying letter, they weretold:

We are asking people like yourself who workwith cars to give us their opinion about certaintypes of engine-starting problems. We hope youwill agree to read the questionnaire and give usyour opinions.

Actually, we are not just interested in automobileengines. We're concerned with all kinds of com-plex mechanical systems ranging from automobileengines to nuclear reactors. In particular, we'reinterested in the ways these systems break downand the judgments about these breakdowns madeby people who repair these systems. That's whywe're asking for your opinions.

If you are willing to participate in this study,please read the instructions on the next page;then fill out the two short questionnaires and mailthem to us in the enclosed addressed and stampedenvelope. We'll mail you a check for $3.

342 B. FISCHHOFF, P. SLOVIC, AND S. LICHTENSTEIN

There are no "right" answers to these questions.At least we don't know the answers. That's whywe're interested in your opinions. Please workalone and don'c refer to any books or discuss thequestionnaire with anyone before you have com-pleted it.

Otherwise, the questionnaire was like thatin Experiment 1. On the final page, subjectswere asked to indicate (a) the rate of start-ing failures per 1,000 attempts (for driversin the United States) ; (b) the number ofyears they had made all or part of theirliving working with cars; and (c) howknowledgeable they were about automobileengine problems compared to other me-chanics : below average, average, above aver-age, or much above average.

Results

Twenty-nine of the 60 questionnaireswere returned, 16 from the pruned treegroup and 13 from the unpruned tree group.Two mechanics rated themselves as muchabove average in knowledge, 18 as aboveaverage, 8 as average, and 1 as below aver-age. They had from 2 to 43 years of ex-perience, with the mean for the unprunedtree group being 12.2 years, and for thepruned tree group, 19.8 years.

Table 5 presents the mean proportion ofstarting failures attributed to each branchby subjects in the present experiment aswell as the unpruned tree results from Ex-periment 1 for the sake of comparison. The

experts thought that battery and ignitionwere more serious problems than did theregular subjects, and that the starting andfuel system problems were less important.They more or less agreed about the com-pleteness of the tree, assigning .060 to"other."

The combined proportion of problems at-tributed to the branches deleted from thepruned tree (plus "other") was .441.Pruned tree subjects assigned to "other" amean proportion of only .215 (Mann-Whit-ney U test, £ = 2.87). The respective me-dian responses were .47 and .16.

Within the pruned tree group, the twosubjects who rated themselves as muchabove average in knowledge assigned amean to "other" of .075, the nine above-average mechanics assigned .278; and thefive average ones, .158. There was a rankorder correlation (tau) of .058 betweennumber of years of experience and propor-tion assigned to "other." Thus, neither self-rated degree of knowledge nor actual ex-perience had any systematic relation to abil-ity to detect what was missing from the tree.

General Discussion

The most dramatic result of these studieswas subjects' inability to appreciate howmuch had been omitted from the prunedfault trees. Exaggeration of fault tree com-pleteness was found with both "regular"subjects and experienced mechanics. The

Table 5Experiment 6: Judgment of Experts

Mean proportion of starting failures attributed to

Group

Unpruned treeordinary subjects

Unpruned treeexperts

Pruned tree 1experts

n

93

13

16

Battery

.264

.410

.483

Start-ing

system

.195

.108

—

Fuelsystem

.193

.096

.229

Igni-tion

system

.144

.248

—

Mis-Engine chief

.076 .051

.051 .025

.073 —

Other

.078

.060

.215'

startingfailures

in 1,000

75

20

100

• Should be .441.

FAULT TREES 343

fact that omission of major branches trig-gered only minimal awareness of the inade-quacies of the pruned tree lent strong sup-port to the availability hypothesis over thecredibility hypothesis, as did the modestimprovement when subjects' attention wasfocused on completeness.

How might things that are out of sightalso be out of mind ? One obvious reason isignorance. There is no way to considersomething that one has never heard of andthat is not mentioned. In a discussion ofthe omissions that seem to plague technicalexperts performing formal risk assessments,Fischhoff (1977) suggested several otherreasons: (a) failure to consider the imagina-tive ways in which human error can messup a system (e.g., the Brown's Ferry fire inwhich the world's largest nuclear powerplant almost melted down due to a techni-cian checking for an air leak with a candlein direct violation of standard operatingprocedure); (b) insensitivity to the assump-tions an analysis makes about constanciesin the world in which the system is em-bedded (e.g., no major changes in govern-ment regulatory policy); (c) overconfi-dence in current scientific and technologicalknowledge (i.e., assuming that there areno new chemical, physical, biological, orpsychological effects to be discovered) ; and(d) failure to see how the system functionsas a whole (e.g., a system may fail becausea backup component has been removed forroutine maintenance).

Although similar problems seem likely toafflict the designers and viewers of faulttrees, this list is probably incomplete. Ex-panding and validating such a list is im-portant not only for our understanding ofhow people conceptualize complex falliblesystems but also for helping them betterdescribe and comprehend such systems. Fo-cusing on "other" was somewhat, but onlypartially, successful in helping people ap-praise the completeness of a fault tree. Im-proved understanding of the reasons foromissions will help in designing better "de-biasing" procedures and ways to approachan evaluation task that provide a moreveridical perspective. When such "cognitive

engineering" seems ineffective, people mayneed rules of thumb like the suggested rulefor estimating how many sources of troubleone cannot think of on the basis of howmany one can think of and one's familiaritywith the problem area.

Because of the importance of intelligentpublic participation in debates about tech-nology (Casper, 1976; Slovic, Fischhoff, &Lichtenstein, 1976), these are critical issuesto which psychologists might address them-selves. Such research does, however, raiseserious ethical questions because of the pos-sibility that the results will disclose waysin which public opinion can be manipulated.For example, Experiments 1 and 6 suggestthat one can get the public to focus on thoseissues one thinks are important by nevermentioning other issues. Even our "debias-ing procedure" (focus on "other") in Ex-periment 2 was a form of manipulation,changing people's perceptions from whatthey would otherwise be. (Although we be-lieve that this change is for the better, thepoint is moot as long as we do not know theproportion of problems in fact due to eachbranch.) Perhaps the prime responsibilityof the discoverer of such effects is to ensurethat they receive the broadest possible dis-semination, so that both potential manipula-tors and the potentially manipulated areaware of them. It may turn out that wepsychologists are merely discovering "tricks"that manipulators have known about allalong. Such research can also suggest as-pects of presentation that may have rela-tively little effect on people's judgments(varying level of detail), attempted manipu-lations that can be readily overcome (pro-viding more detail for one branch), andmanipulations whose effects, although con-sistent, may be too small to have appliedimplications.

Aside from calling for obviously neededconstructive replications (different trees,different subjects, different experts, etc.),these results suggest a variety of questionsfor future study: Would credibility be astronger effect than availability if prunedfault trees were presented by distrustedtechnocrats rather than moderately trusted

344 B. FISCHHOFF, P. SLOVIC, AND S. LICHTENSTEIN

experimental psychologists? What happenswhen people construct their own fault trees ?What happens when the detailed items froma fault tree are listed but not organizedinto categories? What happens with treesdealing with more technical areas or withnontechnical areas for which the assessors'feelings of competence vary? What happenswhen minor rather than major items aredeleted? What if an omitted item is some-how brought to the subjects' attention (asoften happens in public debates) ? Whatindividual differences, if any, interact withthese aspects of presentation in affectingevaluations? (As mentioned, the obviouscovariate of years of experience was uncor-related with the mechanics' awareness of howmuch had been deleted from the prunedtree.) What if detail is manipulated not byadding facts but by adding flourishes, by"fleshing out" possible sources of troublewith vividly detailed scenarios describingjust how they might happen? Why weresubjects' perceptions of the overall startingfailure rate relatively impervious to our ma-nipulations? Was it merely a problem ofmeasurement ?

These studies have supported the notionthat availability affects frequency estimatesand have helped clarify how availabilitymechanisms work. Failure to mention a pos-sibility had a major effect, increasing thedetail of what was mentioned had a smalleffect, and the packaging of what is men-tioned also made a difference. Experiment 2showed, as did Beyth-Marom and Fischhoff(1977), that forcing people to work theirmemories (or imaginations) harder can im-prove their likelihood judgments somewhat.Clearly, much more work is needed on theretrieval, perception, and representation offrequency information.

Reference Note1. Bryan, W. B. Testimony before the Subcom-

mittee on State Energy Policy. Committee onPlanning, Land Use, and Energy, CaliforniaState Assembly, February 1974.

ReferencesAtomic Energy Commission. Reactor safety study:

An assessment of accident risks in U.S. com-mercial power plants (WASH-1400). Washing-ton, D.C.: Author, 1975.

Barrager, S. M., Judd, B. R., & North, D. W.The economic and social costs of coal and nu-clear electric generation. Washington, D.C.: Na-tional Science Foundation, 1976.

Beyth-Marom, R., & Fischhoff, B. Direct mea-sures of availability and judgments of categoryfrequency. Bulletin of the Psychonomic Society,1977, 9, 236-238.

Birnbaum, M. H., Wong, R., & Wong, L. K.Combining information from sources that varyin credibility. Memory & Cognition, 1976, 4,330-336.

Casper, B. M. Technology policy and democracy.Science, 1976, 194, 29-35.

Fischhoff, B. Cost benefit analysis and the art ofmotorcycle maintenance. Policy Sciences, 1977,8, 177-202.

Green, A. E., & Bourne, A. J. Reliability tech-nology. New York: Wiley-Interscience, 1972.

Howell, W. C. Representation of frequency inmemory. Psychological Bulletin, 1973, 80, 44-53.

Kendall, H. W. Nuclear power risks: A reviewof report of APS society's study group on lightwater reactor safety. Cambridge, Mass.: Unionof Concerned Scientists, 1975.

Newell, A., & Simon, H. A. Human problemsolving. Englewood Cliffs, NJ.: Prentice-Hall,1972.

Settle, R. B., & Golden, L. L. Attribution theoryand advertiser credibility. Journal of MarketingResearch, 1974, 11, 181-185.

Slovic, P., Fischhoff, B., & Lichtenstein, S. Cog-nitive processes and societal risk taking. In J.S. Carroll & J. W. Payne (Eds.), Cognition andsocial behavior. Potomac, Md.: Erlbaum, 1976.

Tversky, A., & Kahneman, D. Availability: Aheuristic for judging frequency and probability.Cognitive Psychology, 1973, 4, 207-232.

Received June 2, 1977 •