← All chapters Chapter 19

The Fault Tree in the Safety Case

The tree is not an input to the safety argument; it is its structure.

A safety case must be an argument of claims and evidence, not a list of documents that proves nothing. The claim structure branches exactly as the tree does — per function, per malfunction, per root cause, per measure — with the remaining cut sets as the itemized residual risk. Completeness must itself be claimed at every level, where the book's construction-backed guarantee is spent honestly.