MTBF and MTTF

The formula

The point estimate, which is all most reports contain:

MTBF = T / r

Reading: total unit operating hours accumulated, divided by the number of failures observed. Run 50 units for 1,000 hours each and log 10 failures: 50,000 / 10 = 5,000 h.

Under the constant-failure-rate assumption the whole subject reduces to one parameter ^[1]^[2]:

λ = 1/MTBF R(t) = e^(−λt) = e^(−t/MTBF)

Reading: failure rate is the reciprocal of MTBF, and reliability — the probability of running to time t without failure — decays exponentially. Set t = MTBF and R = e^(−1) ≈ 0.368: only 36.8% of units survive to their own MTBF. The other 63.2% have already failed. MTBF is a mean, not a warranty.

The FIT rate, the semiconductor world's unit for the same quantity ^[2]:

λ [FIT] = failures per 10⁹ device-hours MTBF [h] = 10⁹ / λ[FIT]

Reading: a part rated 500 FIT has an MTBF of 2,000,000 hours. Same number, different clothes.

Series systems add failure rates, not MTBFs ^[6]:

λ_sys = λ₁ + λ₂ + … + λ_n MTBF_sys = 1 / (1/MTBF₁ + 1/MTBF₂ + …)

Reading: a board with 200 parts at 5 FIT each carries 1,000 FIT — a system MTBF of one million hours from parts individually rated at 200 million. This is Lusser's product law wearing exponential notation: the system is weaker than its weakest link suggests.

The demonstrated (lower confidence bound) MTBF from a time-terminated test ^[3]:

MTBF_lower = 2T / χ²(conf; 2r+2)

Reading: twice the total test time, divided by a chi-square value at your confidence level with 2r+2 degrees of freedom. This is the number a customer can hold you to; the point estimate is not.

And the definitional split: MTTF is the mean life of a non-repairable item — a fuse, a bearing, a one-shot pyro. MTBF applies to repairable systems ^[14], and under one common convention runs failure-to-failure with the clock never stopping, so MTBF = MTTF + MTTR ^[15]. Other standards — including the definition in this entry's opening line — count operating (up) time only, which makes MTBF ≈ MTTF for a repairable system ^[14]. Repair time is usually negligible against operating time, so the two conventions agree in practice and the terms get swapped freely — until a spares-provisioning or availability model cares about the difference.

Where you meet it

The proposal. The RFP says "predicted MTBF shall exceed 10,000 hours." Someone builds a parts-count prediction — every component's base failure rate, multiplied by quality and environment factors, summed — out of MIL-HDBK-217F or Telcordia SR-332. That rollup becomes contractual before the first board is fabbed.
The test stand. A reliability demonstration test: units on the stand accumulating hours while the program waits. The chi-square formula above sets the exchange rate between test hours, allowed failures, and the MTBF you can claim. It is brutal at high confidence — see below.
The review board. Field returns are running ahead of prediction, and the board wants to know whether the 217 number was wrong or the environment factor was optimistic. (Both.) This meeting is where the difference between predicted, demonstrated, and observed MTBF stops being pedantry.
The datasheet. Component FIT rates at a stated junction temperature and confidence level, feeding derating analysis and the system reliability budget. A FIT quoted at 55 °C does not transfer to a sealed box in the Alabama sun without an Arrhenius correction.

How it works

Everything above leans on one assumption: the failure rate is constant over time. That is the flat bottom of the bathtub curve — after infant mortality has been burned in and before wear-out begins ^[1]^[2]. Inside that window, the exponential model is memoryless: a unit with 10,000 hours on it is statistically identical to a fresh one. Outside that window — early solder-joint escapes on the left, bearing and capacitor wear-out on the right — the constant-rate math is simply wrong, and Weibull or lognormal models take over.

The signature misuse follows directly. A disk drive rated at 2,000,000 hours MTBF is not promising 228 years of service. It is claiming that during its stated service life — perhaps five years — the population fails at λ = 0.5 failures per million hours, about 0.44% per year. Over a five-year continuous mission (43,800 h), the failure probability is 1 − e^(−43,800/2,000,000) ≈ 2.2%. Both statements come from the same number; only one is what the manufacturer meant. Reading MTBF as lifetime is the single most common reliability error in trade studies, and it is not a small one — it is off by the ratio of MTBF to service life, often a factor of fifty.

The second trap is quoting the point estimate as if it were demonstrated. Take a time-terminated test with T = 10,000 unit-hours and 2 failures. Point estimate: 5,000 h. The one-sided 90% lower bound is 2·10,000 / χ²(0.90; 6) = 20,000 / 10.645 ≈ 1,879 h ^[3]. The number you can defend is 38% of the number in the viewgraph. At 95% it drops to about 1,588 h.

Zero failures does not mean infinite MTBF, and the same formula handles it with 2r+2 = 2 degrees of freedom: with no failures in T unit-hours, the 90% lower bound is 2T / 4.605 ≈ T/2.30. Flip it around for test planning: demonstrating an MTBF of M at 90% confidence with zero failures allowed costs 2.30·M unit-hours on the stand. To demonstrate 10,000 hours, budget 23,000 unit-hours — and one failure resets the arithmetic, not the requirement.

Other edges that cut:

Predictions are comparison tools, not measurements. Handbook rollups exist to compare architectures and flag weak parts, and the handbooks say so. MIL-HDBK-217F Notice 2 has been frozen since 1995 ^[12]^[13]; its part models predate most components on a modern board. Treating its output as a field-failure forecast is how a prediction misses by 10×.
Summing FITs assumes independence. One shared cooling fan, one common power rail, one connector that takes out three channels — common-cause failures break the series formula in the optimistic direction.
Repairable-system data has order. T/r throws away the failure timestamps. If interarrival times are shrinking, the system is deteriorating and no single MTBF describes it; plot the cumulative failures before you average them.
State the confidence, the environment, and the clock. "MTBF 50,000 hours" is not a claim until it says predicted-or-demonstrated, at what confidence, in what environment, and whether the hours are operating, power-on, or calendar. Two vendors quoting the same number under different conventions can differ by an order of magnitude in the field.

History

The mathematics is wartime German, but it grew up in Huntsville. During the war Robert Lusser — an aircraft designer who had worked on the V-1 flying bomb program at Fieseler — confronted the fact that missiles built from individually high-quality parts kept failing anyway ^[4]^[5]. His analysis produced the product law of series components now called Lusser's law: system reliability is the product of component reliabilities, so a thousand parts at 99.9% each yield a system near 37% ^[5]^[6]. High-grade parts in large numbers are not a reliable system. In 1953 Lusser joined von Braun's team at Redstone Arsenal, where he spent six years as a reliability voice for Army missile programs and published Predicting Reliability out of Huntsville in 1957 ^[4]^[7].

The statistics arrived in parallel. In 1953, Benjamin Epstein and Milton Sobel published "Life Testing" in the Journal of the American Statistical Association, working out estimation and test plans for exponentially distributed lifetimes — the paper that made the exponential distribution the workhorse of reliability and put the chi-square bounds above on a rigorous footing ^[8]^[9]. In 1957 the Department of Defense's Advisory Group on Reliability of Electronic Equipment — AGREE, convened after studies showed vacuum-tube electronics spending shocking fractions of their lives in repair — issued the report that made reliability a specified, tested, contractual quantity ^[10]^[11]. The prediction handbook followed: MIL-HDBK-217, first issued in 1961, standardized the parts-count and part-stress methods that generations of proposals have leaned on since ^[12]^[13]. Its final revision, 217F Notice 2, landed in 1995 and has not been updated — a fact worth remembering every time its output shows up in a compliance matrix ^[12]^[13].

Related tools

/tools/bearing-life-l10 — the wear-out end of the bathtub curve, where MTBF math stops applying and Weibull-based life ratings take over.
/tools/arrhenius-rate — the temperature-acceleration model behind translating a datasheet FIT at 55 °C to your actual box temperature.
/tools/half-life-decay — the same exponential decay law; half-life is ln(2)·MTBF in reliability clothing.
/tools/battery-life — service-life estimation, the quantity engineers actually want when they mistakenly reach for MTBF.

Sources

Written by HE in our own words from the cited sources — engineering judgment included, your stamp still required. All entries →