System reliability and reliability block diagrams

The formula

A reliability block diagram is a success-path picture: each block is a function the system needs, and the system works if an unbroken path of working blocks runs from input to output. Two arrangements generate everything else.

Series — every block must work:

R_sys = R₁ · R₂ · … · Rₙ

Reading: reliabilities in series multiply, so the system is always worse than its worst component — every block you add takes a bite.

Parallel (active redundancy) — at least one block must work:

R_sys = 1 − (1 − R₁)·(1 − R₂)·…·(1 − Rₙ)

Reading: in parallel it's the failure probabilities that multiply. The system dies only if everything dies, so unreliabilities shrink geometrically.

k-out-of-n — at least k of n identical units must work (voters, pump banks, array elements):

R_sys = Σ_{i=k}^{n} C(n,i) · Rⁱ · (1−R)^(n−i)

Reading: a straight binomial count over the ways enough units survive. The workhorse case, two-of-three, collapses to R_sys = 3R² − 2R³.

With the constant-failure-rate (exponential) model that underlies most predictions:

R(t) = e^(−λ·t)        λ_series = λ₁ + λ₂ + … + λₙ        MTBF = 1/λ

Reading: under exponential lives, series reliability math turns into simple addition of failure rates — which is why prediction rollups are spreadsheets, not integrals.

Where you meet it

Reliability allocation at PDR. The spec says mission reliability 0.96. Somebody has to split that across power, avionics, propulsion, and software so each IPT gets a budget it can be held to. Allocation is the series formula run backwards, and the argument over who gets the loose allocation is the actual meeting.
The prediction rollup before the review board. A parts-count prediction sums MIL-HDBK-217-style failure rates down the BOM, converts to MTBF, and lands in a chart the customer reads as a promise. Knowing that series λ values simply add is the difference between checking that chart and believing it.
Redundant power on the test stand. Two supplies diode-OR'd into the DAQ bus is a parallel block — but the ORing diodes, the shared breaker, and the changeover logic are series elements, and they quietly cap what the redundancy can buy you.
Trade studies on architecture. One good unit at R = 0.9, two in parallel at 1 − 0.1² = 0.99, or two-of-three voting at 0.972? The RBD is how you price redundancy against weight, cost, and the voter you just added to the series chain.

How it works

The series formula is the brutal one, because it punishes part count no matter how good the parts are. Forty items in series at R = 0.999 each gives 0.999⁴⁰ ≈ 0.961 — you've spent almost your entire 0.96 system budget on parts that are individually 99.9% reliable. Ten mediocre items at 0.98 gives 0.98¹⁰ ≈ 0.817, which is how a cabinet of decent boxes becomes a bad system. This is the arithmetic behind every parts-reduction directive you've ever been handed.

Parallel math runs the other way: two units at 0.95 give 1 − 0.05² = 0.9975. Adding a redundant channel attacks the unreliability, so the first redundant unit is worth a lot and the third is worth almost nothing — the curve of diminishing returns is built into the exponent.

The rules that make the answer honest:

Blocks are functions, not boxes. The RBD follows the functional dependency, not the wiring harness or the rack layout. One physical unit can appear as several blocks; two chassis can be one block. Draw the diagram from the question "what has to work for the mission to succeed," not from the interconnect drawing.
Independence is the load-bearing assumption. The multiplication in both formulas requires component failures to be statistically independent ^[1]^[2]. Redundant units that share a power bus, a cooling loop, a firmware image, a connector, or a parts lot do not fail independently, and common-cause failure is where paper redundancy goes to die. The honest fix is to draw the shared element as its own series block — and then notice that it dominates the answer.
The switch is in series with the miracle. A standby channel needs a detection-and-switchover mechanism; a two-of-three scheme needs a voter. Those elements sit in series with the whole redundant group, and their reliability multiplies everything the redundancy earned. A 0.99 voter in front of a 0.9999 triplex is a 0.99 system.
Same mission time everywhere. R is a function of time. Multiplying one component's 1,000-hour reliability by another's 100-hour reliability produces a number with no meaning. Fix the mission time first; evaluate every block at that time; then combine.

Two MTBF traps worth naming. First, paralleling two identical exponential units does not double the mean life: integrate the parallel survival curve and you get MTTF = 3/(2λ) — a 1.5× improvement, not 2× — because most of the time both units are aging together. Second, MTBF is not a lifetime. A 10,000-hour MTBF under the exponential model means R(10,000 h) = e^(−1) ≈ 0.37; nearly two-thirds of units fail before reaching their MTBF. Quoting MTBF as "how long it lasts" at a review board is a mistake with a long half-life.

Limits of validity: the closed-form algebra above assumes a non-repairable mission — blocks fail and stay failed. Once repair, standby spares with imperfect switching, or shared repair crews enter the picture, you need availability math and Markov or simulation models; the RBD standard covers these extensions as dynamic RBDs ^[3]. And the RBD is the optimist's diagram — it models the success paths you drew. Its pessimist twin, the fault tree, starts from the failure and works down, and a real program runs both because each catches what the other misses ^[1].

History

The math was born from embarrassment. In wartime Germany, the first V-1 flying bombs failed in droves even though every component had passed inspection — the going intuition, that a system is like a chain no stronger than its weakest link, kept predicting success that the launch records refused to deliver ^[4]. The analysis that came out of the missile program replaced the weakest-link picture with the product law: the mathematician Erich Pieruschka supplied the argument that survival probabilities of independent elements multiply, and the resulting series formula became attached to the name of Robert Lusser, the Fieseler engineer who led the V-1's design and championed the idea relentlessly ^[2]^[4]^[5]^[10]. The Defense Department's own reliability handbook calls this "probably the first reliability model" ^[5].

The Huntsville connection is direct. Lusser came to the United States after the war and in 1953 joined von Braun's rocket team at Redstone Arsenal, where he spent six years turning wartime hard lessons into a discipline ^[6]^[7]. His 1957 Redstone report Predicting Reliability traced 60 percent of one Army missile system's failures to components and argued that inspection-based quality methods could not produce reliable missiles — a founding document of the field, written a few miles from Gate 9 ^[8]^[9].

The institutions followed. The Pentagon stood up the Advisory Group on Reliability of Electronic Equipment (AGREE) starting from a 1950 study group, and its 1957 report Reliability of Military Electronic Equipment gave the discipline its standard definition — reliability as a probability of performing a function, under stated conditions, for a stated time — plus the demonstration-testing regime that became MIL-STD-781 ^[8]^[11]^[12]. The mathematics got its rigorous footing in 1961, when Z. W. Birnbaum, J. D. Esary, and S. C. Saunders published the theory of multi-component structures in Technometrics, formalizing k-out-of-n systems and the coherent-structure framework that underlies every RBD tool ^[13]. Richard Barlow and Frank Proschan's Mathematical Theory of Reliability (1965) consolidated the field into the reference it still leans on ^[14]^[15]. Today the diagrams themselves are standardized in IEC 61078 ^[3].

Related tools

/tools/bearing-life-l10 — component-level life math (Weibull, not exponential) that feeds the block values an RBD consumes
/tools/half-life-decay — the same exponential-decay arithmetic as R(t) = e^(−λt), wearing a different unit
/tools/battery-life — mission-duration math that sets the t your reliability numbers must be evaluated at
/tools/friis-cascade — the RF cousin: chaining per-stage specs into one system number, with the first element dominating

Sources

Written by HE in our own words from the cited sources — engineering judgment included, your stamp still required. All entries →