Everything an RBD computes follows from one object. Give each of the n blocks an indicator xᵢ that is 1 when the block works and 0 when it does not, and the diagram defines a structure function φ(x) that returns 1 when the system works. The function is coherent: repairing a block never breaks the system, and every block matters somewhere. Reliability is then the expectation of that function, R = E[φ(x)], and every formula below is a way of evaluating that expectation without enumerating 2ⁿ states.
Two standing assumptions come with it, and both are load-bearing. Blocks fail independently, so probabilities multiply. And each block is characterised by a probability of surviving the mission, Rᵢ = P(block i works throughout t), which for a constant-rate item is e^(−λᵢt) but need not be: a Weibull block, a demand-based probability of failure on demand, or a number from a test all sit in a diagram equally well.
The four structures that compose
Series. Every block is required, so R = Π Rᵢ. Under constant rates this is the only structure in which failure rates add, λsys = Σ λᵢ, and it is the structure a parts-count prediction assumes for the whole system. A series chain is always worse than its worst block, and adding a block can only make it worse.
Active parallel. Any one path carries the function, all of them running: R = 1 − Π(1 − Rᵢ). For two identical blocks R = 2R₁ − R₁². The system's failure rate is not constant even when both blocks' rates are, which is the first place intuition breaks: a redundant pair ages, in the sense that the loss of the first unit changes the system's future, and no single λ describes it.
k-out-of-n. k of the n branches are required. For identical blocks:
Rkoon = Σ C(n,i) · Rⁱ · (1 − R)ⁿ⁻ⁱ for i = k … n
The 2-out-of-3 vote is the common case, R = 3R² − 2R³. Note where it sits: better than a single block while R > 0.5 and worse for every hour after that, the two curves crossing exactly at t = ln2 / λ. A voted group is a promise about a short mission, not about a long life, and quoting its MTTF hides that completely.
Standby. The spare is idle until a switch starts it. With a perfect switch and identical constant-rate units, the survival of the pair is the first two terms of a Poisson process:
R = e^(−λt) · (1 + λt)
and with a switch (or a detection, or a start) that succeeds with probability p:
R = e^(−λt) · (1 + p·λt)
The switch is the whole story. A cold spare with a perfect switch beats an active pair at every mission time; the same spare behind a 95 per cent start does not, and the worked example puts the break-even at p = 0.958. Warm standby sits between the two, the idle unit ageing at a reduced rate, and a diagram cannot represent it without leaving the boolean world.
What redundancy buys, and for how long
Mean time to failure is the integral of the survival curve, MTTF = ∫₀^∞ R(t) dt, and for the standard structures it has a closed form that is worth carrying in the head:
| Structure, identical units at rate λ | MTTF |
|---|---|
| One unit | 1/λ |
| Two in active parallel | 1.5/λ |
| Three in active parallel | 1.833/λ |
| Two in cold standby, perfect switch | 2/λ |
| Two in cold standby, switch probability p | (1 + p)/λ |
| 2-out-of-3 | 0.833/λ |
The last row is the one that surprises people: a 2oo3 vote has a shorter mean life than a single unit, because the second failure arrives long before the single unit's mean. It is nonetheless the right architecture for a short mission, where its reliability is much higher. Two measures, two rankings, and the mission is the one the contract cares about.
The structures that do not compose
Collapsing a diagram block by block only works while the structure is nested series and parallel groups. The bridge is the smallest counterexample: two trains with a cross-tie between them, five elements, no grouping that reproduces the logic. Three routes out, in ascending order of effort:
Pivotal decomposition. Condition on one element and the rest collapses. Conditioning on the cross-tie X:
R = RX · R(structure with X working) + (1 − RX) · R(structure with X failed)
With X working the two compressors are parallel and the two dryers are parallel, in series with each other. With X failed the two trains are independent paths in parallel. At the worked example's rates that is 0.9822 × 0.9914 + 0.0178 × 0.9852 = 0.991264, which is exact.
Path sets and cut sets. A minimal path set is a smallest group whose survival is sufficient; a minimal cut set is a smallest group whose failure is sufficient. The bridge has four of each, and they are not the same four:
| Minimal path sets | Minimal cut sets |
|---|---|
| C1·D1, C2·D2 | C1·C2, D1·D2 |
| C1·X·D2, C2·X·D1 | C1·X·D2, C2·X·D1 |
Both descriptions determine the structure completely, and both over-count if their terms are simply multiplied, because the sets overlap. The correction is inclusion-exclusion, which is exact and grows factorially, or the Esary-Proschan bounds, which are one line each:
Π over cut sets (1 − Π qᵢ) ≤ R ≤ 1 − Π over path sets (1 − Π Rᵢ)
For a system that mostly works these two bounds are wildly asymmetric. The cut bound multiplies quantities that are already small and lands 14 parts per million below the exact answer; the path bound multiplies quantities close to one and lands 8,458 above it. The lower bound is the useful one, and it is the reason large fault trees and large diagrams are evaluated on their cut sets rather than their paths.
Enumeration. Five elements is 32 states, which a machine evaluates instantly and exactly. This is what a tool does, and the reason the hand methods still matter is that they say which combinations carry the answer, which enumeration does not.
Where independence fails
The independence assumption is the model's weakest joint, and it fails in three distinct ways that need three distinct treatments.
| What is shared | What it does to the diagram |
|---|---|
| A common cause: one event fails several blocks at once (a contaminated batch, a shared calibration error, a flood) | Split each block's rate into an independent part and a shared part; the shared part is a new block in series with the whole group |
| A support service: power, cooling, control air, an operator | It is a real block. Draw it once, in series with everything that depends on it, rather than assuming it away |
| Load sharing: the survivor works harder after the first failure | Not representable. The block rates are no longer constant across the mission, and the group needs a Markov model |
The first has a standard treatment, the β-factor: a fraction β of a block's rate is attributed to causes that take the whole redundant group, leaving (1 − β)λ independent. A pair with β = 0.1 is not a pair for a tenth of its failures, and since the shared term is in series with the group, no amount of further redundancy touches it. The method chapter works the sensitivity through; the short version is that β is usually the largest single uncertainty in a redundant model and is almost never measured.
What the model cannot say
A block diagram is a statement about one mission, evaluated at one instant, with blocks that do not come back. Four things follow, and they are limits of the technique rather than of any tool:
- No repair. A failed block stays failed. Availability, which is about how quickly things return, needs a state model; a repairable redundant group belongs in a Markov formulation or a simulation, and the RBD's answer for it is a conservative floor.
- No sequence. "A fails then B" and "B fails then A" are the same state to a structure function. Where the order matters (a switch that must operate before the spare is loaded, a protection that must act before the damage) the logic is outside the boolean world.
- No phases, in one drawing. A mission with take-off, cruise and landing has three success criteria and therefore three diagrams, combined by multiplying the phase results for blocks that carry across.
- No modes. A block is up or down. A valve that fails open and a valve that fails shut sit on different paths, and only a FMECA can say which rate belongs in which block.