Worked Example

Consider a wayside interlocking controller for a light-rail depot: the trackside electronics that reads the axle counters, computes the route locking, holds the signals in a safe state and reports to the control centre. It is deliberately not the level-crossing controller the industry examples carry, which is a different machine with its own rates. The procurement contract sets its reliability target: MTBF ≥ 20,000 hours. Four subsystems, four different design owners, and no detailed design yet. Every number below is an illustrative teaching value; the arithmetic is the method's.

The target converts to the working currency first: λ* = 10⁶ / 20,000 = 50 failures per 10⁶ hours of rate budget to distribute.

Level 1: feasibility of objectives

At this stage nothing exists but the architecture and engineering judgement, so the level-1 split uses feasibility-of-objectives ratings, scored 1–10 against written ground rules and reconciled between two senior engineers:

Reading the ratings: the depot runs a long service day and stands its cabinets down overnight, so performance time scores 8 across the board rather than the anchor sheet's 10 for equipment that never stops, including standby between missions; the interlocking unit is the most intricate and least proven (8 and 6); the power module is simple mature technology but the most exposed (environment 9); and the gateway sits in the middle on everything. The multiplication does the rest: the two hard subsystems claim two-thirds of the failure allowance between them, and the simple, exposed power module is asked to be the most reliable single element, 152,500 hours, precisely because nothing about it justifies a large share of the budget.

Two reading conventions hold for every table below. First, a rate and its MTBF are reciprocals of a single unrounded allocated value, each rounded once for display, so recomputing either column from the other can land a hundred hours away from the figure shown. Second, each level divides its parent's budget as printed one level up, not the parent's unrounded value: level 2 splits B's stated 17.49, so its MTBFs are reciprocals of that, and rebuilding them from B's raw weight of 1,536 instead lands a hundred hours off in every row. Working from the stated parent is what keeps a child level's own Σ row closing exactly on the number the reader can see.

Level 2: ARINC inside the interlocking unit

A month later the interlocking logic unit has a preliminary parts list, and its owner runs an early parts-count prediction over its three assemblies: processor card 6.0, I/O card 9.0, power supply 7.5: 22.5 f/10⁶ h predicted against a budget of 17.49. The unit is 29% over budget before detailed design has begun; the allocation now decides how that pain is distributed. ARINC shares it in proportion to today's estimates:

The last column is ARINC's signature: every assembly is asked for the same 22% rate reduction, because the method preserves relative standing by construction. Whether that is fair is an engineering conversation (perhaps the I/O card has easy derating wins and should absorb more), and that conversation is exactly what the table exists to trigger. Its output, whatever is negotiated, re-enters as a weighted-factor split.

An AGREE view of the gateway

The communications gateway's internals differ in a way ratings cannot see: duty cycles and criticality. Its radio module runs whenever the system runs; its fallback cellular path is energised rarely; and losing the fallback alone does not take the system down. That is AGREE territory. Over a 730-hour reporting month, with the gateway's own budget (61,000 h) as the goal: −ln R* = 730 / 61,000 = 0.011967. The three units hold 40, 15 and 5 modules, so N = 60.

One substitution, the radio module, and the rest follow the same pattern:

θradio = (60 × 1.0 × 730) / (40 × 0.011967) = 43,800 / 0.47868 = 91,500 h

The fallback path returns 26,740 h and the antenna interface 732,000 h from the same substitution, carried above rounded to the nearest hundred hours as every figure in this example is. The last column discounts each rate by the unit's importance and its duty fraction, wᵢ × (tᵢ / 730), and the next section is about why that column exists.

The pattern is the method's teaching, and it runs opposite to the instinct that says the important box gets the hard target. The forty-module radio is always on and indispensable, and it is allowed 91,500 hours: eight times looser than the five-module antenna interface, which runs at identical duty and identical importance and is held to 732,000 hours. Eight times fewer modules, eight times tighter, with nothing else in the closed form moving, because a unit's claim on the gateway's unreliability allowance is one slice per module and the antenna has five of them. The fallback path is looser than either at 26,700 hours, and its two discounts are why: energised for 200 hours of the 730, and taking the system down in only two failures out of five. Note the two columns nothing else in the family can read: no other method here saw the fallback path's 200 hours or its 0.4 at all.

The rows do not sum to the gateway's budget, and should not

Invert the three targets and the level looks broken. As rates the units carry 10.93 + 37.40 + 1.37 = 49.70 per 10⁶ h against the gateway's own budget of 16.39: run the conservation check the results chapter prescribes, children summing exactly to the parent, and this level fails it three times over.

It fails because AGREE conserves the duty-weighted, importance-weighted contribution to mission failure rather than raw hardware rate. Discount each unit's rate by its importance and its duty fraction and the level closes on the parent:

10.93 + 0.4 × 0.274 × 37.40 + 1.37 = 10.93 + 4.10 + 1.37 = 16.40 per 10⁶ h

against 16.39 allocated at level 1, the last digit being the rounding in the MTBFs above. The radio and the antenna are undiscounted because both run the full 730 hours at importance 1; only the fallback path, at 0.4 × (200 / 730) = 0.110, contributes a tenth of what its hardware rate suggests. Per module the three contributions are the same slice: 10.93 / 40 = 0.273, 4.10 / 15 = 0.273 and 1.37 / 5 = 0.274 per 10⁶ h, against the closed form's (−ln R*) / (N · t) = 0.011967 / 43,800 = 2.73 × 10⁻⁷ per hour, which is 0.273 per 10⁶ h per module.

Two things follow for anyone auditing the tree. A reviewer or a script that rate-sums an AGREE level will report a 3× overrun that is not there, so the weighted column belongs in the deliverable alongside the wᵢ and tᵢ that produce it. And where an AGREE level hangs under a parent that was split on raw rates, as this one hangs under the level-1 feasibility-of-objectives table, the currency changes at the boundary: what subsystem D owns upward is 16.39 of mission-relevant rate, not the 49.70 of hardware rate its units carry downward. That leaves the level-1 table mixed, three raw-rate lines and one mission line, which is only honest while the gateway's hardware rate carries a basic-budget line of its own; the method chapter is where the two budgets are kept apart, and step 1's clause forensics has to settle which of them the 20,000-hour contract meant.

The feasibility check bites

The budgets now meet reality. Fleet history for the depot cabinet's own power supplies, a lighter-duty unit than the lineside supply the crossing example books at 300 per 10⁶ h, shows demonstrated MTBFs around 90,000 hours, and subsystem C's allocated 152,500 hours sits far beyond anything the technology has shown. The budget is infeasible not because C is weak but because the ratings gave it too small a share of the failure allowance. The rebalance shifts allowance from the gateway, which vendor data shows is comfortably placed:

Downstream numbers move with it: the gateway's rate allowance falls from 16.39 to 11.95 f/10⁶ h, an MTBF budget of 83,700 hours, and because every AGREE target is proportional to its parent's MTBF goal, all three sub-targets tighten by the same factor 83,700 / 61,000 = 1.372 when the level is re-run. That is not churn; it is the point: an allocation is a living negotiation between the target and the evidence, and every re-run leaves the tree more honest than it found it.