Everything quantitative in reliability engineering rests on one idea: treat time to failure as a random variable. A single unit's failure time cannot be predicted, but a population's failure behaviour follows a distribution, and once that distribution is named, everything else (survival probabilities, failure rates, expected lives, warranty exposure, spares demand) is arithmetic on it. This chapter builds that machinery in the order a practitioner actually needs it: the four functions that describe failure, the point measures quoted in requirements, the distributions that model real hardware, and the physical pictures (bathtub, overstress versus wear-out, load versus strength) that tell you which mathematics applies.
The four functions of failure
Let T be the time to failure of an item. Four equivalent functions describe it, and fluency in moving between them is the core skill of the discipline:
- The reliability function R(t) = P(T > t): the probability of surviving beyond t. It starts at 1 and can only fall.
- The cumulative distribution F(t) = P(T ≤ t) = 1 − R(t): the fraction of the population failed by t.
- The density f(t) = dF/dt: where on the time axis failures concentrate.
- The hazard rate h(t) = f(t)/R(t): the instantaneous failure rate among survivors. This is the conditional view: given that the item has lived to t, how likely is it to fail in the next instant?
The hazard deserves the emphasis it gets, because it is the function with physical meaning. A decreasing hazard says the population is being purged of weak units; a constant hazard says failures arrive at random with no memory; an increasing hazard says something is being consumed: material, lubricant, insulation, life. Integrating the hazard gives the cumulative hazard H(t) = ∫h(u)du, and the single most useful identity in the subject:
R(t) = e^(−H(t))
Every named life distribution is just a choice of hazard shape pushed through this identity. From R(t) also comes the mean life of a non-repairable item, MTTF = ∫R(t)dt over all time: the area under the survival curve.
Point measures and their units
Requirements and datasheets compress the functions above into single numbers. Each is legitimate; each also loses information, and most reliability misunderstandings start with a point measure quoted outside its context.
| Measure | What it is | Unit conventions | The trap |
|---|---|---|---|
| Failure rate λ | Hazard rate, usually assumed constant | failures per 10⁶ h; FIT = failures per 10⁹ device-hours | Only meaningful while the constant-rate assumption holds |
| MTBF | Mean time between failures of a repairable item | hours | Not a life; not a guarantee; ~63% of an exponential population fails before it |
| MTTF | Mean time to failure of a non-repairable item | hours | Averages hide shape: two very different distributions can share an MTTF |
| B₁₀ life | Time by which 10% of the population has failed (B₅, B₁ likewise) | hours, cycles, km | Says nothing about the other 90% without the distribution |
| Mission reliability R(t_m) | Probability of completing a mission of length t_m | dimensionless | Meaningless without the mission profile attached |
| MTTR | Mean time to repair: a maintainability measure | hours | Belongs in the availability equation, not the reliability one |
Three of these repay a closer look. MTBF versus MTTF is not pedantry: the classic definitions (MIL-STD-721C) reserve MTBF for repairable items and MTTF for non-repairable ones, and quoting an MTBF for a one-shot or throwaway item is a category error that usually signals a copied number. FIT arithmetic is a unit convention worth internalising: 1 FIT is one failure per 10⁹ device-hours, so a component at 100 FIT has λ = 10⁻⁷ per hour and an MTBF (if constant-rate and repairable) of 10⁷ hours. And the MTBF-is-not-a-lifetime trap is the industry's most persistent: an electronic unit with a 200,000-hour MTBF is not expected to last 23 years; it is expected to fail at a rate of one per 200,000 unit-hours while it is within its useful life, which may be a tenth of that. The rate describes the plateau of the bathtub curve, not the length of the tub.
Percentile lives (B-lives) are often the more honest requirement currency, especially for wear-out-driven hardware: "B₁₀ ≥ 15,000 hours" pins the early tail of the distribution, which is what warranty exposure and safety cases actually care about, in a way no mean ever can.
Life distributions
Four continuous distributions and two discrete ones cover almost all practical reliability work:
| Distribution | Parameters | Hazard behaviour | Where it earns its keep |
|---|---|---|---|
| Exponential | λ | Constant (the only distribution with this property) | Useful-life electronics; systems whose failures are externally driven; the default of the prediction handbooks |
| Weibull | shape β, scale η | Falling (β < 1), constant (β = 1), rising (β > 1) | The general-purpose life model; β diagnoses the failure regime, η is the characteristic life |
| Lognormal | μ, σ | Rises then falls | Degradation processes that multiply (fatigue crack growth, corrosion, some semiconductor mechanisms); also repair times |
| Normal | μ, σ | Rising | Tightly clustered wear-out (filament life, some mechanical wear); strength and load scatter in interference models |
| Binomial | n, p | per-demand | One-shot devices: the probability of k successes in n firings |
| Poisson | λt | per-interval | Counts of failures in a fixed exposure; the arithmetic behind spares provisioning and standby redundancy |
The exponential distribution, R(t) = e^(−λt), dominates the field's history because of its memoryless property: a survivor is statistically as good as new, so the failure rate of a fleet is constant regardless of age mix. That single assumption makes system arithmetic linear (rates add), which is why the prediction handbooks and most availability models run on it. It is an assumption to be earned, not presumed: it holds well for complex electronics in their useful life and fails badly for anything that wears.
The Weibull distribution, R(t) = e^(−(t/η)^β), is the practitioner's workhorse precisely because it does not presume. The shape parameter β is a regime diagnosis read straight from data: β < 1 flags infant mortality (improve the process or screen), β ≈ 1 flags randomness (add margin or redundancy; preventive replacement is useless), β > 1 flags wear-out (schedule replacement before the hazard climbs). The scale parameter η, the characteristic life, is the time by which 63.2% of the population has failed (set t = η and R = e⁻¹ regardless of β). At β = 1 the Weibull collapses exactly to the exponential with η = 1/λ. Fitting β and η from test or field data is the subject of life data analysis, and the fitted parameters are what the design-side analyses should be fed.
One-shot devices (squibs, fuzes, airbag igniters, deployment mechanisms) break the time-based frame entirely: their reliability is a probability per demand, estimated from binomial trials, and their "life" question (does storage age degrade the per-demand probability?) is a separate, sampled-surveillance problem.
The bathtub curve and its limits
Plot the hazard rate of a large, mixed population of hardware over its whole life and the classic shape appears: a falling early region, a long flat middle, a rising tail.
| Region | Hazard | Dominant causes | Effective countermeasures |
|---|---|---|---|
| Early failures (infant mortality) | Falling | Manufacturing defects, workmanship escapes, damaged parts, installation errors | Process control, inspection, environmental stress screening |
| Useful life | Roughly constant | Residual defects and externally induced events (transients, mishandling, environment) | Margin, derating, protection, redundancy |
| Wear-out | Rising | Fatigue, wear, corrosion, insulation ageing, electromigration | Preventive replacement, life-limiting, redesign of the weak mechanism |
The curve is genuinely useful as a vocabulary: it names the three hazard regimes, maps them onto Weibull β ranges, and explains why the countermeasure must match the regime (screening does nothing for wear-out; preventive replacement does nothing for random failures). But treat it as a composite picture of a population, not a law of nature for a device. Individual failure mechanisms follow their own single-regime hazards, and the published critique of the model (Klutke and colleagues' "critical look" in the IEEE Transactions on Reliability) shows that real populations rarely trace the idealised tub; in particular, the early-life hazard of well-made products is often not decreasing at all, which undercuts naive burn-in justifications. The practical reading: use the bathtub to ask which regime each mechanism of your design lives in, and demand data (a fitted β, a screening fallout trend) before spending money on regime-specific countermeasures.
Overstress and wear-out
Beneath the statistics, hardware fails for physical reasons, and nearly all of them sort into two classes. Overstress failures happen when an applied load exceeds the item's strength at that moment: electrical transient over a junction's rating, mechanical shock past a bracket's yield, thermal excursion past a material limit. They are sudden, and their statistics follow the loads: if extreme loads arrive at random, overstress failures inherit a roughly constant hazard. Wear-out failures happen when strength degrades below the routine load: fatigue accumulates cycle by cycle, corrosion thins a section, electromigration voids a conductor, insulation ages, contacts wear. They are progressive, and their statistics show rising hazards and finite lives.
| Class | Mechanism examples | Statistical signature | Design lever |
|---|---|---|---|
| Overstress | Dielectric breakdown from transients, ESD damage, fracture under shock, thermal runaway | Hazard tracks the load environment; often β ≈ 1 | Margin: derating, protection circuits, load isolation |
| Wear-out | Fatigue, wear, corrosion, creep, electromigration, solder-joint thermal fatigue, battery ageing | Rising hazard, β > 1, finite characteristic life | Slow the mechanism (stress, temperature), or life-limit and replace |
The class distinction is what connects the physics to the mathematics: it tells you which distribution to expect before any data exist, and it tells you which design lever can work. It is also the intellectual basis of physics-of-failure practice, which models the dominant mechanism directly (a fatigue law, an electromigration model, an ageing model) instead of wrapping everything in one generic rate. The prediction topic's foundations chapter covers where handbook rates and physics-of-failure models each belong.
Load, strength, and margin
Why does one design fail at ten times the rate of another built to the same nominal stress ratio? The interference picture answers it. Treat the applied load L and the item's strength S as random variables: load varies with usage, environment, and events; strength varies with materials, tolerances, and manufacturing. Failure occurs when L > S, and the failure probability is governed by the overlap of the two distributions.
For normally distributed load and strength, the standard result condenses the overlap into a single number, the safety margin:
SM = (μS − μL) / √(σS² + σL²)
the separation of the means measured in units of the combined scatter. Reliability per load application is Φ(SM), the standard normal probability below that margin. The insight worth carrying is that variance is as important as mean: widening the gap between mean strength and mean load helps, but so does narrowing either distribution, and a traditional safety factor (ratio of nominal strength to nominal load) is blind to the scatter entirely. Two lessons follow directly. First, derating works because it shifts μL down wholesale, buying margin against the whole load distribution at the cost of using a bigger part. Second, quality control works on reliability through σS: tightening process variation narrows the strength distribution and pulls the weak tail out of the interference zone. Wear-out joins this picture as strength degradation: S drifts downward with age, the overlap grows, and the hazard rises, which is exactly the β > 1 signature seen in the data.
Estimating from data
Everything above assumed the distribution was known. In practice it is estimated, from test or field data, and the estimate carries uncertainty that honest engineering must quote.
For constant-rate items the machinery is compact. Observe r failures in T accumulated unit-hours and the point estimate is λ̂ = r/T. Its uncertainty comes from the chi-square distribution: for a time-truncated observation, the upper confidence bound on the rate at confidence level C is
λ_upper = χ²(C; 2r + 2) / 2T
with the matching lower bound on MTBF being 2T/χ². A worked instance shows why the bound matters more than the estimate. Suppose a fleet accumulates 100,000 hours with 5 failures: λ̂ = 50 failures per 10⁶ hours, MTBF estimate 20,000 hours. At 90% confidence, χ²(0.90; 12) = 18.55, so λ could be as high as 92.7 per 10⁶ hours and the demonstrated MTBF is only 10,780 hours: barely half the point estimate. Requirements phrased as "demonstrate 20,000 h MTBF at 90% confidence" are therefore asking for far more test time than 20,000 hours, which is the arithmetic behind every reliability demonstration test plan.
The zero-failure special case is the success-run formula. To demonstrate reliability R per mission at confidence C with no failures allowed, the required number of independent trials is
n = ln(1 − C) / ln(R)
which prices out demonstration testing brutally fast: showing 99% mission reliability at 90% confidence takes 230 failure-free trials, and every "nine" added to R multiplies the bill by roughly ten. This single formula explains much of reliability programme design: pure end-of-programme demonstration is unaffordable for high targets, so real programmes buy their evidence earlier and cheaper, through analysis, margin, growth testing, and field surveillance instead.
Field and test data rarely come clean: most units are still alive when the analysis runs (right-censored), some fail between inspections (interval-censored). Estimation that ignores censoring is biased, always optimistically on the failed units and pessimistically on the fleet. The full treatment (median-rank plotting, maximum likelihood, confidence bounds on Weibull parameters) belongs to life data analysis, and the short rule here is: never fit a life distribution to failure times alone while discarding the survivors, because the survivors are most of the information.