MTBF: what the number says, and what it cannot tell you

One number, one definition

MTBF stands for mean time between failures. For repairable equipment, it is the total operating time of a population divided by the number of failures observed: a fleet that has accumulated 400,000 operating hours with 8 failures shows an MTBF of 50,000 hours. For items that are discarded rather than repaired, the same idea is called MTTF, mean time to failure.

Behind almost every published MTBF sits one assumption: the failure rate is constant. Failures are then random events, spread evenly in time, and the probability that a unit is still working after a time t is e^(−t/MTBF). Everything that follows comes from that assumption — including what the number cannot say.

Why a high MTBF is not a long life

A hard disk sold with an MTBF of 1.5 million hours does not last 171 years: it is usually replaced after five. Both facts are true. The MTBF says that, in a large population running in its useful life, about 0.6% of disks fail per year of continuous operation (8,760 hours divided by 1.5 million). The service life says when wear starts to dominate. They measure two different things.

Reliability engineers draw this as a bathtub. Early in life, failures caused by manufacturing defects are frequent, then they fade; screening and burn-in exist to remove them before delivery. During the useful life, the failure rate is low and roughly constant: this is the part MTBF describes. Then wear-out begins, and the rate climbs. In airborne electronics, wear-out has names: flash memory endurance, batteries and supercapacitors, electrolytic capacitors, fans, connector mating cycles. None of them is in the MTBF.

The odds for a single unit

Apply the formula at t = MTBF: e^(−1) ≈ 0.37. Even with a perfect model, only 37% of units are still working when they reach their MTBF; 63% have already failed. And the constant-rate model has no memory: a unit that has run 10,000 hours without failure is not "due" for one, and is no more likely to fail in the next hour than a new unit. The figure gives odds, never a date.

This is the heart of the matter. The failure of one unit is a random event: neither the MTBF nor any prediction method can say when it will happen. What can be predicted, with useful accuracy, is how many failures a large fleet will see over a period. A reliability figure is a fleet tool.

Where the number comes from

A published MTBF is either predicted from the design, or observed in service. The two are different kinds of evidence.

• Prediction: each component gets a failure rate from a handbook, adjusted for its quality, electrical stress, temperature and environment; the rates are added, as if any component failure stopped the equipment. The common handbooks are MIL-HDBK-217F Notice 2, whose data date from 1995 and are usually pessimistic for modern parts but remain the shared yardstick in aeronautics; Telcordia SR-332, from telecommunications; and the French FIDES guide, which models the whole life profile, thermal cycling and the quality of the manufacturing process.
• Observation: the operating hours and failures of a fleet in service, or of a similar product. It is the most credible figure once the fleet is large, and the least useful for a new design.
• Accelerated testing, such as HALT, pushes a design to its limits to find weak points. It improves reliability far more than it measures it.

Observed figures carry their own trap: few failures mean wide uncertainty. A product that has accumulated 50,000 operating hours without a single failure has not shown an infinite MTBF. At 90% confidence, it has only shown an MTBF above about 21,700 hours (50,000 divided by 2.3).

Five assumptions that move the result

1. The method and its edition. The same board gives different results under MIL-HDBK-217, Telcordia or FIDES. Compare like with like.
2. The environment. Handbooks apply environment factors: for an integrated circuit, MIL-HDBK-217 uses a factor ten times higher in an uninhabited bay of an aircraft than in an air-conditioned laboratory.
3. The temperature. Semiconductor failure rates rise steeply with temperature, so the assumed ambient, and the temperature rise assumed inside the box, weigh heavily on the result.
4. The hours that are counted. An MTBF can be expressed in operating hours, or in calendar hours over a yearly profile that includes ground time and storage. For equipment that operates a few hundred or a few thousand hours a year, the second figure can be several times the first — same equipment, same data.
5. What counts as a failure. Predictions usually count hardware failures only. Software faults, handling damage, installation errors and units removed but found serviceable are outside the number.

MTBF, MTBUR, MTTR and availability

• MTTF, mean time to failure, applies to items that are not repaired.
• MTBUR, mean time between unscheduled removals, is what an operator actually sees: it counts every unit removed from the aircraft, including those the workshop finds serviceable. It is always lower than the MTBF.
• MTTR, mean time to repair or restore, measures how long a failure keeps the function unavailable — diagnosis, spare, exchange.
• Availability combines the two: MTBF / (MTBF + MTTR). With an MTBF of 20,000 hours and 48 hours to restore, availability is 99.76%. A spare on the shelf shortens MTTR far more cheaply than a better MTBF.

What MTBF is good for

Used for what it is, the number is valuable. It compares two designs computed under identical assumptions. Its detailed breakdown shows which components dominate the failure rate, which tells a designer where derating or cooling pays. And it sizes spares and support.

Take 20 units, each operating 600 hours a year: 12,000 fleet hours. With an MTBF of 20,000 hours, the fleet should see 0.6 failures a year on average. The probability of no failure in a year is 55%, of exactly one 33%, of two or more 12%: one spare covers nearly nine years out of ten. That forecast is about how many, never about which unit or which day.

What it is not

• Not a warranty. A warranty is a contractual commitment on each unit; the MTBF is a statistical estimate over a population.
• Not a service life. A unit with a high MTBF can wear out early, and wear-out items have their own replacement intervals.
• Not a prediction for one unit. Nothing can say when a given unit will fail.
• Not comparable between suppliers without its assumptions.

Questions to ask with an MTBF

1. Predicted or observed? If observed: how many units, how many hours, how many failures, at what confidence level?
2. If predicted: which method and edition, which environment category, which ambient temperature and internal temperature rise?
3. Operating hours, or calendar hours over a profile? Which profile?
4. What counts as a failure: hardware only? Are no-fault-found removals excluded?
5. Which wear-out items are left out, and what are their replacement intervals?

For a longer introduction, the white paper by Wendy Torell and Victor Avelar, "Mean Time Between Failure: Explanation and Standards" (APC, now Schneider Electric, White Paper 78), remains one of the clearest available.