MTBF Calculator

MTBF, MTTF, and which one you actually have

Both are a mean time, but they describe different things, and mixing them up is the most common mistake in reliability numbers:

The arithmetic is identical when the failure rate is constant, which is why the terms get used interchangeably. Once you fit a Weibull or lognormal shape, they stop being interchangeable: the mean of the fitted distribution is a mean time to failure, and this tool labels it MTTF to keep that straight.

The estimate itself

For a constant failure rate, the maximum likelihood estimate is total operating time divided by the number of failures:

• \(T\) is total operating time summed over every unit, failed and unfailed (hours)
• \(r\) is the number of failures observed
• \(\lambda\) is the failure rate (failures per hour)
• \(R(t)\) is the probability a unit survives to time \(t\)

Every hour of operating time counts, including hours on units that never failed. Ten units run 500 hours each with 2 failures gives T = 5000 and MTBF = 2500 hours, not 250.

Why the interval matters more than the number

Failure counts are Poisson, so a small sample is wildly uncertain. Two failures in 1000 unit-hours gives a point estimate of 500 hours, but the true MTBF is anywhere from 159 to 2814 hours at 90% confidence. Quoting 500 alone hides a factor of nearly 18 between the ends:

• \(\chi^2_{p,\nu}\) is the chi-squared quantile with cumulative probability \(p\) and \(\nu\) degrees of freedom
• \(\alpha\) is 1 minus the confidence level

The lower bound uses \(2r+2\) degrees of freedom when the test ran to a planned clock time, and \(2r\) when it was stopped by the last failure. The difference is not cosmetic: a time-terminated test has some unused running time after the final failure, and the extra two degrees of freedom account for it. With zero failures there is no point estimate at all, only a lower bound of \(T / \ln(1/\alpha)\), which is the honest statement that the data has not yet found the failure rate.

One-sided and two-sided bounds, and why the one-sided floor is higher

The tool reports both, and at the same confidence level the one-sided lower bound always comes out above the bottom of the two-sided interval. That looks wrong the first time you see it. It falls out of where each bound is allowed to spend its error budget.

Think of the confidence level as a promise about how often you are allowed to be wrong. At 90%, you have 10 percentage points of wrongness to spend. A two-sided interval has to be wrong no more than that in either direction, so it splits the budget: 5% below the bottom end, 5% above the top. The bottom end is the 5th percentile of the estimate. A one-sided lower bound has no upper limit to defend, so it puts all 10% below itself, and the 5th percentile becomes the 10th. Same confidence, less to protect, so the floor sits higher.

One trap: a 90% one-sided lower bound equals the lower end of an 80% two-sided interval, not a 90% one. If you quote a one-sided bound as though it were the two-sided interval's floor, you are claiming more than the data supports.

Suspensions (censored data)

A unit that is still running when you stop watching is suspended, or right-censored. It has not failed yet, but it did survive its run time, and that is evidence. Throwing suspensions away is the easiest way to hand yourself a pessimistic MTBF. All three fits here use them: their operating time enters T, and for Weibull and lognormal their survival probability enters the likelihood.

When the exponential model is wrong

A constant failure rate means a brand-new unit and a ten-year-old unit are equally likely to fail in the next hour. That holds well for electronics in their useful life and for complex repaired systems, and poorly for anything that wears out. The Weibull shape parameter \(\beta\) is the test:

• \(\beta\) is the shape parameter, which sets whether the hazard rate rises or falls with age
• \(\eta\) is the characteristic life (hours), the time by which 63.2% of units have failed
• \(h(t)\) is the hazard rate, the instantaneous failure rate of the units still working
• \(\Gamma\) is the gamma function

The lognormal distribution covers a similar wear-out shape and is the usual choice for repair times and for fatigue and crack-growth life, where the failure mechanism is a product of many small random effects.

Reading the probability plot

The probability plot puts each observed failure at its median rank, in coordinates that turn the fitted distribution into a straight line. Points hugging the line mean the distribution fits. Curvature, a knee, or two distinct slopes mean it does not, usually because two different failure modes are mixed together and should be fitted separately. Median ranks use Benard's approximation, with Johnson adjusted ranks when suspensions shift the ordering:

• \(F_i\) is the estimated fraction failed at the i-th failure
• \(AR_i\) is the adjusted rank of that failure, which equals its position when there are no suspensions
• \(n\) is the total number of units, failed and suspended

Worked example

Roughly a quarter of units fail inside a mission a fifth as long as the MTBF. That is normal, and it is why a customer conversation should turn on reliability at the mission time rather than on the MTBF.

MTBF, MTTR, availability, and AFR

Four numbers that get used interchangeably and are not the same thing. MTBF and MTTF are covered above; the other two follow from them:

• \(AFR\) is the annualized failure rate, the share of units that fail within a year of 8760 operating hours
• \(MTTR\) is the mean time to repair, how long a unit stays down once it fails (hours)
• \(A\) is steady-state availability, the fraction of calendar time the unit is working

AFR has two definitions in circulation and they part company for short-lived items, so the tool reports both. The share of units failing within a year is \(1 - R(8760)\). The failures per unit-year is \(8760/MTBF\), which is what you get from dividing a fleet's failure count by its operating years, and it is the one drive vendors and Backblaze-style field studies publish. At a 1,000,000-hour MTBF they agree: 0.87% against 0.88%. At a 2920-hour MTBF they do not: 95% of units fail within the year, while a repaired unit averages 3 failures over the same span. The gap is not an error, it is the difference between counting units and counting failures.

Availability needs the repair time, and it is where a long MTBF stops being the whole story. Steady-state availability holds for any life distribution, not just the exponential, because the long-run behaviour of an alternating up-down renewal process depends only on the two means. A 2920-hour MTBF with a 4-hour repair gives 99.86% availability, about 12 hours down per year. Halve the repair time and you buy the same availability improvement as doubling the MTBF, usually for far less money.

Which standards this follows

The methods here are the ones written down in the reliability testing standards, not house rules:

What this tool is not: prediction handbooks

If you arrived looking for MIL-HDBK-217, you want a different calculation. Prediction handbooks work forwards from a bill of materials: count the parts, apply per-part failure rates adjusted for temperature, stress, and environment, and sum them into a system failure rate before anything has been built or tested. This tool works backwards from observed failures. The two meet in the middle, since handbook output is exactly the kind of component MTBF that feeds the System Reliability Calculator.

A predicted MTBF and a demonstrated MTBF are different claims. If you have test or field data, the estimate on this page beats any handbook number, and the confidence interval tells you how much to trust it.

Assumptions and limits

• Units are identical and failures are independent.
• Operating hours are real operating hours. Calendar time on an idle unit is not.
• Repaired items are assumed restored to the same condition, with no cumulative degradation across repairs.
• Confidence bounds for Weibull and lognormal come from the observed Fisher information, a large-sample approximation. With fewer than about 10 failures, treat their width as indicative rather than exact.
• One failure mode at a time. Mixed modes need separate fits.

References