A system that keeps working when a piece breaks is called fault tolerant . There are only two honest ways to survive a broken piece: stop safely (fail-safe) or keep going on a spare (fail-operational) — and the whole topic is just the math of measuring how well each one survives.
This page assumes you have seen nothing . Every letter, every squiggle, every fraction in the parent note the parent topic is built here from the ground up, in the order you need them. Never skip ahead — each symbol is earned before it is used.
Intuition Start with a coin, not a formulaImagine every hour, a tiny invisible dice is rolled for your component. Most hours it says "fine". Very rarely it says "broken". The chance per hour of rolling "broken" is a fixed small number. We give that number a name so we never have to write "chance of breaking per hour" again.
λ λ how many failures happen per hour, on average .
Units: failures per hour, written h − 1
A small λ λ
Example: λ = 1 0 − 5 h − 1
WHY a rate and not just "chance of failing"? Because failure builds up over time. A part that survives one hour easily might not survive a thousand hours. A rate lets us ask about any length of time. Look at the picture below.
The red staircase counts failures as time marches right. Its average steepness is exactly λ
We keep seeing e − λ t
t t how long the system has been running , measured in hours. At t = 0
e e ≈ 2.718 π ≈ 3.14 anything that shrinks by a constant fraction as time passes — like a population of still-alive components.
e − λ t survivors breaks. Not a fixed number of parts — a fixed fraction . When something shrinks by a fixed fraction over and over, the survivor count traces the curve e − λ t e
Common mistake Minus sign confusionThe exponent is negative : − λ t grow , meaning parts un-break themselves. Survival only ever goes down, so the sign must be minus.
P ( something ) P probability : how likely an event is, on a scale from 0 1 P = 0.5
So P ( part still works at t ) = R ( t ) = e − λ t has failed by time t
Not every failure is equally bad. A signal that goes dark by accident (annoying but safe) is different from one that shows GREEN when it should be RED (deadly). The parent note splits λ
β β 0 1 of all failures, what portion are the harmless, detectable kind?
β = 0.99
Now the total rate splits into two smaller rates, like a river forking:
WHY split it? Because fail-safe design only cares about the dangerous trickle λ d β 1
Worked example Squeezing the dangerous streamWith λ = 1 0 − 5 h − 1 β = 0.99 λ d = ( 1 − 0.99 ) × 1 0 − 5 = 0.01 × 1 0 − 5 = 1 0 − 7 h − 1 100 times smaller than the raw rate. That is what "detect your failures" buys you.
The parent note writes MTTDf = ∫ 0 ∞ e − λ d t d t ∫
Definition MTTF and MTTDf — average lifetimes
MTTF = Mean Time To Failure = the average number of hours a part lasts before breaking.MTTDf = Mean Time To Dangerous Failure = average hours before a dangerous failure specifically.
"Mean" is just another word for "average".
∫ 0 ∞ … d t integral : a machine that adds up an infinity of tiny slices . ∫ 0 ∞ 0 d t
Intuition WHY an integral gives theaverage lifetime
Picture the reliability curve R ( t ) area underneath it is the total "amount of survival" accumulated across all time. That area, magically, equals the average lifetime. So:
MTTF = ∫ 0 ∞ e − λ t d t = λ 1 λ 1/ λ average lifetime = 1 over the rate — a fast rate (big λ 1/ λ
Apply the same machine to the dangerous stream and you get the parent's headline result:
MTTDf = ∫ 0 ∞ e − λ d t d t = λ d 1 = ( 1 − β ) λ 1
Fail-operational systems use spares . To count how many ways spares can fail, we need one more notation.
( k n ) ( k n ) n k how many ways you can pick k n , order not mattering.
( 1 3 ) = 3 one of three computers failed.( 2 3 ) = 3 two failed.
WHY we need it: with three identical units, "exactly one failed" can happen three different ways, and probabilities of separate ways add up. The ( 1 3 )
Definition TMR — Triple Modular RedundancyThree identical units all do the same job. A voter takes the majority answer. If one unit lies, the other two out-vote it. The system only loses when 2 or more fail. (More in Redundancy patterns (N+1, TMR, DMR) .)
This is why the parent writes the TMR reliability as a sum: "all three good" plus "exactly one bad" — the two situations where the majority still wins.
A ( T ) A Availability = the probability the system is up and working at a chosen moment. A ( T ) T A > 0.9999
Δ t m a x Δ Δ t m a x longest allowed time to reach the safe state after a fault. Miss it and "safe" arrives too late to help. See Watchdog timers and health monitoring .
ϵ ϵ tiny allowed slack — a number so small we treat it as "almost zero". ϵ = 1 0 − 9 Safety Integrity Levels (SIL) .
S safe condition the system flees to on a fault: brakes clamped, signal RED, pump stopped. The subscript just labels it "safe". It is a place in the system's behaviour, not a number.
reliability R equals e to minus lambda t
probability P from 0 to 1
MTTF equals 1 over lambda
integral adds tiny slices
split into lambda safe and lambda dangerous
Fail-operational availability A
Say the answer out loud before revealing. If any stump you, re-read that section.
What does λ The failure rate — average failures per hour, units h − 1
What does e − λ t The reliability R ( t ) t
Why is the exponent negative? Survival only decreases; a positive exponent would mean parts un-break.
What is P fail ( t ) R ( t ) P fail ( t ) = 1 − e − λ t
What does β λ d β λ d = ( 1 − β ) λ
What does the integral ∫ 0 ∞ e − λ t d t The area under the reliability curve = the mean time to failure = 1/ λ
What does ( 1 3 ) It equals 3 — the number of ways exactly one of three units can be the failed one.
When does a TMR system actually fail? Only when 2 or more of the 3 units fail, since the majority voter overrides a single bad unit.
What does A ( T ) Availability — probability the system is operational at time T A > 0.9999
What are Δ t m a x ϵ Δ t m a x ϵ 1 0 − 9
