Reliability and availability

how many ninesMTBF and MTTRredundancy mathsuptime calculations

MTBF, MTTR, chains, redundancy and the odds of at least one failure: what uptime a system of imperfect parts really delivers.

Availability from MTBF and MTTR

A = \frac{\mathit{MTBF}}{\mathit{MTBF} + \mathit{MTTR}}

Fraction of time a system is up: mean time between failures divided by the whole cycle of running plus repairing. This is where the marketing nines come from.

Series System Reliability

R_s = R^{n}

Reliability of n identical components that must all work: the individual reliability raised to the nth power. Every dependency you add makes the whole thing worse, never better.

Parallel System Reliability (Redundancy)

R_s = 1 - (1 - R)^{n}

Reliability of n identical components when any single one is enough: the chance that they do not all fail together. Redundancy buys nines fast, provided the failures are genuinely independent.

Probability of At Least One Success

P = 1 - (1 - p)^{n}

Chance that at least one of n independent attempts succeeds, found as one minus the chance that every single attempt fails.

How they fit together

Availability from MTBF and MTTR is where the marketing nines come from, and reading it carefully changes what you spend money on. Availability is uptime divided by uptime plus repair time, so halving the repair time helps exactly as much as doubling the time between failures. Faster recovery is almost always the cheaper of the two, and it is the one an operations team can actually control.

Then the two wiring rules, which pull in opposite directions. Series reliability multiplies, so every dependency you add makes the whole worse. Twenty components at 99.9% each give a system at 98%, and nobody notices until the incident review. Parallel reliability is the cure, and it works startlingly well: two components at 90% give 99%, three give 99.9%. Redundancy buys nines faster than quality does.

The catch is in the assumption rather than the algebra. Both formulas require failures to be independent, and in practice they rarely are. Two drives from the same batch, two servers on the same power feed, two availability zones behind one control plane. The exponent is honest and the independence is the lie. At least one is the general form worth keeping in mind, because it is the same computation wearing the costume most risk questions are actually asked in.