What Does 1 FIT Really Mean? Automotive Reliability, PMHF, and the Test-Evidence Problem

In automotive electronics, functional safety, and autonomous-driving discussions, the term FIT appears constantly. FIT stands for Failures In Time, and the basic definition is one failure per one billion operating hours. It is a convenient way to express very small random hardware failure rates — but a FIT value by itself does not describe the risk.

1\ \text{FIT} = 1\ \text{failure per } 10^{9}\ \text{operating hours} = 10^{-9}\ \text{failures/hour}

A supplier may state, “this component has a failure rate of 1 FIT.” That sounds extremely reliable. The more useful questions are: over how many operating hours, across how many vehicles, under what conditions, is the failure safety-relevant, can the system detect it, and what evidence supports the estimate?

Core takeaway: A FIT number is not the conclusion. It is one input to a larger reliability and functional-safety argument.

The equations behind FIT

For a constant failure-rate model, the failure rate per hour is:

\lambda = \text{FIT} \times 10^{-9}

Reliability, cumulative failure probability, and mean time to failure follow directly:

R(t) = e^{-\lambda t} \qquad F(t) = 1 - e^{-\lambda t} \qquad MTTF = \frac{1}{\lambda}

These relationships assume a constant failure rate, independent failures, equivalent exposure across the population, operation within the useful-life region, and no dominant wear-out mechanism during the evaluated mission. A single FIT value is not universally valid for every failure mechanism or every stage of life.

What does 1 FIT mean over an automotive mission?

Assume a failure rate of 1 FIT and an operating time of 8,000 hours. The mission failure probability is:

F(t) = 1 - e^{-(1 \times 10^{-9})(8000)} \approx 7.99997 \times 10^{-6} \approx 8\ \text{ppm}

So 1 FIT over 8,000 operating hours corresponds to roughly 8 failures per million units over the mission. The corresponding reliability is $R(t) \approx 99.9992\%$ — extremely high, but not zero risk.

FIT becomes more meaningful with fleet size

Across a fleet of size $N$ , the expected number of failures is:

E[N_f] = N \times F(t)

For 100,000 vehicles that is about 0.8 failures over the mission; for one million vehicles it is about 8 failures. The expected value is a statistical average, not a guarantee of exactly that count — but it shows why a rate that looks negligible per component becomes important once millions of sensors, processors, and power devices are in service.

MTTF is not the same as service life

For 1 FIT, $MTTF = 1 / (1 \times 10^{-9}) = 10^{9}$ hours — more than 100,000 years. This does not mean an individual component survives that long. MTTF is a statistical parameter of the constant-rate model, not the design life, wear-out life, warranty, or useful service life. An electronic module can have a very low random failure rate while still having a practical service life of 10 to 20 years due to corrosion, fatigue, material degradation, or thermal cycling.

Why zero failures do not prove zero risk

A common misunderstanding is that a zero-failure test proves an extremely low failure rate. Zero failures are encouraging, but they only provide an upper statistical confidence bound. For zero observed failures under a constant-rate model:

\lambda_U = \frac{-\ln(1 - CL)}{T} \qquad FIT_U = \lambda_U \times 10^{9}

At 90% confidence, $-\ln(1 - 0.90) = 2.3026$ . Assume 100 test units for 1,000 hours each with no acceleration and zero failures, so $T = 100{,}000$ device-hours:

\lambda_U = \frac{2.3026}{100{,}000} = 2.3026 \times 10^{-5} \Rightarrow FIT_U \approx 23{,}026\ \text{FIT}

This test does not demonstrate 1 FIT. It demonstrates an upper bound of roughly 23,000 FIT at 90% confidence. That does not mean the true rate is 23,000 FIT — it means the test exposure alone is insufficient to support a much lower numerical claim.

How much testing would demonstrate 1 FIT?

The required equivalent exposure for a zero-failure test is:

T_{required} = \frac{-\ln(1 - CL)}{FIT_{target} \times 10^{-9}} = \frac{2.3026}{1 \times 10^{-9}} = 2.3026 \times 10^{9}\ \text{device-hours}

That is about 2.3 billion equivalent device-hours. At 1,000 hours per unit without acceleration, that is roughly 2.3 million units— clearly impractical for most validation programs. Modern automotive robustness-validation approaches therefore do not rely on ever-larger test-to-pass sample sizes alone. They combine mission profiles, failure-mechanism knowledge, reliability physics, justified acceleration, prior product knowledge, supplier data, field evidence, and robust design.

Acceleration cannot be added as a convenient multiplier. The relationship between test stress, use conditions, and the failure mechanism must be valid; extrapolation becomes unreliable when the accelerated condition triggers a different failure mechanism.

Want to run these numbers on your own claim? Try the FIT Calculator to convert a FIT value into mission ppm, fleet failures, and required test evidence.

Where does a FIT value come from?

A FIT number may come from supplier FMEDA or safety documentation, semiconductor reliability reports, accelerated life testing, technology qualification data, field-return data, reliability prediction standards, physics-of-failure modeling, similar-product history, or engineering judgment. These sources do not carry equal confidence. The useful question is not only “what is the FIT value?” but “how was it established, and is that evidence applicable to this design and mission?”

FIT versus PMHF

FIT and PMHF are related but not the same. FIT is a hardware failure-rate unit. PMHF is the Probabilistic Metric for random Hardware Failures, which evaluates the contribution of random hardware failures to violation of a specific safety goal. A component has a base failure rate, but not every failure violates the safety goal — some have no effect, some result in a safe state, some are detected and controlled, and some are masked by redundancy. PMHF is a safety-goal-level evaluation, not simply the sum of every component’s published FIT.

Automotive functional safety and ASIL A–D

ISO 26262 uses Automotive Safety Integrity Levels (ASILs) to classify the risk of a hazardous event caused by malfunctioning behavior of an E/E system. The ASIL is assigned to a safety goal, not automatically to a component, and is determined through Hazard Analysis and Risk Assessment based on Severity, Exposure, and Controllability. ASIL A is the lowest integrity level and ASIL D the highest; items that do not require an ASIL are handled under quality management (QM).

Classification	General interpretation	Relative rigor
QM	No ASIL assigned	Standard quality-management processes
ASIL A	Lower safety-related risk	Lowest ASIL rigor
ASIL B	Moderate safety-related risk	Increased safety requirements
ASIL C	High safety-related risk	More stringent safety requirements
ASIL D	Highest safety-related risk	Most stringent safety requirements

ASIL D does not mean every component must have an extremely low FIT rate. It means the overall design, process, architecture, diagnostics, and supporting evidence must satisfy the requirements of the highest integrity level.

ASIL hardware metrics and PMHF targets

For random hardware failures, ISO 26262 uses several quantitative metrics, including the Single-Point Fault Metric (SPFM), the Latent Fault Metric (LFM), and PMHF. A commonly published summary of the ISO 26262-5 hardware targets is:

ASIL	SPFM target	LFM target	PMHF target
ASIL A	— (not specified)	— (not specified)	— (not specified)
ASIL B	≥ 90%	≥ 60%	≤ 100 FIT
ASIL C	≥ 97%	≥ 80%	≤ 100 FIT
ASIL D	≥ 99%	≥ 90%	≤ 10 FIT

These values are commonly presented in semiconductor functional-safety guidance summarizing ISO 26262-5. The commonly referenced hardware-metric table provides explicit numerical targets for ASIL B, C, and D but not for ASIL A. For that reason, an educational calculator should not automatically assign ASIL A a fixed PMHF limit; a better approach is to let the user enter a project-specific or customer-defined Safety FIT budget.

Important distinction:a component does not become “ASIL D” simply because its base FIT is below 10 FIT. Component FIT is not PMHF — it is only one input. PMHF evaluates the rate at which random faults could violate a specific safety goal after considering failure-mode distribution, safe versus dangerous failures, single-point and residual faults, detected and latent multiple-point faults, diagnostic coverage, fault-handling time, safety mechanisms, redundancy, architecture, and dependent failures.

Base FIT, safety-relevant fraction, and diagnostic coverage

Base FIT is the estimated random hardware failure rate of a component or block before considering system-level safety mechanisms. The safety-relevant failure fractionis the portion of that base rate associated with failure modes that could contribute to violating the specific safety goal. A sensor may fail stuck-high, stuck-low, drifting, no-output, intermittent, or plausible-but-wrong — some modes are immediately detected, some lead directly to a safe state, and some have no safety impact in a given architecture.

Diagnostic coverageis the proportion of relevant dangerous failures that a safety mechanism can detect and control within the required fault-handling time. Detection alone is not always enough — the diagnostic must act early enough for the system to control the hazard or reach a safe state. Coverage should be supported by analysis and validation, not chosen as an optimistic percentage.

A simplified residual dangerous FIT estimate

For educational screening, a simplified contribution can be written as:

\text{Residual Dangerous FIT} = \text{Base FIT} \times \text{Safety-Relevant Fraction} \times (1 - \text{Diagnostic Coverage})

With a base rate of 100 FIT, a safety-relevant fraction of 40%, and diagnostic coverage of 90%:

\text{Residual Dangerous FIT} = 100 \times 0.40 \times (1 - 0.90) = 4\ \text{FIT}

The component starts at 100 FIT but its simplified residual dangerous contribution is about 4 FIT. This is useful for preliminary allocation and sensitivity analysis — it is not a complete formal PMHF calculation, which must also consider single-point, residual, detected and latent multiple-point faults, exposure duration, fault-tolerant time interval, safety-mechanism effectiveness, common-cause and dependent failures, and safety-goal-specific classification. Treat the simplified equation as an educational screening model, not an ISO 26262 compliance result.

FIT does not cover all autonomous-driving risk

FIT and PMHF address random hardware failures. They do not cover every source of risk in an autonomous or driver-assistance system. A system can operate with no hardware fault and still behave unsafely because of sensor-performance limits, difficult weather or lighting, incomplete environmental understanding, object misclassification, algorithm limitations, unexpected road configurations, foreseeable misuse, HMI problems, cybersecurity events, software defects, or incomplete requirements. Software defects and systematic faults are not random hardware failures and should not be assigned a conventional hardware FIT rate — they require process-based prevention, verification, validation, and safety analysis.

A low hardware FIT rate does not, by itself, prove that an autonomous-driving function is safe. FIT addresses only one part of the overall safety argument.

When is a constant FIT assumption inappropriate?

A constant FIT model is associated with the useful-life region of the bathtub curve. Many physical mechanisms — solder fatigue, contact fretting, corrosion, seal degradation, electromigration, dielectric breakdown, creep, mechanical fatigue, thermal cycling, material aging — are time-dependent, and their failure rate increases with time. A Weibull model is often more appropriate:

R(t) = e^{-(t/\eta)^{\beta}} \qquad \lambda(t) = \frac{\beta}{\eta}\left(\frac{t}{\eta}\right)^{\beta - 1} \qquad FIT(t) = \lambda(t) \times 10^{9}

When $\beta = 1$ the Weibull model reduces to a constant failure rate. When $\beta > 1$ the failure rate increases with time, indicating wear-out. For time-dependent life data, the Weibull Calculator evaluates shape, characteristic life, B-life, and mission reliability directly.

What the FIT Calculator does today

The Reliatools FIT Calculator is built to turn abstract failure-rate numbers into practical engineering meaning. It currently includes two modules:

FIT / Reliability Converter— enter one known value (FIT, failure rate per hour, reliability, mission ppm, or MTTF) and get mission reliability, mission failure probability, equivalent ppm, expected fleet failures, failure rate per hour, MTTF, and reliability “nines.”
Test Evidence Reality Check— estimate total equivalent device-hours, the demonstrated upper FIT, the exposure and sample size required for a target FIT, and the gap between your test evidence and the claimed target.

A Safety FIT / PMHF budget preview (ASIL selection, per-block base FIT, safety-relevant fraction, diagnostic coverage, and simplified residual dangerous FIT) and an advanced Weibull section for time-dependent cases are planned extensions to this tool. Until then, use the standalone Weibull Calculator for wear-out analysis.

Final takeaway

FIT is a useful metric, but a FIT value is not meaningful by itself. It becomes meaningful only when connected to mission exposure, fleet size, confidence level, failure mechanisms, environmental conditions, safety relevance, diagnostic coverage, system architecture, and supporting evidence. 1 FIT sounds tiny, but over 8,000 operating hours it represents roughly 8 ppm mission failure probability, about 0.8 expected failures per 100,000 units, and about 8 per one million units — and demonstrating 1 FIT through a zero-failure test at 90% confidence would require roughly 2.3 billion equivalent device-hours.

The better question is not simply “what is the FIT number?”but what it means over the actual mission, across the fleet, what evidence supports it, which failures are dangerous, how effective the diagnostics are, and whether the result supports the system’s safety argument.

Turn a quoted FIT number into an engineering result with the FIT Calculator, and evaluate time-dependent life data with the Weibull Calculator.

References and further reading

ISO 26262, Road vehicles — Functional safety.
ISO 21448, Road vehicles — Safety of the intended functionality.
Texas Instruments, Functional Safety FIT Rate and Failure Mode Distribution Calculations.
ZVEI, Handbook for Robustness Validation of Automotive Electrical/Electronic Modules.
Escobar, L. A., and Meeker, W. Q., “A Review of Accelerated Test Models.”
McPherson, J. W., Reliability Physics and Engineering: Time-to-Failure Modeling.
Abernethy, R. B., The New Weibull Handbook.

Note: This article and the calculator are educational engineering tools. They do not replace a formal FMEDA, ISO 26262 assessment, safety case, fault-tree analysis, dependent-failure analysis, or certified functional-safety review.

Want help applying this to your validation plan? Contact Reliatools.