The 99.99% That Was Not
During acceptance of a new multi-sensor track distribution system for a terminal area control centre, the supplier's compliance matrix states "availability: 99.99%". The system feeds fused radar and ADS-B tracks to 14 controller working positions. In the first year of shadow-mode operation the service recorded 33 hours of unplanned downtime and 48 hours of planned maintenance windows; the measured service availability was 99.08%. The supplier's figure traces back to a hardware reliability prediction: 8,000 hours MTBF per channel and 6 hours corrective MTTR, with planned maintenance excluded and "degraded operation" (fewer than 14 positions served) counted as available. The contract's only wording is "the system shall be highly available". The safety regulator has now asked the unit to state, in writing, what availability, continuity and integrity mean for this system and how each will be measured.
1. Reconstruct the supplier's availability figure, explain why the operational measurement differs, and state what the contract should have defined.
Read the worked answer
Reconstruct the prediction. Inherent availability from the stated parameters: A = MTBF / (MTBF + MTTR) = 8000 / 8006 = 0.999250, i.e. 99.93% per channel - already below the quoted 99.99%. Only a redundant configuration gets near 99.99%: two independent channels with perfect switchover give 1 − (1 − 0.99925)² ≈ 99.9994%. So the headline figure is a system-level, redundancy-dependent number presented as if it were a property of the equipment.
Reconcile with the measurement. Over 8,760 hours: (8760 − 33 − 48) / 8760 = 99.08% if planned downtime is counted; (8760 − 33) / 8760 = 99.62% if it is not. The 99.08% figure is therefore not a contradiction of the prediction - it is a different metric on a different basis. Add the supplier treating degraded operation as available, and a third, more flattering number appears.
What the contract needed. A named metric (operational availability), a service-state model (full / degraded / partial / unavailable with position-count thresholds), a rule on whether planned maintenance is excluded, the measurement window, exclusions, the data source and audit rights, and a redundancy assumption stated explicitly. "Highly available" is unenforceable: three defensible figures exist for the same year.
2. Explain to the regulator the difference between availability, continuity and integrity for this track service, give one measurable indicator for each, and say why counting degraded periods as "available" hides a safety issue.
Read the worked answer
Availability is time-based: the fraction of time the service is capable of performing its function, including repair time. Indicator: A₀ = MTBF / (MTBF + MTTR + planned downtime), or the percentage of time at least 14 positions are fully served.
Continuity is mission-based: the probability that, once in a given operating state, the service completes the operational task without entering a failed state. Indicator: unplanned service interruptions per 10,000 track-minutes, or the probability that a surveillance chain does not interrupt during a 30-minute arrival sequence.
Integrity is data-based: the probability that delivered data is not corrupted beyond tolerance without an alert within a defined time. Indicator: undetected erroneous-track events per flight hour, verified by injection testing and independent monitoring. A system can be fully available and delivering wrong tracks - that is an integrity failure, invisible to an availability KPI.
Why degradation matters. A configuration serving 6 of 14 positions is "up" in a binary model, so the KPI stays green. Operationally, the unit has lost redundancy, controllers work with reduced display capacity, and the ability to absorb a second failure is gone. Safety is degraded by loss of function and loss of margin, not only by full outage. The reporting set therefore needs safety-facing indicators alongside availability: minutes of lost redundancy, number of positions lost, and alerting latency.