Cabin Pressure Controller: Demonstrating MTBF With Three Failures on the Books
A supplier proposes a cabin pressure controller with a stated MTBF of 2,500 h. Your contract requires demonstration of a 2,000 h MTBF at 80% one-sided confidence before production release. Six units are available and the rig can run them continuously for 14 weeks, giving roughly 14,000 unit-hours, minus 4 h of planned servicing per unit every 500 h. Testing was stopped at 10,000 unit-hours with three failures: the first at 600 unit-hours (repaired in 30 h), then at 3,100 and 5,400 cumulative unit-hours. All three involved capacitors from the same lot. The supplier argues that the 600 h failure is infant mortality and should be excluded, which would leave two failures and, in their view, a passing result. Production release is worth $4M, and your manager wants a go/no-go recommendation with the statistical basis shown, not a supplier assertion.
1. Compute the demonstrated one-sided lower confidence limit for MTBF at 80% confidence using all three failures, decide whether the 2,000 h requirement is met, and assess the supplier's request to exclude the first failure.
Read the worked answer
This is a time-terminated (Type I) test with r = 3 failures in T = 10,000 unit-hours; repair time is excluded from test time (adding the 30 h changes nothing material). Under the exponential assumption:
MTBF_L = 2T / chi-square(2r+2, 1-alpha) = 20,000 / chi-square(8, 0.80) = 20,000 / 11.03 = 1,813 h
1,813 h < 2,000 h, so the requirement is not met. The point estimate of 10,000/3 = 3,333 h is irrelevant to the contract; the lower bound is the contractual quantity, and it carries roughly +/-40% uncertainty.
Excluding the 600 h failure would give r = 2, T = 10,000: 20,000 / chi-square(6, 0.80) = 20,000 / 9.80 = 2,041 h, a nominal pass by 2%. That margin is far smaller than the sensitivity of the calculation, and exclusion requires more than a label:
- a documented root cause with physical evidence, not an assertion of 'infant mortality';
- evidence that the cause was removed from the articles under test (lot screening, burn-in) before the demonstration began;
- a defined, pre-agreed rule for data exclusion in the test plan. Adopting it after seeing the data is post-hoc.
Note also that one capacitor lot explaining all three failures is a common manufacturing cause, not random early life. Recommendation: no-go on the present data; require screened units and a fresh, pre-defined demonstration, or negotiate a variance with lot controls and a field monitoring plan.
2. The supplier proposes restarting with screened units. How many failure-free unit-hours would be needed to demonstrate 2,000 h MTBF at 80% confidence, is that feasible in the 14,112 unit-hour budget, and what risks remain?
Read the worked answer
For a time-terminated test with zero allowed failures, the one-sided lower limit is:
MTBF_L = T / (-ln(1-alpha)) = T / 1.609
Setting MTBF_L = 2,000 h gives T = 2,000 x 1.609 = 3,219 unit-hours.
Feasibility: 3,219 h out of roughly 14,112 available is comfortable, about 537 h per unit across six units, or four to five weeks of continuous running plus servicing. There is ample budget left for a pre-test burn-in and for repeat maintenance events.
Risks and cautions to state explicitly:
- It is a demonstration, not proof. Zero failures in 3,219 h is consistent with a true MTBF of 2,000 h at only 80% confidence; consumer risk is 20%. A 90% requirement would need T = 2,000 x 2.303 = 4,606 h.
- Screening must be validated. If the screen is a 100% burn-in, demonstrate that it actually precipitates the capacitor defect rather than merely moving the failure outside the test window.
- Restart the clock cleanly. Hours accumulated before the corrective action cannot be mixed with post-screen hours in a zero-failure calculation.
- Other modes remain. A test sized to detect a 2,000 h MTBF will not reliably expose modes occurring at 1 per 20,000 h; those must be covered by analysis and field data.
- Alternative: a Wald sequential test with a 2:1 discrimination ratio (2,000 h versus 4,000 h, alpha = beta = 0.10) accepts on a line of slope about 2,886 h per failure with an intercept near 8,800 h, cutting test time when the product is clearly good and stopping early when it is clearly bad.
3. The program director wants to accept the current 10,000 h data with the first failure excluded, arguing that 'the customer will never check the arithmetic.' Give your response, including what evidence you would put in front of the customer.
Read the worked answer
Refuse to sign, and put the reasoning in writing. Three separate problems make this untenable:
Technical. Even with the disputed exclusion the margin is 2,041 h against 2,000 h, which is inside the rounding of the chi-square table and far inside the sampling uncertainty. A single additional failure would return the result to failure. A demonstration whose verdict flips on one arguable data point is not a demonstration.
Integrity and contractual. Most reliability demonstration clauses require the test plan, including exclusion rules, to be agreed before test. Retrospective exclusion is exactly the kind of adjustment that fails audit and undermines every later reliability claim on the program, including growth projections and warranty provisions.
Root cause is unresolved. All three failures share a capacitor lot. That points to a supplier process escape, which is a real reliability risk to the fleet, not a statistical artifact. Leaving it in the field with a 2,500 h claim attached is a warranty and airworthiness exposure far larger than the $4M release value.
Evidence package for the customer: the test plan and its exclusion rules; the failure reports and lot traceability; the proposed screening specification and its validation results; the recomputed lower confidence limit with all failures; a fresh demonstration plan of 3,219 h (or 4,606 h at 90% confidence) with a pre-agreed stopping rule; and a first-year field monitoring commitment with a trigger for corrective action. Offer schedule relief or a warranty-backed conditional release with lot screening as the alternative to a clean re-test, and let the customer choose with the numbers in front of them.