Flight hardware for a life-support system (a CO₂ scrubber cartridge, a valve, a filter) is certified with a zero-failure reliability demonstration test: run n identical units through an accelerated environmental stress cycle (thermal-vacuum + vibration), and if r or fewer fail, the hardware is qualified to reliability R at confidence C.
C = 1 - Σ(k=0..r) C(n,k)·(1-R)^k·R^(n-k)
For r = 0 (zero-failure plan):
n = ceil( ln(1-C) / ln(R) )
Each qual cycle draws a Bernoulli outcome per test unit using the hidden true reliability you set (the unknown real quality of the hardware) — that is what the certification process is trying to estimate without knowing it in advance. The chamber array lights green for a pass, red for a fail, and shakes visibly during its vibration phase.
The demonstrated reliability is the raw pass rate observed so far; the lower confidence bound uses the Clopper–Pearson exact bound at your chosen confidence level — the number regulators actually sign off on, since raw pass rate alone overstates reliability for small sample sizes.
- Target reliability / confidence — sets the certification requirement (n, r) via the binomial test-plan formula above.
- True unit reliability — the real (unobserved) failure rate of the hardware being qualified; move it below the target to see a qual campaign correctly fail.
- Run one qual cycle — tests the next unit in the chamber array and updates the verdict once all n units have been tested.
This is the same statistical logic behind NASA-STD-8729.1 and ECSS-Q-ST-30 hardware qualification: certification is a sample-size problem, not a single pass/fail switch.