Mission-profile-qualified device reliability contract

This note defines the quantitative boundary for Fixture F-008. It operationalizes the durable result of the semiconductor device and circuit reliability audit: accepted service must be evaluated against the actual mission profile of a variable and aging physical population, with mechanism-qualified extrapolation, explicit correction and retirement, and complete lifecycle ledgers.

• Status: fixture mathematics; no new principle or candidate
• Comparison unit: one preregistered service interval and its physical cohort
• Primary rule: never infer recovery, reliability, or efficiency from task score, monitor output, accelerated stress, or component energy alone

Physical identity and time base

For service episode $e$ at sample time $t$, seal the identity envelope

where $l$ identifies a fabrication lot, $w$ a wafer, $d$ a die, $b$ a physical block or array, $p$ a package and board path, $h$ a hardware and firmware version, $s$ a site or facility, $e$ an episode, and $t$ elapsed time [s] from a declared clock origin. All identifiers are immutable byte strings. Replacement, repair, reprogramming, remapping, firmware change, or calibration creates a new versioned identity link; it does not overwrite history.

Let $\Delta t_n=t_{n+1}-t_n$ [s] be sample interval $n$. The actual mission profile over interval $[0,T_e]$ is

where $u_n$ is workload class [class], $V_n$ supply or terminal voltage [V], $f_n$ clock or operation rate [Hz], $T_n$ measured absolute temperature [K], $J_n$ current density [A m$^{-2}$], $a_n$ switching or access activity [dimensionless], $\phi_n$ particle flux [particle m$^{-2}$ s$^{-1}$], $\dot D^{\mathrm{ion}}_n$ ionizing dose rate [Gy s$^{-1}$], $c_n$ cooling state [state], $r_n$ route and protection state [state], and $N_e$ is the number of intervals [interval]. $T_e=\sum_n\Delta t_n$ is episode duration [s]. Commanded voltage, nominal temperature, or benchmark label cannot substitute for the measured histories.

The workload record is further resolved as

where $q_n$ is requested service type [type], $N_n^{\mathrm{op}}$ is operation count [operation], $B_n^{\mathrm{move}}$ is bytes moved [byte], $N_n^{\mathrm{write}}$ is write or program count [write], and $y_n$ is the required quality and safety envelope [contract].

Latent physical state and observable evidence

Let the latent device state be

where $\theta$ is the time-zero physical parameter vector in declared native units, $D_n^{\mathrm{perm}}$ is cumulative irreversible damage [damage unit], $R_n^{\mathrm{rev}}$ is reversible degradation [damage unit], $W_n$ is consumed write, cycle, or stress endurance [cycle or declared wear unit], $\mathcal F_n$ is latent fault state [state], and $Q_n^{\mathrm{res}}$ is remaining repair, spare, timing, thermal, and correction reserve [declared reserve unit]. A dimensionless normalized representation is allowed only after every component scale is fixed.

The physical transition law is

where $g_k$ is a mechanism-qualified transition model, $k$ indexes a physical mechanism, $M_{e,n}$ is the mission-profile slice, $\alpha_k$ is a vector of mechanism parameters in declared native units, $\Gamma_k$ contains interaction coefficients, and $\xi_n$ is process noise in the units of $z$. A model that mixes mechanisms must identify $k$ or explicitly carry a mixture state.

Observed telemetry is

where $o_n$ is the observation vector in sensor-native units, $h$ is the measurement function, $\beta_{v_n}$ is calibration state under calibration version $v_n$, and $p_{\epsilon,v_n}$ is the version-qualified noise law. Calibration state has covariance $\Sigma^{\beta}_n$ in squared native units.

Define observation availability $m_{n,j}\in\{0,1\}$ for channel $j$ and censoring bounds $L_{n,j}$ and $U_{n,j}$ in the channel's native unit. The observation record is

where $a^{\mathrm{ev}}_n=t_n-t_n^{\mathrm{last\,qualified}}$ is evidence age [s]. Adaptive physical interfaces require the same explicit latent inventory, mode, hysteresis, depletion, health, evidence-age, and fallback state; an “adaptive” label is not an observation (C-1504). For a right-censored lifetime $t_i^{\mathrm f}>C_i$, unit $i$ contributes

where $C_i$ is censor time [s], $S$ is survival probability [dimensionless], and $M_i$ is the unit's observed mission profile. A failed unit with failure time $t_i^{\mathrm f}$ [s] and classified mechanism $k_i$ contributes

where $\lambda_{k_i}$ is mechanism-specific hazard [s$^{-1}$]. Missing and censored records are represented in the likelihood; they are not imputed as healthy observations.

Hierarchical variation, yield, and leakage control

For parameter $q$ measured at lot $l$, wafer $w$, die $d$, and block $b$, use the hierarchical decomposition

where $\mu_q$ is the population mean, $L_{l,q}$ the lot effect, $W_{l,w,q}$ the wafer effect, $D_{l,w,d,q}$ the die effect, $B_{l,w,d,b,q}$ the local block effect, and $\eta_{l,w,d,b,q}$ measurement residual, all in the native unit of $q$. Spatial covariance and gradients are modeled explicitly when present.

Let $A_{i,q}=1$ when physical unit $i$ satisfies acceptance criterion $q$ and $A_{i,q}=0$ otherwise. Joint accepted yield is

where $N_{\mathrm{fab}}$ is the number of fabricated units [unit], $Q$ is the number of jointly required criteria [criterion], and $\widehat Y_{\mathrm{joint}}$ is dimensionless. Failed, untestable, unpackageable, and discarded dies remain in $N_{\mathrm{fab}}$.

For a die area $A_{\mathrm{die}}$ [m$^2$] and random killer-defect density $D_0$ [defect m$^{-2}$], the Poisson yield null is

where $Y_{\mathrm P}$ is dimensionless. More flexible clustering models may replace this null only with held-out wafer and lot evidence.

Competing mechanisms and mission-profile damage

For $K$ competing mechanisms, total hazard is

and survival through time $t$ is

where $\lambda$ and every $\lambda_k$ have unit s$^{-1}$, $t$ and $\tau$ have unit s, and $S$ is dimensionless. Cause-specific cumulative incidence is

where $F_k$ is dimensionless and $\tau^-$ denotes the instant before $\tau$.

For a monotone damage proxy, define

where $r_k$ is mechanism-$k$ damage rate [damage unit s$^{-1}$] and $D_k$ is accumulated damage [damage unit]. This integral is evaluated on actual telemetry, not on mean voltage or mean temperature. Endpoint-matched wear histories can therefore carry different mechanism, transition, repair, and remaining-service state (C-1500).

The equal-mean mission-history illustration uses hypothetical Arrhenius parameters to visualize this nonlinearity; it is not calibrated device damage.

An Arrhenius acceleration factor between use temperature $T_u$ [K] and stress temperature $T_s$ [K] is

where $E_a$ is activation energy [eV], $k_{\mathrm B}$ is Boltzmann's constant [eV K$^{-1}$], and $AF_T$ is dimensionless. The electromigration lifetime null is

where $t_{50}$ is median failure time [s], $A_{\mathrm{EM}}$ has the compound unit required to yield seconds, $J$ is current density [A m$^{-2}$], $n_{\mathrm{EM}}$ is dimensionless, and $E_{a,\mathrm{EM}}$ is activation energy [eV]. The fitted range, waveform, geometry, and failure criterion travel with every estimate.

Radiation-induced upset rate for sensitive regions $j$ is

where $E$ is particle energy [J or eV, declared consistently], $\phi_j(E)$ is differential flux [particle m$^{-2}$ s$^{-1}$ energy$^{-1}$], $\sigma_j(E)$ is upset cross-section [m$^2$/bit or m$^2$/device], and $R_{\mathrm{SEU}}$ is upset rate [bit$^{-1}$ s$^{-1}$ or device$^{-1}$ s$^{-1}$].

For mechanisms $k$ and $r$, interaction departure is

where $L_{k+r}$ is loss under combined stress, $L_k$ and $L_r$ are losses under each stress alone, and $L_0$ is unstressed loss, all in the same task or physical unit. $\Delta_{k,r}=0$ is the additive null; the sign and uncertainty of $\Delta_{k,r}$ must be reported rather than absorbed into an unspecified "aging" variable.

Accelerated-test support and extrapolation

Let $x^{\mathrm{stress}}$ be the vector of stress covariates in their normalized, preregistered coordinates and let $\mathcal S_{\mathrm{train}}$ be the support of the accelerated-test design. Define support distance

where $\Sigma$ is a fixed covariance or scale matrix, $\|v\|_{\Sigma^{-1}}=\sqrt{v^{\top}\Sigma^{-1}v}$ is dimensionless Mahalanobis distance, and $d_{\mathrm{sup}}$ is dimensionless. A prediction is out of support when $d_{\mathrm{sup}}(x)>d_{\max}$ for preregistered dimensionless threshold $d_{\max}$.

For a nominal $(1-\alpha)$ survival interval $[\widehat S_i^L(t),\widehat S_i^U(t)]$, empirical interval coverage is

where $\alpha$, $S_i$, and $\widehat C_S$ are dimensionless, $N_{\mathrm{hold}}$ is held-out unit count [unit], and $\mathbb 1$ is the indicator function. Mechanism transitions, failure-analysis disagreement, or false-safe predictions invalidate extrapolation even when aggregate error is small.

Thermal, electrical, and wear coupling

For thermal node vector $T(t)$ [K], the lumped electrothermal null is

where $C_{\mathrm{th}}$ is thermal-capacitance matrix [J K$^{-1}$], $G_{\mathrm{th}}$ is thermal-conductance matrix [W K$^{-1}$], $T_{\mathrm{amb}}$ is ambient-temperature vector [K], and $P(t)$ is dissipated power vector [W]. Routing comparisons use measured spatial $T(t)$ and $P(t)$.

Dynamic switching energy for operation class $q$ is

where $N_q$ is operation count [operation], $\alpha_q$ is activity factor [dimensionless], $C_q$ is effective switched capacitance [F/operation], $V_q$ is voltage [V], and $E_{\mathrm{dyn},q}$ is energy [J]. Leakage, regulation, clocking, memory, transfer, monitoring, correction, thermal control, and idle energy are separate terms.

For physical element $j$, normalized wear evolves as

where $w_j$ is dimensionless consumed endurance, $\Delta x_j$ is stress, write, or cycle increment [wear unit], and $X^{\mathrm{end}}_j$ is measured endurance capacity [same wear unit]. Element $j$ is exhausted when $w_j\ge 1$, unless a stricter registered threshold applies.

Separate native margin, reversible recovery, and compensation as

where $m^{\mathrm{obs}}_j$, $m^0_j$, permanent loss $d^{\mathrm{perm}}_j$, reversible loss $d^{\mathrm{rev}}_j$, and compensation $c^{\mathrm{comp}}_j$ share the same physical margin unit, such as volts or seconds. A reduction in $d^{\mathrm{rev}}_j$ is recovery; an increase in $c^{\mathrm{comp}}_j$ is adaptation. They are never scored as the same event.

Fault geometry and the soft/hard firewall

Let every fault event carry type

where $g_i$ is spatial geometry [bit, word, bank, chip, route, or domain], $\ell_i$ is persistence [s], $\tau_i$ is occurrence time [s], $p_i$ is physical or injected provenance [class], $c_i$ is common-cause identifier [class], and $x_i$ is external-side-effect state [state].

The firewall outcome is one of

where CE is corrected error, DUE is detected uncorrectable error, SDC is silent data corruption, MC is miscorrection, and ESC is escaped unsafe side effect. Each is counted in events [event]. For $N_{\mathrm{tx}}$ protected transactions,

where $N_y$ is count [event] of firewall outcome $y$, and $R_y$ is rate [event/transaction]. SDC and ESC are never merged into average task loss.

For independent per-bit upset probability $p_b$ during scrub interval $\Delta t_s$ [s] and codeword length $n_c$ [bit], the probability of more than one upset is

where $P_{>1}$ and $p_b$ are dimensionless. This is only a null: burst, adjacent, chip, decoder, timing, permanent, and common-cause faults require their measured geometry.

Evidence-age-qualified control authority

Let $m_n^{\mathrm{lb}}$ be a conservative lower bound on timing, voltage, memory, or analog margin in its native unit. Let the proposed operating point consume margin $c_n^{\mathrm{op}}$ in the same unit and let reserve requirement $r_n^{\min}$ share that unit. Authority is admissible only when

where $a_n^{\mathrm{ev}}$ and maximum evidence age $a_{\max}$ are seconds, $x_n$ is current operating covariate vector, and $\mathcal V_n$ is the validated operating envelope. Failure of any condition invokes a preregistered safe operating point or stops acceptance.

Let $P_{\mathrm{esc}}(a)$ be probability [dimensionless] that action $a$ causes an escaped protected failure during one transaction. A controller action is permitted only if

where $\epsilon_{\mathrm{esc}}$ is the preregistered per-transaction risk limit [dimensionless]. The bound includes monitor, regulator, clock, policy, and fallback faults rather than conditioning them away.

Analog and in-memory computation state

For programmed conductance matrix $G^0$ [S], the effective matrix at time $t$ is

where every $\Delta G$ term is in siemens [S] and separately denotes programming error, time- and temperature-dependent drift, cycling variation, and stuck-cell error. For input-voltage vector $v$ [V], ideal current is $i=Gv$ [A]. Measured output is

where $\Psi_{\mathrm{wire}}$ maps conductance and voltage to current while including wire and peripheral effects, $n_{\mathrm{ana}}$ is analog noise [A], and $Q_{\mathrm{ADC}}$ is the converter map from amperes to digital code [code].

Hardware-aware training distribution $P_{\mathrm{train}}(\delta)$ over nonideality vector $\delta$ is compared with held-out physical distribution $P_{\mathrm{test}}(\delta)$. The support test uses the previously defined $d_{\mathrm{sup}}$; confident acceptance outside support is scored separately as silent failure.

Repair, spares, yield, and retirement state

For unit $i$, lifecycle state is

where $a_i$ is availability [dimensionless], $b_i$ remaining spare capacity [block or byte], $r_i$ cumulative repair count [repair], $q_i$ current service qualification [class], $w_i$ wear vector [dimensionless], and $v_i$ version record [version]. A repair updates $s_i$ and its provenance; it never resets fabrication yield or prior embodied cost.

Let $C_i^{\mathrm{repair}}$ be repair cost in a declared vector of joules, kilograms, person-hours, currency, and downtime seconds. Let $V_i^{\mathrm{future}}$ be expected accepted future service [accepted-service unit]. Repair is economically or environmentally admissible only under the registered componentwise budget and risk constraints; a scalar ratio may be reported as

where $E_i^{\mathrm{repair}}$ and $E_i^{\mathrm{future}}$ are repair and future operational energy [J]. Material, labor, risk, and time remain separate ledgers.

Hard retirement indicator is

where $U_i$ is an uncontained or unclassifiable fault indicator [dimensionless], $P_{\mathrm{esc},i}^{U}$ is the upper confidence bound on escape probability [dimensionless], $m_i^{\min}$ is minimum physical margin in the same unit as $m_i^{\mathrm{lb}}$, $\mathcal Q_{\mathrm{safe}}$ is the set of qualified service classes, $b_i^{\min}$ is minimum reserve in the same unit as $b_i$, and $\mathcal V_i$ is the set of accepted versions and validity states. When $R_i^{\mathrm{hard}}=1$, the unit cannot accept protected work. Economic or average-quality gains cannot override this rule.

Accepted service and complete lifecycle ledgers

For transaction $j$, define acceptance

where $q_j$ is measured quality in its native unit, $\mathcal Q_j$ is the accepted quality set, $\ell_j$ is latency [s], $\ell_j^{\max}$ is latency limit [s], $c_j$ is calibration and constraint state [state], $\mathcal C_j$ is its accepted set, and $y_j^{\mathrm{fw}}$ is firewall outcome. Accepted service is

where $\omega_j$ is registered service value [service unit/transaction]. Report also the unweighted accepted transaction count $\sum_j A_j$ [transaction].

Operational energy is

where every term is measured in joules [J] at the declared boundary. Lifecycle energy is

where fabrication, packaging, test, operation, repair, replacement, and end-of-life terms are joules [J] allocated by a published rule. Failed dies, spares, calibration, replacement inventory, and facility overhead remain in scope.

Material and work ledgers are vectors

where $m_r$ is mass [kg] of material category $r$, $R$ is category count, $h_p$ is labor [person-hour] for role $p$, and $P$ is role count. Carbon dioxide equivalent $C_{\mathrm{life}}$ [kg CO$_2$e] is reported separately with inventory version, geography, time, allocation, and uncertainty.

Energy intensity of accepted service is

and is undefined when $S_{\mathrm{acc}}=0$. Energy intensity never replaces the firewall, material, work, availability, latency, or tail-risk outcomes. A coupon-level friction or wear reduction cannot promote without this mission-qualified accepted-service and lifecycle transfer (C-1505).

Matched budget and Pareto comparison

Every arm $a$ receives componentwise budget vector

where the components are fabricated units [unit], silicon area [m$^2$], sensors [sensor], spares [block], calibration observations [observation], labels [label], simulation calls [call], training operations [operation], peak power [W], lifecycle energy [J], wall time [s], stored bytes [byte], human work [person-hour], material mass [kg], and risk allowance [declared risk unit]. Arm $a$ is feasible only if

where $\preceq$ means every component is within its preregistered ceiling in the same unit. Removed ablation components do not donate their budgets elsewhere.

The protected outcome vector is

where $Q_{0.99}^{\mathrm{lat}}$ is 99th-percentile latency [s], $A_{\mathrm{avail}}$ is availability [dimensionless], $N_{\mathrm{repair}}$ is repair count [repair], and $N_{\mathrm{replace}}$ is replacement count [replacement]; the other components were defined above. Pareto dominance is assessed componentwise after preregistering beneficial directions and hard constraints.

For paired held-out mission $e$, candidate-minus-null effect on scalar outcome $y$ is

where $\Delta_{e,y}$ has the unit of outcome $y$. Report hierarchical intervals grouped by lot, wafer, die, site, workload family, and future time; random-record splits are diagnostic only.

Ten-track measurement map

Statistical and retirement contract

The confirmatory analysis preregisters cohort sizes from power or precision targets, all exclusion rules, multiplicity control, censoring model, calibration method, hierarchical grouping, uncertainty propagation, and the direction and minimum relevant magnitude of each effect. Report medians, tails, intervals, per-device traces, failure maps, and unfavorable regimes; do not pool mechanisms or populations merely to obtain significance.

The cross-candidate composition is retained only if, on sealed held-out mission profiles and within $\mathbf B^{\max}$:

1. it improves at least one preregistered accepted-service or lifecycle outcome beyond the complete mature null by the minimum relevant magnitude;
2. no hard firewall, coverage, calibration, availability, or retirement limit is violated;
3. the effect survives hierarchy-aware analysis, mechanism and inventory sensitivity cases, and removal of any unnecessary candidate mechanism; and
4. every claimed gain remains after calibration, correction, recovery, failed units, spare consumption, repair, replacement, material, and human work are charged.

Failure invokes the narrowest applicable response: remove the unsupported component, reduce authority, derate or repurpose a qualified unit, or set $R_i^{\mathrm{hard}}=1$. No result in this contract allocates a new principle or candidate identifier.