BLUF: An asset with no recorded failure is not necessarily a healthy negative. When observation ends before the evaluation horizon, its outcome is incomplete. Preserve the observed time and event indicator, retain the reason observation stopped, and choose an evaluation method whose censoring assumptions match the maintenance process. A survival model cannot repair missing lifecycle identity or prove that a preventive replacement was unnecessary.
The deliverable is an auditable event-or-censoring contract plus a supported evaluation horizon—not a more impressive accuracy score. This article implements the incomplete-outcome boundary left open in predictive-maintenance backtests. Keep that article's asset-group and forward-time separation; changing the outcome representation does not make random sensor-window splits valid.
First define the decision and the clock
Choose one component class, one failure definition and one time origin. For example: time from bearing installation to confirmed bearing failure, measured in elapsed days. Operating hours can be a better exposure clock, but only if meter resets, downtime and missing readings are reconciled. Never mix calendar days and operating hours in one duration field.
A lifecycle prediction from installation differs from a rolling prediction of failure in the next maintenance window. For rolling decisions, use an explicitly designed landmark or time-varying approach with features available at the decision time. Do not attach end-of-life sensor summaries to an installation-time record. Repeated landmarks from one machine remain dependent observations.
The scikit-survival introduction represents right-censored outcomes with an observed time and a Boolean event indicator. The observed time is the earlier of failure time and censoring time. An event indicator of false means the failure time is unobserved beyond that point; it does not mean the component never fails.
Implement a lifecycle label contract
Use a stable parent asset ID and a distinct component-life ID after each replacement. Store origin, observation entry, observation end, failure time if observed, event definition/version, censoring reason, source record IDs, label-available timestamp and data snapshot. These are proposed engineering fields, not prescribed library column names.
Validate origin ≤ entry < end. A confirmed target failure must terminate this first-event record and have no censoring reason. A censored record must have a documented reason and no target failure inside its observed interval. Quarantine contradictory CMMS closure codes rather than silently choosing a value. Unknown origin, unresolved identity or interrupted outcome surveillance prevents ordinary lifecycle interpretation until reconciled.
Separately retain when the label became available. A failure on Monday reported on Friday is delayed reporting: it constrains which historical model freeze can use the diagnosis. A bearing installed before the plant joined observation is delayed entry: it changes which risk sets the bearing may enter. Moving the origin to enrollment merely hides its prior age and changes the prediction question.
The lifelines univariate documentation supports entry for left-truncated observations. Durations still run from the original origin, not from entry. Account for selection into observation as well: an entry argument cannot correct an unknown, condition-dependent enrollment process by itself.
Timeline: observation is not lifetime
The diagram is a synthetic lifecycle illustration, not measured reliability. Solid segments show observation; a cross is an observed failure and a vertical bar is the observation endpoint without observed failure. The dashed interval before entry must not contribute ordinary observed person-time. The dashed continuation after censoring is unknown, not confirmed survival.
Decide what an observation endpoint means
| Endpoint | Representation | Required review |
|---|---|---|
| Fixed dataset cutoff | Right-censored at last verified event-free time | Administrative timing is not proof of independence; inspect installation cohorts and regimes |
| Contract or telemetry coverage ends | Censored only while outcome ascertainment remains valid | Test whether dropout follows poor condition or a specific service policy |
| Preventive replacement | Intervention or competing event, depending on estimand | Reliability and statistical review before treating replacement as independent censoring |
| Confirmed target failure | Event at confirmed failure time | Verify event definition and component-life identity |
| Failure known only between inspections | Interval-censored outcome | Do not invent an exact failure time or reuse an ordinary right-censoring API unchanged |
A sensor gap is not automatically a censoring event if independent maintenance records still establish the outcome. Conversely, a sensor stream continuing to arrive does not prove that failure ascertainment is complete. Establish the last defensible event-free observation using the actual outcome capture process.
Preventive replacement is the difficult case. If technicians remove components because they look close to failure, the removed units are not an exchangeable sample of the survivors. A naive independent-censoring assumption can be wrong. If the question is the probability of target failure before replacement under the current policy, replacement may be a competing event; ordinary one-minus-Kaplan–Meier is not the corresponding cumulative incidence. If the question is failure without replacement, that is a counterfactual question requiring stronger assumptions and specialist review. Renaming replacement as censoring does not identify that answer.
Reproduce the labeling error with a small fixture
Six synthetic component lives start at day zero. A fails at day 2, B is administratively censored at day 3, C fails at day 4, D is censored at day 6, E fails at day 8 and F is censored at day 10. Evaluate failure by day 5. This deliberately tiny fixture tests arithmetic and label handling; it is not a plant benchmark, a model evaluation or evidence that censoring is independent in production.
Coding every unresolved outcome as nonfailure gives 2/6, or 33.33% failure risk. Removing the early-censored B gives a complete-case fraction of 2/5, or 40%. Under the illustrative independent-censoring assumption, Kaplan–Meier instead uses six units at risk at day 2 and four at day 4. Estimated survival is (5/6) × (3/4) = 5/8, giving 37.5% failure risk by day 5. None of these values reveals B's unobserved future.
The following standard-library Python fixture was executed for this article. event=False means censored; the duration is the observed endpoint. The minimal validator rejects duplicate lives, impossible entry ordering, contradictory event/reason pairs and preventive replacement requiring review. A production validator also needs provenance, event-time availability and continuity checks described above.
from fractions import Fraction as Ffrom math import prod# ID, origin, entry, end, event, reasonrows = [('A', 0, 0, 2, True, None),('B', 0, 0, 3, False, 'cutoff'),('C', 0, 0, 4, True, None),('D', 0, 0, 6, False, 'cutoff'),('E', 0, 0, 8, True, None),('F', 0, 0, 10, False, 'cutoff'),]assert len({r[0] for r in rows}) == len(rows)assert all(r[1] <= r[2] < r[3] for r in rows)assert all((r[4] and r[5] is None) or(not r[4] and r[5] == 'cutoff')for r in rows)# Other reasons require review, not silent acceptance.h = 5failed = lambda r: r[4] and r[3] <= hnaive = F(sum(map(failed, rows)), len(rows))known = [r for r in rows if failed(r) or r[3] >= h]complete = F(sum(map(failed, known)), len(known))times = sorted({r[3] for r in rows if failed(r)})risk = lambda t: sum(r[2] < t <= r[3] for r in rows)events = lambda t: sum(r[4] and r[3] == t for r in rows)survival = prod(F(risk(t)-events(t), risk(t)) for t in times)assert (naive, complete, 1-survival) == (F(1,3), F(2,5), F(3,8))print(float(naive), float(complete), float(1-survival))
The run returned naive=0.3333333333333333, complete_case=0.4 and km=0.375. Four deliberately invalid label fixtures were rejected in the local test harness. The arithmetic example has no delayed entries, recurrent failures or tied failure/censor times; use a tested survival library for those cases rather than expanding this teaching loop into a production estimator.
Kaplan–Meier is a baseline, not an assumption-free correction. It requires a defensible independent-censoring interpretation for the population or strata being estimated. Show confidence intervals and numbers at risk with a real curve. With little follow-up, a visually flat tail can reflect a depleted risk set rather than reliable equipment. Do not extend a maintenance claim beyond supported observation.
Match the metric to the maintenance question
| Question | Candidate measure | Boundary |
|---|---|---|
| Does risk rank earlier failures higher? | Concordance; consider IPCW concordance | Harrell concordance can be optimistic with substantial censoring; not a horizon-specific probability check |
| Can we distinguish failures by the chosen horizon? | Cumulative/dynamic AUC | Requires supported times, event/control counts and a defensible censoring model |
| Are predicted survival probabilities useful? | Time-dependent Brier score | Measures probability error, not calibration alone; supply survival probabilities rather than arbitrary risk scores |
| How does probability error vary across a window? | Integrated Brier score | Report the integration interval and weighting; scores across different intervals are not directly comparable |
The scikit-survival evaluation guide explains these distinctions and the inverse-probability-of-censoring weighting used by the relevant implementations. IPCW is not a remedy for every informative intervention. Marginal censoring weights may be inadequate when censoring depends on prognostic covariates.
Freeze evaluation horizons before comparing models. Use training data to estimate the censoring distribution as required by the API; keep outcome labels and fitted transformations within the existing temporal evaluation design. Check support in both training and test follow-up and require positive estimated censoring survival wherever weights are needed. Near-zero support creates unstable weights before an API necessarily raises an error. Report event counts, censoring reasons, risk-set size and exclusions alongside the metric. Shorten the supported horizon or report insufficient evidence rather than silently dropping difficult cases.
Delayed-entry estimation and delayed-entry evaluation are separate capabilities. A Kaplan–Meier fitter accepting entry does not establish that every downstream scoring function supports left truncation. The usual event/time pair does not carry entry information. Audit the exact estimator and metric APIs, or design a justified conditional landmark cohort with a statistician before scoring left-truncated data.
Release checklist and operational limits
1. Reliability owner approves the component-life boundary, event definition and exposure clock; replacement cannot recycle the previous life ID.
2. Data engineering demonstrates outcome coverage, label availability and rejection of impossible or contradictory records.
3. Statistical review documents censoring, delayed-entry and intervention assumptions; preventive replacements remain separately visible.
4. Evaluation freezes supported horizons, model predictions and censoring estimation; the report includes denominators and uncertainty, not only a leaderboard metric.
5. Operations reviews the resulting alert policy separately through alarm rationalization. Better probability estimates do not establish an actionable response or acceptable alarm workload.
More faithful labels increase implementation and review cost. Grouping by asset and shortening horizons can leave too few failures to compare models. A survival curve does not prove downtime avoided, justify an automatic shutdown or estimate the causal benefit of maintenance. Preserve the human approval boundary in the predictive-maintenance architecture.
Start with one outcome audit
Bring one component class, timestamped installations and replacements, failure definitions and the CMMS outcome export. I can help turn those records into a versioned label contract, failing validation fixtures and a horizon-support report. If follow-up or intervention history cannot support the planned decision, the useful next investment is better outcome capture—not a more complex model.
