A vehicle that has not failed yet should not be counted as a non-failure. It is a right-censored observation: you know it survived to its current mileage, and you do not know when it will fail. Censored data survival analysis keeps that survival-to-date evidence in the likelihood, so every unfailed van still counts toward the reliability estimate. Delete those vehicles and the estimators come out biased; label them event-free and the model’s true performance is underestimated. In a reliability pipeline that runs every quarter, the job is to keep those censored vehicles in the model, flip each one to “observed failure” when it actually fails, and recalibrate automatically.
How censored data survival analysis treats a van that has not failed
The NIST/SEMATECH e-Handbook puts it in one line: when not all units on test fail, you have censored data. Industrial assets are engineered to be reliable, so failures are rare and many records end with the asset still running when data collection stops. The authors of the 2026 SurvCF paper call right censoring the dominant case in predictive maintenance, because observation windows are bounded by data collection periods and maintenance schedules.
The Scania Component X dataset records a real fleet of more than 33,000 heavy-duty trucks. Its training time-to-event file (train_tte.csv) holds 23,550 rows, with a study length and a binary in_study_repair label that is set to 1 when Component X was repaired during the study. A vehicle with a 0 had no observed Component X repair during the study, and the dataset authors note that survival analysis takes such censored data into account in training.
A censored vehicle is also not the same as an unlabelled one. Unlabelled samples carry no outcome at all, whereas a censored vehicle carries a partial label: its true failure time lies somewhere beyond its censoring time.
Right, left and interval censoring in mileage and failure records
The three censoring types differ in which part of the failure time is missing.
| Censoring type | What is known | How it appears in fleet data | Likelihood term for the unit |
|---|---|---|---|
| Right | The unit had not failed by the end of observation | Van still in service at the data cut, or removed from the fleet before failing | Survival to the last observed mileage, 1 − F(t) |
| Left | The failure happened before observation began | Component already replaced when the vehicle entered the dataset, date unknown | : |
| Interval | The failure lies within a known window | Fault found at a workshop visit; it failed somewhere since the previous readout | F(Ti) − F(Ti−1) between the two readouts |
NIST describes the general multicensored case the same way: each unit contributes either a run-time without failure, an exact failure time, or an interval within which it failed, and units can have different run-times and readout intervals.
Left truncation is a separate problem from left censoring. A truncated vehicle entered observation late, already carrying mileage, so it belongs in the risk set only from its entry point onward.
Dropping unfailed vehicles, or calling them non-failures, both distort the estimate
A survey of machine learning for survival analysis names the two naive fixes and what each costs. Deleting censored instances produces a sub-optimal model because it discards their information, and treating censoring as event-free works well only for data with few censored instances but underestimates the true performance of the model. Fleet data is the opposite case: most industrial datasets are heavily censored.
Mileage adds a further problem for deletion. Wu’s 2012 review of warranty data analysis points out that for usage-based lifetimes, such as mileage, the lifetime distribution is hard to estimate without the mileage of non-failed vehicles, because non-failed vehicles have a different usage distribution from failed ones. The review also warns that incomplete warranty claims data can produce biased reliability estimates.
Recasting the problem as binary classification (“failed in the window or not”) biases survival in a known direction. Kvamme and Borgan (JMLR, 2019) show that a binary classifier applied to right-censored data always underestimates survival, because removing censored individuals shrinks the proportion of survivors. The same classifier recovers the true curve reasonably well up to the censoring time once it is given the censoring information.
One likelihood, two kinds of vehicle
Each unit carries an observed time T = min(true failure time, censoring time), plus δ = 1 if the failure was observed and δ = 0 if the unit was right-censored. In the discrete-time censored log-likelihood the SurvCF authors use, δ switches between two terms: an observed failure contributes a high hazard at its failure bin together with survival up to that bin, while a censored unit contributes only survival past its censoring bin. NIST’s general form says the same thing for parametric models: the likelihood is a product of one term per unit, f(t) for an exact failure, an interval probability for a failure between readouts, or 1 − F(t) for a unit that survived and was not observed further.
When a vehicle fails, its row changes from δ = 0 to δ = 1, its time is updated, and its contribution moves from the survival-only term to the failure term.
How do we recalibrate the model each quarter without rebuilding it from scratch?
A quarterly cycle works as an updating step, not a rebuild: re-ingest the new mileage and failure records, update each vehicle’s censoring status, then update the existing model using the new quarter’s data, validating it out of sample before it is promoted. TechnoLynx builds quarterly survival pipelines that keep unfailed vehicles in the likelihood, starting by matching the retraining cadence to the fleet’s reporting latency, as part of its AI engineering for manufacturing and automotive.
In the 2023 study on dynamic updating of survival prediction models, intercept recalibration keeps the hazard ratios from the original Cox model and re-estimates only the baseline hazard on the new data. The same study compared that approach with refitting a new Cox model each quarter and with Bayesian dynamic updating. Earlier work it reviews found recalibration performed as well as or better than refitting, particularly when predictor relationships were stable, and updating at regular intervals outperformed a single update.
The best method depends on the size of the update data, the event rate, the model’s complexity, and whether the predictor effects have shifted. Bayesian updating, which carries forward the previous quarter’s coefficient estimates as priors with uncertainty inflated by a forgetting factor of 0.9, did best with new predictors and less data. It also cost the most compute: a single update took 12 to 24 hours on the authors’ 1,000,000-record dataset. When a quarter did not hold enough events to refit at all, the authors kept the previous period’s model, since sometimes a refit is not possible until more data has built up.
For a large fleet, the Cox partial likelihood can also be estimated by stochastic gradient descent. Tarkhan and Simon (2020) take that route for big survival data and note that extending the partial likelihood to censoring, left truncation and ties is straightforward.
If the incremental model and a full refit disagree on a held-out historical quarter by more than the team’s tolerance, investigate before promoting either.
Worked example: quarterly snapshots of a vehicle fleet
Steinberg et al. simulated the successive accumulation of fleet data over time. They trained Bayesian survival models only on workshop-service data available at successive quarterly timestamps between 2015/Q2 and 2017/Q2, and checked each one against what actually happened by 2020/Q4. Censored data was first converted into a non-parametric survival estimate as a function of total mileage using the product-limit (Kaplan-Meier) estimator, and a parametric model was then fitted to it. With each new quarter of information the posterior narrowed and converged toward the real value.
The caveat matters as much as the result. Reliable fleet failure forecasts needed 27 months of data (January 2014 to March 2017) to predict 45 months ahead, although the posterior uncertainty honestly showed how much confidence each earlier forecast deserved. Where no high-mileage vehicles had been seen yet, the model had to extrapolate from its priors, and uncertainty grew sharply when the priors were not informative. NIST makes the general point: maximum likelihood estimates only become unbiased and minimum-variance as the sample size grows.
Can the pipeline flag when a vehicle crosses from censored to observed failure?
Yes. TechnoLynx implements the censored-to-observed-failure flag within the data ingestion step. Each cycle, match new repair or replacement records against the vehicle register. Any vehicle with a qualifying event gets δ = 1 and its event mileage or time, and every other vehicle stays at δ = 0 with its latest readout as its censoring time. Scania’s labelling shows the rule in practice: a component changed or marked as repaired counts as failed, and anything else counts as healthy.
There are three things the flagging logic has to get right:
- Reporting delay. A failure enters your data only when it is reported. Survival research on reporting delays notes that ignoring them can lead to underestimating the hazard. Failures that happened this quarter but arrive next quarter make the latest vehicles look healthier than they are, so either lag the censoring date by the fleet’s typical reporting latency or model the delay explicitly.
- Left truncation. Vehicles that join mid-history enter the risk set at their entry mileage, not at zero.
- Definition drift. If the workshop changes what counts as a repair code, the δ flip changes meaning. The ingestion step should version the event definition alongside the data.
If a team has to turn censored vehicles into hard labels for a classifier, Kaplan-Meier weighting is one published approach. One approach duplicates vehicles censored before the prediction horizon as both event and event-free copies, weighted by the Kaplan-Meier probability of the event. Keeping a survival model avoids that step entirely.
Checks a recalibrated survival model should pass before it replaces the current one
A recalibrated model can regress silently after an update. This is the reliability side of production AI: drift detection and regression suites catch silent quality loss after an update that unit tests and accuracy figures miss. For a survival model with heavy censoring, the checklist looks like this:
- Use a censoring-aware concordance. Harrell’s C becomes too optimistic as censoring increases. Uno’s inverse-probability-of-censoring-weighted (IPCW) estimator stays stable and is the better choice once censoring is moderate to high. IPCW evaluation needs test times that fall inside the training data’s observed time range.
- Score calibration with a Brier score that suits your censoring. The time-dependent Brier score extends mean squared error to right-censored data and measures both calibration and discrimination. Fleet extracts cut at a known date resemble administrative censoring, where every vehicle’s censoring time is known. Under administrative censoring the IPCW Brier score can be biased and can even rank a binary classifier that ignores censored vehicles above the true survival function, so Kvamme and Borgan propose an administrative Brier score that avoids both problems.
- Keep the censoring adjustment independent of the candidate. The 2026 work on proper scoring rules for right-censored data shows that forecast-independent censoring weights preserve the true ranking of models, while forecast-dependent plug-in scores can reverse it. Fit the censoring model once, then score the current and candidate models with the same one.
- Test whether the proportional hazards assumption still holds. Intercept recalibration keeps the original hazard ratios and re-estimates only the baseline hazard. Xue et al. (2018) give an online test of the PH assumption that updates as each new data block arrives and matches the full-data test’s asymptotic distribution.
- Compare against the previous model on the same held-out quarter. This is the out-of-sample, next-period evaluation of discrimination and calibration used in the dynamic-updating study.
- Size the gate for correlated tests. These checks are not independent. In one configuration analysed in a 2026 paper on release gates, a 99% reliability target needed 8 independent tests but 74 at a latent correlation of 0.3. Among r-of-k gates that meet the target, the most lenient one keeps the most good models.
How these checks feed a promotion decision, with a registry, retraining triggers and rollback, is covered in building a drift-triggered retraining pipeline with a model registry. The same reproducible evaluation harness should run unchanged against every future candidate, so quarter-on-quarter comparisons stay comparable. Once the failure probabilities feed maintenance decisions, the questions of audit trails and ownership of the calibration itself belong to calibrating and governing probability-of-failure models.
Quarterly updates are only as good as the censoring dates feeding them
The scoring framework depends on censoring being conditionally independent of failure given the covariates, and dependent censoring can bias even the Kaplan-Meier estimator. A fleet in which vans showing early warning signs get pulled for preventive replacement breaks that assumption quietly: the vehicles most likely to fail leave as “censored”. Before tuning the update algorithm, we would check why vehicles leave observation, because no quarterly recalibration corrects for a censoring mechanism that is tied to the failure itself.
