Masked Causes of Failure in Series Systems:
A Likelihood Framework

The C1–C2–C3 conditions and the basic masked-data likelihood have a substantial history in the reliability literature. Miyakawa (1984) introduced the conditions for analyzing incomplete competing risks data. Usher and Hodgson (1988) formulated the MLE problem for masked series system data under these conditions, and Usher et al. (1993) derived exact maximum likelihood estimates for exponential components. Guess et al. (1991) established that the conditions hold in many practical diagnostic scenarios and developed component reliability estimation under partial failure information. Sarhan (2001) extended reliability estimation to broader settings with masked system life data. Most of this prior work specialized to the Exponential or Weibull families.

The present paper does not claim the C1–C2–C3 conditions or the basic likelihood derivation as novel contributions. Rather, its role is to serve as a foundational reference that provides a unified treatment of the framework in a single self-contained document. The value lies in the unified presentation, the extension of the likelihood to all four censoring types (exact, right, left, and interval), the identifiability analysis, and the five-family instantiation table (Section 7). Companion papers and software packages can cite this work for the general theory while focusing on distribution-specific derivations and simulation studies.

Non-parametric competing risks methods—including the Kaplan–Meier estimator, the Nelson–Aalen cumulative hazard estimator, and the Cox proportional hazards partial likelihood—require observing which event type occurred in order to separate cause-specific hazard contributions. Masking eliminates precisely this information: the candidate set does not identify the cause, so partial likelihood and non-parametric estimators cannot be applied directly. The parametric structure of $h_j(t;{𝜽}_j)$ is what makes the problem tractable under masking—it provides enough structure for the likelihood to separate component hazards even when the data cannot. Our framework is therefore parametric by necessity (for identifiability under masking), not merely by convenience.

The remainder of this paper is organized as follows. Section 2 establishes the series system model and derives the system reliability, density, and hazard functions. Section 3 derives the distribution of the component cause of failure. Section 4 defines the observational model, including the masked data notation and a taxonomy of observation types. Section 5 presents the three conditions and derives the core likelihood contribution—the central result of this paper. Section 6 discusses maximum likelihood estimation in the general framework. Section 7 provides hazard function specifications for common parametric families. Sections 8 and 9 discuss extensions, relaxations, and concluding remarks. Table 1 summarizes the principal notation used throughout the paper.

We consider four types of observations that may arise in reliability studies of series systems (see Klein and Moeschberger, 2005, for background on censored data in survival analysis):

1. 1.

   Exact failure with candidate set. The system is observed to fail at time $t_i$, and a candidate set $c_i\subseteq \{1,\mathrm{\dots },m\}$ is observed that is indicative of the component cause of failure. When $|c_i|=1$, the cause is exactly identified; when $|c_i|>1$, the cause is masked.

2. 2.

   Right-censored. The system is still functioning at observation time ${\tau }_i$; we know only that $T_i>{\tau }_i$.

3. 3.

   Left-censored. The system has already failed before observation time ${\tau }_i$; we know only that $T_i\le {\tau }_i$. A candidate set $c_i$ may also be observed if a diagnostic is performed at inspection time ${\tau }_i$ to partially identify the failure cause.

4. 4.

   Interval-censored. The system failure occurred in the interval $(a_i,b_i)$; we know only that . A candidate set $c_i$ may accompany the observation when a diagnostic is performed at one of the inspection times.

Each observation is represented as a tuple $D_i=(s_i,{\omega }_i,c_i,{𝒙}_i)$, where:

• •

  $s_i$ encodes the observed time information: a failure time $t_i$, a censoring time ${\tau }_i$, or an interval $(a_i,b_i)$;

• •

  ${\omega }_i\in \{E,R,L,I\}$ is a label indicating the observation type: exact failure ($E$), right-censored ($R$), left-censored ($L$), or interval-censored ($I$);

• •

  $c_i\subseteq \{1,\mathrm{\dots },m\}$ is the candidate set, relevant whenever a failure is known to have occurred (exact, left-censored, or interval-censored observations). When no cause information is available, $c_i=\{1,\mathrm{\dots },m\}$. For right-censored observations (no failure observed), $c_i=\mathrm{\varnothing }$ (no component has failed); and

• •

  ${𝒙}_i$ is the covariate vector for the $i$th system (possibly empty when no covariates are recorded).

The complete data set is $D=\{D_1,\mathrm{\dots },D_n\}$, assumed to be independent draws from the observational model.

Each observation type contributes differently to the likelihood function $L(𝜽)={\prod }_{i=1}^n{L}_i(𝜽)$. The likelihood contributions depend on three conditions developed in Section 5; Table 2 previews the final results for reference.

When no cause information is available ($c_i=\{1,\mathrm{\dots },m\}$), the left-censored and interval-censored contributions reduce to the familiar forms $1-{\prod }_{j=1}^m{R}_j({\tau }_i;{𝜽}_j)$ and ${\prod }_{j=1}^m{R}_j(a_i;{𝜽}_j)-{\prod }_{j=1}^m{R}_j(b_i;{𝜽}_j)$, respectively, since ${\sum }_{j=1}^m{h}_j(t;{𝜽}_j){\prod }_{l=1}^m{R}_l(t;{𝜽}_l)=f_{T_i}(t;𝜽)$ by Equation (10).

The right-censored contribution follows directly from the system reliability function (Theorem 1). The remaining three rows—all involving a confirmed failure—require the three conditions developed in Section 5.

Figure 1 depicts the dependency structure of the data generating process. Observed quantities $(S_i,{\omega }_i,{𝒞}_i,{𝒙}_i)$ are shown as shaded nodes; latent quantities (component lifetimes $T_{i1},\mathrm{\dots },T_{im}$, the system lifetime $T_i$, and the component cause of failure $K_i$) are shown as open nodes. Solid arrows denote structural dependencies; dashed arrows denote influences that the C1–C2–C3 conditions allow us to ignore in the likelihood. The covariate vector ${𝒙}_i$ influences both the component lifetimes (through the hazard functions $h_j(t;{𝜽}_j,{𝒙}_i)$) and potentially the candidate set ${𝒞}_i$ (e.g., when the operating environment affects diagnostic quality). The conditions in Section 5 allow us to construct a likelihood that does not require modeling the distribution of ${𝒞}_i$.

Table 3 shows an example of masked data for a 3-component series system with a right-censoring time $\tau =5$. Systems 5 and 6 are right-censored (their failures were not observed before time $\tau$). System 2 has a singleton candidate set, so its cause of failure is exactly identified. The remaining failed systems have candidate sets of size 2, representing partial masking.

Our goal is to estimate $𝜽$ from observed data $D_i=(s_i,{\omega }_i,c_i,{𝒙}_i)$. When the system failure is observed (${\omega }_i=E$), we observe the system failure time $t_i$ and a candidate set $c_i$. The joint pdf of the system lifetime $T_i$ and the candidate set ${𝒞}_i$ is

While we assume the system lifetime pdf $f_{T_i}(t_i;𝜽)$ is known (up to parameters), the conditional distribution ${\mathrm{Pr}}_{𝜽}\{{𝒞}_i=c_i\mid T_i=t_i\}$ is generally unknown—it depends on the diagnostic procedure, which we do not model.

Since ${𝒞}_i$ and $K_i$ are statistically dependent, we can introduce $K_i$ into the analysis. By Theorem 4, the joint pdf of $T_i$ and $K_i$ is $f_{T_i,K_i}(t_i,j;𝜽)=h_j(t_i;{𝜽}_j){\prod }_{l=1}^m{R}_l(t_i;{𝜽}_l)$. The joint pdf of $T_i$, $K_i$, and ${𝒞}_i$ is therefore

Marginalizing over $K_i$,

The unknown conditional probability ${\mathrm{Pr}}_{𝜽}\{{𝒞}_i=c_i\mid T_i=t_i,K_i=j\}$ prevents direct use of this expression for likelihood-based inference. We now introduce three conditions that successively simplify Equation (16) until the unknown masking distribution drops out entirely.

Condition 1 is the minimal requirement for the candidate set to carry useful information about the failure cause: the true cause must not be excluded. In practice, real diagnostics work by narrowing down from the full component set—eliminating candidates that pass functional checks—rather than constructing the candidate set from scratch. Because exclusion of the true cause would require the diagnostic to affirmatively misidentify a functioning component as the sole failure site, C1 holds whenever the diagnostic is competent in this limited sense.

Two common diagnostic architectures illustrate the point. First, automotive on-board diagnostics (OBD) fault codes are generated by the failing module itself: a voltage exceedance or communication timeout triggers the code, so the candidate set inherently includes the true cause. Second, hierarchical troubleshooting trees prune branches based on pass/fail tests at each level; the true cause remains in the surviving subtree at every step unless a test yields a false negative, which is a calibration failure rather than a structural feature of the diagnostic.

In short, C1 asks for diagnostic competence—not actively wrong—rather than diagnostic precision—exactly right. Violating C1 is a pathological scenario (the diagnostic positively excludes the failed component) that would undermine any analysis, masked or otherwise.

Condition 2 is a requirement on the masking mechanism, not merely on the observed data: it must hold for all candidate sets $c_i$ that the mechanism can produce, not just the particular sets realized in the sample. When $|c_i|=1$ (a singleton candidate set), C2 is satisfied vacuously—the condition is non-trivial only when $|c_i|\ge 2$. In words, C2 requires that the diagnostic does not discriminate between components within the candidate set: given that a particular candidate set is reported, no member of that set is favored over another. Symmetry arises naturally whenever masking is determined by structural grouping—subsystem, module, or physical region—rather than by component-specific properties. Components that share a group are indistinguishable to the diagnostic precisely because the diagnostic operates at the group level.

Two additional examples reinforce this pattern. In avionics maintenance, field technicians replace line-replaceable units (LRUs): every component inside the unit is equally suspect because the diagnostic identified the unit, not the component. In industrial settings, SCADA monitoring systems report alarms at the subsystem level—e.g., “pump station fault”—without distinguishing which element (motor, valve, seal) triggered the alarm; the candidate set is the group, and all members are symmetric.

We acknowledge that C2 is the condition most likely to be violated in practice, since partial diagnostic information can make one candidate more plausible than another. When asymmetry is suspected, a practical mitigation is to redefine the candidate set at the finest resolution where symmetry still holds, effectively trading a smaller candidate set for a valid application of C2.

Condition 3 states that the diagnostic procedure’s behavior is determined by factors external to the component lifetime parameters. The masking probability ${\beta }_i$ may depend on the failure time (for exact failures, where the diagnostic is performed at or near the observed failure time), the diagnostician, the testing equipment, or other covariates—but not on $𝜽$. For censored observations, the diagnostic is performed at the inspection time rather than at the unknown failure time; see Remark 3 below. The justification is fundamentally causal: the diagnostic tool was designed and calibrated before any failures were observed, so its behavior cannot depend on the unknown $𝜽$ we are estimating. For instance, OBD voltage thresholds are hard-coded at manufacture; a vibration sensor’s frequency band is set during installation. Neither adapts to the lifetime parameters of the components it monitors.

Condition 3 is closely related to the concept of ignorability in the missing-data framework of Little and Rubin (2002). In our setting, the “missingness” is the loss of exact cause information through masking; C3 ensures that the masking mechanism is ignorable for likelihood-based inference, in the sense that the conditional distribution of the candidate set need not be modeled when maximizing the likelihood over $𝜽$ (see Little and Rubin, 2002, Ch. 6).

When covariates ${𝒙}_i$ are present, C3 requires that the masking probabilities do not depend on $𝜽$ given the covariates and failure time. If the same covariates influence both the failure rate and the diagnostic quality (e.g., an extreme operating environment that accelerates failures and also degrades sensor accuracy), the practitioner should verify that the masking mechanism remains ignorable after conditioning on ${𝒙}_i$.

To illustrate how the three conditions arise in practice, consider an electronic device with three components arranged in a series configuration. Components 1 and 2 are on a shared circuit board, while component 3 is separate. A diagnostic tool isolates the failure to either the shared circuit board or the individual component. A more detailed board-level inspection sometimes pinpoints the specific failed component; let $p\in (0,1)$ denote the probability that this inspection succeeds. The conditional probabilities for candidate sets are:

This diagnostic tool satisfies all three conditions:

• •

  C1: The candidate set always contains the failed component—the tool correctly isolates failures to the correct subsystem (each possible candidate set contains the true cause).

• •

  C2: For the candidate set $\{1,2\}$, the masking probability is the same whether component 1 or component 2 failed (both equal $1-p$). For singleton candidate sets $\{1\}$ or $\{2\}$, Condition 2 is satisfied trivially.

• •

  C3: The masking probabilities depend only on the diagnostic tool (through $p$) and not on the component lifetime parameters $𝜽$.

The parameter $p>0$ is essential for identifiability: when the board-level inspection never succeeds ($p=0$), components 1 and 2 always appear together in every candidate set and their individual parameters cannot be separated—see Section 5.8 for a detailed discussion. Any $p>0$ ensures that some observations produce singleton candidate sets $\{1\}$ or $\{2\}$, providing the information needed to distinguish the two components.

According to Guess et al. (1991), many industrial diagnostic scenarios naturally satisfy these conditions, reinforcing the practical applicability of the framework.

The C1–C2–C3 derivation in Sections 5.2–5.4 applies to any observation where a failure is known to have occurred. Equation (22) gives the joint density of the failure time and candidate set at a specific time $t_i$. For left-censored and interval-censored observations, the failure time is not known exactly, so we integrate over the admissible range.

We now assemble the full likelihood from the individual contributions (Equation (23), Theorems 7–8, and the right-censored case from Theorem 1). Let $ℰ=\{i:{\omega }_i=E\}$, $ℛ=\{i:{\omega }_i=R\}$, $ℒ=\{i:{\omega }_i=L\}$, and $ℐ=\{i:{\omega }_i=I\}$ denote the index sets of observations that are exact failures, right-censored, left-censored, and interval-censored, respectively.

Before addressing identifiability within our framework, we note the classical competing risks result of Tsiatis (1975): without the component independence assumption (Remark 1), the marginal component lifetime distributions are not identifiable from system lifetime data alone—even with complete observation of the failure cause. Our framework inherits identifiability from the independence assumption, which allows the system reliability to factor as a product of component reliabilities (Theorem 1). Given independence, the identifiability question reduces to whether the observed candidate sets provide enough information to separate the component parameters.

The following theorem shows that separability is the key condition governing identifiability under C1–C2–C3.

Part (a) states that diagnostically confounded components are fundamentally unresolvable: the likelihood surface has a ridge along all reparametrizations of the confounded pair, producing an infinite family of equivalent maximizers rather than a unique MLE. Part (b) provides a checkable condition: the analyst needs only inspect the candidate-set structure $𝒮$ to verify separability.

The MLE is found by solving the score equations

for each parameter ${\theta }_{j,r}$ (the $r$th element of the $j$th component’s parameter vector). In general, these equations do not admit closed-form solutions and must be solved numerically using methods such as Newton–Raphson or quasi-Newton algorithms (Nocedal and Wright, 2006; Byrd et al., 1995).

Under standard regularity conditions (which must be verified for each specific distribution family)—including identifiability, smoothness of the log-likelihood, and the true parameter lying in the interior of the parameter space—the MLE is consistent, asymptotically normal, and asymptotically efficient (Casella and Berger, 2002; Lehmann and Casella, 1998). That is, as $n\to \mathrm{\infty }$, $\widehat{𝜽}\stackrel{𝑝}{\to }{𝜽}_0$ (the true parameter) and $\sqrt{n}(\widehat{𝜽}-{𝜽}_0)\stackrel{𝑑}{\to }𝒩(\mathrm{𝟎},{ℐ}^{-1}({𝜽}_0))$, where $ℐ({𝜽}_0)$ is the per-observation Fisher information matrix. For finite samples, these asymptotic approximations may be inaccurate, and bootstrap methods (e.g., the bias-corrected and accelerated method (Efron, 1987; Efron and Tibshirani, 1994)) provide a nonparametric alternative for constructing confidence intervals.