The product passed 1,000 temperature cycles from -40°C to +85°C. The test was run correctly, by a qualified laboratory, with calibrated equipment, according to the test plan. The results were clean — no failures, no parametric drift, no anomalous behaviour. The customer accepted the qualification. The product shipped.
Eighteen months later, field failures started appearing in units installed in outdoor enclosures in central Europe. The failure mode was solder joint cracking at the interface between the processor BGA and the PCB. The qualification test had cycled the product at 5°C/min ramp rate. The field environment — an unheated metal enclosure in an industrial park — experienced daily thermal cycles from -15°C at night to +65°C in the sun, with ramp rates determined by solar heating and natural convection: approximately 15°C/min on fast-heating summer days.
The lab test was too slow. Not wrong — too slow. The test applied the right temperature range at the wrong rate, which underestimated the mechanical stress per cycle. The product had enough fatigue life to pass the lab test and not enough to survive the field environment.
Why tests pass and products fail
There are five distinct reasons a product can pass an environmental test and subsequently fail in service. Understanding which one applies determines the corrective action.
1. The test conditions did not match the field environment. The example above. The test plan described conditions derived from a standard's default values rather than from measured data from the actual deployment environment. The standard's defaults are conservative for many applications and non-conservative for others. The only way to know which applies to your product is to measure the field environment — or find data from similar applications — before writing the test plan. MIL-STD-810 is explicit about this: the correct approach is to derive test conditions from measured life cycle data, not to use the method's default values as a substitute for measurement. The tailoring methodology is covered in MIL-STD-810: The Defense Standard That Tells You How to Design the Test, Not Just Run It.
2. The test applied the wrong failure mechanism. Temperature cycling targets CTE mismatch fatigue — the progressive cracking of solder joints from differential expansion. Thermal shock targets brittle fracture — the instantaneous cracking of ceramic components and glass-to-metal seals from steep gradients. If the field environment produces fast thermal transitions (panel doors opening, moving from storage to operation), and the qualification test was a temperature cycling profile at 5°C/min, the test did not evaluate the product's resistance to the failure mode that the field environment creates. The distinction between temperature cycling and thermal shock — and the failure modes each targets — is at Thermal Shock Testing: Why Slow Ramps Miss the Failures That Matter.
3. The acceleration factor was wrong. Accelerated tests apply more stress per unit time than the field environment to compress the test duration. The acceleration factor — how many field hours one test hour represents — is derived from a physical model (Arrhenius for electrochemical degradation, Coffin-Manson for fatigue, inverse power law for mechanical wear). If the model parameters are wrong, the acceleration factor is wrong, and the test duration is wrong. A test that was supposed to represent 10 years of field life may have represented 3 years. The product had 3 years of fatigue life. It failed in year 3.
4. The product that was tested was not the product that was shipped. The qualification samples were built from a pre-production batch with a different PCB laminate, a different solder paste, or a different reflow profile than the production version. The production variant had different mechanical properties at the solder joint. The test results did not transfer to the product the customer received.
5. The field usage was outside the qualified envelope. The product was qualified for -20°C to +70°C. Customers installed it in environments that reached -30°C. The product was qualified for 500 thermal cycles. After 5 years of operation, some units had experienced 1,500 cycles. The qualification was correct for the specified application. The application in the field was not the one that was specified.
How to close the gap before it produces a field failure
The most reliable way to prevent this class of failure is to measure the actual field environment before writing the test plan, and to verify the acceleration model against field data from similar products before accepting it as valid. Both of these steps are more expensive than applying standard default conditions. Both of them cost less than a field failure investigation, a customer return programme, and a redesign.
If field measurement is not feasible, the next best approach is to test at more conservative conditions than the standard requires — faster ramp rates, wider temperature range, more cycles — and document the conservatism explicitly in the test plan. A product that passes a more severe test than the field environment requires has a positive margin. The magnitude of that margin may not be known, but its existence provides some insurance against the field environment exceeding expectations.
What to do when field failures appear after a qualification pass
First, characterise the failure mode physically — not electrically. Open the failed units. Look at the solder joints under optical and SEM microscopy. Identify where the crack initiated and how it propagated. The crack morphology tells you the failure mechanism: fatigue cracks have a characteristic striated appearance; brittle fracture looks different; corrosion-driven failures look different again. You cannot identify the correct root cause or design the correct corrective test without knowing the failure mechanism at the physical level.
Second, reconstruct the field environment experienced by the failed units. How many cycles? What temperature range? What ramp rate? What humidity? In what sequence? This data — usually available from installation records, climate data, and customer usage logs — tells you what the product actually experienced relative to what was tested.
Third, verify that the qualification test would have caught the failure mode at the field conditions. Run the field conditions in the lab on a sample of units from the same production lot as the failures. If they fail in the same way at the same life consumed, the test was valid but the field environment exceeded the qualified envelope. If they do not fail, the test was not representative of the failure mechanism. The HALT programme — which applies stresses beyond the qualified operating range specifically to discover failure modes before they appear in the field — is the test designed to prevent this scenario. The HALT methodology is covered in HALT Testing: The Test Designed to Break Your Product.