Case #005: The HALT Programme Nobody Stopped.

01The programme

The company had twelve employees and one product — a connected industrial sensor that had taken two years to develop. The Series A round had closed three months earlier. The term sheet included a milestone: completion of HALT testing before the next board meeting.

The CTO had heard of HALT. He knew it involved temperature and vibration. He knew it was supposed to find weaknesses in hardware. He had read that it was used by defence contractors and that companies like Apple and Qualcomm used accelerated testing in their development programmes. He was confident it was the right thing to do.

He contacted a test laboratory. The laboratory had a HALT chamber. They quoted a three-day slot. The CTO booked it.

There was no test plan. There were no defined operating limits. There were no stop criteria. The programme consisted of a booking, a date, and an expectation that the laboratory would handle the rest.

02What HALT is for

HALT — Highly Accelerated Life Testing — is a methodology for finding design weaknesses before a product reaches production. The process applies stepped stress — increasing temperature and vibration incrementally — while monitoring the product's functionality. The goal is to find the stress levels at which the product begins to malfunction.

Two limits are defined in the process. The Operating Limit is the stress level at which the product loses functionality — but recovers when the stress is removed. This is a soft failure: the product has revealed a weakness but has not been permanently damaged. The Destruct Limit is the stress level at which the failure is permanent — the product does not recover when the stress is removed.

03What happened in the chamber

The laboratory received the device on a Tuesday morning. The CTO had sent three units — the only three fully built samples the company had. He had not sent a functional test procedure. He had not defined what "functioning" meant — which outputs to monitor, which parameters to log, which deviations from nominal would constitute a failure.

The laboratory's test engineer was experienced. He had run hundreds of HALT programmes. He knew that the absence of a test plan was a problem. He called the CTO before starting.

The conversation was brief. The CTO said the device should work at all temperatures. He said it should survive. He said to run it hard — the investors wanted to see results. The test engineer made notes. He wrote down what he had been told. He began the test.

Temperature step stressing began at ambient and stepped in 10°C increments, with a dwell at each step for functional monitoring. The device was connected to a laptop running the company's own software — the only way to monitor its outputs, because nobody had provided a separate test fixture or monitoring protocol.

At +85°C, the device stopped transmitting data. The test engineer logged it. He reduced the temperature. The device recovered. He logged the recovery. This was the Upper Operating Limit — the product had revealed a thermal weakness at +85°C.

He called the CTO. The CTO asked him to keep going — to find out what it could really handle. The test engineer explained that they had found the Operating Limit and that continuing would risk permanent damage. The CTO said that was acceptable. He wanted to know the Destruct Limit too.

The test engineer continued. At +105°C, the device stopped transmitting and did not recover when the temperature was reduced. A component on the board — a voltage regulator — had failed irreversibly. The sample was destroyed.

The test engineer moved to the second sample. Cold step stressing. At −45°C, the device lost communication. It recovered when the temperature rose. Lower Operating Limit: −45°C. He reported the finding.

The CTO asked him to continue. At −65°C, a ceramic capacitor cracked. The second sample was destroyed.

The third sample was used for vibration testing. It failed at 18 Grms — the vibration Operating Limit. The test engineer stopped. He did not continue to the vibration Destruct Limit. He had one sample left and no way to replace it.

04The result nobody wanted

The laboratory issued a report. It listed the Operating Limits found: +85°C upper thermal, −45°C lower thermal, 18 Grms vibration. It noted that two samples had been destroyed during destruct limit exploration. It noted that no functional test procedure had been provided and that monitoring had been conducted using the company's own software via USB.

The CTO presented the results to the board. The board asked a question he had not anticipated: what are the product's design specifications?

The product was specified for operation from −20°C to +60°C. The Upper Operating Limit found in HALT was +85°C — a margin of 25°C above the upper specification. The Lower Operating Limit was −45°C — a margin of 25°C below the lower specification. The vibration Operating Limit was 18 Grms — substantially above the typical operating environment.

The margins were actually reasonable. The product had more robustness than the CTO had realised.

But two of the three samples had been destroyed finding information that was not necessary to find. The weakness at +85°C had been identified and characterised. Continuing to +105°C had destroyed a sample and produced a data point — the Destruct Limit — that was useful context but not required for the programme's purpose. The Lower Operating Limit at −45°C had been found. Continuing to −65°C had destroyed a second sample and cracked a capacitor that the design team now had to investigate, repair, and re-test.

The company had three samples. Two were gone. The next build was six weeks away. The milestone had been met — technically — but the programme had consumed resources it did not need to consume and produced damage it did not need to produce.

05Root cause

No test plan existed before the programme started. A HALT programme without a test plan is a chamber running on a schedule. The test plan is where operating limits are defined — or, when they are unknown, where the methodology for finding them is specified. Without a plan, the test engineer had no documented stop criteria. He stopped where his professional judgement told him to stop, until the customer overrode that judgement.

Operating limits were not defined before testing began. The product had design specifications — operating temperature range, input voltage range, output parameters. These specifications are the baseline against which HALT results are interpreted. A product that fails at +85°C with a specification of +60°C has 25°C of margin. Whether that is sufficient depends on the application. Without knowing the specification, the test engineer could not interpret what he was finding — and neither could the CTO.

The CTO did not understand the difference between Operating Limits and Destruct Limits. Both are useful outputs of HALT. But they serve different purposes. Operating Limits define the product's stress margins — the information used to evaluate design robustness and to set HASS profiles if production screening is planned. Destruct Limits confirm that the product has been stressed to failure — useful context, but expensive to obtain, particularly when sample count is low. The decision to pursue Destruct Limits with limited samples, without a defined reason, consumed two samples unnecessarily.

06What operating limits are for

The Operating Limit is the most important output of a HALT programme. It tells you how far the product can be stressed before it begins to malfunction — and by implication, how much margin exists between the product's operational capability and its design specification.

A product with an Upper Operating Limit of +85°C and a design specification of +60°C has 25°C of thermal margin. If the application environment can reach +55°C, the margin to the Operating Limit is 30°C — sufficient for most applications. If the application environment can reach +75°C, the margin is only 10°C — marginal, and potentially a concern for long-term reliability.

HALT does not pass or fail products. It characterises them. The characterisation is only meaningful if the Operating Limits are compared to the design specification and the application environment. Without that comparison, HALT produces numbers without context.

The Destruct Limit is a secondary output. It is useful for understanding how far beyond the Operating Limit the product can be pushed before it fails permanently — the size of the safety margin between a recoverable failure and an unrecoverable one. For most hardware startup programmes, finding the Destruct Limit is optional. Finding the Operating Limit is not.

06What changed after

The company ran a second HALT programme six weeks later, when the next build was available. This time, the CTO worked with the test laboratory to produce a test plan before the samples arrived at the lab.

The test plan defined the product's design specification, the expected operating environment, the functional test procedure — a separate test fixture, not the laptop — and stop criteria for each stress axis. The stop criteria specified that testing would stop when an Operating Limit was found, and that Destruct Limit testing would only proceed with explicit written approval from the CTO and only if additional samples were available.

The second programme used two samples. Both were returned to the company at the end of testing. The Operating Limits found were consistent with the first programme. The capacitor weakness identified in the first programme had been addressed in the new build — the replacement component was rated to −85°C. The new Lower Operating Limit was −70°C.

The board was satisfied. The milestone was met. No samples were destroyed.