Zero Failures in a Wipe Sample: Confidence Bounds Explained

Short answer

Zero detected failures in a wipe sample does not prove that the failure probability is zero. Under a fixed-size, independent Bernoulli model, the exact one-sided upper confidence bound after zero failures is:

p_upper = 1 - alpha^(1/n)

Here, n is the number of independent checks, alpha is the chosen tail probability, and p_upper bounds the model's unknown failure probability. At 95% confidence, alpha = 0.05. With 100 checks and zero failures, the upper bound is about 2.9513%. That is a statement about a statistical model and its sampled population, not proof that a drive is clean or that inaccessible storage was sanitized.

Who this is for

This guide is for sanitization engineers, quality reviewers and ITAD teams interpreting zero-failure results. It derives the bound, supplies reproducible arithmetic and explains when the calculation does not apply. It does not prescribe a universal sampling requirement or replace media-specific acceptance criteria.

A “failure” must have a fixed operational definition: for example, a check detecting a prohibited residual pattern under a specified detection method. Failure probability is not automatically the percentage of bytes left behind. A negative detector result can also reflect limited detector sensitivity.

When to use this

Use the formula when you can defend a model with a predetermined positive sample size, independent binary outcomes, a common failure probability and a defined sampling population. Choose the confidence level and the failure criterion before looking at results.

This may be useful for a process-quality study or a policy-defined logical read-back procedure. Identify which of those you are doing. A population of device operations is different from a population of logical blocks on one device, and neither automatically includes hidden physical flash.

When not to use this

Do not apply the formula merely because a spreadsheet contains many rows. Repeated observations of one location, outcomes driven by a shared defect, selective reporting of successful runs and stopping rules chosen after seeing results can invalidate the model.

For a fixed finite population sampled without replacement, a hypergeometric model is the relevant exact starting point. A binomial approximation needs justification; it is not made exact by labeling blocks “random.” Also, this zero-failure formula does not apply once any failures have been observed. Use an appropriate general interval and investigate those failures.

Workflow

1. Define the variables and assumptions

Let X count detected failures in n checks. Each check has failure probability p, with 0 <= p <= 1. Assume the checks are independent and have the same p. Then X follows a binomial distribution.

The quantities p, alpha and p_upper are dimensionless probabilities. The sample size n is a count of defined units, not a number of gigabytes. The confidence level is 1 - alpha, with 0 < alpha < 1.

Specify the detector, address or operation population, selection procedure, exclusions and response to errors. If a read cannot complete, do not silently count it as a clean result. Record and resolve it under the acceptance policy.

2. Derive the zero-failure limit

For one check, the probability of no detected failure is 1 - p. Independence makes the probability of zero failures across all checks:

P(X = 0 | p) = (1 - p)^n

Invert this probability at the one-sided tail probability alpha:

(1 - p_upper)^n = alpha
1 - p_upper = alpha^(1/n)
p_upper = 1 - alpha^(1/n)

Larger candidate values of p would make the observed zero-failure result less likely than alpha. This is the zero-failure endpoint of an exact one-sided binomial confidence procedure, not an invented physical law of erasure.

A 95% confidence procedure has at least its stated coverage over repeated sampling under the model. It does not mean there is a 95% posterior probability that this particular drive is clean. Nor does the zero-failure maximum-likelihood estimate, p = 0, eliminate uncertainty.

Use alpha = 0.05 for this one-sided 95% bound. The upper endpoint of a two-sided 95% equal-tail interval instead uses alpha / 2 = 0.025; those are different questions and give different numbers.

3. Calculate a concrete example

For n = 100 and alpha = 0.05:

p_upper = 1 - 0.05^(1/100)
        = 0.0295130496...
        = 2.95130496... percent

With 300 checks the bound is about 0.993608%; with 1,000 checks it is about 0.299125%. All require zero detected failures and the same defended assumptions. None establish that the uninspected population contains no failures.

For a quick approximation, write the bound as 1 - exp(log(alpha)/n). When -log(alpha)/n is small, the first-order expansion gives:

p_upper approximately equals -log(alpha) / n
At 95% confidence: -log(0.05) = 2.995732...
So p_upper is approximately 3/n

The familiar “rule of three” is an approximation to this statistical bound. It is not a requirement for three overwrite passes. Use the exact expression for calculations, especially when n is small: at n = 1, the exact upper bound is 95%, while 3/n is not even a valid probability.

4. Plan the sample size before observing outcomes

To make the zero-failure upper bound no larger than a chosen probability p_target, solve the inequality for n:

1 - alpha^(1/n) <= p_target
n >= log(alpha) / log(1 - p_target)
n_min = ceil(log(alpha) / log(1 - p_target))

Both logarithms are negative, so the ratio is positive. With 95% one-sided confidence and a target of 1%, the minimum is 299 independent checks, all with zero failures. A target of 0.1% requires 2,995. These are model-based planning numbers, not recommended media-release thresholds.

This Python example performs mathematics only. It opens no device and issues no erase command:

from math import ceil, expm1, log, log1p


def zero_failure_upper(n, alpha=0.05):
    if isinstance(n, bool) or not isinstance(n, int) or n < 1:
        raise ValueError("n must be a positive integer")
    if not 0 < alpha < 1:
        raise ValueError("alpha must be between zero and one")
    return -expm1(log(alpha) / n)


def required_zero_failure_sample(p_target, alpha=0.05):
    if not 0 < p_target < 1 or not 0 < alpha < 1:
        raise ValueError("probabilities must be between zero and one")
    return ceil(log(alpha) / log1p(-p_target))


for n in (100, 300, 1000):
    print(n, f"{100 * zero_failure_upper(n):.6f}%")
print("1% target:", required_zero_failure_sample(0.01))
print("0.1% target:", required_zero_failure_sample(0.001))

The stable expm1 and log1p functions avoid subtracting nearly equal floating-point values unnecessarily. Floating-point boundary cases still deserve checking when a policy threshold is extremely close to the calculated endpoint.

5. Challenge independence and coverage

Consider a deliberately extreme counterexample: all 1,000 checks share the same binary outcome because they observe one common failure mechanism. If its failure probability is 10%, the probability of zero detected failures is 90%, not 0.9^1000, which is about 1.75 × 10^-46 under independence.

This example shows why a large row count can create misleading precision. It is not a universal recipe for replacing n with an “effective sample size.” Establish a suitable dependence model or redesign the study around independently sampled units.

Likewise, logical checks say nothing directly about storage excluded from the interface. A perfect calculation cannot add controller spare areas, inaccessible sectors or unexamined encryption-key copies to the sampling population.

Verification checklist

• Define the unit, population, detector and failure criterion before sampling.
• Record the planned sample size, selection process and confidence level.
• Justify independence and a common probability; identify clustering explicitly.
• Confirm that zero failures were actually observed, with no hidden read errors.
• Use the one-sided tail probability and retain the exact calculation.
• State excluded areas and separate the statistical result from the release decision.

Resale and evidence checklist

Retain the sanitization technique, actual completion status, errors, device identity and validation decision alongside any sampling record. A report should state “zero detected failures among n defined checks under model M,” followed by its assumptions and upper bound. Do not replace those details with “95% wiped.”

NIST SP 800-88 Rev. 2 distinguishes checking an operation's outcome from deciding whether sanitization is adequate. It does not require elaborate post-clear or post-purge content sampling unless organizational policy requires it. This formula is an optional analytical tool for a justified study, not a substitute for that decision process.

What not to publish

Do not publish customer data, recovered fragments, private device identifiers or proprietary evidence records. Do not describe this bound as a certificate, a hardware test result or proof of irreversible erasure. It also establishes no feature, certification or availability claim for forthcoming software.

Common mistakes

Reporting zero risk. Zero observations leave a nonzero upper confidence bound.

Confusing failure probability with byte fraction. The unit and selection design determine what the parameter means.

Using the two-sided tail in a one-sided calculation. Record the statistical question explicitly.

Trying multiple sample sizes and keeping the best result. The stated coverage does not automatically survive an unplanned stopping or selection procedure.

Using mathematical precision to hide scope uncertainty. More decimal places do not establish detector sensitivity or physical coverage.

CliDeck workflow fit

A runbook can require a sampling design and documented exceptions before a reviewer accepts a numerical result. Keep this calculation attached to its actual population and operation evidence. That is a process-design suggestion, not a claim that CliDeck implements this analysis or certifies any sanitization outcome.

FAQ

Is 299 checks a universal wipe-verification requirement?

No. It is the minimum for this particular 95% one-sided, 1% target, zero-failure binomial calculation. Device scope, policy and dependence may make that model unsuitable.

Does confidence mean the probability that my drive is clean?

No. The confidence statement describes repeated-procedure coverage under assumptions. It is not a posterior probability of complete device cleanliness.

Can the formula cover hidden flash?

Only a population actually included in the justified observation model can be addressed. Host-visible sampling does not prove sanitization of inaccessible physical locations.

Related guides

Compare the fixed-population random-sample analysis, review flash translation and coverage, and apply the scope distinction to SD and microSD formatting.

Verification note: arithmetic checked, no media tested

The example code, numerical bounds, minimum sample sizes and correlation counterexample were checked with Python. No drive was wiped, read or tested for this article. Operational checklists describe criteria for future evidence collection rather than completed hardware experiments.

Safety note: This guidance applies only to devices your team owns or is authorized to process. Use the approved, device-specific procedure, customer policy, and your organization’s sanitization and evidence procedures.