The €40M problem: why the most expensive engineering failures are invisible until they're not

There's a category of engineering failure that never appears in an incident report. No alerts, no error logs, no outage. It manifests as a line in the annual accounts — a warranty reserve larger than it should be, held with more uncertainty than it needs, because the engineering organisation cannot predict something that is, in principle, entirely predictable. The version worth examining: a €40M annual warranty over-reserve held by a mid-market medical imaging company against unplanned failures across 12,000 MRI and CT units in 34 countries. The reserve isn't the product of unreliable equipment. It's the product of an architectural gap — the absence of a unified telemetry pipeline that would make failure prediction solvable. The data exists. It's just sitting in six different regional systems with six different schemas, inaccessible to any model that could act on it.

€40M isn't interesting because it's an unusually large number — for a €1.2B revenue company running a complex deployed fleet, it's a fairly contained overrun. It's interesting because it's representative of a pattern across industries: the most expensive engineering failures are usually not system failures. They're architectural gaps — missing components that would be straightforward to build, if the decision had been made to build them. The cost isn't a catastrophic event. It's the accumulated cost of not being able to predict, and therefore prevent, a class of events happening continuously and quietly across a large deployed base.

"We don't have predictive maintenance" is a symptom, not a cause. The structural reason: the absence of a unified telemetry schema. Each MRI unit generates DICOM service events — standardised medical imaging protocol messages carrying operational telemetry alongside clinical data: operating temperature, gradient coil usage, RF amplifier power, cryogen top-up records, error codes that correlate with future failure modes. The data is rich and the fleet is large enough that a regression model trained on it would have real statistical power. But the events land in six different regional service management systems — Central Europe, Southern Europe, APAC, North America, Middle East, rest-of-world — each with its own field naming, its own error-code schema, its own aggregation logic applied before storage. The signals that would feed a Remaining Useful Life model are present. They're just not comparable across regions, and no single system sees the whole fleet.

The reserve exists not because failures are unpredictable in principle, but because they're unpredictable in practice given the current data architecture. Unable to model failure distribution, the finance team applies a conservative actuarial estimate based on industry failure-rate statistics and historical claims pattern. The reserve is larger than it needs to be because the uncertainty is larger than it needs to be — and the uncertainty is larger than it needs to be because the data architecture was never designed with cross-fleet predictive analytics in mind. That decision, made differently at the start, would have cost a fraction of what the reserve now costs annually.

The fix isn't a new model. It's a unified asset event pipeline that normalises the six regional schemas into one comparable signal, feeding a Remaining Useful Life model that can finally see the whole fleet at once — at which point the architectural gap closes and the reserve becomes a number the finance team can actually defend, instead of a number they're forced to guess.

Further reading: ISO 13485:2016, Medical devices — Quality management systems, §7.5. · DICOM Standard, Digital Imaging and Communications in Medicine. · Google Cloud, Pub/Sub and Dataflow documentation. · Liu, F.T., Ting, K.M., & Zhou, Z-H. (2008). Isolation Forest. IEEE ICDM.