Chapter 15. Reliability of Nondeterministic Systems

Learning objectives

After this chapter you should be able to:

Compute failure intensity, MTTF and R(t), and fit a Goel–Okumoto growth model to weekly defect counts, with the uncertainty in expected remaining faults.
Build an operational profile and explain why reliability is measured against use.
State the three load-bearing assumptions of reliability growth modeling and distinguish failing to meet one from being new.
Explain how regeneration, model-calling components and correlated verification layers violate them, and where the classical models still apply.
Estimate the reliability of a nondeterministic component from repeated trials, with a Wilson interval and the rule of three.
Measure what a second verification layer adds, using seeded defects, incremental detection, the joint miss rate and a correlation.

Opening case

A composite case, not a real engagement.

Marcus and Aiko, who maintain Dispatch (Chapter 14), are two months from a release. They have rebuilt the customer-notification module with coding agents. At each stage of a delivery the system sends the customer a short message, which the module composes by calling a large language model (LLM).

The chapter continues from here.

What the chapter covers

15.1 The classical method
- 15.1.1 What reliability means
- 15.1.2 The operational profile
- 15.1.3 Reliability growth: the Goel–Okumoto model
- 15.1.4 Service levels and what the classical models got right
15.2 The assumption it depends on
15.3 What agents change
- 15.3.1 What does not change: frozen code
- 15.3.2 Violation 1: components that call models
- 15.3.3 Violation 2: churn
- 15.3.4 Violation 3: layers that share blind spots
- 15.3.5 The saturation critique
- 15.3.6 How strong is the evidence?
15.4 The verdict
15.5 What replaces it: reliability measured per baseline
- 15.5.1 Repeated-trial reliability with confidence intervals
- 15.5.2 Churn-aware growth modeling
- 15.5.3 Measuring what a second layer adds
- 15.5.4 The same example, side by side
15.6 Lab: Reliability of your system
15.7 What would make this verdict false

Lab and prediction

Lab: Reliability of your system

Feeds milestone M6. How the labs fit the project

The lab tests this prediction from the working paper the book grows from (Smith 2026a):

P10 Verification layers built on the same model show correlated failures, so observed failure rates exceed p^k

This chapter's own prediction: A growth-model forecast fitted on one baseline undershoots the defect count observed after a regeneration by more than its Poisson limit allows.

A result that contradicts a prediction, honestly reported, is a result. You are graded on accurate records and reasoned interpretation, not on agreeing with the book.

Summary

Reliability is the probability of failure-free operation in a stated environment: R(t) = e^(−λt) and MTTF = 1/λ for constant λ. The Goel–Okumoto model fits the fall in failure intensity during testing; on the worked data, about 90 faults, about 20 remaining, with a wide interval.
Load-bearing assumptions: the program is fixed between fixes; execution is deterministic; failures are independent. The verdict rests on regeneration, model-calling components and same-model layers not meeting them, not on their being new.
Evidence: frozen agent-written code still fits. Nondeterminism of model calls is measured for code generation; correlated failure is measured classically and projected for AI review layers; churn is structural.
Compounding and saturation: five steps at 95% succeed 77% of the time; 20 items at p = 0.1 give an 88% chance of at least one defect.
Verdict: breaks for model-calling components, fits that span regeneration, and p^k claims about untested layers; it holds for frozen deterministic code on a fixed baseline.
Replacement: repeated-trial estimates with Wilson intervals and the rule of three; growth models scoped to one baseline; a measured joint miss rate, correlation and incremental detection for each layer. A correlated layer still added 40% detection while p^k failed.

Key terms

Operational profile: the operations a system performs and the probability of each in use (Musa 1993).Also used in 13, 16
Goel–Okumoto model: nonhomogeneous Poisson growth model, m(t) = a(1 − e^(−bt)); a is expected total faults, b the per-fault detection rate.
Wilson interval, rule of three: an interval for a proportion with good coverage at small n; with no failures in n trials, the 95% upper bound on the failure probability is about 3/n.Also used in 13, 17
Baseline-scoped fit: a growth-model fit restricted to the period when program, model, prompts and configuration were unchanged.
Joint miss rate, φ: the fraction of defects missed by every layer; the correlation between two layers' miss indicators.Also used in 1, 11, 12, 16, 18
Incremental detection: the share of one layer's misses that another layer catches (Chapter 16, condition 1).Also used in 1, 5, 7, 9, 11, 12, 16, 18

Connections

Where this chapter and another point to each other most often.

Chapter 2: The Assumption Audit: A Method That Outlasts the Tools
Table 15.3 gives each and what its negation does to the output (Section 2.3).
Chapter 6: Cost and Schedule Estimation After COCOMO
From Chapter 6: Reading faster looks cheaper but only moves the cost into rework and defects, which ρ and Chapter 15's reliability analysis will catch later.
Chapter 12: Reviews: Inspecting Evidence, Not Diffs
Agent authorship changes what faults look like (Chapter 12) and may change a and b, not what the model assumes.
Chapter 13: Testing, Evaluation, and Tests as Steering
A model-based judge brings its own errors into your estimate (Chapter 13). 3.
Chapter 14: Configuration Management When Agents Commit
Measure what a second verification layer adds, using seeded defects, incremental detection, the joint miss rate and a correlation. ## Opening case A composite case, not a real team. Marcus and Aiko, who maintain Dispatch (Chapter 14), are two months from a release.
Chapter 16: Roles and the Four Conditions for Assurance
It is not a condition for a layer to be useful: a correlated layer can still catch defects the first missed (Chapter 16, condition 1).
Chapter 18: Running the Whole Life Cycle: The Engineer as Manager of an Agent Team
From Chapter 18: Eight activities fill the manager's week: specify (Chapter 4), decompose (Chapters 7 and 11), assign (Chapters 8 and 16), review evidence packages (Chapter 12), verify (Chapters 13 and 15), decide (Chapters 7 and 14), escalate (Chapters 16 and 17) and record.

See it on the map

15 Reliability of Nondeterministic Systems