The Jelinski-Moranda Model
Published in 1972, the Jelinski-Moranda model is widely considered the first formal software reliability model. Rather than a continuous NHPP curve, it models the times between individual failures directly, with the hazard rate dropping by a fixed step each time a fault is fixed.
The model that started the field
Jelinski and Moranda modeled software failures as a Markov process: a fixed number of faults exist, each fault contributes equally to a constant hazard rate, and every time a fault is found and fixed, the hazard rate drops by an equal step. It's simple, historically foundational, and still used as a baseline against which newer models are compared.
Times-Between-Failures (Markov)
Rather than a mean value function over continuous time, this model works directly with the interval between consecutive failures.
1972 — Jelinski & Moranda
Often cited as the origin point of formal, quantitative software reliability modeling.
Foundational, Rarely Used Alone
Valuable for teaching and comparison, but its rigid assumptions mean it's rarely the sole model relied on for production decisions today.
How the Jelinski-Moranda Model works
The model expresses the hazard rate between the (i−1)th and ith failures as directly proportional to the number of faults still remaining in the software.
Hazard Function Between Failures
Each time a fault is fixed, the count of remaining faults drops by one, so the hazard rate steps down by exactly φ after every fix.
- Z(tᵢ) — the (constant) hazard rate during the interval before the ith failure
- N — the total number of faults present at the start of testing
- φ — the per-fault hazard rate contribution (a proportionality constant)
- i — the index of the current failure interval
Time-Between-Failures Distribution
Because the hazard rate is constant within each interval, the time until the next failure follows a simple exponential distribution.
- Tᵢ — the random time between the (i−1)th and ith failures
- The mean of Tᵢ is 1 / Z(tᵢ), so intervals get longer as faults are removed
- N and φ are the same parameters as the hazard function
Key Assumptions
These assumptions are stricter than most later models, which is part of why later work (Moranda Geometric, Littlewood-Verrall) exists to relax them.
- A fixed, known total number of faults N exists at the start of testing
- Every fault is equally likely to cause a failure (equal severity)
- Failure times are independent and exponentially distributed
- Fault repair is instantaneous, perfect, and never introduces new faults
- The hazard rate decreases by exactly the same fixed step φ after every single fix
Parameter Estimation
N and φ are estimated using maximum likelihood estimation over the sequence of observed inter-failure times. Because the model only has two parameters, it can technically be fit with very few data points — though estimates become unstable with fewer than roughly 10-15 observed failures.
- N — the total fault count, inferred from how the intervals between failures lengthen over time
- φ — the size of the step-down in hazard rate after each fix
Strengths, limitations, and best fit for the Jelinski-Moranda Model
Simple, transparent, and historically foundational
Its assumptions are easy to state and explain, and it remains a standard baseline against which every later times-between-failures model is compared.
Equal-severity assumption rarely holds
Real faults vary widely in how often they're triggered; the assumption that every fault contributes an identical, fixed amount to the hazard rate is often too rigid.
Small clean data sets
Most valuable as a baseline or teaching tool rather than a sole production model on modern, complex codebases.
Needs individual failure timestamps
Unlike interval-count models, Jelinski-Moranda needs the actual time of each individual failure, not just grouped counts per testing period.
Learn about other models.
Start with Requs Trend demo or a discussion of your current reliability growth modeling approach.