The Rule of Three for Zero Failures

Suppose an AI agent completes 300 valid trials without a single observed failure. The empirical failure rate is zero, but rare failures can remain unseen in a finite sample. Reliability engineering needs a bound on the failure probability that could still be consistent with the result.

The exact zero-failure upper bound

If trials are independent, comparable Bernoulli opportunities with failure probability p, the probability of observing zero failures in N trials is (1 − p)^N. Setting that probability equal to α and solving for p gives the one-sided upper bound:

For a 95% bound, α = 0.05. With 300 zero-failure trials, the exact upper bound is about 0.00994, or 0.994%.

Why the rule of three works

For small probabilities, the exact expression is closely approximated by −ln(α) / N. Because −ln(0.05) is approximately 2.996, the 95% upper bound becomes:

This is the rule of three. After 100 zero-failure trials, the approximate upper bound is 3%; after 300, it is 1%; after 3,000, it is 0.1%. The approximation is memorable and increasingly accurate as N grows.

What a zero-failure result supports

A careful statement is: “No failures were observed in 300 valid trials; the approximate one-sided 95% upper bound on failure probability is 1% under the tested conditions.” This is much stronger than reporting “0% failures,” because it communicates the remaining uncertainty and the scope of the evidence.

The result does not prove that the system is failure-free, nor does it establish the same bound for different prompts, user populations, tools, model versions, or production conditions. It also does not apply if failures were missed by an unreliable judge.

Planning a zero-failure demonstration

The rule can be inverted. To make the approximate 95% upper bound no larger than a target p_target, plan for:

To support an upper bound near 1%, plan about 300 zero-failure trials. For 0.1%, plan about 3,000. This is a demonstration design: it only achieves the intended conclusion if all planned trials remain valid and no failures occur. If failures are observed, estimate the rate and use an interval appropriate for a nonzero count.

Assumptions that matter for AI systems

Independence can fail when an agent carries state between trials, a shared service degrades, or cached context affects later outcomes. Comparability can fail when the model provider silently changes versions or when the input mix drifts. A narrow set of repeated prompts may demonstrate reliability only for those prompts, not for the production population. Record conditions, reset state where appropriate, and distinguish repeated stochastic trials from coverage across diverse cases.