DORA Metrics — Definitions, the Math, and How to Measure Them

The five DORA metrics as formulas with worked arithmetic, and how Four Keys and GitLab actually compute them. Covers joins, medians, edge cases and the mistakes that distort the numbers.

Overview

Most teams that publish DORA numbers have never checked how the numbers are computed. A dashboard says lead time is 3 hours, but it is a median of daily medians over merge-to-deploy time for merge requests only. Another says recovery time is 0 hours, because the query truncates 50 minutes to zero whole hours. Change failure rate drops to 2% because staging deployments were counted as production. None of these are delivery problems; they are measurement problems, and they are what this page is about.

The concepts, the band history and the capability model are covered in the other DORA pages of this section. This page adds the arithmetic: the definition of each metric as published by DORA, the formula, the events it needs, a worked example on made-up sample data with every step shown, and the exact calculation logic of two real implementations: Google's Four Keys project (archived on January 23, 2024, but still the reference for the SQL) and GitLab's built-in DORA metrics (Ultimate tier).

> [!IMPORTANT] DORA says these metrics are meant to be applied at the application or service level, and should be used to see whether you are improving, not to compare teams, and certainly not individuals (2024 Accelerate State of DevOps report).

Symptom to first check

Lead time looks too good or too bad — Is it commit-to-deploy or merge-to-deploy, median or mean, per change or per merge request? — The five metrics; Medians, means and windows
Deployment frequency jumped with no process change — Are non-production environments in the production tier? Are rollbacks or retries counted? — GitLab's built-in calculation; Edge cases
Change failure rate is 0% or over 100% — How are incidents linked to deployments, and are duplicates counted twice? — The measurement pipeline; GitLab's built-in calculation
Recovery time reads 0 hours — Is the query truncating to whole hours? When does the clock start? — Medians, means and windows
Org-wide number hides a struggling service — Pooled ratio or average of service ratios? — Per-service versus organization aggregation
Teams argue about whose numbers are better — The metrics are being used as a target or a league table — Mistakes and anti-patterns

What you will be able to do

State the definition and formula of all five DORA metrics, including deployment rework rate, and name the events each one needs.
Compute every metric by hand on a sample month of deployments, and explain why a median and a mean of the same data differ.
Explain how Four Keys joins commits to deployments by SHA and incidents to deployments by a root-cause commit, and what its SQL truncates or drops.
Call GitLab's DORA API and know what each value means, including that monthly is a median of daily medians.
Spot the edge cases (rollbacks, hotfixes, batched deploys, multi-environment pipelines, monorepos, pull-based GitOps) and the mistakes that distort the numbers.

Key concepts

Change lead time: Time for a change to go from committed to version control to deployed in production. Four Keys: median per commit in minutes. GitLab: median seconds from merge request merge to production.
Deployment frequency: Number of deployments over a period or time between deployments. GitLab: mean of successful production deployments per day. Four Keys: Daily, Weekly, Monthly or Yearly bucket.
Change fail rate: Ratio of deployments that require immediate intervention (rollback or hotfix) after reaching production. A change stopped before production is not a failure.
Failed deployment recovery time: Time to recover from a deployment that fails and requires immediate intervention. Renamed from MTTR in 2023 to cover only change-caused failures.
Deployment rework rate: Ratio of deployments that are unplanned but made because of a production incident. Added in 2024; with change fail rate it forms the stability factor.
Deploy SHA join: Linking a deployment to the commits it shipped through the commit ID it deployed; without it lead time cannot be computed.
Root-cause link: The commit or deployment ID recorded on an incident. Four Keys parses root cause: SHA from the issue; without the link change fail rate reads 0%.
Median of daily medians: What GitLab's API returns for monthly and all intervals; it weights each day equally and can differ from the true median.
Production deployment tier: GitLab's environment tier used by DORA metrics; guessed from the name unless set with environment:deployment_tier.

When to use it

When you are setting up DORA measurement for a service and need to decide what counts as a deployment, a change, a failure and a recovery.
When a DORA dashboard (GitLab, Four Keys or a commercial tool) shows a number nobody can explain and you need to recompute it from raw events.
When leadership asks for one organization-wide number and you need to show what pooling or averaging hides.
When an interviewer asks you to explain DORA metrics with the math, or to walk a rollback through every metric.
When a team is under pressure to hit a DORA target and you need to show how the metric can be gamed.

Interview questions

DORA metrics - explain with math and measurement calculations
Why do Four Keys and GitLab use medians, and when would you still look at the mean or a percentile?
How do you join a deployment to its commits and to incidents? What breaks if the keys are missing?
What counts as a change failure? Does a rollback count? A failed pipeline?
Change fail rate and deployment rework rate look similar. What is the difference, and why did DORA add rework rate?
How does GitLab calculate DORA metrics, and what are its documented limitations?
Your VP wants to rank 20 teams by their DORA metrics and reward the top five. How do you respond?
Deployment frequency doubled overnight but nothing changed in the process. How do you debug it?
For failed deployment recovery time, when does the clock start and stop? Show how the choice changes the number.
How would you report DORA metrics for an organization with 30 services?
What were the 2024 DORA performance levels, and how should a team use them?