Perturbation analysis involves changing the data state at a location in an executing program and determining the effect of that change on the program's remaining computation. This technique has been used to estimate propagation rates during fault sensitivity analysis, and also to compare test sets and testing strategies. This paper describes an error flow model that allows emphasis to be placed on propagation analysis, which is implemented using data state perturbation. A perturbation-adequate testing strategy is defined that is similar in concept to mutation testing, and some results are presented that support the coupling effect and the consistency of perturbation-adequate testing. Some observations are made that relate mutation to perturbation.

We define the information content of test set T with respect to a program P to be the degree to which the behavior of P on T approximates the overall behavior of P. Informally, the higher the information content of a test set, the greater the likelihood an error in the data state of a program will be manifested under testing.Perturbation analysis injects errors into the data state of an executing program and traces the impact of those errors on the intervening states and the program's output. The injection is performed by perturbation functions that randomly change the program's data state. Using perturbation analysis we demonstrate that different test sets may satisfy the same testing criterion but have significantly different information content.We believe that "consistency of information content" is a crucial measure of the quality of a testing strategy. We show how perturbation analysis may be used to assess individual testing strategies and to compare different testing strategies.The "coupling effect" of mutation testing implies that there is little variation among mutation-adequate test sets for a program. This implication is investigated for two simple programs by analyzing the variation among several mutation-adequate test sets.

No abstract available.

Formulas for estimating the probability of failure when testing reveals no errors are introduced. These formulas incorporate random testing results, information about the input distribution; and prior assumptions about the probability of failure of the software. The formulas are not restricted to equally likely input distributions, and the probability of failure estimate can be adjusted when assumptions about the input distribution change. The formulas are based on a discrete sample space statistical model of software and include Bayesian prior assumptions. Reusable software and software in life-critical applications are particularly appropriate candidates for this type of analysis.>

A theory of fault-based program testing is defined and explained. Testing is fault-based when it seeks to demonstrate that prescribed faults are not in a program. It is assumed that a program can only be incorrect in a limited fashion specified by associating alternate expressions with program expressions. Classes of alternate expressions can be infinite. Substituting an alternate expression for a program expression yields an alternate program that is potentially correct. The goal of fault-based testing is to produce a test set that differentiates the program from each of its alternates. A particular form of fault-based testing based on symbolic execution is presented. In symbolic testing, the output from the system is an expression in terms of the input and the symbolic alternative. Equating this with the output from the original program yields a propagation equation whose solutions determine those alternatives which are not differentiated by this test. Since an alternative set can be infinite, it is possible that no finite test differentiates the program from all its alternates. Circumstances are described as to when this can be decided.>

The principles of data abstraction facilitate maintenance and enhance software reliability. However, FORTRAN includes features that undermine data abstraction. A FORTRAN preprocessor called FAD enforces data abstraction when reusing FORTRAN-callable subprograms. Using FAD, reusable software is organized as the implementation of abstract data types (ADTs). FAD users access the reusable software by declarations and subprogram invocations based on the ADTs. The FAD preprocessor translates ADT references into FORTRAN code and prohibits inappropriate manipulation of ADT instances. With the FAD system, ADT implementations can be changed without changing FORTRAN code that uses the ADTs. A maintenance strategy using FAD facilitates detailed control of reusable software.>