Software fault localization, the act of identifying the locations of faults in a program, is widely recognized to be one of the most tedious, time consuming, and expensive – yet equally critical – activities in program debugging. Due to the increasing scale and complexity of software today, manually locating faults when failures occur is rapidly becoming infeasible, and consequently, there is a strong demand for techniques that can guide software developers to the locations of faults in a program with minimal human intervention. This demand in turn has fueled the proposal and development of a broad spectrum of fault localization techniques, each of which aims to streamline the fault localization process and make it more effective by attacking the problem in a unique way. In this article, we catalog and provide a comprehensive overview of such techniques and discuss key issues and concerns that are pertinent to software fault localization as a whole.

A Survey on Software Fault Localization

Maintainers of old code often need to discover where particular program features are implemented. This paper presents a method, called ‘software reconnaissance’ for answering this question through an analysis of the execution of different test cases. The method is quite easy to implement, requiring only a test coverage monitor, some simple tools, and a surprisingly small number of test cases.



A statistical case study is presented that shows the kind of results that can be obtained on a typical medium-sized program. The method seems to be effective in identifying a small number of code components that are unique to a particular program feature, though it may not find all components that make up the feature's delocalized plan. A small protocol case study shows that professional programmers can learn to use the method quickly and can use the information that it produces.



Software reconnaissance may be a simple but useful addition to the maintainer's tool kit in that it provides starting points for understanding a large program and a way of recovering some requirements traceability information from old code. For the researcher, it also provides a novel functionality ‘view’ of software that maps features to program components at different levels of precision.

Software reconnaissance: mapping program features to code

Finding a fault in a program is a complex process which involves understanding the program's purpose, structure, semantics, and the relevant characteristics of failure producing tests. We describe a tool which supports execution slicing and dicing based on test cases. We report the results of an experiment that uses heuristic techniques in fault localization.

Fault localization using execution slices and dataflow tests

The paper presents an overview of the role of concepts in program comprehension. It discusses concept location, in which the implementation of a specific concept is located in the code. This process is very common and precedes a large proportion of code changes. The paper also discusses the process of learning about the domain from the code, which is a prerequisite of code reengineering. The paper notes the similarities and overlaps between program comprehension and human learning.

/pdf/the-role-of-concepts-in-program-comprehension-38p11yjfyl.pdf

The role of concepts in program comprehension

The performance of fault localization techniques is critical to their adoption in practice. This paper reports on an empirical study of a wide range of fault localization techniques on real-world faults. Different from previous studies, this paper (1) considers a wide range of techniques from different families, (2) combines different techniques, and (3) considers the execution time of different techniques. Our results reveal that a combined technique significantly outperforms any individual technique (200 percent increase in faults localized in Top 1), suggesting that combination may be a desirable way to apply fault localization techniques and that future techniques should also be evaluated in the combined setting. Our implementation is publicly available for evaluating and combining fault localization techniques.

An Empirical Study of Fault Localization Families and Their Combinations

Software development is a complex and error prone process. As a result of this process, much time is spent debugging software. This debugging process actually consists of two activities, fault localization and repair. For most problems, much of the debugging effort is devoted to fault localization. In this paper, current fault localization techniques are surveyed and a new technique called relational path analysis is proposed. Relational path analysis suggests that there exists information associated with stored execution paths of programs that, when analyzed heuristically, can localize faults with statistical significance. This paper presents a set of candidate heuristics for relational path analysis and the results of an experiment utilizing the heuristics. Conclusions regarding the effectiveness and usability of this technique and future research in this area are also discussed.

Larry Cousins

Papers

Towards automatic software fault location through decision-to-decision path analysis