This paper discusses modularization as a mechanism for improving the flexibility and comprehensibility of a system while allowing the shortening of its development time. The effectiveness of a “modularization ” is dependent upon the criteria used in dividing the system into modules. A system design problem is presented and both a conventional and unconventional decomposition are described. It is shown that the unconventional decompositions have distinct advantages for the goals outlined. The criteria used in arriving at the decompositions are discussed. The unconventional decomposition, if implemented with the conventional assumption that a module consists of one or more subroutines, will be less efficient in most cases. An alternative approach to implementation which does not have this effect is sketched.

Drawing upon early work by Burstall, we extend Hoare's approach to proving the correctness of imperative programs, to deal with programs that perform destructive updates to data structures containing more than one pointer to the same location. The key concept is an "independent conjunction" P & Q that holds only when P and Q are both true and depend upon distinct areas of storage. To make this concept precise we use an intuitionistic logic of assertions, with a Kripke semantics whose possible worlds are heaps (mapping locations into tuples of values).

An experiment comparing the effectiveness of the all-uses and all-edges test data adequacy criteria was performed. The experiment was designed so as to overcome some of the deficiencies of previous software testing experiments. A large number of test sets was randomly generated for each of nine subject programs with subtle errors. For each test set, the percentages of executable edges and definition-use associations covered were measured and it was determined whether the test set exposed an error. Hypothesis testing was used to investigate whether all-uses adequate test sets are more likely to expose errors than are all-edges adequate test sets. All-uses was significantly more effective than all-edges for five of the subjects, and appeared guaranteed to detect the error in four of them. Further analysis showed that in four of these subjects, all-uses-adequate test sets were more effective than all-edges-adequate test sets of similar size. Logistic regression analysis was used to investigate whether the probability that a test set exposes an error increases as the percentage of definition-use associations or edges covered by it increases. The evidence did not strongly support this conjecture. Error exposing ability was shown to be strongly positively correlated to percentage of covered definition-use associations in only four of the nine subjects. Error exposing ability was also shown to be positively correlated to the percentage of covered edges in four (different) subjects, but the relationship was weaker. Author's address: Computer Science Dept., Polytechnic University, 6 Metrotech Center, Brooklyn, N.Y. 11201. E-mail: pfrankl@poly.edu. Supported in part by NSF Grants CCR-8810287 and CCR9206910 and by the New York State Science and Technology Founda...

Fault-based testing strategies test software by focusing on specific, common types of faults. The coupling effect hypothesizes that test data sets that detect simple types of faults are sensitive enough to detect more complex types of faults. This paper describes empirical investigations into the coupling effect over a specific class of software faults. All of the results from this investigation support the validity of the coupling effect. The major conclusion from this investigation is the fact that by explicitly testing for simple faults, we are also implicitly testing for more complicated faults, giving us con dence that fault-based testing is an effective way to test software.

A consideration of several different examples sheds new light on the problem of ereat-ing reliable, well-structured programs that behave efficiently. This study focuses largely on two issues: (a) improved syntax for iterations and error exits, making it possible to write a larger class of programs clearly and efficiently without go to state-

We study the problem of certifying programs combining imperative and functional features within the general framework of type theory. Type theory constitutes a powerful specification language, which is naturally suited for the proof of purely functional programs. To deal with imperative programs, we propose a logical interpretation of an annotated program as a partial proof of its specification. The construction of the corresponding partial proof term is based on a static analysis of the effects of the program, and on the use of monads. The usual notion of monads is refined in order to account for the notion of effect. The missing subterms in the partial proof term are seen as proof obligations, whose actual proofs are left to the user. We show that the validity of those proof obligations implies the total correctness of the program. We also establish a result of partial completeness. This work has been implemented in the Coq proof assistant. It appears as a tactic taking an ann...

Constraint-based testing is a novel way of generating test data to detect specific types of common programming faults. The conditions under which faults will be detected are encoded as mathematical systems of constraints in terms of program symbols. A set of tools, collectively called Godzilla, has been implemented that automatically generates constraint systems and solves them to create test cases for use by the Mothra testing system. Experimental results from using Godzilla show that the technique can produce test data that is very close in terms of mutation-adequacy to test data that is produced manually, and at substantially reduced cost. Additionally, these experiments have suggested a new procedure for unit testing, where test cases are viewed as throw-away items rather than scarce resources. 1 INTRODUCTION This paper describes experimental results that are based on a new technique for generating test data. This technique, called constraint-based testing (CBT), uses the source code to automatically generate test data that attempts to satisfy the mutation-adequacy criteria. Elsewhere, we describe the technique [9, 12], and the details and algorithms of the implementation [29]; here we describe a set of experiments that measure CBT.

This article introduces the verification tool Why. This tool produces verification conditions from annotated programs given as input.

: : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : xiii 1. INTRODUCTION : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 1 1.1 Problem and Motivation : : : : : : : : : : : : : : : : : : : : : : : : 2 1.2 Scope of This Research : : : : : : : : : : : : : : : : : : : : : : : : : 2 1.3 Organization of This Dissertation : : : : : : : : : : : : : : : : : : : 5 2. AN OVERVIEW OF MUTATION AND DATA FLOW TESTING : : : : 9 2.1 Mutation Testing : : : : : : : : : : : : : : : : : : : : : : : : : : : : 9 2.2 Alternate Mutation Testing : : : : : : : : : : : : : : : : : : : : : : 10 2.2.1 Randomly Selected x% Mutation Testing : : : : : : : : : : : 10 2.2.2 Constrained Mutation Testing : : : : : : : : : : : : : : : : : 11 2.2.3 Other Forms of Mutation Testing : : : : : : : : : : : : : : : 12 2.3 Data Flow Testing : : : : : : : : : : : : : : : : : : : : : : : : : : : 14 2.4 Testing Tools : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 16 3. A FORMALEVALUATIONOF M...

We present a new technique for constructing a program dependence graph that contains a program’s control flow, along with the usual control and data dependence information. Our algorithm constructs a program dependence graph while the program is be-ing parsed. For programs containing only structured transfers of control, our algorithm does not require in-formation provided by the control flow graph or post dominator tree and therefore obviates the construction of these auxiliary graphs. For programs cent aining explicit transfers of control, our algorithm adjusts the partial control dependence subgraph, constructed dur-ing the parse, to incorporate exact control dependence information. There are several advantages to our ap-proach. For many programs, our algorithm may result in substantial savings in time and memory since our construction of the program dependence graph does not require the auxiliary graph. Furthermore, since we incorporate control and data flow as well as ex-act control dependence information into the program dependence graph, our graph has a wide range of ap-plicability. We have implemented our algorithm by incorporating it into the Free Software Foundation’s GNU C compiler; currently we are performing experi-ments that compare our technique with the traditional approach.