曝光台 注意防骗
网曝天猫店富美金盛家居专营店坑蒙拐骗欺诈消费者
several occurred in more than version. We will refer to the former as non-correlated and the latter as
correlated. The details of the faults are quite complex and a complete description is beyond the scope of
this paper. We include in this section a description of two non-correlated and two correlated faults for
illustrative purposes. Recall that all the versions used in this experiment were required to pass two hundred
tests as part of the acceptance procedure. The faults described in this section all survived that acceptance
procedure.
The non-correlated faults that we describe here will be recognized as commonly occurring. They are
subtle and important nonetheless. The first was an omission by the programmer of the assignment of a
value to a function for one path through the function. This was not checked by any of the compilers used in
this experiment. The result of executing that particular path through the function was that the function
returned whatever happened to be at the memory location allocated for the result. The effect was therefore
- 15 -
implementation dependent since some implementations always initialize storage. The effect was also time
dependent since the result obtained was acceptable on some calls and not on others. In the million test
cases, this particular fault caused the version containing it to fail only 607 times.
The second non-correlated fault was the use of the wrong expression to index an array. This occurred
in several versions. The required expression was usually a single identifier, and the fault usually consisted
of using the wrong identifier. A specific example is the following function call:
sam3pts(x[i], y[i], x[j], y[i], x[k], y[k]);
The wrong index expression has been used for the fourth parameter. The correct function call is:
sam3pts(x[i], y[i], x[j], y[j], x[k], y[k]);
This particular fault caused the associated version to fail 1297 times during the one million tests. We find it
surprising that major faults such as this can occur in programs that are doing extensive manipulation of
arrays yet cause relatively few failures.
The correlated faults were, in general, far more obscure. The first example involves the comparison
of angles. In a number of cases, the specifications require that angles be computed and compared. As with
all comparisons of real quantities, the limited precision real comparison function was to be used in these
cases. The fault was the assumption that comparison of the cosines of angles is equivalent to comparison of
the angles. With arbitrary precision this is a correct assumption of course but for this application it is not
since finite precision floating point arithmetic was used and the precision was limited further for
comparison. Of the twenty seven versions written, four made this incorrect assumption. In borderline
cases this assumption was false, and this caused the associated versions to disagree with the gold program.
The number of failures attributable to this fault varied from 71 to 206 in the various versions although this
particular fault caused more than one version to fail on the same test case on only eight occasions.
- 16 -
This fault cannot be attributed to the specifications. Rather it was caused by a fundamental lack of
understanding of numerical analysis. The solution lies in a thorough analytic treatment of the arithmetic of
the machine involved, and the algorithms used in the computation of the angles and their cosines.
The second correlated fault example involved an assumption about the angle subtended by three
points. Recall that the program is required to process simulated two-dimensional radar data. The data is
presented as points in a plane expressed in Euclidean coordinates. The specifications for the problem
require the determination of whether three data points (simulated radar echos) lie on a straight line. It is
possible to determine this by examining the angle subtended by the three points, regarding one of them as
the vertex of the angle. If the angle is zero or the angle is 180 degrees, the points lie on a straight line.
Figure 1A shows the general case, and Figures 1B and 1C show the two cases where all three points lie on a
straight line. The fault made by more than one programmer is the omission of the second case.
Again, this fault cannot be attributed to the specifications. It was caused by a lack of understanding
of geometry. It is not clear how such a fault could be prevented since basically it is attributable to an
•
•
•
1
2
3
Figure 1A
• • •
1 2 3
Figure 1B
• • •
2 1 3
Figure 1C
- 17 -
incomplete case analysis. In fact, although the fundamental fault was the same in more than one version,
中国航空网 www.aero.cn
航空翻译 www.aviation.cn
本文链接地址：
航空资料35(191)
