Complexity Metrics

Many organizations want to predict the number of defects (faults) in software systems, before they are deployed, to gauge the likely delivered quality and maintenance effort. To help in this, numerous software metrics and statistical models have been developed, with a correspondingly large literature. We provide a critical review of this literature and the state-of-the-art. Most of the wide range of prediction models use size and complexity metrics to predict defects. Others are based on testing data, the "quality" of the development process, or take a multivariate approach. The authors of the models have often made heroic contributions to a subject otherwise bereft of empirical studies. However, there are a number of serious theoretical and practical problems in many studies. The models are weak because of their inability to cope with the, as yet, unknown relationship between defects and failures. There are fundamental statistical and data quality problems that undermine model validity. More significantly many prediction models tend to model only part of the underlying problem and seriously misspecify it. To illustrate these points the "Goldilock's Conjecture," that there is an optimum module size, is used to show the considerable problems inherent in current defect prediction approaches. Careful and considered analysis of past and new results shows that the conjecture lacks support and that some models are misleading. We recommend holistic models for software defect prediction, using Bayesian Belief Networks, as alternative approaches to the single-issue models used at present. We also argue for research into a theory of "software decomposition" in order to test hypotheses about defect introduction and help construct a better science of software engineering.

This paper reports on a modest study which relates seven different software complexity metrics to the experience of maintenance activities performed on a medium size software system. Three different versions of the system that evolved over a period of three years were analyzed in this study. A major revision of the system, while still in its design phase, was also analyzed.

To produce high quality object-oriented (OO) applications, a strong emphasis on design aspects, especially during the early phases of software development, is necessary. Design metrics play an important role in helping developers understand design aspects of software and, hence, improve software quality and developer productivity. In this paper, we provide empirical evidence supporting the role of OO design complexity metrics, specifically a subset of the Chidamber and Kemerer suite, in determining software defects. Our results, based on industry data from software developed in two popular programming languages used in OO development, indicate that, even after controlling for the size of the software, these metrics are significantly associated with defects. In addition, we find that the effects of these metrics on defects vary across the samples from two programming languages-C++ and Java. We believe that these results have significant implications for designing high-quality software products using the OO approach.

Mixed model manufacturing systems are increasingly used to meet global competition by providing a broad variety of products to customers. The increase of product variety adds more complexity to production processes, thus, leading to a negative effect on the performance of production processes. Therefore, it is of great interest to effectively measure such complexity and to quantify its effect on manufacturing system performance. In this paper, a set of complexity metrics are proposed for measuring the complexity of different elements in a manufacturing system. These metrics were defined by constructing a linkage with the communication system's framework. Different from those existing complexity measures defined in the literature, this paper considers production quality into the measure of the process capability on handling the complexity induced by the input demand variety. Examples are given in the paper to discuss different properties of the defined metrics and their potential applications.

The cognitive strategies by which humans process complex, metrically-ambiguous rhythmic patterns remain poorly understood. We investigated listeners' abilities to perceive, process and produce complex, syncopated rhythmic patterns played against a regular sequence of pulses.

In the absence of an agreed measure of software quality the density of defects has been a very commonly used surrogate measure. As a result there have been numerous attempts to build models for predicting the number of residual software defects. Typically, the key variables in these models are either size and complexity metrics or measures arising from testing information. There are, however, serious statistical and theoretical difficulties with these approaches. Using Bayesian Belief Networks we can overcome some of the more serious problems by taking account of all the diverse factors implicit in defect prevention, detection and complexity.

Viewshed calculation can play an important role in urban and natural resource planning. However, difficulties exist in incorporating built structures in viewshed computation. These features are rarely reflected in available elevation maps and adding them can be complicated as their locations, shapes, and heights are often uncertain. This study examined the impact of generalizing building locations and heights on viewshed properties. We used a geographic information system and high resolution data to assess how viewsheds, generated with actual building footprints and heights, differ from viewsheds generated from generalized building locations and uniform heights. We measured differences among viewsheds created with different approaches in terms of area and landscape complexity. Viewsheds generated using uniform heights and actual footprints differed significantly from the most accurate viewsheds in their areal extents and in the areas of some land use classes. Viewsheds produced using estimated locations combined with both realistic and uniform heights differed significantly from viewsheds created with accurate data in their areal extents and areas most land use types. Viewsheds produced using estimated locations also differed significantly from more accurate viewsheds in both complexity metrics assessed. Viewsheds produced using accurate locations and uniform heights differed significantly in one complexity metric, richness, but not in a second, diversity. Therefore, it may be feasible to generalize building heights when diversity and the areas of some specific land use classes are central to viewshed analysis, but generalizing building locations is less advisable. When viewshed areal extents are critical, location or height generalization may be ill-advised.

This paper describes an experimental microprocessor-based tool, SAS (Software Analysis System), which has been developed to enable dynamic program structure acquisition and analysis to be made on digital computing machines. The system uses a universal hardware  extraction technique to obtain branch vectors which are used 10 analyze and display the structure of the software being monitored. A display, especially designed for small instrument screens, is used to present this structure. Emphasis has been directed towards development of methods with high degrees of machine independence and it is envisaged that such techniques could either be integrated into the new generation of logic analyzers or form part of a universal tool for computer programmers. Initial research has been guided towards the application of
these techniques to compiled, assembled, or machine coded systems and in this context a number of techniques are described. The motivation for this research has been provided by the present escalating software costs, in particular those in post-development which account for approximately 75% of the total software expenditure.

tivity and flexibility in output, which could result in information customization systems. Data interchange. Data interchange involves transforming information from one representation to another. Often, the same initial and target formats occur many times, as in converting documents from one word processing format to another. Sometimes, though, data must be converted to a specialized format for a one-time analysis. Typically, a program will be written to do this custom conversion. To our knowledge, no one has yet developed a tool for interactively helping a user specify initial and/or target formats. Such an artifact would be a useful information customizing tool.

Summary Business Process Models (BPMs), often created using a modeling language such as UML activity diagrams, Event- Driven Process Chains Markup Language (EPML) and Yet Another Workflow Language (YAWL), serve as a base for communication between the stakeholders in the software development process. In order to fulfill this purpose, they should be easy to understand and easy to maintain. For

A management model for explaining software errors is developed and estimated. The model is used to analyze two years of error log data at a commercial site. The focus is on identifying managerially controllable factors which affect software reliability. At the research site, application systems which (1) underwent frequent modification; (2) were maintained by programmers with low levels of application experience; (3) had high reliability requirements, and (4) had high levels of static complexity all showed particularly high error rates, other things being equal. It is suggested that that managers can make quantified judgements about the degree to which they wish to reduce error rates by implementing a number of procedures, including enforcing release control, assigning more experienced maintenance programmers, and establishing and enforcing complexity metric standards.

Web applications are increasingly subject to mass attacks, with vulnerabilities found easily in both open source and commercial applications as evinced by the fact that approximately half of reported vulnerabilities are found in web applications. In this paper, we perform an empirical investigation of the evolution of vulnerabilities in fourteen of the most widely used open source PHP web applications, finding that vulnerabilities densities declined from 28.12 to 19.96 vulnerabilities per thousand lines of code from 2006 to 2010. We also investigate whether complexity metrics or a security resources indicator (SRI) metric can be used to identify vulnerable web application showing that average cyclomatic complexity is an effective predictor of vulnerability for several applications, especially for those with low SRI scores.

The proliferation of newer agile integrative business information systems (IBIS) environments that use the software agent and the multiagent systems paradigms has created the need for a common and well-accepted conceptual modeling grammar that can be used to efficiently, precisely, and unambiguously, model agile IBIS systems at the conceptual level. In this paper, we propose a conceptual modeling grammar termed Agile Integration Modeling Language (AIML) based on established ontological foundation for the multiagent-based integrative business information systems (MIBIS) universe. The AIML grammar provides adequate and precise constructs and semantics for modeling agile integration among participating work systems in terms of quickly building and dismantling dynamic collaboration relationships among them to respond to fast-changing market needs. The AIML grammar is defined as a formal model using Extended BNF and first order logic, and is elaborated using a running example in the paper. The grammar is also evaluated in terms of its syntactic, semantic, and pragmatic qualities and is found to exhibit a high degree of quality on all these three dimensions. In particular, the pragmatic quality of AIML measured in terms of grammar complexity evaluated using complexity metrics indicates that AIML is much easier to learn and use as compared to the Unified Modeling Language (UML) for modeling agile integration of work systems in organizations. Decision Support Systems 44 (2007) 266 -284 www.elsevier.com/locate/dss ☆ The authors are grateful to Vijayan Sugumaran, participants at the SOM-Informatics Working Group seminar at SUNY Buffalo, and anonymous reviewers and attendees at the AMCIS 2003 and HICSS 2004 conferences for providing invaluable suggestions during the course of development of this paper. We are also grateful to Sukhamay Kundu for his critical evaluation of the AIML formal grammar included in the paper. ⁎ Corresponding author. Tel.: +1 716 645 3507; fax: +1 716 645 6117.

Refactoring is widely recognized as a way to improve the internal structure of a software system in order to ensure its long-term maintainability. Consequently, software projects which adopt refactoring practices should see reductions in the complexity of their code base. We evaluated this assumption on an open source system -namely PMD, a Java source code analyzer-and discovered that periods of refactorings did not affect the cyclomatic complexity. This paper investigates this counterintuitive phenomenon through a detailed analysis of the actual source code manipulations applied on the system under study.

Software metrics should be used in order to improve the productivity and quality of software, because they provide critical information about reliability and maintainability of the system. In this paper, we propose a cognitive complexity metric for evaluating design of object-oriented (OO) code. The proposed metric is based on an important feature of the OO systems: Inheritance. It calculates the complexity at method level considering internal structure of methods, and also considers inheritance to calculate the complexity of class hierarchies. The proposed metric is validated both theoretically and empirically. For theoretical validation, principles of measurement theory are applied since the measurement theory has been proposed and extensively used in the literature as a means to evaluate the software engineering metrics. We applied our metric on a real project for empirical validation and compared it with Chidamber and Kemerer (CK) metrics suite. The theoretical, practical and empirical validations and the comparative study prove the robustness of the measure.

A large number of real networks are characterized by two fundamental properties: they are small world and scale-free. A recent paper demonstrated that the structure of many complex networks is also self-similar under a length-scale transformation, and calculated their fractal dimension using the “box counting” method. We studied nine large object-oriented software systems, finding that the graphs associated to these networks are self-similar. We also studied the time evolution of the fractal dimension during system growth, finding a significant correlation between the fractal dimension and object-oriented complexity metrics known to be correlated with software fault-proneness. Thus, in software systems the fractal dimension could be considered as a measure of internal complexity, and consequently of the system quality.

Cascading style sheets (CSS) is a Web-based style sheet language that is used for the presentation of Web documents. CSS has advanced from CSS1 to CSS3.and extensions to CSS known as CSS pre-processors have also emerged in the last few years. As is the case with regular software, CSS have inherent complexity that keeps on increasing with age which is undesirable, and metrics are needed to measure with the aim of controlling it. Although several Web metrics have been proposed in the literature, the area of stylesheets is still lagging. Findings show that few CSS-related metrics exist, and there is no evidence of proof for their mathematical soundness through the popularly known frameworks such as Briand framework and Weyuker's properties. In addition, they have not been empirically validated. In order to address this gap, future studies should focus on defining and validating new metrics for CSS and its pre-processors.

Software systems are affected by degradation as an effect of continuous change. Since late interventions are too much onerous, software degradation should be detected early in the software lifetime. Software degradation is currently detected by using many different complexity metrics, but their use to monitor maintenance activities is costly. These metrics are difficult to interpret, because each emphasizes a particular aspect of degradation and the aspects shown by different metrics are not orthogonal. The purpose of our research is to measure the entropy of a software system to assess its degradation. In this paper, we partially validate the entropy class of metrics by a case study, replicated on successive releases of a set of software systems. The validity is shown through direct measures of software quality such as the number of detected defects, the maintenance effort and the number of slipped defects.

Many distributed systems lend themselves to be modelled as networks, where nodes can have a range of attributes and properties based on which they may be classified. In this paper, we attempt the task of quantifying varying levels of similarity among nodes in a complex network over a period of time. We analyze how this similarity varies as nodes implement their functional logic and node states vary accordingly. We then use information theory to analyze how much Shannon information is conveyed by such a similarity measure, and how such information varies with time. We also propose node congruity as a measure to quantify the contribution of each node to the network's scalar assortativity. Finally, focussing on networks with binary states, we present algorithms (logic functions) which can be implemented in nodes to maximize or minimize scalar assortativity in a given network, and analyze the corresponding tendencies in information content.

Information overload is a new challenge in e-commerce sites. The problem refers to the fast growing of information that lead following the information flow in real world be impossible. Recommender systems, as the most successful application of information filtering, help users to find items of their interest from huge datasets. Collaborative filtering, as the most successful technique for recommendation, utilises social behaviours of users to detect their interests. Traditional challenges of Collaborative filtering, such as cold start, sparcity problem, accuracy and malicious attacks, derived researchers to use new metadata to improve accuracy of recommenders and solve the traditional problems. Trust based recommender systems focus on trustworthy value on relation among users to make more reliable and accurate recommends. In this paper our focus is on trust based approach and discuss about the process of making recommendation in these method. Furthermore, we review different proposed trust metrics, as the most important step in this process.

The proliferation of newer agile integrative business information systems (IBIS) environments that use the software agent and the multiagent systems paradigms has created the need for a common and well-accepted conceptual modeling grammar that can be used to efficiently, precisely, and unambiguously, model agile IBIS systems at the conceptual level. In this paper, we propose a conceptual modeling grammar termed Agile Integration Modeling Language (AIML) based on established ontological foundation for the multiagent-based integrative business information systems (MIBIS) universe. The AIML grammar provides adequate and precise constructs and semantics for modeling agile integration among participating work systems in terms of quickly building and dismantling dynamic collaboration relationships among them to respond to fast-changing market needs. The AIML grammar is defined as a formal model using Extended BNF and first order logic, and is elaborated using a running example in the paper. The grammar is also evaluated in terms of its syntactic, semantic, and pragmatic qualities and is found to exhibit a high degree of quality on all these three dimensions. In particular, the pragmatic quality of AIML measured in terms of grammar complexity evaluated using complexity metrics indicates that AIML is much easier to learn and use as compared to the Unified Modeling Language (UML) for modeling agile integration of work systems in organizations. Decision Support Systems 44 (2007) 266 -284 www.elsevier.com/locate/dss ☆ The authors are grateful to Vijayan Sugumaran, participants at the SOM-Informatics Working Group seminar at SUNY Buffalo, and anonymous reviewers and attendees at the AMCIS 2003 and HICSS 2004 conferences for providing invaluable suggestions during the course of development of this paper. We are also grateful to Sukhamay Kundu for his critical evaluation of the AIML formal grammar included in the paper. ⁎ Corresponding author. Tel.: +1 716 645 3507; fax: +1 716 645 6117.

Despite the recent advances in the theory underlying obfuscation, there still is a need to evaluate the quality of practical obfuscating transformations more quickly and easily. This paper presents the first steps toward a comprehensive evaluation suite consisting of a number of deobfuscating transformations and complexity metrics that can be readily applied on existing and future transformations in the domain of binary obfuscation. In particular, a framework based on software complexity metrics measuring four program properties: code, control flow, data and data flow is suggested. A number of well-known obfuscating and deobfuscating transformations are evaluated based upon their impact on a set of complexity metrics. This enables us to quantitatively evaluate the potency of the (de)obfuscating transformations.

& Conclusions-This paper presents a methodology and an example of risk assessment of functional-requirement specifications for complex real-time software systems. A heuristic risk-assessment technique based on CPN (colored Petri-net) models is presented. This technique is used to classify software functional-requirement specification components according to their relative importance in terms of such factors as severity and complexity. A dynamic complexity measure, based on concurrence in the functional requirements, is introduced. This technique is applied on the Earth Operation Commanding Center (EOC COMMANDING), a large component of the NASA Earth Observing System (EOS) project. Two specification models of the system are considered. Results of applying this technique to both models are presented.

Three software complexity measures (Halstead's E, McCabe's u(G), and the length as measured by number of statements) were compared to programmer performance on two software maintenance tasks. In an experiment on understanding, length and u(G) correlated with the percent of statements correctly recalled. In an experiment on modification, most significant correlations were obtained with metrics computed on modified rather than

Software is unequivocally the foremost and indispensable entity in this technologically driven world. Therefore quality assurance, and in particular, software testing is a crucial step in the software development cycle. This paper presents an effective test selection strategy that uses a Spectrum of Complexity Metrics (SCM). Our aim in this paper is to increase the efficiency of the testing process by significantly reducing the number of test cases without having a significant drop in test effectiveness. The strategy makes use of a comprehensive taxonomy of complexity metrics based on the product level (class, method, statement) and its haracteristics.We use a series of experiments based on three applications with a significant number of mutants to demonstrate the effectiveness of our selection strategy.For further evaluation, we compareour approach to boundary value analysis. The results show the capability of our approach to detect mutants as well as the seeded errors.

is an agile practice that is widely accepted and advocated by most agile methods and methodologists. In this paper, we report on a post hoc analysis of the results of an IBM team who has sustained use of TDD for five years and over ten releases of a Java-implemented product. The team worked from a design and wrote tests incrementally before or while they wrote code and, in the process, developed a significant asset of automated tests. The IBM team realized sustained quality improvement relative to a pre-TDD project and consistently had defect density below industry standards. As a result, our data indicate that the TDD practice can aid in the production of high quality products. This quality improvement would compensate for the moderate perceived productivity losses. Additionally, our data indicates that the use of TDD may decrease the degree to which code complexity increases as software ages, as measured by cyclomatic complexity metric.

Complexity is often hypothesized to be the enemy of software security. If this hypothesis is true, complexity metrics may be used to predict the locale of security problems and can be used to prioritize inspection and testing efforts. We performed statistical analysis on nine complexity metrics from the JavaScript Engine in the Mozilla application framework to find differences in code metrics between vulnerable and nonvulnerable code and to predict vulnerabilities. Our initial results show that complexity metrics can predict vulnerabilities at a low false positive rate, but at a high false negative rate.

This paper describes an experiment on tagging Romanian using QTAG, a parts-of-speech tagger that has been developed originally for English, but with a clear separation between the (probabilistic) processing engine and the (language specific)resource data. This way, the tagger is usable across various languages as shown by successful experiments on three quite different languages: English, Swedish and Romanian. After a brief presentation of the QTAG tagger, the paper dwells on language resources for Romanian and the evaluation of the results. A complexity metrics for tagging experiments is proposed which considers the performance of a tagger with respect to the "difficulty" of a text.

In this report we present a complex metric burst, associated with the 14 July 2000 major solar event, recorded by the ARTEMIS-IV radio spectrograph at Thermopylae. Additional space-borne and Earth-bound observational data are used, in order to identify and analyze the diverse, yet associated, processes during this event. The emission at metric wavelengths consisted of broad-band continua including a moving

In order to obtain a most effective return on a software project investment, then at least one requirements inspection shall be completed. A formal requirement inspection identifies low quality knowledge representation content in the requirements document. In software development projects where natural language requirements are produced, a requirements document summarizes the results of requirements knowledge analysis and becomes the basis for subsequent software development. In many cases, the knowledge content quality of the requirements documents dictates the success of the software development. The need for determining knowledge quality of requirements documents is particularly acute when the target applications are large, complicated, and mission critical. The goal of this research is to develop knowledge content quality indicators of requirements statements in a requirements document prior to informal inspections. To achieve the goal, knowledge quality properties of the requirements statements are adopted to represent the quality of requirements statements. A suite of complexity metrics for requirements statements is used as knowledge quality indicators and is developed based upon natural language knowledge research of noun phrase (NP) chunks. A formal requirements inspection identifies low quality knowledge representation content in the requirements document. The knowledge quality of requirements statements of requirements documents is one of the most important assets a project must inspect. An application of the metrics to improve requirements understandability and readability during requirements inspections can be built upon the metrics shown and suggested to be taken into account.

The complexity of configuring computing systems is a major impediment to the adoption of new information technology (IT) products and greatly increases the cost of IT services. This paper develops a model of configuration complexity and demonstrates its value for a change management system. The model represents systems as a set of nested containers with configuration controls. From this representation, we derive various metrics that indicate configuration complexity, including execution complexity, parameter complexity, and memory complexity. We apply this model to a J2EEbased enterprise application and its associated middleware stack to assess the complexity of the manual configuration process for this application. We then show how an automated change management system can greatly reduce configuration complexity.

Web Services technology has the potential to cater an enterprise's needs, providing the ability to integrate different systems and application types regardless of their platform, operating system, programming language, or location. Web Services could be deployed in traditional, centralized or brokered client server approach or they could be in peer to peer manner. Web Services could act as a server providing functionality to a requester or act as a client, receiving functionality from any service. From the performance perspective the availability of Web Services plays an important role among many parameters.

Refactoring is widely recognized as a way to improve the internal structure of a software system in order to ensure its long-term maintainability. Consequently, software projects which adopt refactoring practices should see reductions in the complexity of their code base. We evaluated this assumption on an open source system -namely PMD, a Java source code analyzer-and discovered that periods of refactorings did not affect the cyclomatic complexity. This paper investigates this counterintuitive phenomenon through a detailed analysis of the actual source code manipulations applied on the system under study.

The main objective of this work is to present an application of an extension of the original Knowledge Discovery in Databases (KDD) process called Fuzzy Prototypical Knowledge Discovery (FPKD) together with a FPKD based prediction model. This technique is applied to Software Engineering measurement. In order to get quality object-oriented information systems (OOIS), it is necessary to assess their quality focusing on diagrams which are available early in the development life-cycle, such as class diagrams. It is in this context where objectoriented measures are necessary to help designers evaluate internal quality characteristics of class diagrams, such as structural complexity, and based on these evaluations, predict external quality characteristics, such as maintainability which is (and will continue to be) one of the most critical OOIS quality characteristic. Hence, by means of the FPKD process we will build a prediction model for class diagram maintainability based on class diagram structural complexity metrics. Using the FPKD process we will search for fuzzy prototypes for characterising class diagrams maintainability, and later we will use these prototypes for predicting class diagram maintainability in a real case. The data used for prediction was obtained through a controlled experiment.

Complexity metrics play an important role in software development; they are reducing the costs during almost the whole development process. There is a growing demand for measuring the complexity of large systems with keeping the consistency of the results regardless of the diversity of the programming languages. In this article we present a general software measurement process on .NET basis

Accurate estimates of development effort play an important role in the successful management of larger Web development projects. By applying measurement principles to measure qualities of the applications and their development processes, feedback can be obtained to help understand, control and improve products and processes.

In the absence of an agreed measure of software quality the density of defects has been a very commonly used surrogate measure. As a result there have been numerous attempts to build models for predicting the number of residual software defects. Typically, the key variables in these models are either size and complexity metrics or measures arising from testing information.

AbstractÐThe dearth of published empirical data on major industrial systems has been one of the reasons that software engineering has failed to establish a proper scientific basis. In this paper, we hope to provide a small contribution to the body of empirical knowledge. We describe a number of results from a quantitative study of faults and failures in two releases of a major commercial system. We tested a range of basic software engineering hypotheses relating to: The Pareto principle of distribution of faults and failures; the use of early fault data to predict later fault and failure data; metrics for fault prediction; and benchmarking fault data. For example, we found strong evidence that a small number of modules contain most of the faults discovered in prerelease testing and that a very small number of modules contain most of the faults discovered in operation. However, in neither case is this explained by the size or complexity of the modules. We found no evidence to support previous claims relating module size to fault density nor did we find evidence that popular complexity metrics are good predictors of either fault-prone or failure-prone modules. We confirmed that the number of faults discovered in prerelease testing is an order of magnitude greater than the number discovered in 12 months of operational use. We also discovered fairly stable numbers of faults discovered at corresponding testing phases. Our most surprising and important result was strong evidence of a counter-intuitive relationship between pre-and postrelease faults: Those modules which are the most fault-prone prerelease are among the least fault-prone postrelease, while conversely, the modules which are most faultprone postrelease are among the least fault-prone prerelease. This observation has serious ramifications for the commonly used fault density measure. Not only is it misleading to use it as a surrogate quality measure, but, its previous extensive use in metrics studies is shown to be flawed. Our results provide data-points in building up an empirical picture of the software development process. However, even the strong results we have observed are not generally valid as software engineering laws because they fail to take account of basic explanatory data, notably testing effort and operational usage. After all, a module which has not been tested or used will reveal no faults, irrespective of its size, complexity, or any other factor.

It is widely accepted that sizing or predicting the volumes of various kinds of software deliverable items is one of the first and most dominant aspects of software cost estimating. Most of the cost estimation model or techniques usually assume that software size or structural complexity is the integral factor that influences software development effort. Although sizing and complexity measure

The problem of cost estimation in software engineering has been addressed by several researchers. Research shows that among many factors that affect the development cost, size of the product plays an important role. In addition to the size, product properties like complexity, cohesion and coupling are also mentioned as cost factors. We focus on the relationship between complexity of a

Software metrics are currently used in the industry mainly for cost and effort estimation, while some research suggested their use as fault indicators. There are very few empirical studies in software measurement, especially in the realm of object-oriented metrics. There is no record of management system assessment using software metrics. In this paper we discuss the use of the established

In the absence of an agreed measure of software quality the density of defects has been a very commonly used surrogate measure. As a result there have been numerous attempts to build models for predicting the number of residual software defects. Typically, the key variables in these models are either size and complexity metrics or measures arising from testing information. There are, however, serious statistical and theoretical difficulties with these approaches. Using Bayesian Belief Networks we can overcome some of the more serious problems by taking account of all the diverse factors implicit in defect prevention, detection and complexity.

AbstractÐThe dearth of published empirical data on major industrial systems has been one of the reasons that software engineering has failed to establish a proper scientific basis. In this paper, we hope to provide a small contribution to the body of empirical knowledge. We describe a number of results from a quantitative study of faults and failures in two releases of a major commercial system. We tested a range of basic software engineering hypotheses relating to: The Pareto principle of distribution of faults and failures; the use of early fault data to predict later fault and failure data; metrics for fault prediction; and benchmarking fault data. For example, we found strong evidence that a small number of modules contain most of the faults discovered in prerelease testing and that a very small number of modules contain most of the faults discovered in operation. However, in neither case is this explained by the size or complexity of the modules. We found no evidence to support previous claims relating module size to fault density nor did we find evidence that popular complexity metrics are good predictors of either fault-prone or failure-prone modules. We confirmed that the number of faults discovered in prerelease testing is an order of magnitude greater than the number discovered in 12 months of operational use. We also discovered fairly stable numbers of faults discovered at corresponding testing phases. Our most surprising and important result was strong evidence of a counter-intuitive relationship between pre-and postrelease faults: Those modules which are the most fault-prone prerelease are among the least fault-prone postrelease, while conversely, the modules which are most faultprone postrelease are among the least fault-prone prerelease. This observation has serious ramifications for the commonly used fault density measure. Not only is it misleading to use it as a surrogate quality measure, but, its previous extensive use in metrics studies is shown to be flawed. Our results provide data-points in building up an empirical picture of the software development process. However, even the strong results we have observed are not generally valid as software engineering laws because they fail to take account of basic explanatory data, notably testing effort and operational usage. After all, a module which has not been tested or used will reveal no faults, irrespective of its size, complexity, or any other factor.