A Quantitative Analysis into the Economics of Correcting Software Bugs

  • Craig S. Wright
  • Tanveer A. Zia
Part of the Lecture Notes in Computer Science book series (LNCS, volume 6694)


Using a quantitative study of in-house coding practices, we demonstrate the notion that programming needs to move from “Lines of Code per day” as a productivity measure to a measure that takes debugging and documentation into account. This could be something such as “Lines of clean, simple, correct, well-documented code per day”, but with bugs propagating into the 6th iteration of patches, a new paradigm needs to be developed. Finding flaws in software, whether these have a security related cost or not, is an essential component of software development. When these bugs result in security vulnerabilities, the importance of testing becomes even more critical. Many studies have been conducted using the practices of large software vendors as a basis, but few studies have looked at in-house development practices. This paper uses an empirical study of in-house software coding practices in Australian companies to both demonstrate that there is an economic limit to how far testing should proceed as well as noting the deficiencies in the existing approaches.


Software Development Life Cycle Model Checking Software Verification Empirical studies 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Anderson., R.: Why information security is hard, an economic perspective. In: 17th Annual Computer Security Applications Conf., New Orleans, LA (December 2001)Google Scholar
  2. 2.
    Carman, D.W., Dolinsky, A.A., Lyu, M.R., Yu, J.S.: Software Reliability Engineering Study of a Large-Scale Telecommunications System. In: Proc. Sixth Int’l Symp. Software Reliability Eng., pp. 350–359 (1995)Google Scholar
  3. 3.
    Connell, C.: It’s Not About Lines of Code, (viewed March 15, 2010)
  4. 4.
    Daskalantonakis, M.K.: A Practical View of Software Measurement and Implementation Experiences within Motorola. IEEE Trans. Software Eng. 18(11), 998–1010 (1992)CrossRefGoogle Scholar
  5. 5.
    Kaaniche, K., Kanoun, K.: Reliability of a Telecommunications System. In: Proc. Seventh Int’l Symp. Software Reliability Eng., pp. 207–212 (1996)Google Scholar
  6. 6.
    Khoshgoftaar, T.M., Allen, E.B., Kalaichelvan, K.S., Goel, N.: Early Quality Prediction: A Case Study in Telecommunications. IEEE Trans. Software Eng. 13(1), 65–71 (1996)CrossRefGoogle Scholar
  7. 7.
    Levendel, Y.: Reliability Analysis of Large Software Systems: Defects Data Modeling. IEEE Trans. Software Eng. 16(2), 141–152 (1990)CrossRefGoogle Scholar
  8. 8.
    Mills, H.D.: Top-down programming in large systems. In: Rustin, R. (ed.) Debugging Techniques in Large Systems. Prentice-Hall, Englewoods Cliffs (1971)Google Scholar
  9. 9.
    Munson, J.C., Khoshgoftaar, T.M.: The Detection of Fault-Prone Programs. IEEE Transactions on Software Engineering 18(5), 423–433 (1992)CrossRefGoogle Scholar
  10. 10.
    Cobb, C.W., Douglas, P.H.: A theory of production. American Economic Review 18(1), 139–165 (1928); Supplement, Papers and Proceedings of the Fortieth Annual Meeting of the American Economic Association (1928)Google Scholar
  11. 11.
    Bayes, T.: An essay towards solving a problem in the doctrine of chances. Philosophical Transactions of the Royal Society 53, 370–418 (1763)Google Scholar
  12. 12.
    Bacon, D.F., Chen, Y., Parkes, D., Rao, M.: A market-based approach to software evolution. Paper Presented at the Proceeding of the 24th ACM SIGPLAN Conference Companion on Object Oriented Programming Systems languages and Applications (2009)Google Scholar
  13. 13.
    Sestoft, P.: Systematic software testing IT University of Copenhagen, Denmark1 Version 2, 2008-02-25 (2008)Google Scholar
  14. 14.
    Wright, C.S.: The not so Mythical IDS Man-Month: Or Brooks and the rule of information security. In: ISSRE (2010)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2011

Authors and Affiliations

  • Craig S. Wright
    • 1
  • Tanveer A. Zia
    • 1
  1. 1.School of Computing and MathematicsCharles Sturt UniversityAustralia

Personalised recommendations