Distribution of defects in a large software system

This report summarizes the findings of a retrospective analysis of coding errors in a major software system produced by a large Canadian software engineering firm. The code-base of the system is approximately 1.7 million lines of C++ integrated with third party RDBMS and GIS products. The safety related nature of the system and the size of its code base make it an ideal candidate for an investigation of software related defects referred to as ' memory leaks.' A ' memory leak' results from the failure to return previously allocated heap memory. The distribution of memory leaks is analyzed and a two-part memory leak classification scheme is described. A secondary focus of the investigation is the influence of decision complexity on system safety. This investigation yielded two statistically significant findings. The first is a relationship between programmer experience and memory leak creation. The second is a correlation between subsystem complexity and memory leak density. The impact of software process improvement measures are also discussed.--Page iii.