HOME
TheInfoList



A software bug is an error, flaw or fault in a
computer program A computer program is a collection of instructions that can be executed by a computer to perform a specific task. A computer program is usually written by a computer programmer in a programming language. From the program in its human-readable f ...
or
system A system is a group of interacting or interrelated elements that act according to a set of rules to form a unified whole. A system, surrounded and influenced by its environment, is described by its boundaries, structure and purpose and expresse ...
that causes it to produce an incorrect or unexpected result, or to behave in unintended ways. The process of finding and fixing bugs is termed "
debugging In computer programming and software development, debugging is the process of finding and resolving ''bugs'' (defects or problems that prevent correct operation) within computer programs, software, or systems. Debugging tactics can involve inter ...
" and often uses formal techniques or tools to pinpoint bugs, and since the 1950s, some computer systems have been designed to also deter, detect or auto-correct various computer bugs during operations. Most bugs arise from mistakes and errors made in either a program's
design A design is a plan or specification for the construction of an object or system or for the implementation of an activity or process, or the result of that plan or specification in the form of a prototype, product or process. The verb ''to design'' ...
or its
source code In computing, source code is any collection of code, with or without comments, written using a ''human-readable'' programming language, usually as plain text. The source code of a program is specially designed to facilitate the work of comput ...
, or in components and
operating system An operating system (OS) is system software that manages computer hardware, software resources, and provides common services for computer programs. Time-sharing operating systems schedule tasks for efficient use of the system and may also inclu ...
s used by such programs. A few are caused by
compiler In computing, a compiler is a computer program that translates computer code written in one programming language (the ''source'' language) into another language (the ''target'' language). The name "compiler" is primarily used for programs that ...

compiler
s producing incorrect code. A program that contains many bugs, and/or bugs that seriously interfere with its functionality, is said to be ''buggy'' (defective). Bugs can trigger errors that may have
ripple effect A ripple effect occurs when an initial disturbance to a system propagates outward to disturb an increasingly larger portion of the system, like ripples expanding across the water when an object is dropped into it. The ripple effect is often used ...
s. Bugs may have subtle effects or cause the program to crash or
freeze Freeze may refer to: Liquids turning to solids *Freezing, the physical process of a liquid turning into a solid Cessation of movement or change *Freeze (b-boy move), the halting of all movement in a clever position *freeze, an old command-li ...
the computer. Other bugs qualify as
security bugs A security bug or security defect is a software bug that can be exploited to gain unauthorized access or privileges on a computer system. Security bugs introduce security vulnerabilities by compromising one or more of: * Authentication of users and ...
and might, for example, enable a malicious user to bypass
access control In the fields of physical security and information security, access control (AC) is the selective restriction of access to a place or other resource while access management describes the process. The act of ''accessing'' may mean consuming, en ...
s in order to obtain unauthorized privileges. Some software bugs have been linked to disasters. Bugs in code that controlled the
Therac-25 The Therac-25 was a computer-controlled radiation therapy machine produced by Atomic Energy of Canada Limited (AECL) in 1982 after the Therac-6 and Therac-20 units (the earlier units had been produced in partnership with CGR of France). It was inv ...

Therac-25
radiation therapy Radiation therapy or radiotherapy, often abbreviated RT, RTx, or XRT, is a therapy using ionizing radiation, generally provided as part of cancer treatment to control or kill malignant cells and normally delivered by a linear accelerator. Radiati ...

radiation therapy
machine were directly responsible for patient deaths in the 1980s. In 1996, the
European Space Agency , german: Europäische Weltraumorganisation , et, Euroopa Kosmoseagentuur , french: Agence spatiale européenne , fi, Euroopan avaruusjärjestö , el, Ευρωπαϊκός Οργανισμός Διαστήματος , hu, Európai Űrügy ...
's US$1 billion
prototype A prototype is an early sample, model, or release of a product built to test a concept or process. It is a term used in a variety of contexts, including semantics, design, electronics, and software programming. A prototype is generally used to ...
Ariane 5 Ariane 5 is a European heavy-lift space launch vehicle developed and operated by Arianespace for the European Space Agency (ESA). It is launched from the Centre Spatial Guyanais in French Guiana. It has been used to deliver payloads into geostat ...
rocket had to be destroyed less than a minute after launch due to a bug in the on-board guidance computer program. In June 1994, a Royal Air Force
Chinook Chinook may refer to: People and language *Chinookan peoples, several groups of indigenous people of the U.S. Pacific Northwest *Chinookan languages, a small family of languages spoken by Chinook peoples **Lower Chinook **Upper Chinook language ** ...
helicopter
crashed "Crashed" is the third U.S. rock single, (the fifth overall), from the band Daughtry's debut album. It was released only to U.S. rock stations on September 5, 2007. Upon its release the song got adds at those stations, along with some Alternative ...
into the
Mull of Kintyre The Mull of Kintyre is the southwesternmost tip of the Kintyre Peninsula (formerly ''Cantyre'') in southwest Scotland. From here, the Antrim coast of Northern Ireland is visible on a calm and clear day, and a historic lighthouse, the second co ...
, killing 29. This was initially dismissed as pilot error, but an investigation by ''
Computer Weekly ''Computer Weekly'' is a digital magazine and website for IT professionals in the United Kingdom. It was formerly published as a weekly print magazine by Reed Business Information for over 45 years. Topics covered within the magazine include outso ...
'' convinced a
House of Lords The House of Lords is the upper house of the Parliament of the United Kingdom. Membership is by appointment, heredity or official function. Like the House of Commons, it meets in the Palace of Westminster. Members of the House of Lords are dr ...

House of Lords
inquiry that it may have been caused by a software bug in the aircraft's engine-control computer. In 2002, a study commissioned by the US
Department of Commerce The United States Department of Commerce is an executive department of the U.S. federal government concerned with promoting economic growth. Among its tasks are gathering economic and demographic data for business and government decision makin ...
's
National Institute of Standards and Technology The National Institute of Standards and Technology (NIST) is a physical sciences laboratory and a non-regulatory agency of the United States Department of Commerce. Its mission is to promote innovation and industrial competitiveness. NIST's acti ...
concluded that "software bugs, or errors, are so prevalent and so detrimental that they cost the US economy an estimated $59 billion annually, or about 0.6 percent of the gross domestic product".


History

The Middle English word ''
buggeThe name Bugge (of Norwegian origin) may refer to: * Peter Olivarius Bugge (1764-1849), a Norwegian bishop (:no:Peder Olivarius Bugge) * Sophus Bugge, a Norwegian philologist * Bugge Wesseltoft, a Norwegian jazz musician * David Buggé (born 195 ...
'' is the basis for the terms "
bugbear A bugbear is a legendary creature or type of hobgoblin comparable to the boogeyman (or bugaboo or babau or cucuy), and other creatures of folklore, all of which were historically used in some cultures to frighten disobedient children. Etymology It ...
" and " bugaboo" as terms used for a monster. The term "bug" to describe defects has been a part of engineering jargon since the 1870s and predates electronic computers and computer software; it may have originally been used in hardware engineering to describe mechanical malfunctions. For instance,
Thomas Edison Thomas Alva Edison (February 11, 1847October 18, 1931) was an American inventor and businessman who has been described as America's greatest inventor. He developed many devices in fields such as electric power generation, mass communication, ...

Thomas Edison
wrote the following words in a letter to an associate in 1878:
Baffle Ball ''Baffle Ball'' is a pinball machine created in November 19 1931 by David Gottlieb, founder of the Gottlieb amusement company. Gameplay For one US cent players got ten balls. These would be fired up onto the playfield and fall into pockets and ho ...
, the first mechanical
pinball Pinball is a type of arcade game in which a player uses paddles (called flippers) to manipulate one or more balls inside a ''pinball machine''. A pinball machine is a glass-covered cabinet containing a play field populated with lights, targets, ...
game, was advertised as being "free of bugs" in 1931. Problems with military gear during
World War II World War II or the Second World War, often abbreviated as WWII or WW2, was a global war that lasted from 1939 to 1945. It involved the vast majority of the world's countries—including all the great powers—forming two opposing milit ...
were referred to as bugs (or
glitch A glitch is a short-lived fault in a system, such as a transient fault that corrects itself, making it difficult to troubleshoot. The term is particularly common in the computing and electronics industries, in circuit bending, as well as among pla ...
es). In the 1940 film, ''
Flight Command ''Flight Command'' is a 1940 American film about a cocky U.S. Navy pilot who has problems with his new squadron and with the wife of his commander. It stars Robert Taylor, Ruth Hussey and Walter Pidgeon. ''Flight Command'' has the distinction of of ...
'', a defect in a piece of direction-finding gear is called a "bug". In a book published in 1942,
Louise Dickinson RichLouise Dickinson Rich (14 June 1903 – 9 April 1991) was a writer known for fiction and non-fiction works about the New England region of the United States, particularly Massachusetts and Maine. Her best-known work was her first book, the autob ...
, speaking of a powered
ice cutting Ice cutting is a winter task of collecting surface ice from lakes and rivers for storage in ice houses and use or sale as a cooling method. Rare today, it was common before the era of widespread mechanical refrigeration and air conditioning technol ...
machine, said, "Ice sawing was suspended until the creator could be brought in to take the bugs out of his darling."
Isaac Asimov Isaac Asimov (; 1920 – April 6, 1992) was an American writer and professor of biochemistry at Boston University. He was known for his works of science fiction and popular science. Asimov was a prolific writer, and wrote or edited more t ...
used the term "bug" to relate to issues with a robot in his short story "
Catch That Rabbit#REDIRECT Catch That Rabbit {{R from other capitalisation ...
", published in 1944. The term "bug" was used in an account by computer pioneer
Grace Hopper Grace Brewster Murray Hopper ( December 9, 1906 – January 1, 1992) was an American computer scientist and United States Navy rear admiral. One of the first programmers of the Harvard Mark I computer, she was a pioneer of computer programmi ...

Grace Hopper
, who publicized the cause of a malfunction in an early electromechanical computer. A typical version of the story is: Hopper did not find the bug, as she readily acknowledged. The date in the log book was September 9, 1947.Log Book With Computer Bug
", National Museum of American History, Smithsonian Institution.
The operators who found it, including William "Bill" Burke, later of the
Naval Weapons Laboratory The United States Naval Surface Warfare Center Dahlgren Division (NSWCDD), named for Rear Admiral John A. Dahlgren, is located in Dahlgren, Virginia, with a geographically separated command, ''Naval Surface Warfare Center Dahlgren Division Dam N ...
,
Dahlgren, Virginia Dahlgren is an unincorporated community and census-designated place (CDP) in King George County, Virginia, United States. The population was 2,653 at the 2010 census, up from 997 in 2000. History Since 1918, Dahlgren has been the site of a U.S. na ...
, were familiar with the engineering term and amusedly kept the insect with the notation "First actual case of bug being found." Hopper loved to recount the story. This log book, complete with attached moth, is part of the collection of the Smithsonian
National Museum of American History The National Museum of American History: Kenneth E. Behring Center collects, preserves, and displays the heritage of the United States in the areas of social, political, cultural, scientific, and military history. Among the items on display is th ...
. The related term "
debug In computer programming and software development, debugging is the process of finding and resolving ''bugs'' (defects or problems that prevent correct operation) within computer programs, software, or systems. Debugging tactics can involve inter ...
" also appears to predate its usage in computing: the ''
Oxford English Dictionary The ''Oxford English Dictionary'' (''OED'') is the principal historical dictionary of the English language, published by Oxford University Press (OUP). It traces the historical development of the English language, providing a comprehensive res ...
''s etymology of the word contains an attestation from 1945, in the context of aircraft engines. The concept that software might contain errors dates back to Ada Lovelace's 1843 notes on the analytical engine, in which she speaks of the possibility of program "cards" for
Charles Babbage Charles Babbage (; 26 December 1791 – 18 October 1871) was an English polymath. A mathematician, philosopher, inventor and mechanical engineer, Babbage originated the concept of a digital programmable computer. Babbage is considered ...
's
analytical engine The Analytical Engine was a proposed mechanical general-purpose computer designed by English mathematician and computer pioneer Charles Babbage. It was first described in 1837 as the successor to Babbage's difference engine, which was a design ...
being erroneous:


"Bugs in the System" report

The Open Technology Institute, run by the group, New America, released a report "Bugs in the System" in August 2016 stating that U.S. policymakers should make reforms to help researchers identify and address software bugs. The report "highlights the need for reform in the field of software vulnerability discovery and disclosure." One of the report's authors said that Congress has not done enough to address cyber software vulnerability, even though Congress has passed a number of bills to combat the larger issue of cyber security. Government researchers, companies, and cyber security experts are the people who typically discover software flaws. The report calls for reforming computer crime and copyright laws.


Terminology

While the use of the term "bug" to describe software errors is common, many have suggested that it should be abandoned. One argument is that the word "bug" is divorced from a sense that a human being caused the problem, and instead implies that the defect arose on its own, leading to a push to abandon the term "bug" in favor of terms such as "defect", with limited success. Since the 1970s
Gary Kildall Gary Arlen Kildall (; May 19, 1942 – July 11, 1994) was an American computer scientist and microcomputer entrepreneur who created the CP/M operating system and founded Digital Research, Inc. (DRI). Kildall was one of the first people to se ...
somewhat humorously suggested to use the term "blunder". In software engineering, ''mistake metamorphism'' (from Greek ''meta'' = "change", ''morph'' = "form") refers to the evolution of a defect in the final stage of software deployment. Transformation of a "mistake" committed by an analyst in the early stages of the software development lifecycle, which leads to a "defect" in the final stage of the cycle has been called 'mistake metamorphism'. Different stages of a "mistake" in the entire cycle may be described as "mistakes", "anomalies", "faults", "failures", "errors", "exceptions", "crashes", " glitches", "bugs", "defects", "incidents", or "side effects".


Prevention

The software industry has put much effort into reducing bug counts. These include:


Typographical errors

Bugs usually appear when the programmer makes a
logic error In computer programming, a logic error is a bug in a program that causes it to operate incorrectly, but not to terminate abnormally (or crash). A logic error produces unintended or undesired output or other behaviour, although it may not immediate ...
. Various innovations in
programming style Programming style, also known as code style, is a set of rules or guidelines used when writing the source code for a computer program. It is often claimed that following a particular programming style will help programmers read and understand sourc ...
and
defensive programming Defensive programming is a form of defensive design intended to ensure the continuing function of a piece of software under unforeseen circumstances. Defensive programming practices are often used where high availability, safety, or security is nee ...
are designed to make these bugs less likely, or easier to spot. Some typos, especially of symbols or logical/
mathematical operators Mathematical Operators is a Unicode block containing characters for mathematical, logical, and set notation. Notably absent are the plus sign (+), greater than sign (>) and less than sign (<), due to them already appearing in the Basic Lat ...
, allow the program to operate incorrectly, while others such as a missing symbol or misspelled name may prevent the program from operating. Compiled languages can reveal some typos when the source code is compiled.


Development methodologies

Several schemes assist managing programmer activity so that fewer bugs are produced.
Software engineering#REDIRECT Software engineering#REDIRECT Software engineering {{Redirect category shell, 1= {{R from other capitalisation ...
{{Redirect category shell, 1= {{R from other capitalisation ...
(which addresses software design issues as well) applies many techniques to prevent defects. For example, formal
program specificationIn computer science, formal specifications are mathematically based techniques whose purpose are to help with the implementation of systems and software. They are used to describe a system, to analyze its behavior, and to aid in its design by verifyi ...
s state the exact behavior of programs so that design bugs may be eliminated. Unfortunately, formal specifications are impractical for anything but the shortest programs, because of problems of
combinatorial explosion In mathematics, a combinatorial explosion is the rapid growth of the complexity of a problem due to how the combinatorics of the problem is affected by the input, constraints, and bounds of the problem. Combinatorial explosion is sometimes used to j ...
and indeterminacy.
Unit testing In computer programming, unit testing is a software testing method by which individual units of source code—sets of one or more computer program modules together with associated control data, usage procedures, and operating procedures&mdas ...
involves writing a test for every function (unit) that a program is to perform. In
test-driven development Test-driven development (TDD) is a software development process relying on software requirements being converted to test cases before software is fully developed, and tracking all software development by repeatedly testing the software against all ...
unit tests are written before the code and the code is not considered complete until all tests complete successfully.
Agile software development In software development, agile (sometimes written Agile) practices involve discovering requirements and developing solutions through the collaborative effort of self-organizing and cross-functional teams and their customer(s)/end user(s). It advoc ...
involves frequent software releases with relatively small changes. Defects are revealed by user feedback. Open source development allows anyone to examine source code. A school of thought popularized by
Eric S. Raymond Eric Steven Raymond (born December 4, 1957), often referred to as ESR, is an American software developer, open-source software advocate, and author of the 1997 essay and 1999 book ''The Cathedral and the Bazaar''. He wrote a guidebook for the R ...
as
Linus's law#REDIRECT Linus's law {{R from move ...
says that popular
open-source software Open-source software (OSS) is a type of computer software in which source code is released under a license in which the copyright holder grants users the rights to use, study, change, and distribute the software to anyone and for any purpose. ...
has more chance of having few or no bugs than other software, because "given enough eyeballs, all bugs are shallow". This assertion has been disputed, however: computer security specialist
Elias Levy Elias Levy (also known as Aleph One) is a computer scientist. He was the moderator of "Bugtraq", a full disclosure vulnerability mailing list, from May 14, 1996 until October 15, 2001. He was the CTO and co-founder of the computer security company ...
wrote that "it is easy to hide vulnerabilities in complex, little understood and undocumented source code," because, "even if people are reviewing the code, that doesn't mean they're qualified to do so." An example of this actually happening, accidentally, was the 2008 OpenSSL vulnerability in Debian.


Programming language support

Programming language A programming language is a formal language comprising a set of instructions that produce various kinds of output. Programming languages are used in computer programming to implement algorithms. Most programming languages consist of instruction ...
s include features to help prevent bugs, such as static
type system In programming languages, a type system is a logical system comprising a set of rules that assigns a property called a type to the various constructs of a computer program, such as variables, expressions, functions or modules. These types formali ...
s, restricted
namespace In computing, a namespace is a set of signs (''names'') that are used to identify and refer to objects of various kinds. A namespace ensures that all of a given set of objects have unique names so that they can be easily identified. Namespaces a ...
s and
modular programming Modular programming is a software design technique that emphasizes separating the functionality of a program into independent, interchangeable modules, such that each contains everything necessary to execute only one aspect of the desired functiona ...
. For example, when a programmer writes (pseudocode) LET REAL_VALUE PI = "THREE AND A BIT", although this may be syntactically correct, the code fails a type check. Compiled languages catch this without having to run the program. Interpreted languages catch such errors at runtime. Some languages deliberately exclude features that easily lead to bugs, at the expense of slower performance: the general principle being that, it is almost always better to write simpler, slower code than inscrutable code that runs slightly faster, especially considering that
maintenance cost The technical meaning of maintenance involves functional checks, servicing, repairing or replacing of necessary devices, equipment, machinery, building infrastructure, and supporting utilities in industrial, business, and residential installatio ...
is substantial. For example, the
Java programming language Java is a class-based, object-oriented programming language that is designed to have as few implementation dependencies as possible. It is a general-purpose programming language intended to let application developers ''write once, run anywhere'' ...
does not support pointer arithmetic; implementations of some languages such as
Pascal Pascal, Pascal's or PASCAL may refer to: People and fictional characters * Pascal (given name), including a list of people with the name * Pascal (surname), including a list of people and fictional characters with the name ** Blaise Pascal, French ...
and
scripting language#REDIRECT Scripting language#REDIRECT Scripting language {{R from other capitalisation ...
{{R from other capitalisation ...
s often have runtime
bounds checking In computer programming, bounds checking is any method of detecting whether a variable is within some bounds before it is used. It is usually used to ensure that a number fits into a given type (range checking), or that a variable being used as an a ...
of arrays, at least in a debugging build.


Code analysis

Tools for
code analysis Static program analysis is the analysis of computer software that is performed without actually executing programs, in contrast with dynamic analysis, which is analysis performed on programs while they are executing. In most cases the analysis is pe ...
help developers by inspecting the program text beyond the compiler's capabilities to spot potential problems. Although in general the problem of finding all programming errors given a specification is not solvable (see
halting problem In computability theory, the halting problem is the problem of determining, from a description of an arbitrary computer program and an input, whether the program will finish running, or continue to run forever. Alan Turing proved in 1936 that a gen ...
), these tools exploit the fact that human programmers tend to make certain kinds of simple mistakes often when writing software.


Instrumentation

Tools to monitor the performance of the software as it is running, either specifically to find problems such as bottlenecks or to give assurance as to correct working, may be embedded in the code explicitly (perhaps as simple as a statement saying PRINT "I AM HERE"), or provided as tools. It is often a surprise to find where most of the time is taken by a piece of code, and this removal of assumptions might cause the code to be rewritten.


Testing

Software tester Software testing is an investigation conducted to provide stakeholders with information about the quality of the software product or service under test. Software testing can also provide an objective, independent view of the software to allow the ...
s are people whose primary task is to find bugs, or write code to support testing. On some projects, more resources may be spent on testing than in developing the program. Measurements during testing can provide an estimate of the number of likely bugs remaining; this becomes more reliable the longer a product is tested and developed.


Debugging

Finding and fixing bugs, or ''debugging'', is a major part of
computer programming Computer programming is the process of designing and building an executable computer program to accomplish a specific computing result or to perform a specific task. Programming involves tasks such as: analysis, generating algorithms, profiling ...
.
Maurice Wilkes Sir Maurice Vincent Wilkes (26 June 1913 – 29 November 2010) was a British computer scientist who designed and helped build the Electronic Delay Storage Automatic Calculator (EDSAC), one of the earliest stored program computers, and who inve ...
, an early computing pioneer, described his realization in the late 1940s that much of the rest of his life would be spent finding mistakes in his own programs. Usually, the most difficult part of debugging is finding the bug. Once it is found, correcting it is usually relatively easy. Programs known as
debugger A debugger or debugging tool is a computer program used to test and debug other programs (the "target" program). The main use of a debugger is to run the target program under controlled conditions that permit the programmer to track its operatio ...
s help programmers locate bugs by executing code line by line, watching variable values, and other features to observe program behavior. Without a debugger, code may be added so that messages or values may be written to a console or to a window or log file to trace program execution or show values. However, even with the aid of a debugger, locating bugs is something of an art. It is not uncommon for a bug in one section of a program to cause failures in a completely different section, thus making it especially difficult to track (for example, an error in a graphics
rendering Render, rendered, or rendering may refer to: Computing * Rendering (computer graphics), generating an image from a model by means of computer programs * Architectural rendering, creating two-dimensional images or animations showing the attributes ...
routine causing a file I/O routine to fail), in an apparently unrelated part of the system. Sometimes, a bug is not an isolated flaw, but represents an error of thinking or planning on the part of the programmer. Such ''
logic error In computer programming, a logic error is a bug in a program that causes it to operate incorrectly, but not to terminate abnormally (or crash). A logic error produces unintended or undesired output or other behaviour, although it may not immediate ...
s'' require a section of the program to be overhauled or rewritten. As a part of
code review Code review (sometimes referred to as peer review) is a software quality assurance activity in which one or several people check a program mainly by viewing and reading parts of its source code, and they do so after implementation or as an interrup ...
, stepping through the code and imagining or transcribing the execution process may often find errors without ever reproducing the bug as such. More typically, the first step in locating a bug is to reproduce it reliably. Once the bug is reproducible, the programmer may use a debugger or other tool while reproducing the error to find the point at which the program went astray. Some bugs are revealed by inputs that may be difficult for the programmer to re-create. One cause of the
Therac-25 The Therac-25 was a computer-controlled radiation therapy machine produced by Atomic Energy of Canada Limited (AECL) in 1982 after the Therac-6 and Therac-20 units (the earlier units had been produced in partnership with CGR of France). It was inv ...

Therac-25
radiation machine deaths was a bug (specifically, a
race condition A race condition or race hazard is the condition of an electronics, software, or other system where the system's substantive behavior is dependent on the sequence or timing of other uncontrollable events. It becomes a bug when one or more of the ...

race condition
) that occurred only when the machine operator very rapidly entered a treatment plan; it took days of practice to become able to do this, so the bug did not manifest in testing or when the manufacturer attempted to duplicate it. Other bugs may stop occurring whenever the setup is augmented to help find the bug, such as running the program with a debugger; these are called ''
heisenbug In computer programming jargon, a heisenbug is a software bug that seems to disappear or alter its behavior when one attempts to study it. The term is a pun on the name of Werner Heisenberg, the physicist who first asserted the observer effect of ...
s'' (humorously named after the
Heisenberg uncertainty principle In quantum mechanics, the uncertainty principle (also known as Heisenberg's uncertainty principle) is any of a variety of mathematical inequalities asserting a fundamental limit to the accuracy with which the values for certain pairs of physical ...
). Since the 1990s, particularly following the
Ariane 5 Flight 501 Cluster was a constellation of four European Space Agency spacecraft which were launched on the maiden flight of the Ariane 5 rocket, Flight 501, and subsequently lost when that rocket failed to achieve orbit. The launch, which took place on Tu ...
disaster, interest in automated aids to debugging rose, such as
static code analysis Static program analysis is the analysis of computer software that is performed without actually executing programs, in contrast with dynamic analysis, which is analysis performed on programs while they are executing. In most cases the analysis is pe ...
by
abstract interpretationIn computer science, abstract interpretation is a theory of sound approximation of the semantics of computer programs, based on monotonic functions over ordered sets, especially lattices. It can be viewed as a partial execution of a computer program ...
. Some classes of bugs have nothing to do with the code. Faulty documentation or hardware may lead to problems in system use, even though the code matches the documentation. In some cases, changes to the code eliminate the problem even though the code then no longer matches the documentation.
Embedded system An embedded system is a computer system—a combination of a computer processor, computer memory, and input/output peripheral devices—that has a dedicated function within a larger mechanical or electronic system. It is ''embedded'' as ...
s frequently work around hardware bugs, since to make a new version of a
ROM Rom, or ROM may refer to: Biomechanics and medicine * Risk of mortality, a medical classification to estimate the likelihood of death for a patient * Rupture of membranes, a term used during pregnancy to describe a rupture of the amniotic sac * Ra ...
is much cheaper than remanufacturing the hardware, especially if they are
commodity items In economics, a commodity is an economic good, usually a resource, that has full or substantial fungibility: that is, the market treats instances of the good as equivalent or nearly so with no regard to who produced them. The price of a commodit ...
.


Benchmark of bugs

To facilitate reproducible research on testing and debugging, researchers use curated benchmarks of bugs: * the Siemens benchmark * ManyBugs is a benchmark of 185 C bugs in nine open-source programs. * Defects4J is a benchmark of 341 Java bugs from 5 open-source projects. It contains the corresponding patches, which cover a variety of patch type. * BEARS is a benchmark of continuous integration build failures focusing on test failures. It has been created by monitoring builds from open-source projects on
Travis CI Travis CI is a hosted continuous integration service used to build and test software projects hosted on GitHub and Bitbucket. Travis CI was the first CI service which provided services to open-source projects for free, however free open-source pl ...
.


Bug management

Bug management includes the process of documenting, categorizing, assigning, reproducing, correcting and releasing the corrected code. Proposed changes to software – bugs as well as enhancement requests and even entire releases – are commonly tracked and managed using
bug tracking system A bug tracking system or defect tracking system is a software application that keeps track of reported software bugs in software development projects. It may be regarded as a type of issue tracking system. Many bug tracking systems, such as those u ...
s or
issue tracking system An issue tracking system (also ITS, trouble ticket system, support ticket, request management or incident ticket system) is a computer software package that manages and maintains lists of issues. Issue tracking systems are generally used in collabor ...
s. The items added may be called defects, tickets, issues, or, following the
agile development In software development, agile (sometimes written Agile) practices involve discovering requirements and developing solutions through the collaborative effort of self-organizing and cross-functional teams and their customer(s)/end user(s). It advoc ...
paradigm, stories and epics. Categories may be objective, subjective or a combination, such as
version number Software versioning is the process of assigning either unique ''version names'' or unique ''version numbers'' to unique states of computer software. Within a given version number category (major, minor), these numbers are generally assigned in inc ...
, area of the software, severity and priority, as well as what type of issue it is, such as a feature request or a bug.


Severity

''Severity'' is the impact the bug has on system operation. This impact may be data loss, financial, loss of goodwill and wasted effort. Severity levels are not standardized. Impacts differ across industry. A crash in a video game has a totally different impact than a crash in a web browser, or real time monitoring system. For example, bug severity levels might be "crash or hang", "no workaround" (meaning there is no way the customer can accomplish a given task), "has workaround" (meaning the user can still accomplish the task), "visual defect" (for example, a missing image or displaced button or form element), or "documentation error". Some software publishers use more qualified severities such as "critical", "high", "low", "blocker" or "trivial". The severity of a bug may be a separate category to its priority for fixing, and the two may be quantified and managed separately.


Priority

''Priority'' controls where a bug falls on the list of planned changes. The priority is decided by each software producer. Priorities may be numerical, such as 1 through 5, or named, such as "critical", "high", "low", or "deferred". These rating scales may be similar or even identical to ''severity'' ratings, but are evaluated as a combination of the bug's severity with its estimated effort to fix; a bug with low severity but easy to fix may get a higher priority than a bug with moderate severity that requires excessive effort to fix. Priority ratings may be aligned with product releases, such as "critical" priority indicating all the bugs that must be fixed before the next software release.


Software releases

It is common practice to release software with known, low-priority bugs. Most big software projects maintain two lists of "known bugs" – those known to the software team, and those to be told to users. The second list informs users about bugs that are not fixed in a specific release and
workaround A workaround is a bypass of a recognized problem or limitation in a system or policy. A workaround is typically a temporary fix that implies that a genuine solution to the problem is needed. But workarounds are frequently as creative as true soluti ...
s may be offered. Releases are of different kinds. Bugs of sufficiently high priority may warrant a special release of part of the code containing only modules with those fixes. These are known as '' patches''. Most releases include a mixture of behavior changes and multiple bug fixes. Releases that emphasize bug fixes are known as ''maintenance'' releases. Releases that emphasize feature additions/changes are known as major releases and often have names to distinguish the new features from the old. Reasons that a software publisher opts not to patch or even fix a particular bug include: * A deadline must be met and resources are insufficient to fix all bugs by the deadline. * The bug is already fixed in an upcoming release, and it is not of high priority. * The changes required to fix the bug are too costly or affect too many other components, requiring a major testing activity. * It may be suspected, or known, that some users are relying on the existing buggy behavior; a proposed fix may introduce a
breaking change Breaking or breakin' may refer to: Physical damage * Fracture, the separation of an object into two or more pieces under stress ** Breaking (martial arts), a martial arts skill ** Ship breaking, a type of ship disposal * Structural integrity and ...
. * The problem is in an area that will be obsolete with an upcoming release; fixing it is unnecessary. * It's "not a bug". A misunderstanding has arisen between expected and perceived behavior, when such misunderstanding is not due to confusion arising from design flaws, or faulty documentation.


Types

In software development projects, a "mistake" or "fault" may be introduced at any stage. Bugs arise from oversights or misunderstandings made by a software team during specification, design, coding, data entry or documentation. For example, a relatively simple program to alphabetize a list of words, the design might fail to consider what should happen when a word contains a
hyphen The hyphen is a punctuation mark used to join words and to separate syllables of a single word. The use of hyphens is called hyphenation. ''Son-in-law'' is an example of a hyphenated word. The hyphen is sometimes confused with dashes (figure da ...
. Or when converting an abstract design into code, the coder might inadvertently create an
off-by-one error An off-by-one error or off-by-one bug (known by acronyms OBOE, OBO, OB1 and OBOB) is a logic error involving the discrete equivalent of a boundary condition. It often occurs in computer programming when an iterative loop iterates one time too many ...
and fail to sort the last word in a list. Errors may be as simple as a typing error: a "<" where a ">" was intended. Another category of bug is called a ''
race condition A race condition or race hazard is the condition of an electronics, software, or other system where the system's substantive behavior is dependent on the sequence or timing of other uncontrollable events. It becomes a bug when one or more of the ...

race condition
'' that may occur when programs have multiple components executing at the same time. If the components interact in a different order than the developer intended, they could interfere with each other and stop the program from completing its tasks. These bugs may be difficult to detect or anticipate, since they may not occur during every execution of a program. Conceptual errors are a developer's misunderstanding of what the software must do. The resulting software may perform according to the developer's understanding, but not what is really needed. Other types:


Arithmetic

*
Division by zero In mathematics, division by zero is division where the divisor (denominator) is zero. Such a division can be formally expressed as \dfrac where ''a'' is the dividend (numerator). In ordinary arithmetic, the expression has no meaning, as there ...
. *
Arithmetic overflow Arithmetic (from the Greek ἀριθμός ''arithmos'', 'number' and τική έχνη ''tiké échne', 'art' or 'craft') is a branch of mathematics that consists of the study of numbers, especially the properties of the traditional operations o ...
or underflow. * Loss of
arithmetic precision Significant figures (also known as the significant digits, ''precision'' or ''resolution'') of a number in positional notation are digits in the number that are reliable and absolutely necessary to indicate the quantity of something. If a numbe ...
due to
rounding Rounding means replacing a number with an approximate value that has a shorter, simpler, or more explicit representation. For example, replacing $ with $, the fraction 312/937 with 1/3, or the expression with . Rounding is often done to obtain ...
or
numerically unstable In the mathematical subfield of numerical analysis, numerical stability is a generally desirable property of numerical algorithms. The precise definition of stability depends on the context. One is numerical linear algebra and the other is algorith ...
algorithms.


Logic

*
Infinite loop In computer programming, an infinite loop (or endless loop) is a sequence of instructions that, as written, will continue endlessly, unless an external intervention occurs ("pull the plug"). It may be intentional. Overview This differs from: * ...
s and infinite
recursion Recursion (adjective: ''recursive'') occurs when a thing is defined in terms of itself or of its type. Recursion is used in a variety of disciplines ranging from linguistics to logic. The most common application of recursion is in mathematics ...
. *
Off-by-one error An off-by-one error or off-by-one bug (known by acronyms OBOE, OBO, OB1 and OBOB) is a logic error involving the discrete equivalent of a boundary condition. It often occurs in computer programming when an iterative loop iterates one time too many ...
, counting one too many or too few when looping.


Syntax

* Use of the wrong operator, such as performing assignment instead of equality test. For example, in some languages x=5 will set the value of x to 5 while x

5
will check whether x is currently 5 or some other number. Interpreted languages allow such code to fail. Compiled languages can catch such errors before testing begins.


Resource

*
Null pointer In computing, a null pointer or null reference is a value saved for indicating that the pointer or reference does not refer to a valid object. Programs routinely use null pointers to represent conditions such as the end of a list of unknown length ...
dereference. * Using an
uninitialized variableIn computing, an uninitialized variable is a variable that is declared but is not set to a definite known value before it is used. It will have ''some'' value, but not a predictable one. As such, it is a programming error and a common source of bugs ...
. * Using an otherwise valid instruction on the wrong
data type In computer science and computer programming, a data type or simply type is an attribute of data which tells the compiler or interpreter how the programmer intends to use the data. Most programming languages support basic data types of integer n ...
(see
packed decimal In computing and electronic systems, binary-coded decimal (BCD) is a class of binary encodings of decimal numbers where each digit is represented by a fixed number of bits, usually four or eight. Sometimes, special bit patterns are used for a si ...
/
binary coded decimal In computing and electronic systems, binary-coded decimal (BCD) is a class of binary encodings of decimal numbers where each digit is represented by a fixed number of bits, usually four or eight. Sometimes, special bit patterns are used for a si ...
). *
Access violation In computing, a segmentation fault (often shortened to segfault) or access violation is a fault, or failure condition, raised by hardware with memory protection, notifying an operating system (OS) the software has attempted to access a restricted ...
s. * Resource leaks, where a finite system resource (such as
memory Memory is the faculty of the brain by which data or information is encoded, stored, and retrieved when needed. It is the retention of information over time for the purpose of influencing future action. If past events could not be remembered, it ...
or
file handlesIn Unix and related computer operating systems, a file descriptor (FD, less frequently fildes) is an abstract indicator (handle) used to access a file or other input/output resource, such as a pipe or network socket. File descriptors form part of the ...
) become exhausted by repeated allocation without release. *
Buffer overflow In information security and programming, a buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory locations. Buffers are areas of memory set a ...
, in which a program tries to store data past the end of allocated storage. This may or may not lead to an access violation or
storage violationIn computing a storage violation is a hardware or software fault that occurs when a task attempts to access an area of computer storage which it is not permitted to access. Types of storage violation Storage violation can, for instance, consist of r ...
. These are known as
security bug A security bug or security defect is a software bug that can be exploited to gain unauthorized access or privileges on a computer system. Security bugs introduce security vulnerabilities by compromising one or more of: * Authentication of users and ...
s. * Excessive recursion which—though logically valid—causes
stack overflow Stack Overflow is a question and answer site for professional and enthusiast programmers. It is a privately held website, the flagship site of the Stack Exchange Network, created in 2008 by Jeff Atwood and Joel Spolsky. It features questions an ...
. * Use-after-free error, where a pointer is used after the system has freed the memory it references. * Double free error.


Multi-threading

*
Deadlock File:Deadlock at a four-way-stop.gif, thumbnail, Four processes (blue lines) compete for one resource (grey circle), following a right-before-left policy. A deadlock occurs when all processes lock the resource simultaneously (black lines). The ...
, where task A cannot continue until task B finishes, but at the same time, task B cannot continue until task A finishes. *
Race condition A race condition or race hazard is the condition of an electronics, software, or other system where the system's substantive behavior is dependent on the sequence or timing of other uncontrollable events. It becomes a bug when one or more of the ...

Race condition
, where the computer does not perform tasks in the order the programmer intended. * Concurrency errors in
critical sectionIn concurrent programming, concurrent accesses to shared resources can lead to unexpected or erroneous behavior, so parts of the program where the shared resource is accessed need to be protected in ways that avoid the concurrent access. This protect ...
s,
mutual exclusion In computer science, mutual exclusion is a property of concurrency control, which is instituted for the purpose of preventing race conditions. It is the requirement that one thread of execution never enters a critical section while a concurrent t ...
s and other features of concurrent processing.
Time-of-check-to-time-of-useIn software development, time-of-check to time-of-use (TOCTOU, TOCTTOU or TOC/TOU) is a class of software bugs caused by a race condition involving the ''checking'' of the state of a part of a system (such as a security credential) and the ''use'' of ...
(TOCTOU) is a form of unprotected critical section.


Interfacing

* Incorrect API usage. * Incorrect protocol implementation. * Incorrect hardware handling. * Incorrect assumptions of a particular platform. * Incompatible systems. A new
API In computing, an application programming interface (API) is an interface that defines interactions between multiple software applications or mixed hardware-software intermediaries. It defines the kinds of calls or requests that can be made, how ...
or
communications protocol A communication protocol is a system of rules that allows two or more entities of a communications system to transmit information via any kind of variation of a physical quantity. The protocol defines the rules, syntax, semantics and synchronizat ...
may seem to work when two systems use different versions, but errors may occur when a function or feature implemented in one version is changed or missing in another. In production systems which must run continually, shutting down the entire system for a major update may not be possible, such as in the telecommunication industry or the internet. In this case, smaller segments of a large system are upgraded individually, to minimize disruption to a large network. However, some sections could be overlooked and not upgraded, and cause compatibility errors which may be difficult to find and repair. * Incorrect code annotations


Teamworking

* Unpropagated updates; e.g. programmer changes "myAdd" but forgets to change "mySubtract", which uses the same algorithm. These errors are mitigated by the
Don't Repeat Yourself#REDIRECT Don't repeat yourself {{R from other capitalisation ...
philosophy. * Comments out of date or incorrect: many programmers assume the comments accurately describe the code. * Differences between documentation and product.


Implications

The amount and type of damage a software bug may cause naturally affects decision-making, processes and policy regarding software quality. In applications such as
manned space travel
manned space travel
or
automotive safety Automotive safety is the study and practice of design, construction, equipment and regulation to minimize the occurrence and consequences of traffic collisions involving motor vehicles. Road traffic safety more broadly includes roadway design. ...
, since software flaws have the potential to cause human injury or even death, such software will have far more scrutiny and quality control than, for example, an online shopping website. In applications such as banking, where software flaws have the potential to cause serious financial damage to a bank or its customers, quality control is also more important than, say, a photo editing application. NASA's
Software Assurance Technology Center The Goddard Space Flight Center (GSFC) is a major NASA space research laboratory located approximately northeast of Washington, D.C. in Greenbelt, Maryland, United States. Established on May 1, 1959 as NASA's first space flight center, GSFC emplo ...
managed to reduce the number of errors to fewer than 0.1 per 1000 lines of code ( SLOC) but this was not felt to be feasible for projects in the business world. According to a NASA study on
Flight Software Complexity
, "an exceptionally good software development process can keep defects down to as low as 1 defect per 10,000 lines of code." Other than the damage caused by bugs, some of their cost is due to the effort invested in fixing them. In 1978, Lientz and al. showed that the median of projects invest 17 per cent of the development effort in bug fixing. In research in 2020 on
GitHub __FORCETOC__ GitHub, Inc. is a provider of Internet hosting for software development and version control using Git. It offers the distributed version control and source code management (SCM) functionality of Git, plus its own features. It provide ...
repositories showed the median is 20%.


Well-known bugs

A number of software bugs have become well-known, usually due to their severity: examples include various space and military aircraft crashes. Possibly the most famous bug is the
Year 2000 problem The Year 2000 problem, also known as the Y2K problem, the Millennium bug, Y2K bug, the Y2K glitch, or Y2K, refers to events related to the formatting and storage of calendar data for dates beginning in the year 2000. Problems were anticipated, ...
, also known as the Y2K bug, in which it was feared that worldwide economic collapse would happen at the start of the year 2000 as a result of computers thinking it was 1900. (In the end, no major problems occurred.) The 2012 stock trading disruption involved one such incompatibility between the old API and a new API.


In popular culture

* In both the 1968 novel ''2001: A Space Odyssey (novel), 2001: A Space Odyssey'' and the corresponding 1968 film ''2001: A Space Odyssey (film), 2001: A Space Odyssey'', a spaceship's onboard computer, HAL 9000, attempts to kill all its crew members. In the follow-up 1982 novel, ''2010: Odyssey Two'', and the accompanying 1984 film, ''2010 (film), 2010'', it is revealed that this action was caused by the computer having been programmed with two conflicting objectives: to fully disclose all its information, and to keep the true purpose of the flight secret from the crew; this conflict caused HAL to become paranoid and eventually homicidal. * In the English version of the Nena 1983 song ''99 Luftballons'' (99 Red Balloons) as a result of "bugs in the software", a release of a group of 99 red balloons are mistaken for an enemy nuclear missile launch, requiring an equivalent launch response, resulting in catastrophe. * In the 1999 American comedy ''Office Space'', three employees attempt to exploit their company's preoccupation with fixing the Y2K computer bug by infecting the company's computer system with a virus that sends rounded off pennies to a separate bank account. The plan backfires as the virus itself has its own bug, which sends large amounts of money to the account prematurely. * The 2004 novel ''The Bug'', by Ellen Ullman, is about a programmer's attempt to find an elusive bug in a database application. * The 2008 Canadian film ''Control Alt Delete (film), Control Alt Delete'' is about a computer programmer at the end of 1999 struggling to fix bugs at his company related to the year 2000 problem.


See also

* Anti-pattern * Bug bounty program * Glitch removal * ISO/IEC 9126, which classifies a bug as either a ''defect'' or a ''nonconformity'' * Orthogonal Defect Classification * Racetrack problem * RISKS Digest * Software defect indicator * Software regression * Software rot * Automatic bug fixing


References


External links

*
Common Weakness Enumeration
– an expert webpage focus on bugs, at NIST.gov
BUG type of Jim Gray
– another Bug type * *

– an email from 1981 about Adm. Hopper's bug *
Toward Understanding Compiler Bugs in GCC and LLVM
. A 2016 study of bugs in compilers {{Authority control Software bugs,