bayesian network based software reliability prediction

www.elsevier.com/locate/jss

The Journal of Systems and Software 77 (2005) 103–112

Bayesian network based software reliability prediction withan operational profile q

Cheng-Gang Bai *

Department of Automatic Control, Beihang University (Beijing University of Aeronautics and Astronautics), Beijing 100083, China

Received 29 June 2004; received in revised form 11 November 2004; accepted 26 November 2004Available online 24 December 2004

Abstract

This paper uses a Bayesian network to model software reliability prediction with an operational profile. Due to the complexity ofsoftware products and development processes, software reliability models need to possess the ability to deal with multiple param-eters. A Bayesian network exhibits a strong ability to adapt to problems involving complex variant factors. A special kind of Bayes-ian network named a Markov Bayesian network has been applied successfully into modeling software reliability prediction.However, the existing research did not pay enough attention to the fact that the failure characteristics of many software systemsoften depend on the specific operation performed. In this paper, an extended Markov Bayesian network is developed to model soft-ware reliability prediction with an operational profile. The extended Markov Bayesian network proposed in the paper is focused ondiscrete-time failure data. Methods to solve the network are proposed, and an example is used to illustrate the utilization of themodel.� 2004 Elsevier Inc. All rights reserved.

Keywords: Software reliability; Software failure rate; Operational profile; Bayesian network; Markov Bayesian network; Discrete-time failure data;Software run

1. Introduction

Research on how to predict software reliability accu-rately is of great practical importance. Many softwarereliability prediction models have been developed anddescribed in the literature (Goel, 1985; Xie, 1991,1993), among which many classic probability modelsare widely discussed. For some recent references, see,e.g. (Cai, 1998b; Sahinoglu et al., 2001; Malaiya et al.,2002; Zheng, 2002; Ozekici and Soyer, 2003; Reussneret al., 2003). The traditional software reliability predic-tion models mainly belong to stochastic process models,

0164-1212/$ - see front matter � 2004 Elsevier Inc. All rights reserved.doi:10.1016/j.jss.2004.11.034

q Supported by the National Natural Science Foundation of China(Grant No. 60473067 and Grant No. 60233020).

* Tel.: +861082315087; fax: +861082317328.E-mail address: [email protected]

such as the Jelinski–Moranda model (Jelinski and Mor-anda, 1972) and the Goel–Okumoto NHPP model (Goeland Okumoto, 1979). This kind of model suggests that astochastic process, especially a non-homogeneous Pois-son process (NHPP) (Boland and Singh, 2002, 2003),can describe the failure process of software.

However, many of these models make unrealisticrestrictive assumptions to ensure tractability and solv-ability (Bishop and Pullen, 1988; Lyu, 1996), such asremoving defects completely (no new defects introducedwhen removing the one detected), or data completeness(no missing data). These restrictive assumptions havelimited the development and applications of theseprobability models in recent years, and as a resultresearchers have begun to explore other approaches.The assumptions have been relaxed by making no distri-bution assumptions on the failure process (Pfeffermanand Cemuschi-Frias, 2002), but this advantage is

mailto:[email protected]

Nomenclature

{D,S,P} denote Bayesian networkD the set of variables (or nodes) of Bayesian

networkS the set of conditional probability distribu-

tion(CPD) of Bayesian networkP the set of marginal probability distributions

of Bayesian networkp(X) if X is a continuous variable, it denotes the

probability density function of X; if X is adiscrete variable, it denotes the probabilitydistribution of X

MBN Markov Bayesian networkXi(1 6 i 6 n) the remaining defects number after the

ith failureYi(1 6 i 6 n) the time between the (i � 1)th and ith

failureEMBN extended Markov Bayesian networkn number of software testing runsm number of operationsf failure ordergf the number of runs from the fth failure to

(f + 1)th failureR the software reliability after n runs

H ð1Þj the failure rate of Oj at the beginning of test-

ing process j = 1,2, . . ., mH ðiÞ

j the failure rate of Oj after the (i � 1)th run,i = 2, . . . ,n + 1, j = 1,2, . . ., m

Oj the j th operation, j = 1,2, . . ., mAi the ith run, Ai = j if the jth operation Oj is

carried out at ith run, i = 1,2, . . ., nQi the operational profile for the ith run,

i = 1,2, . . ., nQn+1 the operational profile for the possible next

run after n runsQ operational profile if it is invariantZi the result of the i th run, Zi = 1 if a failure

occurs at ith run, and otherwise Zi = 0, i =1,2, . . ., n

d denotes the decrement of failure rate after afailure occurs and the failure-causing defectsare removed

Beta(Æ ja,b) denotes Beta distribution with para-meters a,b

Dir(Æ jq1, . . . ,qm) denotes Dirichlet distribution withparameters q1, . . .,qm

104 C.-G. Bai / The Journal of Systems and Software 77 (2005) 103–112

compensated by the added noise in the software reliabil-ity prediction results. Non-probability models, e.g. neu-ral networks, have been applied (Karunanithi andWhitley, 1992; Khoshgoftaar and Szabo, 1996; Sitte,1999; Cai et al., 2001). Recent research has shown someadvantage of neural networks in predictive capabilitiesover the traditional NHPP model (Ho et al., 2003).However, there are still some problems with this ap-proach. First, due to the randomness of the networkstructure, it is difficult to express the interrelationshipsbetween the input variables. Second, it is necessary toensure the integrity of the neural network, which meansthat if the data is absent in some input nodes, it wouldbe difficult for the neural network to process effectively.

Amongst many unreasonable assumptions in mosttraditional models, one of the most serious limitationsis the reliance on past failure data, alone, to predict soft-ware reliability. The future failure time not only relies onthe past failure data, but also relies on other variablessuch as how the software is used.

Models of such complex problems as software reli-ability prediction in large software systems should incor-porate prior information and available expertexperience. The Bayesian method provides a proper toolto deal with this problem (Kuo and Yang, 1995,1996;Kuo and Lee, 1997; Basu and Ebrahimi, 2003). How-ever, it is difficult for traditional Bayesian models to dealwith problems involving complex variant factors. A rel-

atively new technique, the Bayesian network, can be ap-plied to model and solve such problems. Bayesiannetworks can describe many factors of the system simul-taneously and also can express the interrelations be-tween them efficiently. It combines precise probabilitydistributions and prior expertise information in a waythat is more suitable to solving problems with manyuncertainties. Due to these desirable properties, Bayes-ian networks have been increasingly applied in manyfields (Bickmore, 1994; Madigan et al., 1996; Lewisand Ransing, 1997; Castillo et al., 1999; Zhu, 2003),although this approach has found applications in reli-ability only in the last seven years (Sigurdsson et al.,2001). A Bayesian framework combining diverse sourcesof evidence was developed to assess system dependabil-ity (Neil et al., 1996; Bouissou et al., 1999). It has beenused to predict software reliability in the early phases ofthe development by incorporating information ahead oftesting (Smidts et al., 1998) and to develop a causalmodel for software defect rates prediction (Fenton andNeil, 1999). It has also been combined with fault treesfor reliability analysis (Pai, 2001), and used for the cer-tification of COTS (Commercial Off-The-Shelf) softwarereliability (Yu and Johnson, 2003). In our previous work(Bai et al., 2005), a software failure prediction modelbased on Markov Bayesian networks was developed.

However, an undesirable restriction in almost all ofthe software reliability models in the literature is that

C.-G. Bai / The Journal of Systems and Software 77 (2005) 103–112 105

the parameters of the software failure process are inde-pendent of the operation that the software performs(Ozekici and Soyer, 2003). Musa (1993, 1996) describeshow operational profiles can be built and states thatthere is substantial benefit to be gained by applyingthem. An operational profile describes how users em-ploy a system (Musa, 1993). There has been some workon the topic of software reliability with an operationalprofile. Cai (1998a) developed various methods to modeloperational profiles. Ozekici and Soyer (2003) provide astochastic and statistical framework to model softwarereliability in the presence of an operational profile. Theirmethod is based on the assumption that software reli-ability behavior can be measured in terms of continuoustime. However, many systems depart from this assump-tion (Cai, 2000). For example, the reliability behavior ofa bank transaction processing software system should bemeasured in terms of how many transactions are suc-cessful, rather than how long the software system oper-ates without failure. Cai (2003) discussed how to assesssoftware reliability with an operational profile duringthe software validation phase. In the validation phase,it is assumed that no detected defects are removed.

Different from these earlier works, this paper de-scribes an extended Markov Bayesian network thatcan deal with software reliability prediction with anoperational profile. This paper is organized as follows.Section 2 presents the background of the paper. In Sec-tion 3, we develop an extended Markov Bayesian Net-work model for software reliability prediction. InSection 4, we discuss the techniques for solving themodel under various assumptions. In Section 5, a casestudy is given with real software failure data, andsatisfactory results are obtained.

2. Background

2.1. Bayesian network

The definition of a Bayesian network can be found inmany versions, but the basic form (Pearl, 1986) is statedas follows: a Bayesian network is a directed probabilitygraph, connecting the relative variables with arcs, andthis kind of connection expresses the conditional depen-dence between the variables. The formal definitionfollows.

A Bayesian network is defined as the set of {D,S,P},where

(1) D is a set of variables (or nodes).(2) S is a set of conditional probability distributions

(CPD).S = {p(DjParents(D))jD 2 D}, Parents(D)� D standsfor all the parent nodes for D, p(DjParents(D)) is theconditional distribution of variable D.

(3) P is a set of marginal probability distributions.P = {p(D)jD 2 D} stands for the probability distri-bution of variable D.

In the Bayesian network, variables are used to ex-press the events or objects. The problem could be mod-eled with the behavior of these variables. In general, wefirst calculate (or determine from expert experience) theprobability distribution of each variable and the condi-tional probability distribution between them. Then fromthese distributions we can obtain the joint distributionsof these variables. Finally, some deductions can bedeveloped for some variables of interest using someother known variables.

A Bayesian network is generally based on Bayesianstatistical theory. Compared with other traditional dataanalysis methods, a Bayesian network has the followingproperties:

(1) A Bayesian network can be connected to all thevariables of interest, so it is expected to increasethe precision of the analysis. For example, in aproblem with two input and one output variables,the two input variables might be correlated. If bothof the input variables can be observed, most of themodels will be able to predict the output. However,if one of the inputs cannot be observed, then fewmodels can provide a precise prediction, and thecorrelation between these two variables is not used.On the contrary, it is natural for a Bayesian networkto measure and use this kind of correlation.

(2) A Bayesian network can model the causal relation-ship between variables. Thus, the interdependenceof the variables could be studied in order to improveprediction. For example, one market analyst maywant to know whether it is worthwhile to increasethe intensity of some advertising campaign in orderto gain more sales of a certain product. To solve thisproblem, the analyst needs to know whether theadvertisement is an influencing factor, and theextent of its influence. Bayesian networks can helpto solve problems like this.

A Bayesian network with Bayesian statistical meth-ods can combine the relative knowledge in the problemdomain and the available data effectively. No one withpractical experiences can deny the importance of theprior information or the problem domain knowledge,especially in circumstances where little or no data areavailable or when data collection is costly.

2.2. Bayesian network based software reliability

prediction model

Let Xi (1 6 i 6 n) denote the number of remainingdefects after the ith failure, and Yi (1 6 i 6 n) the time

Xn

X3

X2

X1

…

…

Yn

Y2

Y2

Y1

Fig. 1. A Markov Bayesian network (MBN).


between the (i � 1)th and ith failure. During the defectsremoval process, it is possible to both remove and intro-duce defects, and hence Xi+1 is dependent on Xi. Thetime interval between software failures is influencedby the number of remaining defects. Assuming thatp(xi+1jxi) and p(yijxi) are independent of time, then aMarkov Bayesian network can be used to model thisproblem (Jordan et al., 1999). The network graph isgiven in Fig. 1 (Bai et al., 2005).

2.3. Operational profile

Musa (1993) said �a profile is simply a set of disjoint(only one can occur at a time) alternatives with the prob-ability that each will occur.� An operational profile sim-ply consists of the set of all operations that a system isdesigned to perform and their probabilities of occur-rence. It provides a quantitative characterization ofhow the system will be used in the field, making it anessential ingredient of software reliability engineering.Technically speaking, one can think of an operationalprofile as a generic random variable that indicates theoperations that will be performed by the system (Ozekiciand Soyer, 2003).

2.4. Software run

The Poisson model (Bai et al., 2005) is based on theassumption that software reliability behavior can bemeasured in terms of calendar time, clock time orCPU execution time. Although this assumption isappropriate for a wide scope of systems, there are manysystems, which depart from this assumption. For exam-ple, the reliability behavior of a bank transaction pro-cessing software system should be measured in termsof how many transactions are successful, rather thanof how long the software system operates without failure(Cai, 2000).

Cai (2000) proposed the conception of ‘‘a run’’ to de-scribe discrete time. A run is minimum execution unit ofsoftware. Any software execution process can be dividedinto a series of runs.

3. Bayesian network model with an operational profile

3.1. Extended Markov Bayesian network

Assume that there are m operations and n runs. LetOj = j denote the jth operation of them operations. LetAi (i = 1, . . . ,n) denote the ith run. Ai = j (i = 1, . . . ,n)if the jth operation Oj is carried out at ith run. Let Qi

(i = 1, . . . ,n) denote operational profile at ith run

Qi ¼ qðiÞj j qðiÞj ¼ Pr½Ai ¼ j� ð1 6 j 6 mÞn oði ¼ 1; . . . ; nÞ:

Let

Zi ¼1 if a failure occurs at the i th run

0 if no failure occurs at the ith run

�ði¼ 1; . . . ;nÞ

Let H ð1Þj ðj ¼ 1; . . . ;mÞ denote the failure rate of Oj at the

beginning of the testing. Let H ðiÞj ði ¼ 2; . . . ; nþ 1;

j ¼ 1; . . . ;mÞ denote the failure rate of Oj after the(i � 1)th run. Comparing with our previous work (Baiet al., 2005), we use failure rate in this study rather thanthe number of remaining defects. The main reasons are(1) it is easier to get the relationship between failure rateand testing results than that between the number ofremaining defects and testing results; (2) it is easier topredict software reliability based on the failure raterather than on remaining defects. So, failure rate ismuch more interesting.

Let R denote the software reliability after the total nruns. Qn+1 denotes the operational profile after the totaln runs.

Fig. 2 shows the extended Markov Bayesian network(EMBN).

3.2. Determining the distributions

In order to use the EMBN model to predict softwarereliability, the following distributions are essential:

(1) The initial distributions of H ð1Þj . pðH ð1Þ

j Þ ðj ¼ 1;. . . ;mÞ. These could be estimated using softwaremetrics from the development of the software prod-uct, or be given by experts.

(2) The initial distributions of Qi (i = 1, . . . ,n + 1). Qi isthe operational profile at the ith run. It can beassumed that the initial distributions of Qi can begotten from historical data.

(3) The conditional distribution of Zi (i = 1, . . . ,n)

Pr Zi ¼ 1 j Ai;HðiÞ1 ; . . . ;H ðiÞ

m

h i¼ H ðiÞ

j � qðjÞi

Pr Zi ¼ 0 j Ai;HðiÞ1 ; . . . ;H ðiÞ

m

h i¼ 1� H ðiÞ

j � qðjÞi

Hm(2)

Hm (1)

Z2Z1

A2A1

Q1 Q2

Hm(n)

Zn

An

Qn

…

…

…

…

…

H1(n)H1

(2)H1

(1) H1(n+1)

Hm(n+1)

R

Qn+1

… … … … …

Fig. 2. Extended Markov Bayesian network.


(4) The conditional distribution of Ai (i = 1, . . . ,n)

pfAi ¼ j j Qi ¼ fqðiÞj ; j ¼ 1; . . . ;mgg ¼ qðiÞj

(5) The conditional distribution of H ðiÞj ði ¼ 2; . . . ;nþ 1Þ.

Cai (2000) proposed five models to describe thechanging trend about hazard rate function (the prob-ability that the software fails). Therefore, the 5 mod-els can be applied into this step. For example, whenAi = j 0, it is feasible to let H ðiþ1Þ

j0 ¼ H ðiÞj0 � dZi;

H ðiþ1Þj ¼ H ðiÞ

j ; j 6¼ j0.(6) The conditional distribution of R

R ¼ 1�Xmj¼1

H ðnþ1Þj qðnþ1Þ

j

As in standard Bayesian network, the joint probabil-ity density of R, H ðiÞ

j ði¼ 1; . . . ;nþ 1; j¼ 1; . . . ;mÞ, Ai

(i = 1, . . . ,n), Zi (i = 1, . . . ,n), Qi (i = 1, . . . ,n + 1) is

pR; H ðiÞ

j ði¼ 1; . . . ;nþ1; j¼ 1; . . . ;mÞ; Ai ði¼ 1; . . . ;nÞ;Zi ði¼ 1; . . . ;nÞ; Qi ði¼ 1; . . . ;nþ1Þ

( )

¼ pfR jQnþ1; Hnþ1j ðj¼ 1; . . . ;mÞg �

Ynþ1

i¼1

pfQig �Yni¼1

pfAi jQig

�Ymj¼1

pfH ð1Þj g �

Ynþ1

i�2

Ymj¼1

pfH ðiÞj jH ði�1Þ

j ;Ai�1;Zi�1g

�Yni¼1

pfZi jH ðiÞj ðj¼ 1; . . . ;mÞ; Aig ð1Þ

3.3. Software reliability prediction

Although Eq. (1) is useful in evaluating the predictionprobabilities, the densities in Eq. (1) can be difficult tocompute directly. Here, we propose to use the Gibbssampling approach to approximate Eq. (1). Accordingto the Gibbs sampling theory (Gelfand and Smith,1985), the key point is to sample from the conditionaldistributions of every variable under condition that allother variables are known.

(1) H ðkÞl

pH ðkÞ

l jR; H ðiÞj ði¼1; . . . ;nþ1; j¼1; . . . ;m; ði;jÞ 6¼ ðk;lÞÞ

Ai ði¼1; . . . ;nÞ; Zi ði¼1; . . . ;nÞ; Qi ði¼1; . . . ;nþ1Þ

( )

/pR; H ðiÞ

j ði¼1; . . . ;nþ1; j¼1; . . . ;mÞ; Ai ði¼1; . . . ;nÞ

Zi ði¼1; . . . ;nÞ; Qi ði¼1; . . . ;nþ1Þ

( )

¼pfR jQnþ1; Hnþ1j ðj¼1; . . . ;mÞg �

Ynþ1

i¼1

pfQig�Yni¼1

pfAi jQig

�Ymj¼1

pfH ð1Þj g�

Ynþ1

i�2

Ymj¼1


j ; Ai�1; Zi�1g

�Yni¼1

pfZi jH ðiÞj ðj¼1; . . . ;mÞ; Aig

if 1 < k < n + 1

pH ðkÞ

l jR;H ðiÞj ði¼ 1; . . . ;nþ1; j¼ 1; . . . ;m; ði;jÞ 6¼ ðk;lÞÞ

Ai ði¼ 1; . . . ;nÞ; Zi ði¼ 1; . . . ;nÞ; Qi ði¼ 1; . . . ;nþ1Þ

( )

/ pfH ðkÞl jH ðk�1Þ

l ;Ak�1;Zk�1g �pfZk jH ðkÞl ;Akg

�pfH ðkþ1Þl jH ðkÞ

l ;Ak;Zkg

if k = 1

pH ðkÞ

l j H ðiÞj ði ¼ 1; . . . ; n; j ¼ 1; . . . ;m; ði; jÞ 6¼ ðk; lÞÞ

Ai ði ¼ 1; . . . ; nÞ; Zi ði ¼ 1; . . . ; nÞ; Qi ði ¼ 1; . . . ; nÞ

( )

/ pfH ð1Þl g � pfZ1 j H ð1Þ

l ;A1g � pfH ð2Þl j H ð1Þ

l ;A1;Z1g

if k = n + 1

pH ðkÞ

l jR;H ðiÞj ði¼ 1; . . . ;nþ1; j¼ 1; . . . ;m; ði;jÞ 6¼ ðk;lÞÞ

Ai ði¼ 1; . . . ;nÞ; Zi ði¼ 1; . . . ;nÞ; Qi ði¼ 1; . . . ;nþ1Þ

( )

/ pfH ðnþ1Þl jH ðnÞ

l ; An; Zng

So, the distribution

pH ðkÞ

l jR; H ðiÞj ði¼1; .. . ;nþ1; j¼1; . .. ;m; ði;jÞ 6¼ ðk;lÞÞ

Ai ði¼1; .. . ;nÞ; Zi ði¼1; .. . ;nÞ; Qi ði¼1;. . .;nþ1Þ

( )

can be sampled.


(2) Zk. If k < n

pZk jR; H ðiÞ

j ði¼ 1; . . . ;nþ1; j¼ 1; . . . ;mÞ

Ai ði¼ 1; . . . ;nÞ; Zi ði¼ 1; . . . ;n; i 6¼ kÞ; Qi ði¼ 1; . . . ;nþ1Þ

8<:

9=;

/ pR; H ðiÞ

j ði¼ 1; . . . ;nþ1; j¼ 1; . . . ;mÞ; Ai ði¼ 1; . . . ;nÞ

Zi ði¼ 1; . . . ;nÞ; Qi ði¼ 1; . . . ;nþ1Þ

8<:

9=;


Ynþ1

i¼1

pfQig �Yni¼1

pfAi jQig

�Ymj¼1

pfH ð1Þj g �

Ynþ1

i�2

Ymj¼1


j ; Ai�1; Zi�1g

�Yni¼1

pfZi jH ðiÞj ðj¼ 1; . . . ;mÞ; Aig

/ pfZi jH ðiÞj ðj¼ 1; . . . ;mÞ; Aig �pfH ðkþ1Þ

AkjH ðkÞ

Ak; Ak; Zkg


pZk jR; H ðiÞ

j ði¼ 1; . . . ;nþ1; j¼ 1; . . . ;mÞ

Ai ði¼ 1; . . . ;nÞ; Zi ði¼ 1; . . . ;n; i 6¼ kÞ; Qi ði¼ 1; . . . ;nþ1Þ

8<:

9=;

can be sampled.

(3) Ak

pAk jR; H ðiÞ

j ði¼ 1; . . . ;nþ1; j¼ 1; . . . ;mÞ

Ai ði¼ 1; . . . ;n; i 6¼ kÞ; Zi ði¼ 1; . . . ;nÞ; Qi ði¼ 1; . . . ;nþ1Þ

8<:

9=;

/ pR; H ðiÞ

j ði¼ 1; . . . ;nþ1; j¼ 1; . . . ;mÞ; Ai ði¼ 1; . . . ;nÞ

Zi ði¼ 1; . . . ;nÞ; Qi ði¼ 1; . . . ;nþ1Þ

8<:

9=;


Ynþ1

i¼1

pfQig �Yni¼1

pfAi jQig

�Ymj¼1

pfH ð1Þj g �

Ynþ1

i�2

Ymj¼1


j ; Ai�1; Zi�1g

�Yni¼1

pfZi jH ðiÞj ðj¼ 1; . . . ;mÞ; Aig/ pfAk jQkg

�pfH ðkþ1Þj jH ðkÞ

j ;Ak;Zkg �pfZk jH ðkÞAk; Akg


pAk jR;H ðiÞ

j ði¼ 1; . . . ;nþ1; j¼ 1; . . . ;mÞ

Ai ði¼ 1; . . . ;n; i 6¼ kÞ; Zi ði¼ 1; . . . ;nÞ; Qi ði¼ 1; . . . ;nþ1Þ

8<:

9=;

can be sampled.

(4) Qk

pQk jR;H

ðiÞj ði¼ 1; . . . ;nþ1; j¼ 1; . . . ;mÞ

Ai ði¼ 1; . . . ;nÞ; Zi ði¼ 1; . . . ;nÞ; Qi ði¼ 1; . . . ;nþ1; i 6¼ kÞ

( )

/ pR; H ðiÞ

j ði¼ 1; . . . ;nþ1; j¼ 1; . . . ;mÞ; Ai ði¼ 1; . . . ;nÞZi ði¼ 1; . . . ;nÞ; Qi ði¼ 1; . . . ;nþ1Þ

( )


Ynþ1

i¼1

pfQig �Yni¼1

pfAi jQig

�Ymj¼1

pfH ð1Þj g �

Ynþ1

i�2

Ymj¼1


j ; Ai�1; Zi�1g

�Yni¼1

pfZi jH ðiÞj ðj¼ 1; . . . ;mÞ; Aig

if k < n + 1

pQk jR;H

ðiÞj ði¼ 1; . . . ;nþ1; j¼ 1; . . . ;mÞ

Ai ði¼ 1; . . . ;nÞ; Zi ði¼ 1; . . . ;nÞ; Qiði¼ 1; . . . ;nþ1; i 6¼ kÞ

( )

/ pfQkg �pfAk jQkg

if k = n + 1

pQk jR; H

ðiÞj ði¼ 1; . . . ;nþ1; j¼ 1; . . . ;mÞ


( )

/ pfR jQnþ1;Hnþ1j ðj¼ 1; . . . ;mÞg �pfQnþ1g


pQk jR;H

ðiÞj ði¼ 1; . . . ;nþ1; j¼ 1; . . . ;mÞ


( )

can be sampled.(5) R

pR jH ðiÞ

j ði¼1; . . . ;nþ1; j¼1; . . . ;mÞAi ði¼1; . . . ;nÞ; Zi ði¼1; . . . ;nÞ; Qi ði¼1; . . . ;nþ1Þ

( )

/pR;H ðiÞ

j ði¼1; . . . ;nþ1; j¼1; . . . ;mÞ; Ai ði¼1; . . . ;nÞZi ði¼1; . . . ;nÞ; Qi ði¼1; . . . ;nþ1Þ

( )

¼pfR jQnþ1;Hnþ1j ðj¼1; . . . ;mÞg �

Ynþ1

i¼1

pfQig�Yni¼1

pfAi jQig

�Ymj¼1

pfH ð1Þj g�

Ynþ1

i�2

Ymj¼1


j ; Ai�1; Zi�1g

�Yni¼1

pfZi jH ðiÞj ðj¼1; . . . ;mÞ; Aig

¼pfR jQnþ1;Hnþ1j ðj¼1; . . . ;mÞg


pR jH ðiÞ

j ði¼ 1; . . . ;nþ1; j¼ 1; . . . ;mÞAi ði¼ 1; . . . ;nÞ; Zi ði¼ 1; . . . ;nÞ; Qi ði¼ 1; . . . ;nþ1Þ

( )

can be sampled.


From the above discussion it is derived that theconditional distributions of every variable can besampled. Therefore, if we know the values of anysubset of all variables in the model, the others canbe inferred by the Gibbs sampling approach. Wecall this algorithm the Gibbs sampling-basedAlgorithm.

Although the time which the algorithm consumes ismanageable, if all Ai (i = 1, . . . ,n) , Zi (i = 1, . . . ,n)are known, a simpler algorithm to predict softwarereliability can be derived by a message-passingscheme (Pearl, 1986). We call this the SimplifiedAlgorithm.

Assume that operational profile is invariable, that isQ1 = Q2 = � � �

So, let Q = {qjjqj = Pr[Ai = j], (1 6 j 6 m)}.Given Ai = ai (i = 1, . . . ,n), Zi = zi (i = 1, . . . ,n), the

simplified algorithm is as follows:

(1) Give Ai = ai(i = 1, . . . ,n), Zi = zi(i = 1, . . . ,n)(2) Give the prior distributions of H ð1Þ

j ) pðH ð1Þj Þ,

(j = 1, . . . ,m)(3) Give the prior distribution of Q = {qj,j = 1, . . . ,

m})p(Q)(4) 1) i

(5) pðH ðiÞj Þ ) p ðH ðiÞ

j Þ, p ðH ðiÞj Þ (j = 1, . . . ,m) denote

the prior distribution of H ðiÞj .

(6) Calculate the posterior distribution of H ðiÞj ðj ¼

1; . . . ;mÞ by Bayesian rule. Let hðH ðiÞj j Zi;AiÞ

denote the posterior distribution of H ðiÞj ,

respectively.

hðH ðiÞj j Zi ¼ zi;Ai ¼ aiÞ / pfZi ¼ zi jH ðiÞ

j gpfH ðiÞj g j¼ ai

hðH ðiÞj j Zi ¼ zi;Ai ¼ aiÞ ¼ pfH ðiÞ

j g j 6¼ ai

(7) hðH ðiÞj j Zi ¼ zi; Ai ¼ aiÞ ) pðH ðiÞ

j Þ(8) Calculate the distribution of H ðiþ1Þ

j (j = 1, . . . ,m) by


j � zid; j ¼ ai

and


j ; j 6¼ ai

Let pðH ðiþ1Þj Þ (j = 1, . . . ,m) denote the distribution

of H ðiþ1Þj :

(9) Calculate the posterior distribution of Q byBayesian rule.

hðQ j Ai ¼ aiÞ / pðAi ¼ ai j QÞpðQÞ(10) h(QjAi = ai) ) p(Q)(11) If i = n, then go (12); else i + 1 ) i and go (5)

(12) Output pðH ðnþ1Þj Þ (j = 1, . . . ,m)

(13) Output p(Q)(14) Estimate the operational profile: Q = {qjjj = 1, . . . ,

m} from p(Q)

(15) Predict the software reliability

R ¼ 1�Xmj¼1

qjpðHðnþ1Þj Þ

(16) End.

4. A case study

We apply this model to software known as the Spaceprogram. Rothermel et al. (2001) describe the programas follows: ‘‘Space consists of 9,564 lines of C code(6,218 executable), and functions as an interpreter foran array definition language (ADL). The program readsa file that contains several ADL statements, and checksthe contents of the file for adherence to the ADL gram-mar and to specific consistency rules. If the ADL file iscorrect, space outputs an array data file containing a listof array elements, positions, and excitations; otherwise,the program outputs an error message’’. We applyEMBN to this data set to predict the software reliabilitybehavior in this program.

With the assumption that the initial failure rates ofeach operation follow a Beta distribution and the oper-ational profile follows a Dirichlet distribution, we applythe model for software reliability prediction.

Assume that

H ð1Þj � BetaðaðiÞj ; bðiÞ

j Þ; Q � Dirððq1; . . . ; qmÞj q1; . . . ; qmÞ

where Beta(a,b) is Beta distribution with parameters a,b.

Dir((q1, . . . ,qm)jq1, . . . ,qm) is a Dirichlet distribution,if

pðq1;q2; . . . ;qm j q1;q2; . . . ;qmÞ

¼

CPmj¼1

qj

� �Qmj¼1

CðqjÞ

Qmj¼1

qqj�1

i ; 06 pi 6 1; i¼ 1; . . . ;m;Pmj¼1

pj ¼ 1

!

0 otherwise

8>>>><>>>>:

The simplified algorithm is adopted in this case study.For step (6) of the algorithm, we have

H ð1Þj j Z1 ¼ z1;A1 ¼ a1 � Betaðað1Þj þ z1; b

ð1Þj þ 1� z1Þ;

j ¼ ai

In order to keep H ðiþ1Þj still a Beta distribution, we use

EH ðiþ1Þj ¼ EH ðiÞ

j � d other than H ðiþ1Þj ¼ H ðiÞ

j � d in thestep (8). From this we have

H ð2Þj � Beta

að1Þj þ z1 � dz1ðað1Þj þ bð1Þj þ 1Þ

bð1Þj þ 1� z1 þ dz1ðað1Þj þ bð1Þ

j þ 1Þ

!

Table 1Software reliability prediction by EMBN model

Failureorder f

Operational profile Software reliability

For Set A For Set B

1 0.1995, 0.3112, 0.4894 0.5001 0.69672 0.1991, 0.3115, 0.4894 0.8571 0.88893 0.1991, 0.3112, 0.4897 0.9231 0.92864 0.1995, 0.3112, 0.4894 0.9444 0.93475 0.1991, 0.3112, 0.4897 0.9600 0.95836 0.1991, 0.3115, 0.4894 0.9643 0.96307 0.1991, 0.3112, 0.4897 0.9697 0.96888 0.1991, 0.3112, 0.4897 0.9744 0.97309 0.1991, 0.3112, 0.4897 0.9773 0.976210 0.1995, 0.3112, 0.4894 0.9792 0.978711 0.1995, 0.3112, 0.4894 0.9815 0.980812 0.1991, 0.3115, 0.4894 0.9833 0.982813 0.1991, 0.3112, 0.4897 0.9848 0.984414 0.1991, 0.3112, 0.4897 0.9861 0.985515 0.1991, 0.3112, 0.4897 0.9882 0.987816 0.1991, 0.3112, 0.4897 0.9891 0.988817 0.1991, 0.3115, 0.4894 0.9901 0.989718 0.1991, 0.3115, 0.4894 0.9907 0.990319 0.1991, 0.3115, 0.4894 0.9915 0.991220 0.1995, 0.3112, 0.4894 0.9922 0.991921 0.1991, 0.3112, 0.4897 0.9927 0.992522 0.1991, 0.3112, 0.4897 0.9932 0.993023 0.1991, 0.3112, 0.4894 0.9937 0.993524 0.1991, 0.3112, 0.4897 0.9941 0.993925 0.1991, 0.3112, 0.4897 0.9945 0.994426 0.1991, 0.3112, 0.4897 0.9949 0.9948


So,

að2Þj ¼ að1Þj þ z1 � dz1ðað1Þj þ bð1Þj þ 1Þ

bð2Þj ¼ bð1Þ

j þ 1� z1 þ dz1ðað1Þj þ bð1Þj þ 1Þ

(j ¼ a1

að2Þj ¼ að1Þj

bð2Þj ¼ bð1Þ

j

(j 6¼ a1

Furthermore

aðiþ1Þj ¼ aðiÞj þ zi � dzi ðaðiÞj þ bðiÞ

j þ 1Þ

bð2Þj ¼ bðiÞ

j þ 1� zi þ dzi ðaðiÞj þ bðiÞj þ 1Þ

(j ¼ ai

aðiþ1Þj ¼ aðiÞj

bðiþ1Þj ¼ bðiÞ

j

(j 6¼ ai

In the step (9), let

hðQ j Ai ¼ aiÞ � Dir qð1Þi ; . . . ; qðjÞ

i þ 1; . . . ; qðmÞi

� �j ¼ aj

and assume that q1 = 2, q2 = 2, q3 = 2, d = 0.0002.In this study, it is interesting to see to what extent the

prediction is dependent on different initial values of theparameters. Two kind of initial values of parameters areas follows:

Set A : a11 ¼ 1; b11 ¼ 1; a12 ¼ 1; b12 ¼ 1; a13 ¼ 1; b13 ¼ 1:

Set B : a11 ¼ 1; b11 ¼ 3; a12 ¼ 2; b12 ¼ 2; a13 ¼ 1; b13 ¼ 4:

The software is tested for 3000 runs in total, and thereare three operations (m = 3). Twenty-six failures occurin total during testing. Because we are interested in thetrend of the software reliability prediction along withthe testing process, all the software reliability predic-tions for n = 1, . . . , 3000 are calculated and studied.However, for the sake of space limitation, only thosedata with failures occurring are listed in Table 1.

Table 1 shows the results of software reliability byEMBN model. The serial numbers of failure order arelisted in the first column with the title ‘‘Failure Order’’.The estimations of operational profile after f failures oc-curred are listed in the second column. Table 1 showsthe estimations of operational profile basically keep con-stant, especially when f is large. The software reliabilityprediction for parameters values Set A and Set B arelisted in the third and the fourth column, respectively.Table 1 shows that at the beginning of the test the thirdcolumn is quite different from the fourth column. Thatmeans that at the beginning of the test the prior infor-mation play a key role in predicting software reliability.It tells us that if the number of test runs is not very bigthe prior distribution should be selected carefully. How-ever, the trend of software reliability becomes stableregardless of the initial values of the parameters. Thatmeans that if the number of test runs is large, assumingdifferent prior distributions don�t make much difference.

In order to evaluate the performance of the proposedmodel, we compare our results with those of the Kaani-che–Kanoun model (K&K model) (Kaaniche andKanoun, 1992). The K&K model is one of the few dis-crete software reliability models. Most discrete softwarereliability models assume that all design faults can beremoved from the software. However, this is not typicalof most large software systems. The K&K model, as wellas ours, does not need this assumption. Due to spacelimitation, only the parameter Set A is used for ourmodel. Table 2 shows the failure interval (the numberof runs from one failure to the next failure) predictionsfor each of the models, and Fig. 3 illustrates the results.From the results, we see that the EMBN model has goodestimation and prediction capabilities. From the results,we can see that when the failure order is small, the K&Kmodel is unable to predict the failure intervals. Incontrast, the EMBN model is always able to make pre-dictions. It seems that better predictions can be achievedby combining the prior experience and the failure datafrom software testing. However, in the very late stageof software testing the behaviors of software are sud-denly changed. This means that it is difficult to findmore defects by the current software testing methods.In this situation, both of the two methods fail to giveproper predictions. If we want to find more defects,the software testing methods should be changed (Baiet al., 2003). This means that software testing profiles

Table 2The SPACE failure data (* means no value)

Failureorder f

Failure intervaldata gf

Predictions byEMBN model

Predictions byK&K Model

1 5 2 *2 14 7 *3 16 13 *4 27 18 *5 17 25 206 31 28 197 34 33 208 35 39 259 37 44 2810 41 48 3111 54 54 3812 58 60 4413 59 66 5014 122 72 5415 79 85 6716 99 92 7317 79 101 8318 135 107 8919 136 117 9920 137 128 11021 142 137 11622 163 147 12623 185 158 13824 193 170 15025 224 183 16426 865 197 178

0 5 10 15 20 25 300

100

200

300

400

500

600

700

800

900

f

ENBN Model

K & K Model

Failure Data

fη

Fig. 3. Comparison between EMBN model and K&K model.


will be changed. Due to the complexity of this problem,it is difficult to solve in the current paper. However, thisproblem will be studied further in the future.

5. Conclusion

For most safety-critical software with high reliabilityrequirements, an adequate sample of failures is hard to

obtain, so prior information should be incorporated.For this, the Bayesian approach seems appropriate(Pham and Pham, 2001). From this starting point, aBayesian network model is proposed to predict softwarereliability. This is desirable for complex software sys-tems where prior information may be available from ex-perts or former development processes and experience.

However, Bayesian network models require the userto develop prior distributions. There exist several waysto do this, such as relying on expert opinion. The expertopinion includes empirical experience with other similarsoftware, knowledge of software testing, and otherbackground information. Although specific assumptionswere made in the development of our model, the initialdistributions can also be obtained by combining infor-mation gained in the former development process.Moreover, other distributions can be assumed to reflectdifferent testing configurations.

Bayesian models often involve high complexity andcomputational effort. As a result, the suggested algo-rithm, the Gibbs sampling-based Algorithm, would betime consuming. However, it is unreasonable to expectthat a simple model would be able to model a complexsystem. A very simple algorithm for a special case, whichoften happens in practice, is proposed in the paper.

Beta distributions are adopted as priors for the casestudy. The Beta distribution has many interesting prop-erties. The most important property of the Beta distribu-tion is that it is conjugated with the binomialdistribution. Thus the Beta distribution fits very wellfor the variables that are defined on (0,1). However,studies with other distributions present avenues for fur-ther research.

Acknowledgment

The author would like to thank the two anonymousreferees and the editor for providing helpful comments.

References

Bai, C.G., Hu, Q.P., Xie, M., 2005. Software failure prediction basedon a Markov Bayesian network model. Journal of Systems andSoftware 74 (3), 275–282.

Bai, C.G., Cai, K.Y., Chen, T.Y., 2003. An efficient defect estimationmethod for software defect curves. In: Proceedings of the 27thAnnual International Computer Software and Applications Con-ference, Dallas, USA, pp. 534–539.

Basu, S., Ebrahimi, N., 2003. Bayesian software reliability modelsbased on Martingale processes. Technometrics 45 (2), 150–158.

Bickmore, T.W., 1994. Real-time sensor data validation. NASAContractor Report 195295, National Aeronautics and SpaceAdministration.

Bishop, P., Pullen, F.D., 1988. Probabilistic modeling of softwarefailure characteristics. in: Proceedings of the IFAC WorkshopSAFECOMP�88, pp. 87–93.


Boland, P.J., Singh, H., 2002. Determining the optimal release time forsoftware in the geometric Poisson reliability model. InternationalJournal of Reliability, Quality and Safety Engineering 9 (3), 201–213.

Boland, P.J., Singh, H., 2003. A birth-process approach to Moranda�sgeometric software-reliability model. IEEE Transactions on Reli-ability 52 (2), 168–174.

Bouissou, M., Martin, F., Ourghanlian, A., 1999. Assessment of asafety-critical system including software: A Bayesian belief networkfor evidence sources. in: Proceedings of the Annual Reliability andMaintainability Symposium, pp. 142–150.

Cai, K.Y., 1998a. Software defect and operational profile modeling.Kluwer Academic Publishers, Dordrecht.

Cai, K.Y., 1998b. On estimating the number of defects remaining insoftware. Journal of Systems and Software 40, 93–114.

Cai, K.Y., 2000. Towards a conceptual framework of software runreliability modeling. Information Sciences 126 (1–4), 137–163.

Cai,, K.Y., 2003. In: Proceedings of the 3rd International Conferenceon Quality Software. IEEE Computer Society Press, Silver Spring,MD, pp. 32–39.

Cai, K.Y., Cai, L., Wang, W.D., 2001. On the neural networkapproach in software reliability modeling. Journal of Systems andSoftware 58, 47–62.

Castillo, E., Sarabia, J.M., Solares, C., 1999. Uncertainty analyses infault trees and Bayesian networks using FORM SORM methods.Reliability Engineering and Systems Safety 65, 29–40.

Fenton, N., Neil, M., 1999. Software metrics: successes, failures andnew directions. Journal of Systems and Software 47, 149–157.

Gelfand, A., Smith, A., 1985. Sampling based approaches to calculat-ing marginal densities. Journal of the American Statistical Asso-ciation 85, 385–409.

Goel, A.L., 1985. Software reliability models: assumptions, limitations,and applicability. IEEE Transactions on Software Engineering SE-11, 1411–1423.

Goel, A.L., Okumoto, K., 1979. Time dependent error detection ratemodel for software reliability and other performance measure.IEEE Transactions on Reliability 28 (3), 206–211.

Ho, S.L., Xie, M., Goh, T.N., 2003. A study of the connectionistmodels for software reliability prediction. Computers and Math-ematics with Application 46 (7), 1037–1045.

Jelinski, Z., Moranda, P.B., 1972. Software reliability research. In:Proceedings of the Statistical Methods for the Evaluation ofComputer System Performance. Academic Press, New York, pp.465–484.

Jordan, M.I., Ghahramani, Z., Jaakkola, T.S., Saul, L.K., 1999. Anintroduction to variational methods for graphical models. In:Jordan, M. (Ed.), Learning in Graphical Models. MIT Press,Cambridge, MA.

Kaaniche, M., Kanoun, K., 1992. The discrete-time hyperexponentialmodel for software reliability growth evaluation. in: Proceedings ofthe Third International Symposium on Software Reliability Engi-neering, pp. 64–75.

Karunanithi, N., Whitley, D., 1992. Prediction of software reliabilityusing feedforward and recurrent neural nets. in: International JointConference on Neural Networks, vol. 1, pp. 800–805.

Khoshgoftaar, T.M., Szabo, R.M., 1996. Using neural networks topredict software faults during testing. IEEE Transactions onReliability 45 (4), 56–462.

Kuo, L., Lee, J.C., 1997. Bayes inference for S-shaped software-reliability growth models. IEEE Transactions on Reliability 46 (1),76–80.

Kuo, L., Yang, T.Y., 1996. Bayesian computation for nonhomogene-ous Poisson processes in software reliability. Journal of theAmerican Statistical Association 91 (434), 763–773.

Lewis, R.W., Ransing, R.S., 1997. A semantically constrained Bayes-ian network for manufacturing diagnosis. International Journal ofProduction Research 35, 2171–2187.

Lyu, M.R. (Ed.), 1996. Handbook of Software Reliability Engineering.McGraw-Hill, New York.

Madigan, D., Mosurski, K., Almond, R.G., 1996. Explanation inbelief networks. Journal of Computational and Graphical Statistics6, 160–187.

Malaiya, Y.K., Li, M.N., Bieman, J.M, 2002. Software reliabilitygrowth with test coverage. IEEE Transactions on Reliability 51 (4),420–426.

Musa, J.D., 1993. Operational profiles in software reliability engineer-ing. IEEE Software 10 (1993), 14–32.

Musa, J.D., 1996. The operational profile. In: Ozekici (Ed.), Reliabilityand Maintenance of Complex Systems, NATO ASI Series, vol.F154. Springer, Berlin, pp. 332–343.

Neil, M., Littlewood, B., Fenton, N., 1996. Applying Bayesian beliefnetworks to system dependability assessment. in: Proceedingsof Safety Critical Systems Club Symposium, Springer-Verlag,Berlin.

Ozekici, S., Soyer, R., 2003. Reliability of software with an operationalprofile. European Journal of Operational Research 149 (2), 459–474.

Pai, G.J., 2001. Combining Bayesian belief networks with fault tree toenhance software reliability analysis. in: Proceedings of the IEEEInternational Symposium on Software Reliability Engineering.

Pearl, J., 1986. Fusion, propagation and structuring in belief network.Artificial Intelligence 29, 241–288.

Pfefferman, J.D., Cemuschi-Frias, B., 2002. A non-parametric non-stationary procedure for failure prediction. IEEE Transactions onReliability 51 (4), 434–442.

Pham, L., Pham, H., 2001. A Bayesian predictive software reliabilitymodel with pseudo-failures. IEEE Transactions on Systems, Manand Cybernetics 31 (3), 233–238.

Reussner, R.H., Schmidt, H.W., Poernomo, I.H., 2003. Reliabilityprediction for component-based software architectures. Journal ofSystems and Software 66 (3), 241–252.

Rothermel, G., Untch, R., Chu, C., Harrold, M.J., 2001. Prioritizingtest cases for regression testing. IEEE Transactions on SoftwareEngineering 27, 929–948.

Sahinoglu, M., Deely, J.J., Capar, S., 2001. Stochastic Bayes measuresto compare forecast accuracy of software-reliability models. IEEETransactions on Reliability 50 (1), 92–97.

Sigurdsson, J.H., Walls, L.A., Quigley, J.L., 2001. Bayesian belief netsfor managing expert judgment and modeling reliability. Qualityand Reliability Engineering International 17, 181–190.

Sitte, R., 1999. Comparison of software-reliability-growth predictions:neural networks vs parametric-recalibration. IEEE Transactionson Reliability 48, 285–291.

Smidts, C., Stoddard, R.W., Stutzke, M., 1998. Software reliabilitymodels: an approach to early reliability prediction. IEEE Trans-actions on Reliability 47, 268–278.

Xie, M., 1991. Software reliability modeling. World Scientific Pub-lisher, Singapore.

Xie, M., 1993. Software reliability models: a selected bibliography.Journal of Software Testing, Verification and Reliability 3, 32–38.

Yu, Y., Johnson, B.W., 2003, A BBN approach to certifying thereliability of COTS software system reliability. in: ProceedingsAnnual Reliability and Maintainability Symposium, pp. 19–24.

Zheng, S.H., 2002. Dynamic release policies for software systems witha reliability constraint. IIE Transactions 34 (3), 253–262.

Zhu, W.P., 2003. Using Bayesian network on network tomography.Computer Communication 26, 155–163.

bayesian network based software reliability prediction

Documents