大型的程式總是包含許多的錯誤 (bug)，這些錯誤只在特定的輸入 (Input) 下才會發生。程式除錯 (Fault Localization) 的步驟在Time-to-Market日漸重要的今天，關鍵性的決定了產品開發的速度。
為了找到程式的錯誤，程式設計師通常必須花費很多的時間在：人工檢查程式碼 (Examine codes) 和人工觀察程式狀態 (Program States) 有無異常。這兩項工作都是耗時且需要經驗的。
在自動程式除錯的研究領域，為了有效的縮短除錯時間，有許多的技術被提出來。其中程式碼覆蓋度 (Code Coverage) 被認可為最有效可找出可疑程式碼 (Suspicious Statements) 的一項技術。程式設計師只需檢查可疑的部份，而不需檢查所有的程式碼。然而，單純檢查程式碼在現實的除錯步驟當中是不夠的，一旦程式設計師無法在可疑程式碼中看出錯誤，還是必須手動一步步的去檢查程式狀態以找出程式行為的異常 (Anomaly in Program Behavior)。本研究發明了一項名為狀態覆蓋度 (State Coverage) 的技術，利用通過 (passed) 及失敗 (failed) 的測試輸入 (Test Cases)，以及在程式碼的分支敘述 (branch statement) 插入檢查點 (Check Point) 的方法，加上機率函數的計算，找出在特定位置和錯誤最有關係的程式狀態 (Fault Relevant States)。我們並利用此可疑程式狀態 (Suspicious States) 配合可疑程式碼來加速除錯的速度。
我們採用了有名的測試程式Siemens Suite來驗證我們的方法，實驗結果發現，透過狀態覆蓋這項技術，有高達22%的測試程式被我們精準的找出了錯誤。而整體而言，加上狀態覆蓋度的效率比單純使用程式碼覆蓋度高了86%。

A state is statistically considered to be more suspicious if it appears more in failed cases and less in passed cases.
We implemented both code coverage and stage coverage in a debugging tool and used a commonly-used benchmark consisting of 58 faulty programs to evaluate their performance.
For 22% of these programs, their faults are within 10 statement steps of the most suspicious statement identified by code coverage.
By adding state coverage and breaking at the most suspicious state of this most suspicious statement, we increase this ratio to 41%, an 86% performance improvement.
Finally, we also explain a few cases in which both state coverage and code coverage cannot perform well.

[1] H. Agrawal and J. Horgan. Dynamic Program Slicing. In Proceedings of ACM SIGPLAN 1990 Conference on Programming Language Design and Implementation, pages 246-256,1990.
[2] H. Agrawal, J. Horgan, S. London, and W. Wong. Fault Localization Using Execution Slices and Datafow Tests. In Proceedings of IEEE Software Reliability Engineering, pages
143-151, 1995.
[3] H. Cleve and A. Zeller. Locating Causes of Program Failures. In Proceedings of International Conference on Software Engineering, pages 342-351, 2005.
[4] gcov: a Test Coverage Program. http://gcc.gnu.org/onlinedocs/gcc-3.0/gcc 8.html.
[5] GDB: The GNU Project Debugger. http://www.gnu.org/software/gdb/.
[6] Neelam Gupta, Haifeng He, Xiangyu Zhang, and Rajiv Gupta. Locating Faulty Code Using Failure-inducing Chops. In Proceedings of IEEE/ACM International Conference on
Automated Software Engineering, pages 263-272, 2005.
[7] M. J. Harrold, G. Rothermel, K. Sayre, R. Wu, and L. Yi. An Empirical Investigation of the Relationship Between Spectra Diferences and Regression Faults. Journal of Software Testing, Verification, and Reliability, 10(3):171-194, 2000.
[8] M. Hutchins, H. Foster, T. Goraida, and T. Ostrand. Experiments of the Effectiveness of Dataflow and Controlflow-based Test Adequacy Criteria. In Proceedings of International Conference on Software Engineering, pages 191-200, 1994.
[9] J. Jones and M. J. Harrold. Empirical Evaluation of the Tarantula Automatic Fault Localization Technique. In Proceedings of IEEE/ACM International Conference on Automated Software Engineering, pages 273-282, 2005.
[10] J. Jones, M. J. Harrold, and J. Stasko. Visualization of Test Information to Assist Fault Localization. In Proceedings of International Conference on Software Engineering, pages 467-477, 2002.
[11] B. Korel and J. Laski. Dynamic Slicing of Computer Programs. The Journal of Systems and Software, 13(3):187-195, 1990.
[12] M. Renieris and S. Reiss. Fault Localization with Nearest Neighbor Queries. In Proceedings of IEEE/ACM International Conference on Automated Software Engineering, pages 30-39, 2003.
[13] M. Weiser. Program Slicing. IEEE Transactions on Software Engineering, SE-10(4):352-357, 1982.
[14] xSlice: A Tool for Program Debugging. http://xsuds.argreenhouse.com/html-man/coverpage.html.
[15] A. Zeller. Yesterday, My Program Worked. Today, It Does Not. Why? In Proceedings of ACM SIGSOFT International Symposium on Foundations of Software Engineering, pages
253-267, 1999.
[16] A. Zeller. Isolating Cause-Effect Chains from Computer Programs. In Proceedings of ACM SIGSOFT International Symposium on Foundations of Software Engineering, pages 1-10,2002.
[17] A. Zeller and R. Hildebrandt. Simplifying and Isolating Failure-Inducing Input. IEEE Transactions on Software Engineering, 28(2):183-200, 2002.
[18] Xiangyu Zhang, Haifeng He, Neelam Gupta, and Rajiv Gupta. Experimental Evaluation of Using Dynamic Slices for Fault Location. In Proceedings of International Symposium on
Automated Analysis-driven Debugging, pages 33-42, 2005.