Metamorphic testing is an approach to both test case generation and test result verification. A central element is a set of metamorphic relations, which are necessary properties of the target function or algorithm in relation to multiple inputs and their expected outputs. Since its first publication, we have witnessed a rapidly increasing body of work examining metamorphic testing from various perspectives, including metamorphic relation identification, test case generation, integration with other software engineering techniques, and the validation and evaluation of software systems. In this article, we review the current research of metamorphic testing and discuss the challenges yet to be addressed. We also present visions for further improvement of metamorphic testing and highlight opportunities for new research. Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from permissions@acm.org.  Software testing is a mainstream approach to software quality assurance and verification. However, it faces two fundamental problems: the oracle problem and the reliable test set problem. The oracle problem refers to situations where it is extremely difficult, or impossible, to verify the test result of a given test case (that is, an input selected to test the program). Normally, after the execution of a test case t, a systematic mechanism called a test oracle (or simply an oracle) is required to check the execution result. If the result does not agree with the expected outcome, we say that t fails and refer to it as a failure-causing test case. Otherwise, we say that t succeeds and refer to it as a successful, or non-failure-causing, test case. In many real-life situations, however, an oracle may not exist, or it may exist but resource constraints make it infeasible to use. The reliable test set problem means that since it is normally not possible to exhaustively execute all possible test cases, it is challenging to effectively select a subset of test cases (the reliable test set) with the ability to determine the correctness of the program. A number of strategies have been proposed to generate test cases for addressing the reliable test set problem, including random testing [39] , coverage testing [101], search-based testing [40] , and symbolic execution [11] . Compared with test case generation strategies, only a few techniques have been proposed to address the oracle problem, such as assertion checking [79] and N -version programming [61] . When the oracle problem occurs, many strategies for the reliable test set problem have limited applicability and effectiveness. Regardless of how effective a strategy is in generating a failure-causing test case, unless it leads to a crash of the program under test, that failure may not be recognized in the presence of the oracle problem. Unlike most other software testing techniques, Metamorphic Testing (MT) [15] can be used for both test case generation and test result verification-thus addressing both fundamental problems of testing. Although it was initially proposed as a method to generate new test cases based on successful ones, it soon became apparent that MT is also an effective approach for alleviating the oracle problem. A central element of MT is a set of Metamorphic Relations (MRs), which are necessary properties of the target function or algorithm in relation to multiple inputs and their expected outputs. When implementing MT, some program inputs (called source inputs) are first generated as source test cases, on the basis of which an MR can then be used to generate new inputs as follow-up test cases. Unlike the traditional way of verifying the test result of each individual test case, MT verifies the source and follow-up test cases as well as their outputs against the corresponding MR. Since its first publication in 1998, quite a number of studies have been conducted on various aspects of MT. In recent years especially, MT has been attracting an increasing amount of attention and has helped detect a large number of real-life faults. It was a surprise to the software testing community, for example, when MT managed to detect new faults [77, 93] in three out of seven programs in the Siemens suite [43] even though these programs had repeatedly been studied in major software testing research projects for twenty years. In addition, Le et al. [50] detected over 100 faults in two popular C compilers (GCC and LLVM) based on a simple relation, which was quickly realized to be an MR [51, 78] . In addition to its extensive use in software testing [8, 13, 14, 16, 20, 50-52, 83, 91, 99], MT has been widely applied to address the oracle problem in the broader context of software engineering [3, 27, 29, 45, 46, 57, 77, 92, 93] . It has also been used as a technique for validation [91] and quality assessment [98] , detecting real-life faults in several popular search engines. In recent surveys of the oracle problem [4, 68, 71, 72] , a significant amount of discussion was devoted to MT, which was categorized as a mainstream and promising approach for addressing the problem. Among the surveys specifically about MT [34, 42, 81]
In software engineering, metamorphic testing uses metamorphic relations to help establish a test oracle (see, e.g., REF ] for a recent review).
Metamorphic Testing: A Review of Challenges and Opportunities
CSUR
Computer Science