Static Testing: defect prevention
SIM3302
objectives
Able to list various type of structured group examinations (manual checking) Able to statically analyse program code using compilers, data flow analysis, and control flow analysis
Structured Group Examination
Systematic use of human capability to think and analyse
Apply human analytical capability to check and evaluate complex issues This done by through intensive reading and trying to understand the documents that are examined Techniques : Reviews Another terms : inspection Peer reviews : if colleagues provide feedback Types of reviews
Walkthrough Inspection Technical review Informal review
You will learn in software quality course SIM4306
Static analysis
What is static analysis?
Analysis of software artifacts e.g., requirements or code, carried out without execution of these software artifacts
Objective of static analysis
To reveal defects or parts that are defect-prone in a document Additional objective
To derive metrics in order to measure and prove the quality of the object
How is static analysis done?
Static analysis tools known as static analysers
Objects to be analysed
Formal documents that must follow a certain formal structure
4
Static analyzers: General form
Static Analyser
Document Eg. Source code Syntax violation Deviation Data flow info Control flow info
Static analysis
Who and when used static analysis tools?
Developers Before and during component or integration testing
To check if guidelines or programming conventions are adhered to
During integration testing : analyse adherence to interface guidelines
What are produced by static analysis tools?
List of warnings and comments
Syntax violation Deviation from conventions and standards Control flow anomalies Data flow anomalies metrics
6
Static Analysis
If a static analysis is performed before a review, a number of defects can be found and the number of the aspects to be checked in the review clearly decreases
Thus much less effort in a review
Not all defects can be found using static testing
Some defects become apparent only when the program is executed (runtime)
Example: division by zero valued variable
Compiler as Static Analysis Tool
Detection of violation of the programming language syntax; reported as a fault or warning Further information and other checks
Generating a cross reference list of the different program elements (eg variables, functions) Checking for correct data type usage by data and variables in programming languages with strict typing Detecting undeclared variables Detecting code that is not reachable Detecting overflow or underflow of field boundaries Checking of interface consistency Detecting the use of all labels as jump start or jump target
8
Data Flow Analysis
What is it?
A form of static analysis based on the definition and usage of variables
How it is performed?
Analysis of data use
The usage of data on paths through the program code is checked
Use to detect data flow anomalies
Unintended or unexpected sequence of operations on a variable
What is an anomaly?
An inconsistency that can lead to failure, but does not necessarily so May be flagged as a risk
9
Data Flow Analysis
Examples of data flow anomalies
Reading variables without previous initialization Not using the values of a variable at all
The usage of every single variable is inspected Three types of usage or states of variables
Defined (d) : the variable is assigned a value Reference (r) : the value of the variable is read and/or used Undefined (u) : the variable has no defined value
10
Data Flow Analysis
Three types of data flow anomalies
ur-anomaly : an undefined value (u) of a variable is read on a program path (r) du-anomaly : the variable is assigned a value (d) that becomes invalid/undefined (u) without having been used in the meantime dd-anomaly : the variable receives a value for the second time (d) and the first value had not been used (d)
11
Data Flow Analysis: Example
The following function is supposed to exchange the integer Value of the parameters Max and Min with the help of the variable Help, if the value of the variable Min is greater than the value of the variable Max
void exchange (int& Min, int& Max) { int Help; if (Min > Max) { Max = Help; Max = Min; Help = Min; } }
12
Data Flow Analysis: Example
The following anomalies detected:
ur-anomaly of the variable Help
The domain of the variable is limited to the function The first usage of the variable is on the right side of an assignment At this time, the variable still has an undefined value, which is referenced there There was no initialization of the variable when it was declared
dd-anomaly of variable Max
The variable is used twice consecutively on the left side of an assignment and therefore is assigned a value twice Either the first assignment can be omitted or the use of the first value has been forgotten
13
Data Flow Analysis: Example
The following anomalies detected:
du-anomaly of the variable Help
In the last assignment of the function the variable Help is assigned another value that cannot be used anywhere This is because the variable is only valid inside the function
14
void exchange (int& Min, int& Max) { int Help; if (Min > Max) { Max = Help; Max = Min; Help = Min; } }
Help = Max; Max = Min; Min = Help;
15
Control Flow Analysis
What is control flow?
An abstract representation of all possible sequences of events (paths) in the execution of a component or system
A program structure is represented (modeled) by a control flow graph (CFG) CFG is a directed graph that shows a sequence of events (paths) in the execution through a component or system CFG consists of nodes and edges
Node represents a statement or a sequence of statements Edge represents control flows from one statement to another
16
Control Flow Analysis
Basic constructs of CFG
Sequence of assignment statements
IF THEN ELSE statement IF THEN
WHILE DO statement DO WHILE
17
Control Flow : example
A
DO
IF C THEN IF D THEN IF E THEN F ELSE G ELSE IF H THEN J ELSE K ELSE L WHILE B M
Modeled as
C D
E
G F J
H K L
B M
18
Control Flow Anomalies
Statically detected anomaly in the control flow of a test object Example
Jumps out of a loop body Program structure has many exits
19
Determining Metrics
Quality characteristics can be measured with metrics The intention is to gain a quantitative measure of software whose nature is abstract Example:
McCabes metric or cyclomatic complexity, V Measures the structural complexity of program code Based on CFG V(G) = e - n + 2 where V(G) is cyclomatic number of graph G e = number of edges in G n = number of nodes in G
20
Determining Metrics
Example: for CFG in previous slide
V(G) = e - n + 2 = 16 12 + 2 = 6 V(G) higher than 10 can not be tolerated and rework of the source code has to take place
V(G) can be used to estimate the testability and maintainability V(G) specifies the number of linearly independent paths in the program
21
Summary
Static testing can be done to find defect and deviation using:
Structured group examinations
Reviews
Inspection, walkthrough, technical review, informal review
Static analysis using static analyzers
Compiler Data flow analysis Control flow analysis
22
