Author: Royd Lüdtke, Director Director Static Code Analysis Tools (Verifysoft Technology)
Static Code Analysis and Dynamic Testing: Complementary Techniques for your Software Quality
Increased recall campaigns, delayed deliveries, difficulties in delivering the promised functions on time: software quality is not evident. The development of good software is only possible through consistent action, adherence to standards and the use of mature test and quality assurance tools. Bad software leads to monetary losses and deterioration of the corporate image. Embedded software is even more critical, as it is mostly used in safety-critical applications. Here, software errors can endanger human lives and must therefore be avoided at all costs.
For this reason, standards like ISO 26262, IEC 61508 or DO178-C have strict requirements regarding the quality of development and testing of software.
To ensure quality, both static code analysis procedures and the testing of executable software during dynamic analysis (including unit tests) are necessary. As each of the two approaches uncovers only a part of the existing defects, both complementary methods are necessary.
Static Analysis Tools can already be used at the beginning for the Development
While dynamic analysis requires the code to be executed, static analysis does not. Static analysis tools can therefore be used early in the development process during the implementation phase. For this reason, static code analysis contributes massively to the success of the project – the earlier errors are found, the more cost-effective are the fixes.
Without writing test cases, static code analysis tools check the code for syntax, semantics, control flow and data flow anomalies, concurrency problems as, well as for programming rules. Many bugs and security vulnerabilities are uncovered.
It is recommended, that the code is analyzed statically on a regular basis right from the start of development – preferably by the individual developer before he checks-in his code. It makes sense to only submit the code to a further verification step such as code reviews, unit tests or integration tests when the static code analysis no longer indicates any errors. With this procedure, the number of error messages during the final inspection before delivery can be dramatically reduced.
Static analysis tools are particularly useful in the development of embedded systems, where languages such as C and C++ are used. These languages give developers a lot of freedom – unfortunately also for writing faulty source code. Bugs like Null-Pointer-Exceptions, Buffer-Overflows or problems with global variables are common. Such errors can be avoided with static code analysis.
Dynamic Tests are also necessary
As soon as the software can be executed, static analysis should be supplemented by dynamic tests.
Dynamic tests are mainly used to prove the functional correctness of a system. Usually, they are performed as soon as the first code components are executable. An important part of these tests is the code coverage analysis, which ensures that all (important) parts of the code will be tested.
Code coverage tools like Testwell CTC++ from Verifysoft (1) place counters at all relevant points in the source code (instrumentation of the code), to measure if this code parts have been executed during the test runs. As embedded systems have usual only limited memory space, it is important that the overhead of this instrumentation remains small. In addition, code coverage tools should only have a minimal impact on performance to avoid malfunctions in time-critical systems. Coverage tools are usually integrated into the development environments – the code instrumentation is automatic. After the test runs, the coverage analyzer generates reports that allow to see in detail which functions were executed, and which were not.
For safety-critical software code coverage is mandatory. The standards DO-178C (aviation), ISO 26262 (automotive), EN 50128 (railway), and the general standard IEC 61508 stipulate high code coverage levels up to Modified Condition Decision Coverage (MC/DC) to demonstrate testing of all conditions or decisions in a software.
To achieve good Quality, both Static Analysis and Dynamic Tests are needed
To guarantee high quality, a combination of static analysis, sufficient testing during execution of the software (dynamic tests) associated with code coverage is necessary.
More information on: www.verifysoft.com
Verifysoft Technology - Software Testing Blog 