Better Software - July/August 2008 - (Page 41) Figure 6 Figure 7 unpredictable and non-deterministic behavior of the program. Note the message: The severity level of this defect is “Critical,” the highest level. In addition to finding defects, the ASA tool allows users to categorize and prioritize defects found. The tool also is smart enough to recognize when defects have been fixed and that other unfixed, detected defects have shifted position in the source code. This capability is because the tool keeps track of defects by attributes and characteristics, not simply by location. The tool has a rich set of metrics, which includes cyclomatic complexity, detected fault density, and more than one hundred others, as shown in figure 6, a portion of a metrics report. The ASA tool also contains an architectural tool that allows the source code to be displayed in graphical format. The graphs show cyclic relationships between functions or methods within files and allow the user to drag and drop the methods or functions into different files to resolve the cyclic relationships. The tool also suggests the source code changes required to re-architect the source code, as shown in the Architect tool in figure 7. So what are some of the benefits of using ASA tools? To answer that question, consider the time it takes a developer debugging code to discover and fix software defects. Two case studies are presented. The first case study is scientific research code written in C++. This is the environment and toolkit used primarily by physicists to create highly portable 2D and 3D simulations. These pro- grams change frequently and are highly algorithmic and complex. They also run in parallel on some of the world’s largest and fastest computers. The second case study is C++ code used in security software products. This code has been stable for years with occasional functionality upgrades. These case studies represent two very different types of software. Our first case study was done using a physics simulation application written in the C++ programming language that is used by other application development teams at Lawrence Livermore National Laboratory (LLNL), which uses two of the better performing ASA tools, Klocwork K7 and Coverity Prevent. The first case study presented is for the Klocwork K7 tool. The application in this case study involved approximately 137,000 lines of executable C++ code, and approximately 1,000 suspected defects were discovered by Klocwork. The case study focused on just one defect (buffer overflow) of which eighty-two instances were discovered. This defect type was chosen because the behavior of the code at run time is unpredictable, it isn’t repeatable from run to run, it typically is not caught by debuggers, and it is one of the most time-consuming defects to isolate and repair. The value of the ASA tool became apparent when it took fewer than thirty minutes to run the static analysis on the application, and all eightytwo detected buffer overflows were fixed by the developer in just a couple of days. This translates into customers’ not having to deal with intermittent and non-repeatable reliability problems and your not having to respond to as many customer complaints and release cycles with fixes, which saves money. The second case study was conducted on 345,000 lines of code written by laboratory developers in Borland C++ Version 6. This software was used for user interfaces and gateways for a physical security system. The C++ code has been running in a 24/7 environment for four years and contains a variety of applications such as Alarm Display and Configuration Editor. This software runs at multiple sites, and the code is very stable with rare, unexplained errors. Even though the level of quality of this software was generally acceptable, our case BETTER SOFTWARE www.StickyMinds.com JULY/AUGUST 2008 41 http://www.StickyMinds.com
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.