Some time ago we communicated with TEKAMA Company about developing a course on static analysis for one of their corporate clients. Unfortunately, the project has not been implemented but we are still ready to develop theoretical and practical courses in this sphere. If you are interested in courses in the saphere of increasing software quality and code verification, write to us, we are likely to find mutual interests.
To make clear what exactly these courses include let’s study the contents of the two courses we have been planning to develop for TEKAMA Company. The first course is theoretical, the second is practical.
Static analysis. Theoretical section.
The first section of the course is of theoretical character and is intended for familiarizing the attendees with the methodology of static analysis and the principles it is based on. The course is meant for developers using C/C++ programming languages within the framework of Visual Studio 2008 environment. But it concerns many theoretical issues such as estimating the cost of a program project, metrics’ types, etc, what can be interesting for developers using any development environments.
Contents:
- The history of static analysis methodology
- Technical principles underlying static code analyzers
- Metrics
- Static analysis
- Additional information and a story about resources devoted to the topic of static analysis
- Answering the questions
a. Methods of increasing programs’ quality
b. Code review methodology as a basis of static analysis
c. Development of static analysis methodology
d. Advantages and disadvantages of static analysis in comparison with other code verification (testing) methodologies
a. Brief description of the interior organization of static analyzers
b. Collection of information on the basis of parsing AST or parse tree
c. Tools for creating solutions in the sphere of code analysis
a. Estimate of the cost of a program project on the basis of metrics
i. Where do estimate errors arise from and in what way is metrics calculation helpful
ii. Types of cost estimate metrics, their advantages and disadvantages
1. The role of lines of code (LOC) in size estimate
2. Functional points
3. Conversion of functional points into LOC
4. Simplified methods of calculating functional points
5. Dutch method
6. GUI items
iii. Using estimates when negotiating and making decisions
iv. Steve McConnel’s works in the sphere of cost estimate
v. An example of a tool in the sphere of estimating the cost of creating a project
b. Increase of quality and safety of a project with the help of complexity estimate metrics
i. Holstead’s metrics
ii. Jilb’s metrics
iii. McCabe’s metrics (cyclomatic complexity)
iv. Meyers’ metrics
v. Other metrics and literature on them
vi. Practical use of complexity metrics
vii. Examples of tools for estimating cyclomatic complexity (SourceMonitor, C and C++ Code Counter)
a. Difference between static analysis and dynamic analysis
b. Advantages and disadvantages of static analysis in comparison with dynamic analysis
c. How static and dynamic analysis can efficiently complement each other
d. Using sets of rules for diagnosing
i. Scott Meyers “Effective C++”
ii. MISRA
iii. OOP
iv. Qt Best Practices
v. Other sets of rules
e. Using static analysis for style unification
i. Examples
ii. Discussion of the examples
f. Using static analysis for searching errors
i. Inattention errors, diagnosing, examples
ii. Initialization errors, diagnosing, examples
iii. Safety errors, diagnosing, examples
iv. Compatibility errors when developing cross-platform solutions, diagnosing, examples
v. Performance errors, diagnosing, examples
vi. Errors in multi-thread programs, diagnosing, examples
vii. Other types of errors, diagnosing, examples
g. Using static analysis in practice
i. Why are there so many warnings and what to do with them?
ii. Integration of static analysis into the development process
h. Examples of the most popular static analysis systems
Static analysis. Practical section.
The second section is of practical character and is intended for familiarizing the attendees with some static analysis tools and methods of using them. The course is meant for developers using C/C++ programming languages within the framework of Visual Studio 2008 development environment. In the second section of the course we can touch upon the ways of applying practical studies on getting acquainted with the tools. As the authors of the course we can provide Viva64 and VivaMP tools free for the attendees to get acquainted with the working principles of static analyzers. If it is interesting to arrange practical studies on the basis of other tools, we should discuss this possibility and the budget for purchasing them separately.
Contents:
- Review of code static analysis tools
- Learning to apply the tools for calculating metrics
- Learning to apply C/C++ code static analysis tools
- Practical approaches to integration of static analysis tools in the development process
- Answering the questions
a. Lint
b. PC-Lint
c. FxCop
d. JLint
e. Cccc
f. Estimate
g. Analyzer included into Visual Studio Team System
h. Viva64
i. VivaMP
j. Parasoft C++Test
k. Other tools
a. Simple tools: SourceMonitor, C and C++ Code Counter (Cccc)
i. SourceMonitor. Examples of use.
ii. C and C++ Code Counter. Examples of use.
b. Estimate program by Steve McConnel
i. Methodologies of using Estimate program
ii. Examples of use
a. PC-Lint
i. Installation and setting of PC-Lint
ii. Integration of PC-Lint into Visual Studio 2005/2008 and use of Visual Lint productt
iii. Adaptation of PC-Lint tool’s settings to a project’s peculiarities
iv. Examples of use
b. Viva64
i. Installation and setting of Viva64
ii. Adaptation of Viva64 tool’s settings to a project’s peculiarities
iii. Examples of use
iv. We can discuss the variants of practical training on search of errors in 64-bit programs with the help of Viva64 tool. As the authors of Viva64 analyzer we are ready to provide the attendees with it free to get acquainted with it within the framework of the course.
c. VivaMP
i. VivaMP as a new direction in testing parallel applications
ii. Installation and setting of VivaMP
iii. Adaptation of VivaMP tool’s settings to a project’s peculiarities
iv. Examples of use
v. We can discuss the variants of practical training on search of errors in parallel programs with the help of VivaMP tool. As the authors of VivaMP analyzer we are ready to provide the attendees with it free to get acquainted with it within the framework of the course.
d. C++Test
i. Installation and setting of C++Test
ii. Adaptation of C++Test tool’s settings to a project’s peculiarities
iii. Examples of use
