Home > Software Quality News > Static analysis tool helps software engineers find bugs during builds
Software Quality News:
EMAIL THIS

Static analysis tool helps software engineers find bugs during builds

By Jennette Mullaney, Associate Editor
03 Sep 2008 | SearchSoftwareQuality.com

Software quality news and advice
Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us    Add to Google

When Mentor Graphics Inc. decided to switch to an agile methodology, the company needed a source code analysis tool that fit its development methodology and its complex code base. Klocwork Insight, a static analysis tool, provided the right services and conformed to agile principles.

Klocwork [Insight's] static analysis takes the runtime burden away from engineering and QA. It identifies potential software quality issues before [the code] gets built and propagated.
Kevin Pendleton
Director of quality and support systems, Mentor Graphics Inc.

The tool handles Mentor Graphic's extensive amount of source code, including older legacy code and newer acquired code, said Kevin Pendleton, director of quality and support systems for Mentor Graphics. Integrating Klocwork at the engineering desktop level prevents bugs from getting into builds or the QA environment, he explained.

"Klocwork [Insight's] static analysis takes the runtime burden away from engineering and QA," Pendleton said. "It identifies potential software quality issues before [the code] gets built and propagated."

Engineers discover and correct bugs themselves
Mentor Graphics uses the database that Insight creates at each build "to refactor legacy code and to analyze acquired technology details of code, relationships, third-party components, and forward architecture," Pendleton said. Engineers are able to view their own code and correct mistakes on the spot, while the information is still fresh in their minds. According to Klocwork, this process "empowers" engineers.

Pendleton agrees with that claim. "Let's just say our first step was to integrate Klocwork builds at our mainline system build level -- that is after engineering makes their changes and we build a system or set of products," he said.

In that scenario, Klocwork captures the impact of changes, particularly how many of a certain class of defect was introduced.

"We can correct those," Pendleton said, "but it's already a little late." However, if engineers are able to see and fix their own code, they are able to preclude that defect from ever being seen by QA or customers.

More information on the benefits of static analysis
How static analysis can improve software security

Static Analysis as Part of the Code Review Process -- Chapter 3, Secure Programming with Static Analysis

Web application security testing basics

Before choosing Insight, Mentor Graphics had been using dynamic analysis "sporadically," Pendleton said. He found dynamic analysis "more intensive" to complete.

"Typically, it requires a different caliber of an engineer who can run through all aspects of a design flow exorcising code to get all the bugs," Pendleton said. "With static analysis, you don't have to do it at the runtime -- you do it at the build level. It's easier to adopt."

Transitioning to agile
Easy adoption was crucial in light of the fact that Mentor Graphics was switching to an agile methodology. Pendleton is impressed with Klocwork Insight's integration into an agile environment.

"From my perspective, it fits very well with an agile model," he said. "Part of an agile approach is to find errors early, thereby reducing downstream costs."

Mentor Graphics decided to employ the Scrum model, Pendleton said. "We don't just flip a switch," he said of the transition. "We have a mixed environment as we look to deploy Scrum across our enterprise."

Pendleton has "high hopes" for standardizing Klocwork Insight as part of an agile implementation. "I think it makes sense based on results we've seen -- it's absolutely in line with agile principles," he said.

The tool is easy to use and has increased the productivity of Mentor Graphic's engineers and the quality of their code, according to Pendleton.

"As we move forward with our agile implementation, I'm looking forward to seeing Klocwork be a required element of that process," he said.



Tags: Software security testing toolsAgile software developmentScrum software developmentSource code analysisWeb application security tools and servicesTesting toolsVIEW ALL TAGS

Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us    Add to Google



RELATED CONTENT
Software security testing tools
Why you don't need to buy a testing tool, except when you do
Old problems persist in Web 2.0 security practices
Beating software's cross-site scripting, authentication problems
Free tools for Agile testers
Put a stop to software espionage by watermarking source code
How to make your software tamperproof
How can I tell if my software security has been breached?
WebGoat: password weakness issues, basic application hacking concerns
Lesser-known free software testing tools testers should try
Demo: Using WebGoat, a free software testing tool

Agile software development
Q&A: Software tester describes daily application performance testing work
Top Agile development tips of 2009
How to manage your development portfolio through Agile Focus Stories
Top software testing and quality assurance news stories from 2009
Agile development: Quality assurance, consistency in testing
Aligning business goals with Focus Stories
Scaling Agile development: Get your Focus Story together
Getting things done with agile modeling: Five architectural tips
IBM Rational Team Concert gets more 'social'
Handling the people side of Agile software development

Scrum software development
Best practices for Scrum and when to apply them
Test-driven testing face-off: Waterfall vs. Agile
Agile by the numbers: Survey finds more adoption, but age-old problems
Boston SPIN: A small group's big ideas about agile development
Accelerate your agile software testing
Danube's Dan Rawsthorne: Scrum teams and metrics
Agile development growing, but problems remain
Turning agile skeptics to believers at Blueprint Systems
How Covad made the switch to a distributed agile development process
Can traditional project management and agile development coexist?

RELATED GLOSSARY TERMS
Terms from Whatis.com − the technology online dictionary
penetration testing  (SearchSoftwareQuality.com)

RELATED RESOURCES
2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
Search Bitpipe.com for the latest white papers and business webcasts
Whatis.com, the online computer dictionary



Software Development Methods - Extreme Programming, Agile Programming, Scrum
About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
SEARCH 
TechTarget provides technology professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective purchase decisions and managing their organizations' technology projects - with its network of technology-specific websites, events and online magazines.

TechTarget Corporate Web Site  |  Media Kits  |  Site Map




All Rights Reserved, Copyright 2006 - 2010, TechTarget | Read our Privacy Policy
  TechTarget - The IT Media ROI Experts