1. UNIVERSITAS SCIENTIARUM SZEGEDIENSIS UNIVERSITY OF SZEGED D epartment of Software Engineering Source code analysis with Columbus  Quality assessment  Architecture reconstruction Árpád Beszédes Department of Software Engineering, University of Szeged, Hungary

2. UNIVERSITY OF SZEGED D epartment of Software Engineering UNIVERSITAS SCIENTIARUM SZEGEDIENSIS 2008.04.17Scalable Program Analysis - Dagstuhl Seminar2 Who we are  One of the leading SE research groups in Hungary ■http://www.inf.u-szeged.hu/sed/  Competences ■Software quality ■Software testing ■Embedded systems ■Networks ■Open Source ■.NET ■Java

3. UNIVERSITY OF SZEGED D epartment of Software Engineering UNIVERSITAS SCIENTIARUM SZEGEDIENSIS 2008.04.17Scalable Program Analysis - Dagstuhl Seminar3 Monitor Source code quality Test management Architecture IT operation performance Processes (e.g. issue m) Place of source code analysis Software maintenance / evolution of large systems

4. UNIVERSITY OF SZEGED D epartment of Software Engineering UNIVERSITAS SCIENTIARUM SZEGEDIENSIS 2008.04.17Scalable Program Analysis - Dagstuhl Seminar4 References  Telecom, financial, other  Analyzed systems (1-30 MLOC) ■Graphisoft ArchiCAD ■Nuance-Scansoft Recognita ■evoSoft ■Erste Bank ■Nokia S60 platform ■Mozilla Firefox & Thunderbird ■SUN, OpenOffice.org ■Eclipse ■NASA WorldWind ■Etc.

5. UNIVERSITY OF SZEGED D epartment of Software Engineering UNIVERSITAS SCIENTIARUM SZEGEDIENSIS 2008.04.17Scalable Program Analysis - Dagstuhl Seminar5 Source code- based QA methodology architecture Continuous measurement and monitoring is needed!

6. UNIVERSITY OF SZEGED D epartment of Software Engineering UNIVERSITAS SCIENTIARUM SZEGEDIENSIS 2008.04.17Scalable Program Analysis - Dagstuhl Seminar6 Quality decrease of sw systems from: Roger Pressman - Software Engineering Software Engineering: A Practitioner's Approach, McGraw-Hill

7. UNIVERSITY OF SZEGED D epartment of Software Engineering UNIVERSITAS SCIENTIARUM SZEGEDIENSIS 2008.04.17Scalable Program Analysis - Dagstuhl Seminar7 Columbus technology  Analysis of large sw systems  In the scope of regular maintenance ■C/C++/C#/Java/SQL ■Quality measurements, auditing ■Reverse Engineering, architecture reconstruction ■One-shot assessment ■Continuous monitoring

8. UNIVERSITY OF SZEGED D epartment of Software Engineering UNIVERSITAS SCIENTIARUM SZEGEDIENSIS 2008.04.17Scalable Program Analysis - Dagstuhl Seminar8 Some history  1998-2001: Nokia Research Center  FrontEndART Software Ltd.  Further development ■Industrial projects ■Grants  50-100 man-years

9. UNIVERSITY OF SZEGED D epartment of Software Engineering UNIVERSITAS SCIENTIARUM SZEGEDIENSIS 2008.04.17Scalable Program Analysis - Dagstuhl Seminar9 Main components  Robust source code parsers  Analysis methodologies  Representation metamodels designed for maintenance tasks (language schemas)  Programming interfaces (API)  Extensions: CFG, call graph, DU, support for dynamic analysis (testing), etc.  Back ends ■Code measurement ■Reverse engineering  Standalone or SDK integration, command-line, API ■SourceAudit, SourceDoc (previously Columbus/CAN)  Monitoring subsystem: SourceInventory (was Monitor)

10. UNIVERSITY OF SZEGED D epartment of Software Engineering UNIVERSITAS SCIENTIARUM SZEGEDIENSIS 2008.04.17Scalable Program Analysis - Dagstuhl Seminar10 Overview Source code Reverse engineered model Transformed model Modified Source code Architecture reconstruction Visualization Program comprehension Measurements Analyses Reengineering etc. Schemas fact extraction process dependency and design pattern detection analyzing fault- proneness class diagrams and documentation checking coding conventions monitoring

11. UNIVERSITY OF SZEGED D epartment of Software Engineering UNIVERSITAS SCIENTIARUM SZEGEDIENSIS 2008.04.17Scalable Program Analysis - Dagstuhl Seminar11 Reverse Engineering  SourceDoc tool  Creation of UML logical views of the analyzed system ■Class diagrams ■In standard XMI format –can be loaded e.g. into Rational Rose  Automatic generation of HTML documentation ■Class-level ■Hyperlinked  Design pattern usage detection  Detecting architecture-level dependencies ■“Superlinking” ■Among physical components (e.g. exe, dll) ■E.g. function calls, includes

12. UNIVERSITY OF SZEGED D epartment of Software Engineering UNIVERSITAS SCIENTIARUM SZEGEDIENSIS 2008.04.17Scalable Program Analysis - Dagstuhl Seminar12 “Bad smell” detection  SourceAudit tool  Finds code fragments that ■might be problematic ■and error-prone, ■so it needs refactoring ■e.g.: Feature Envy: a function which does not use its own class, but relies on others

13. UNIVERSITY OF SZEGED D epartment of Software Engineering UNIVERSITAS SCIENTIARUM SZEGEDIENSIS 2008.04.17Scalable Program Analysis - Dagstuhl Seminar13 Clone detection  Finds duplicated code fragments (copy/paste, clones)  Clones can cause many hard-to-find bugs  The detection can be scaled ■from exact match ■to similar code fragments  Uses efficient flat-tree based recognition  Language independent

14. UNIVERSITY OF SZEGED D epartment of Software Engineering UNIVERSITAS SCIENTIARUM SZEGEDIENSIS 2008.04.17Scalable Program Analysis - Dagstuhl Seminar14 Code checking  Checking conformance to coding rules ■Some of them indicate bugs  The rules ■check the coding style ■extend the warning capabilities of the compiler ■check typical implementation errors ■new rules can be added easily (C++ API)  General good practice rules  Company specific rules  Integration of other checkers’ results  Integration with MS Visual Studio and Eclipse  Command-line operation

15. UNIVERSITY OF SZEGED D epartment of Software Engineering UNIVERSITAS SCIENTIARUM SZEGEDIENSIS 2008.04.17Scalable Program Analysis - Dagstuhl Seminar15 Code measurement – metrics  All popular metrics for procedural, OO, SQL languages ■CK, size, complexity, coupling, cohesion, OO-ness, etc.  Interpretation of metrics? ■E.g. different types of cyclomatic complexity  The metrics-based fault predictor model selects C++ classes that are liable to errors 1 ■successfully tested on Mozilla [1] Gyimóthy T, Ferenc R and Siket I. Empirical Validation of Object-Oriented Metrics on Open Source Software for Fault Prediction. IEEE TSE vol.31, no.10, October 2005

16. UNIVERSITY OF SZEGED D epartment of Software Engineering UNIVERSITAS SCIENTIARUM SZEGEDIENSIS 2008.04.17Scalable Program Analysis - Dagstuhl Seminar16 Connectivity to other tools  ART (RSF)  {CPP|J|CS}ML (XML)  FAMIX XMI  GXL  Maisa (Prolog)  RSF  UML XMI  VCG  Machine readable CSV  Human readable txt

17. UNIVERSITY OF SZEGED D epartment of Software Engineering UNIVERSITAS SCIENTIARUM SZEGEDIENSIS 2008.04.17Scalable Program Analysis - Dagstuhl Seminar17 Technical details  Own and commercial front ends  Analysis of complex systems: ■Compiler wrapping technology  Standard schemas ■OO-style ■C++ API  High-level language independent model  Cross-module dependencies: superlinking

18. UNIVERSITY OF SZEGED D epartment of Software Engineering UNIVERSITAS SCIENTIARUM SZEGEDIENSIS 2008.04.17Scalable Program Analysis - Dagstuhl Seminar18 Scalability?  Limited low-level analyses ■Lightweight? ■Problems of other kind  Common high-level model  Relatively easy system integration  Anything else you wanted to know?

19. UNIVERSITY OF SZEGED D epartment of Software Engineering UNIVERSITAS SCIENTIARUM SZEGEDIENSIS 2008.04.17Scalable Program Analysis - Dagstuhl Seminar19 Monitoring subsystem  SourceInventory  The source code of the system is ■downloaded automatically by the framework from a configuration management system (e.g. CVS) ■analyzed, and the results are stored in a database ■queries can be run and diagrams can be drawn from a web-based interface, which communicates with the database

20. UNIVERSITY OF SZEGED D epartment of Software Engineering UNIVERSITAS SCIENTIARUM SZEGEDIENSIS 2008.04.17Scalable Program Analysis - Dagstuhl Seminar20 Monitoring subsystem (cont.)  Automatic alerts can be issued when indicators overrun critical thresholds ■metric baselines  Internally: quality assessment  Customer: continuous measurement  Public databases: Mozilla, maemo, (OpenOffice, Eclipse)

21. UNIVERSITY OF SZEGED D epartment of Software Engineering UNIVERSITAS SCIENTIARUM SZEGEDIENSIS 2008.04.17Scalable Program Analysis - Dagstuhl Seminar21 Screenshots (1)

22. UNIVERSITY OF SZEGED D epartment of Software Engineering UNIVERSITAS SCIENTIARUM SZEGEDIENSIS 2008.04.17Scalable Program Analysis - Dagstuhl Seminar22 Screenshots (2)

23. UNIVERSITY OF SZEGED D epartment of Software Engineering UNIVERSITAS SCIENTIARUM SZEGEDIENSIS 2008.04.17Scalable Program Analysis - Dagstuhl Seminar23 Screenshots (3)

24. UNIVERSITY OF SZEGED D epartment of Software Engineering UNIVERSITAS SCIENTIARUM SZEGEDIENSIS 2008.04.17Scalable Program Analysis - Dagstuhl Seminar24 Screenshots (4)

25. UNIVERSITY OF SZEGED D epartment of Software Engineering UNIVERSITAS SCIENTIARUM SZEGEDIENSIS 2008.04.17Scalable Program Analysis - Dagstuhl Seminar25 Screenshots (5)

26. UNIVERSITY OF SZEGED D epartment of Software Engineering UNIVERSITAS SCIENTIARUM SZEGEDIENSIS 2008.04.17Scalable Program Analysis - Dagstuhl Seminar26 Screenshots (6)

27. UNIVERSITY OF SZEGED D epartment of Software Engineering UNIVERSITAS SCIENTIARUM SZEGEDIENSIS 2008.04.17Scalable Program Analysis - Dagstuhl Seminar27 Screenshots (7)

28. UNIVERSITY OF SZEGED D epartment of Software Engineering UNIVERSITAS SCIENTIARUM SZEGEDIENSIS 2008.04.17Scalable Program Analysis - Dagstuhl Seminar28 Screenshots (8)

29. UNIVERSITY OF SZEGED D epartment of Software Engineering UNIVERSITAS SCIENTIARUM SZEGEDIENSIS 2008.04.17Scalable Program Analysis - Dagstuhl Seminar29 Screenshots (9)

30. UNIVERSITY OF SZEGED D epartment of Software Engineering UNIVERSITAS SCIENTIARUM SZEGEDIENSIS 2008.04.17Scalable Program Analysis - Dagstuhl Seminar30 Nokia R&D projects  History ■1998 – TED projects: C++ to UML ■2005 – ART projects: Symbian platform  Architecture reconstruction of Symbian platform ■Identification of “architectural erosion”  Quality measurement of Symbian platform ■Metrics ■Official Symbian coding guidelines (SourceAudit)  Quality measurement of maemo platform

31. UNIVERSITY OF SZEGED D epartment of Software Engineering UNIVERSITAS SCIENTIARUM SZEGEDIENSIS 2008.04.17Scalable Program Analysis - Dagstuhl Seminar31 Technology extensions – 1  SourceAudit coding rules (114) ■general 'good practice' C++ coding rules ■Symbian OS-specific rules ■Nokia recommended rules  viability – the code will not work  reliability – the code may not work  maintainability – the code may be difficult to modify  readability – the code may be difficult to understand  reusability – the code may be less usable in conjunction with other code  convention – the code will be unconventional

32. UNIVERSITY OF SZEGED D epartment of Software Engineering UNIVERSITAS SCIENTIARUM SZEGEDIENSIS 2008.04.17Scalable Program Analysis - Dagstuhl Seminar32 Technology extensions – 2  Architecture cross-component dependencies ■call: inter-component function calls ■include: the same header file is included by two components ■resource: the consumer’s serviceClass attribute equals to the provider’s interface_uid, the consumer’s contentType attribute equals to provider's default data item, and consumer's serviceCmd attribute equals to provider's opaque_data ■publish & subscribe: if a component sets a property (category and key), and an other subscribes for this property then there is a P&S dependency between the two components  Dependency metrics, e.g. xCallIn, xCallOut, xInclude  Visualization

33. UNIVERSITY OF SZEGED D epartment of Software Engineering UNIVERSITAS SCIENTIARUM SZEGEDIENSIS 2008.04.17Scalable Program Analysis - Dagstuhl Seminar33 Technology extensions – 3  Build process (Symbian SDK) wrapping ■Hides the original compiler with wrapper programs (e.g. gcc.exe)  After activating the SDKWrapper the project can be built as usual ■creating abld.bat by ‘bldmake bldfiles’ and ■building the project by ‘abld build …’  Build scripts provided for linking and inter- component dependency computation  Difficulties: compiling resource files, excluding test components