Building better software: The applicability of a professional tool for automating quality assessment and fault detection

Abstract

The size of software applications is growing. It is no longer possible to achieve full coverage in pre-release testing, and in many cases it is not even possible to provide significant partial coverage. Automatic methods such as formal modeling are a possible solution, but they are far too expensive to apply to every piece of developed code. Static code defect detectors provide a solid and dependable means for selecting high risk sections of code for more expensive review, such as formal modeling or manual inspection. Historically, static code defect detectors have been vilified in academic and industrial domains on the basis that they are unstable and uncorrelated with defect data. This vilification is an unfair characterization of these detectors, and is based largely on an assessment criteria that can be demonstrated to be inadequate for selecting and cataloging produced detectors. This study introduces a new mechanism for assessing detectors, called PACE, which is used to demonstrate that acceptable detectors can be produced with relative ease, and that those detectors are stable enough to be used in a general environment. Furthermore, this thesis presents a study in producing a viable commercial application for streamlining this type of analysis, and discusses how that application has been received in commercial and government domains.