[ISTQB] 3.3 Static Analysis by Tools (K2)

Key terms extracted from ISTQB glossary which are related to this section are: 

• compiler: which is a software tool that translates programs into machine language.
• control flow: is a sequence of events (paths) executed though a component or a system. 
• data flow: is an abstract representation of possible data changes of an object from its creation, usage or destruction.

Static testing can be performed on software code with white box techniques for finding defects. 

Static analysis tools analyse program code, its generated output but also help to assess the complexity of the component.

LO-3.3.1 Recall typical defects and errors identified by static analysis and compare them to reviews and dynamic testing (K1) 

Static analysis reviews code and finds defects whereas dynamic analysis executes code and finds failures. 

Typically, static analysis is effective for checking if :

• each variable used has a defined size and format and was initially declared and correctly initialized.
• components called between 2 interfaces are consistent in terms of what is passing from one to what is expected to an another in order to avoid format mismatches for example.
• unreachable code and erroneous logic have been identified because they will surely cause failures in the software like code never executed or infinite loops.
• standards, syntax and security vulnerabilities have been taken in account by developers for not generating violations in the program or involve misunderstandings.

LO-3.3.2 Describe, using examples, the typical benefits of static analysis (K2)

• Main benefit is early detection of defects: typically defects and errors identified by static analysis are compared to reviews and dynamic testing results, so an early detection of defects is performed. 
• Moreover, static analysis determines dependencies and inconsistencies and provide an early warning on code complexity. 
• Also, maintainability of code and design is improved.

LO-3.3.3 List typical code and design defects that may be identified by static analysis tools (K1)  

Static analysis tools which can identify the logic structure of code and routes associated are used by: 

• developers for checking their code against predefined rules or standards (before and during dynamic component and component integration testing).
• designers for modelling software/systems before development process.

Static analysis tools produce a large number of warning messages and compilers provide diagnostic information. 

Code comments are recommended as they are providing useful help by describing each function.