Improving manual analysis of automated code inspection results: Need and effectiveness

Abstract

Automated code inspection using static analysis tools has been found to be useful and cost-effective over manual code reviews. This is due to ability of these tools to detect programming bugs (or defects) early in the software development cycle without running the code. Further, using sound static analysis tools, even large industry applications can be certified to be free of certain types of the programming bugs such as Division by Zero, Null/Illegal Dereference of a Pointer, Memory Leaks, and so on. In spite of these merits, as per various surveys, the static analysis tools are used infrequently and inconsistently in practice to ensure software quality. Large number of false alarms generated and the efforts required to manually analyze them are the primary reasons for this. Similar has been the experience of our team with the usage of these tools.