Static and Dynamic Analysis: Without and With Execution
Static and Dynamic Analysis: Without and With Execution
This domain tests the distinction between examining code or models without running them and observing runtime behavior. You must select the right technique and interpret tool output.
Core rules
- Static analysis does not execute the software. It includes control-flow analysis (unreachable code, infinite loops), data-flow analysis (undefined variables, unused assignments, def-use anomalies), coding-standard checks, complexity metrics, and reviews of code or design.
- Static analysis finds defects early and can be automated in CI, but it produces false positives and cannot measure runtime behavior.
- Dynamic analysis executes the software. It detects memory leaks, resource leaks, pointer and array-bound errors, runtime exceptions, concurrency faults, and performance bottlenecks; it also measures coverage and profiles execution.
- Dynamic analysis needs representative data and environment; results depend on the tests run.
- Tools: static analyzers, code reviewers, complexity tools; dynamic memory checkers (e.g., Valgrind), profilers, coverage tools, and application performance monitoring.
- Both support risk-based decisions: static findings guide code review and unit test design; dynamic findings confirm failures and guide non-functional testing.
Worked example
A C module allocates a buffer in a loop and frees it only when status == OK. Static data-flow analysis flags a possible path where the buffer is not freed. A dynamic memory checker run with a failing status confirms a leak of 4 KB per iteration. Reasoning: static analysis found the potential defect without execution; dynamic analysis confirmed it, quantified it, and provided evidence for a fix. Neither alone gives both potential and proof.
Traps
- Expecting static analysis to reveal performance bottlenecks.
- Treating a static warning as a confirmed defect without review.
- Running dynamic analysis with unrealistic data and concluding there are no leaks.
- Confusing code coverage measurement (dynamic) with static analysis.
- Ignoring false positives and disabling the tool instead of tuning rules.