Introduction of static quality analysis in small- and medium-sized software enterprises: experiences from technology transfer

Abstract

Today, small and medium-sized enterprises (SMEs) in the software industry face major challenges. Their resource constraints require high efficiency in development. Furthermore, quality assurance (QA) measures need to be taken to mitigate the risk of additional, expensive effort for bug fixes or compensations. Automated static analysis (ASA) can reduce this risk because it promises low application effort. SMEs seem to take little advantage of this opportunity. Instead, they still mainly rely on the dynamic analysis approach of software testing.In this article, we report on our experiences from a technology transfer project. Our aim was to evaluate the results static analysis can provide for SMEs as well as the problems that occur when introducing and using static analysis in SMEs. We analysed five software projects from five collaborating SMEs using three different ASA techniques: code clone detection, bug pattern detection and architecture conformance analysis. Following the analysis, we applied a quality model to aggregate and evaluate the results.Our study shows that the effort required to introduce ASA techniques in SMEs is small (mostly below one person-hour each). Furthermore, we encountered only few technical problems. By means of the analyses, we could detect multiple defects in production code. The participating companies perceived the analysis results to be a helpful addition to their current QA and will include the analyses in their QA process. With the help of the Quamoco quality model, we could efficiently aggregate and rate static analysis results. However, we also encountered a partial mismatch with the opinions of the SMEs. We conclude, that ASA and quality models can be a valuable and affordable addition to the QA process of SMEs.

Tools, Strategies & Models for Incorporating Software Quality Assurance in Risk Oriented Testing

“…It helps in architecture conformance analysis too. For bug detection we can use Find Bugs 1.3.9 for java based systems 8 . j Learn is another tool which is used for integration of test development and SQA activities.…”

“…It considered all software quality models from the user and customer perspective [8]. It considered three factors as most important which were:…”

Risk orientation in software testing processes of small and medium enterprises: an exploratory and comparative study

“…Risk and testing aspects specific to SME are addressed only in a few publications (Karlström et al 2005;Azar et al 2007;Martin and Hoffman 2007;Gleirscher et al 2014). Karlström et al (2005) present a minimal test practice framework (MTPF) that allows the incremental introduction of appropriate practices at the appropriate time in small and emerging software companies.…”

“…In general, testing is performed on a daily basis to reduce the cost of fixing defects later. Finally, Gleirscher et al (2014) report on experiences from introducing automated static analysis in small-and medium-sized enterprises as a measure to mitigate the risk of additional, expensive effort for bug fixes or compensations. Their study of five software projects from five SME shows that the effort required to introduce automated static analysis techniques in SME is small and helps to detect multiple defects in production code, which was perceived to be beneficial by the participating companies.…”

The accuracy of dependency analysis in static architecture compliance checking

“…Furthermore, they explored the effectiveness and usability of three supporting tools by executing tests, based on a simple system with a basic architecture. Our research follows Passos et al We aspire to contribute to the evolution of ACC, motivated by the notion that the adoption of ACC‐tools is still limited . Further research is necessary to advance and improve current methods and tools .…”