Static Code Analysis

Intent

Analyse source code to identify building blocks and their dependencies, determine complexity, coupling, cohesion and other structural properties.

Static Analysis can serve two purposes:

Analyse source code to identify building blocks and their dependencies, determine complexity, coupling, cohesion and other structural properties.
Detect certain types of bugs, dangerous coding patterns and bad coding style.

Description

Use source code analysis tools to analyse static properties of the system’s source code, e.g. the following:

Coupling and dependencies: Where do the building-blocks (e.g. classes, packages, modules, subsystems) of your system depend upon? What are the intra-system call- and communication relationships?

Experiences

Many projects (commercial and open-source) apply automated static code analysis as part of their build processes.

Applicability

Apply static code analysis when the code base is medium sized or large and the appropriate tools are available.

Many metrics and tools are tailored to object-oriented programming languages.
Dynamically typed languages often have limited tool support.

Also Known As

Code quality analysis
Software measurement and metrics

References

SonarQube, LGPL-licenced open-source platform to analyze code.
JDepend, open-source Java dependency checker.
Sonargraph, static code analyzer focused on software structure and architecture.

Related patterns

Software Archeology
Understand software by examining existing source code.
Structural Analysis stub
Analyze the static structures (e.g. building block structure) of the system, e.g. package or module dependencies, runtime- and/or deployment dependencies. See the more specific Static Code Analysis, Context Analysis and Data Analysis.
Instrument System
Find out how the system is really used and what the runtime relationships are, as well as other facts that can not be easily determined by Static Code Analysis even in situation where the system under design is largely undocumented and the architecture work thus mostly relies on assumptions, interviews and lore.
Quantitative Analysis
Measure artifacts or processes within the system, e.g. source code.
Use Invariants to Kill Zombies
Provide a safe approach in situations where it seems to dangerous to delete code or whole modules from a huge system because Static Code Analysis can’t recognize whether the code is still in use or not.

Found a mistake or want to add your experience? Edit this pattern on GitHub.