Usage of static and dynamic program analysis to generate documentation from legacy source code.

1. SCCH is an initiative of SCCH is located in
Integration of Static and Dynamic Analysis for
Understanding Legacy Source Code
Michael Moser
+43 7236 3343 814
michael.moser@scch.at
www.scch.at
ICSME’16, Industry Track, 06.10.2016

2. Integration of Static and Dynamic Analysis for Understanding Legacy Source Code
An Industry Collaboration
2© Software Competence Center Hagenberg GmbH
Michael Moser
michael.moser@scch.at
Pichler Josef
josef.pichler@scch.at
Wilhelm Kirchmayr
wilhelm.kirchmayr@voestalpine.com
Ludwig Nocke
ludwig.nocke@voestalpine.com
Rudolf Tober
wilhelm.kirchmayr@voestalpine.com

3. Integration of Static and Dynamic Analysis for Understanding Legacy Source Code
3© Software Competence Center Hagenberg GmbH
Background: Mr. Kaufmann’s Process Models
Mr. Kaufmann
(Process Engineer)

4. Integration of Static and Dynamic Analysis for Understanding Legacy Source Code
4© Software Competence Center Hagenberg GmbH
Background: Mr. Kaufmann’s Process Models
Mr. Kaufmann
(Process Engineer)

5. Integration of Static and Dynamic Analysis for Understanding Legacy Source Code
5© Software Competence Center Hagenberg GmbH
Background: Mr. Kaufmann’s Process Models
Mr. Kaufmann
(Process Engineer)
controlled by

6. Integration of Static and Dynamic Analysis for Understanding Legacy Source Code
6© Software Competence Center Hagenberg GmbH
Background: Mr. Kaufmann’s Process Models
Mr. Kaufmann
(Process Engineer)
controlled by feedback from

7. Integration of Static and Dynamic Analysis for Understanding Legacy Source Code
7© Software Competence Center Hagenberg GmbH
Integration of Static and Dynamic Analysis for Understanding Legacy Source Code
C++, 5600 LoC
Core Model created by 3rd
party company
20 model outputs from 22 inputs
Evolved in a multi-shell model
Background: Mr. Kaufmann’s Process Models
DeMo - Process model for desulphurization
Influence of input values not documented
Mr. Kaufmann

8. Integration of Static and Dynamic Analysis for Understanding Legacy Source Code
8© Software Competence Center Hagenberg GmbH
Mr. Kaufmann
(retired)
Background: Mr. Kaufmann’s Process Models
Mr. Bauer / Mr. Huber
(Process Engineers)

9. Integration of Static and Dynamic Analysis for Understanding Legacy Source Code
9© Software Competence Center Hagenberg GmbH
Background: Mr. Kaufmann’s Process Models
Questions ???
What is the formula for a model result?
Which input values affect which result?
What are all results of a process model?
Mr. Kaufmann
(retired)
Mr. Bauer / Mr. Huber
(Process Engineers)

10. Integration of Static and Dynamic Analysis for Understanding Legacy Source Code
Starting Point: Requirements and Goals
10© Software Competence Center Hagenberg GmbH
Integration of Static and Dynamic Analysis for Understanding Legacy Source Code
Documentation requested!
Simplify maintenance and optimization
Grant quick overview of the system
Capture dependencies between inputs and outputs
Flexible clipping of model source code
Reflect the hierarchical structure
Offline documentation

11. Integration of Static and Dynamic Analysis for Understanding Legacy Source Code
use of dynamic analysis
Examine program execution
Do not fully capture behavior
Needed: Model Interpretation
Include values from model execution
Merge with results from static analysis
Starting Point: Overall Approach
11
use of static analysis
Analyze entire program sources
Extract abstract representations
Application of RbG* to extract
Mathematical formulae
Decision tables / path conditions
Essential program structures
Needed: Stepwise Computation
from a model input to its outputs
Out1
Var1
In1
Var2
In2
Out1
Var1
In1
Var2
In2
input
values
*M. Moser and J. Pichler: RbG: A Documentation Generator
for Scientific and Engineering Software, (SANER 2015)

12. Integration of Static and Dynamic Analysis for Understanding Legacy Source Code
Example: A process model
12© Software Competence Center Hagenberg GmbH
Calling Context
typedef struct {
double snow_density;
} output;
typedef struct {
double snow_height;
double gamma_rho_S;
bool useFudgeFactor;
} input;

13. Integration of Static and Dynamic Analysis for Understanding Legacy Source Code
Example: A process model
13© Software Competence Center Hagenberg GmbH
Pre processing of input in outer shell

14. Integration of Static and Dynamic Analysis for Understanding Legacy Source Code
Example: A process model
14© Software Competence Center Hagenberg GmbH
Execution of core computational model

15. Integration of Static and Dynamic Analysis for Understanding Legacy Source Code
Example: A process model
15© Software Competence Center Hagenberg GmbH
Post processing of result data

16. Integration of Static and Dynamic Analysis for Understanding Legacy Source Code
Results for Example: Stepwise Computation
Symbol Formula Path Condition Input

17. Integration of Static and Dynamic Analysis for Understanding Legacy Source Code
Results for Example: Stepwise Computation
Symbol Formula Path Condition Input
One table for each result
One row for each computation that may influence result
Variables used within definitions are repeatedly resolved
Variable names may be replaced with symbol info

18. Integration of Static and Dynamic Analysis for Understanding Legacy Source Code
18© Software Competence Center Hagenberg GmbH
Integration of Static and Dynamic Analysis for Understanding Legacy Source Code
Results for Example: Model Execution
Symbol Formula Value Path Condition Input

19. Integration of Static and Dynamic Analysis for Understanding Legacy Source Code
19© Software Competence Center Hagenberg GmbH
Integration of Static and Dynamic Analysis for Understanding Legacy Source Code
Results for Example: Model Execution
Symbol Formula Value Path Condition Input
Results from model execution merged with static tables
Model execution with concrete input values
Unexecuted rows are hidden

20. Integration of Static and Dynamic Analysis for Understanding Legacy Source Code
20© Software Competence Center Hagenberg GmbH
Results for Example: Model Execution
Symbol Formula Value Path Condition Input
Results from model execution merged with static tables
Model execution with concrete input values
Unexecuted rows can be displayed

21. Integration of Static and Dynamic Analysis for Understanding Legacy Source Code
Results for Example: Big Picture
21© Software Competence Center Hagenberg GmbH

22. Integration of Static and Dynamic Analysis for Understanding Legacy Source Code
Results for Example: Big Picture
22© Software Competence Center Hagenberg GmbH
Fits on a sheet of paper
C++ methods and functions
Ordered call relations
Sub model clustering
Database access
Side-by-side with code
Packaged with documentation

23. Integration of Static and Dynamic Analysis for Understanding Legacy Source Code
dynamic analysis
model execution
program interpretation
flow-sensitive analysis
inter-procedural control-flow-graph
Specification of concrete values
Merge with stepwise computation
Analysis: A little more details
23© Software Competence Center Hagenberg GmbH
static analysis
stepwise computation
Construction of use-definition chains
Inter-procedural control-flow-graph
Forward propagation of definitions
Use-Definition chains per model output
“Entry-Point” Aware
big picture
Call-graph analysis
Pattern-matching
Out1
Var1
In1
Var2
In2
Out1
Var1
In1
Var2
In2
input
values

24. Integration of Static and Dynamic Analysis for Understanding Legacy Source Code
Results: Tool Support for Documentation Generation
24© Software Competence Center Hagenberg GmbH

25. Integration of Static and Dynamic Analysis for Understanding Legacy Source Code
Results: Lessons Learned from DeMo Process Model
25© Software Competence Center Hagenberg GmbH

26. Integration of Static and Dynamic Analysis for Understanding Legacy Source Code
Results: Lessons Learned from DeMo Process Model
26© Software Competence Center Hagenberg GmbH
domain experts provided
model outputs and model inputs
2 entry point definitions (F1, F2)
3 sets of input values
core entry point (F2)
21 outputs, 22 inputs
significant drop of rows
reduction 78% - 98%

27. Integration of Static and Dynamic Analysis for Understanding Legacy Source Code
Limitations: For the General Case
27© Software Competence Center Hagenberg GmbH
Integration of Static and Dynamic Analysis for Understanding Legacy Source Code
Implementation limited in several ways
Bindings are only statically resolved
No 100% language coverage for C++
Pointer arithmetic not supported
Missing input values yield incomplete results
Interpreted model execution vs. real program execution
Extraction of formulae is limited (partly on purpose)
Scalability of big picture representation
Limited

28. Integration of Static and Dynamic Analysis for Understanding Legacy Source Code
28© Software Competence Center Hagenberg GmbH
Take Aways / Summary Characterization of
computational models in
process control software
Integration of static and
dynamic program analysis
Documentation generation for a
real world process model
Dynamic analysis creates more
compact and understandable
documentation

29. Integration of Static and Dynamic Analysis for Understanding Legacy Source Code
Thanks and Discussion
Michael Moser
Software Analytics and Evolution
Software Competence Center Hagenberg, Austria
michael.moser@scch.at
29© Software Competence Center Hagenberg GmbH