Adopting Bug-hunting Tools While Staying Agile

By Author: Todd Landry
Total Articles: 9
Comment this article

While the Agile Manifesto's principle of individuals and interactions over processes and tools seems to de-emphasis the need for tools, Agile teams use many tools to support their development - including software configuration management tools, build management tools, requirements tracking tools, testing tools, project management tools, and more.

Most of the testing tools that are well-known to Agile teams focus on functional testing, unit testing, and build quality, with less of an emphasis on source code verification to identify non-functional errors such as programming bugs. This is likely due to the overly cumbersome options traditionally available to find these types of bugs; Agile teams don't have time for lengthy code review meetings or to profile their code for days to find a memory leak.
Even unit testing, a stalwart of Agile testing, requires the creation and management of test cases to support a developer's bug hunting.

Agile teams must strike the right balance between ensure working, software quality tool while also exercising caution ...
... so that the adoption of tools does not hinder the individual interaction required by Agile. Smaller Agile teams may have an easier time striking this balance and may decide to manage the project at hand with nothing more than a large bulletin board and color-coded cue cards.
Teams working on larger projects, however, generally employ tools to ensure that they have the best opportunity for success.

Automating Bug Detection: Source Code Analysis in an Agile World
SCA is a bug-detection solution that requires no test cases, is fully automated, and fits well with milestones typically found in an Agile process. SCA technology has grown in popularity and is becoming a mainstream option for professional software developers to reduce the number of bugs in their code while also reducing costs and keeping software development on track.

The underlying technology associated with SCA is called Static Code Analysis and the current generation of technology solutions is capable of providing sophisticated, high-value analysis that will locate and describe areas of weakness in software source code - such as memory and resource management, program data management, buffer overflows, un-validated user input, vulnerable coding practices, concurrency violations, and a variety of longer term maintenance issues.
SCA is distinct from traditional dynamic analysis techniques, such as unit or penetration tests, because the work is performed at build time using only the source code of the program or module in question. The results reported are therefore generated from a complete view of every possible execution path, rather than some aspect of limited, observed runtime behaviour.

Since SCA is essentially a build-time analysis, it is most effectively used as a build milestone activity when individual developers or development teams run their builds - either at the integration-build level or the developer-build level.

Todd Landry, a Senior Product Manager at Klocwork, a leading developer of static source code analysis software and expert in critical software defects.
http://www.klocwork.com/
http://www.klocwork.com/products/insight/klocwork-truepath/