feature article
Subscribe Now

Coverity Enforces Software Architecture

There’s a school of thought that says that you should write your comments first and the code afterwards and that source code should be treated as a human-readable document that only incidentally contains instructions for the computer. In other words, if you write code that other programmers can understand, you’ll automatically write code that’s more efficient and maintainable. Who knows, some day you may need to revise your little gem, and you don’t want to be caught wondering, “What was this part supposed to do?”

By the same token, diagrams and flow charts aren’t just for maintenance and documentation. Writing (or even sketching) complete design documents before the code starts flying can help everyone visualize the overall application — to see what goes where. That’s particularly important for large programming teams where the work is divided up amongst individuals who may or may not share the boss’s big-picture view.

A company called Coverity is automating this whole process with its “Architecture Analyzer” product. As the name suggests, Architecture Analyzer analyzes the, uh, architecture of your software. It’s a detailed, automated, corporate safety net for large programming projects that eliminates bugs at the source. Which is to say, it prevents you from writing faulty code in the first place, rather than having to debug it afterwards.

Magic, you say? Not really. Just the methodical enforcement of good programming practices. Practices, it must be said, that many programmers despise.

Like a third-grade penmanship teacher, Coverity’s Architecture Analyzer (CAA) encourages you to write neatly and between the lines. It’s all about clarity, repeatability, and good manners. In programming terms, CAA enforces clear thinking, well-defined interfaces, and adherence to the API rules.

That’s more structure than many programmers like – but exactly what their bosses crave. CAA is the antithesis of the cowboy code jock slinging code in the middle of the night, hacking functions and fixes in a caffeine-crazed blur. In contrast, CAA is all about premeditation, good code hygiene, and clear documentation. By enforcing those rules, it eliminates the source of many bugs, reliability holes, and security leaks.

Architecture Analyzer is graphical. You diagram the overall structure of your application with boxes and arrows. Boxes represent functional units of code, while arrows reflect how data passes in and out of these boxes. No arrow, no communication with the black box. This flowcharting process is central to Coverity’s fault-checking process. It also, not incidentally, forces the programmer to take a big-picture view of his overall project and outline just how processes and functions will interrelate. Seat-of-the-pants code hackers need not apply.

You can diagram your application code any way you like. CAA doesn’t enforce any particular style or architecture; that’s up to you. What it does do is make sure you stick to your own rules, and that those rules are self-consistent. If you’ve defined a function with one data source and one sink, for example, CAA will make sure no other functions call or depend upon that module.

Once the diagramming is done, Coverity’s tool analyzes the information flow and looks for unintended back doors. Is there, for example, a way to pass information into a control block without first passing through its encryption API? Can one process snarf data from another unintentionally, accidentally, or maliciously? Have you created any circular dependencies?

What CAA doesn’t do is nit-pick individual lines of code. That’s what compilers and lint checkers are for. CAA is strictly a big-picture tool, making sure that the structure of your application is sound, reliable, and free from loopholes that might present problems later on. You’re still free to write comments and indent lines any way you like.

On one level, CAA works simply because it forces programmers to graph out their application. That’s already more discipline than some programmers usually demonstrate. The very act of diagramming a program’s overall architecture will highlight certain structural problems. In the early stages, it almost doesn’t matter that CAA even has an analysis back end; the diagrams themselves are diagnostic.

But of course, Coverity’s back end does perform elaborate and detailed analysis. Once your flow diagrams pass the “sniff test,” they become enforceable design blueprints. CAA makes sure you stick to the architecture you defined without straying from the ins and outs described in the diagrams. Naturally, you can revise your architectural diagrams whenever you like, but doing so may affect the code development already underway.

Coverity’s Architecture Analyzer can prevent (or at least forestall) software “entropy” as the design ages and the code accumulates hacks, cruft, and patches. It stands as a shining beacon of the original program architects’ intent and structure. It prevents quick fixes from circumventing (either deliberately or accidentally) intended procedures, built-in security mechanisms, bounds checking, parameter inspection, and so on. It’s a silent QA manager looking over your shoulder to be sure you don’t outsmart yourself or the other programmers or wind up creating spaghetti code that no one else can maintain. In short, CAA tries to make you a better programmer.

Not everyone wants that. Programming is often treated as a creative endeavor, undertaken by spirited and talented artistes who cannot or should not be shackled to convention, regulations, or reasonable hygiene. Get over it. Programming is a job like any other, and an employer’s responsibility is to ship a profitable product, not coddle and babysit self-indulgent hackers. While some programs can be created by individuals working solo, it’s more common for teams of coders to work cooperatively, and, for those times, a tool like CAA is probably a prudent business investment. It’s said that communication gets exponentially harder the more members involved, so it’s not surprising that miscommunication can be a big problem in large programming projects. Codifying that communication (some of it, at least) through CAA eliminates one source of miscommunication and adds rigor to an otherwise ad-hoc process. In the realm of commercial software development, that’s got to be a good thing.

Leave a Reply

featured blogs
Nov 24, 2020
In our last Knowledge Booster Blog , we introduced you to some tips and tricks for the optimal use of the Virtuoso ADE Product Suite . W e are now happy to present you with some further news from our... [[ Click on the title to access the full blog on the Cadence Community s...
Nov 23, 2020
It'€™s been a long time since I performed Karnaugh map minimizations by hand. As a result, on my first pass, I missed a couple of obvious optimizations....
Nov 23, 2020
Readers of the Samtec blog know we are always talking about next-gen speed. Current channels rates are running at 56 Gbps PAM4. However, system designers are starting to look at 112 Gbps PAM4 data rates. Intuition would say that bleeding edge data rates like 112 Gbps PAM4 onl...
Nov 20, 2020
[From the last episode: We looked at neuromorphic machine learning, which is intended to act more like the brain does.] Our last topic to cover on learning (ML) is about training. We talked about supervised learning, which means we'€™re training a model based on a bunch of ...

Featured video

Synopsys and Intel Full System PCIe 5.0 Interoperability Success

Sponsored by Synopsys

This video demonstrates industry's first successful system-level PCI Express (PCIe) 5.0 interoperability between the Synopsys DesignWare Controller and PHY IP for PCIe 5.0 and Intel Xeon Scalable processor (codename Sapphire Rapids). The ecosystem can use the companies' proven solutions to accelerate development of their PCIe 5.0-based products in high-performance computing and AI applications.

More information about DesignWare IP Solutions for PCI Express

featured paper

Top 9 design questions about digital isolators

Sponsored by Texas Instruments

Looking for more information about digital isolators? We’re here to help. Based on TI E2E™ support forum feedback, we compiled a list of the most frequently asked questions about digital isolator design challenges. This article covers questions such as, “What is the logic state of a digital isolator with no input signal?”, and “Can you leave unused channel pins on a digital isolator floating?”

Click here to download the whitepaper

Featured Chalk Talk

Next Generation Connectivity and Control Concepts for Industry 4.0

Sponsored by Mouser Electronics and Molex

Industry 4.0 promises major improvements in terms of efficiency, reduced downtime, automation, monitoring, and control. But Industry 4.0 also demands a new look at our interconnect solutions. In this episode of Chalk Talk, Amelia Dalton chats with Mark Schuerman of Molex about Industry 4.0 and how to choose the right connectors for your application.

Click here for more information about Molex Industry 4.0 Solutions