Evaluating C Code Quality without Build Enviroment

[HMeyers]

I have been hired to evaluate a 20 KLOC application in a non-life critical healthcare device. The evaluation is to determine the code quality. This is not a testing effort as other organizations have been hired to do that. I am being retained to view the actual code and determine the quality.

The code is developed offshore from the US and I have no access to the developers and the actual build environment. There is no code documentation or any up development stream documentation, except for a end user user manual. The comments in the code is extremely limited and in another language that is translatable by Google Translate. I also have no access to the development process used to develop the application.

I have attempted to use various static analysis tools that will run a lint type of check on the code.

Besides for the static analysis does anybody have any additional paths I can take to evaluate the code.

Thank you,

hmeyers

[quzah]

Lots of alcohol.


Quzah.

[Salem]

On what skill set did you sell yourself as being able to undertake this task?

[claudiu]

I have been hired to evaluate a 20 KLOC application in a non-life critical healthcare device. The evaluation is to determine the code quality. This is not a testing effort as other organizations have been hired to do that. I am being retained to view the actual code and determine the quality.

The code is developed offshore from the US and I have no access to the developers and the actual build environment. There is no code documentation or any up development stream documentation, except for a end user user manual. The comments in the code is extremely limited and in another language that is translatable by Google Translate. I also have no access to the development process used to develop the application.

I have attempted to use various static analysis tools that will run a lint type of check on the code.

Besides for the static analysis does anybody have any additional paths I can take to evaluate the code.

Thank you,

hmeyers

Hmm. Tricky one, and for the most part I agree with quzah. I mean how qualitative can this be if they didn't bother to leave documentation for it?

Also, what is this quality they speak of? What is the exact metric they are looking for? Efficiency? Code readability? Time that it takes to update or enhance code functionality? Or is it just some term coined by management? If the latter is true I would write a report containing one word: worthless.

[MK27]

Sounds like you are to be one of a number of opinions. I guess you could do stuff like single step thru it to determine exactly what's going on, etc, and along the way (relative to other sources you have hacked) decide whether you are impressed by this, how comprehensible and maintainable it seems, etc.

I also have no access to the development process used to develop the application.

Who cares? It's done now. I can't imagine saying "Oh, well this is a great example of a _____ development method" unless ______ is "some deranged bunch of morons owning keyboards". The development process shouldn't have a bearing on the final product.

[Adak]

When I think of software quality, I think of:

1) Documentation - sum of internal and external

2) Functions: organized along functional lines: input, output, computations, etc., and appropriately sized.

3) Transparency - ease of understanding it. Imagine you had to make an enhancement to it, and it was your first time seeing the code. How difficult would it be? Assume this programmer speaks only your country's language.

I would not mark it down because it's from oversea's. I would mark it down if it didn't include English documentation and comments, if you're in an English speaking country. Hard to imagine that it doesn't have that, for you.

Are the variable and function names, descriptive?

4) Algorithmic efficiency. How are the big O numbers for it's algorithms? Is it sorting small numbers of values with Insertion sort? GOOD! Is it sorting a large number of values with Bubble sort? BAD! That type of thing.


The project that has run into this a lot, is the Linux kernel project. If you check them out, they'll have a lot to say about code quality - they've been dealing with it for decades.