Can static code analysis replace peer code review?

Whenever I talk about peer code review, someone always wants to pit static code analysis tools against human review.  Which is better?  They assume that because we sell a peer review tool we necessarily have to hate automation.

But that's just not true.  You need both.

Want to simultaneously waste developers' time and give them trivial busywork?  Have them hunt around for local variables that aren't all lowercase and find instances where you've overloaded equals() but not hashCode().

Anything you can automate... should be automated!  Of course.

But there are certain questions that static analysis can never answer.  Like:

1. Does the code work as documented?
2. Are the unit tests correct?
3. Can another developer look at this code and be able to use or maintain it?
4. Is this a good algorithm?
5. Is this good code organization?

Items 1-3 especially are important.  Really important, if you care about code quality.  The only way to answer these questions is through peer code review.

Static analysis is like the spell-checker in Word.  Of course you should use it, and of course you should clear spelling errors before handing your document to a friend to edit.  But it's that human edit that finds the problems, checks for correctness, and can identify the sentences that are "weird."

Spell Czech is good, butt knot enough.  It takes a human to find the important problems.

So definitely run that static code analysis!  Just don't expect that to magically make your code correct or maintainable.

Comments

[Alen]

Good points, I've also added my two cents from a static analysis perspective: http://kloctalk.klocwork.com/?p=173

[Tom Harris]

Of these questions, the biggest one that is solely in the domain of code review is "Can another developer look at this code and be able to use or maintain it?"

A "no" answer on this is what we're looking for from code review, so that code can be simplified and clarified, making it less error-prone.

And catching problems with readability and maintainability depend on being able to see the entire codebase with point-and-click navigation, not just the diffs the reviewer has chosen to upload. Discussed in today's Smart Bear webinar (see temporary partial log at http://twitter.com/tweetquality or tweet-search #collab).

Hoping for that feature, whether it's:

1. Bringing review into IDE environment
2. Bringing web codebase browsing (e.g. OpenGrok) into Code Reviewer / Code Collaborator
3. Opening Smart Bear APIs so customer community can do it for themselves