Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Many sources note that automatic static code analysis include data flow and control flow. But these two are included in white box testing as well. Is there a difference in the automation? That in automatic static analysis all is done by the tools while in white box testing, a person creates the data to exercise the possible paths?

share|improve this question
up vote 5 down vote accepted

Static analysis and testing are different things, and pick up different classes of problems.

With black or white box testing, you execute parts of the code with inputs, etc that the developer or tester thinks are important. The only real quality control you have over the developer / tester's design of test cases is code coverage ... and that doesn't tell you anything about whether the logic has been properly tested.

By contrast, static analysis is looking for problems in a different way; i.e. by analysing what the code does independently of the test cases / data. Typically they find different kinds of problem, and typically they find them with less effort on the part of the developer / tester. For example, a static analyser might identify dead code, or a storage or resource leak that would be impossible to find by unit testing, or an unsafe practice like (in Java) using == to test strings.

In short the two approaches are complementary.

share|improve this answer
+1, but with white box testing and code coverage analysis you will identify dead code eventually. – scarfridge Nov 11 '12 at 8:55
@Stephen C Yet both are considered to be a testing activity, looking for defects. – user970696 Nov 11 '12 at 9:54
@user970696 - I disagree with that. Testing is not synonymous with "looking for defects", Testing is just one way of looking for defects. Other ways include use of static analysis tools, manual code review and (in an ideal world) formal methods. – Stephen C Nov 13 '12 at 0:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.