The document discusses detecting uninitialized variables in large Cobol programs with unrealizable code paths. It presents context-sensitive and context-insensitive analysis results, showing context-sensitive finds fewer uninitialized variables instances by tracking variable definitions and uses across code blocks. Heuristics like removing code smells and prioritizing by utility parameters further reduce detected instances. The technique supports maintenance by precisely locating variables causing failures and can be extended to other program analysis.

1. Precise Detection of Un-Initialized Variables
In Large, Real-life Cobol Programs
In Presence Of Unrealizable Paths
Adnan Contractor
Ravindra Naik
Rahul Jiresal
1

2. Agenda
Motivation
Un-Initialized Variables
Results
Unrealizable Paths
Solution
Heuristics
2

3. Typical Maintenance Scenario
Failure Change
Request
• Re-produce Code Changes
• Analysis • Understand
• Testing • Impact
Analysis
• Production
Conjecture
Analysis
Changes
Delivered
Code
Change
Failures &
Efforts
Automated
Tools
3

4. Case Study
Background Concerns
• Core banking product • Repeated failure of transactions
• Stable back-office COBOL • Not so-easily-reproducible failures
applications • Longer turn-around time
• Over 1 million transactions daily
Examples…
Transaction for Recurring Deposit account
change of base A Forex transaction closure fails whenever
branch fails failing only after 6PM triggered at the same time at
randomly two different branches
Not yet 5 days 8 months
fixed 1 day 10 days
4

5. Case Study
Branch A Request for RD
acct closure
Check Balance
Notify balance
to customer
Customer Banker Request for RD
acct closure
Branch B
Check Balance
Notify balance
to customer
Fire Close acct
command
Customer Banker
Fire Close acct 5
command

6. Un-Initialized Variables
double calculatePoints
1
(char cardType, double amt)
2
1 float rate;
double points;
4
2 if (cardType == ‘G’)
3
3 rate = 0.005;
4 elseif (cardType == ‘S’) 5
5 rate = 0.001;
6
6 points = amt * rate;
7 return points;
7
6

7. Results
Un-Initialized
Program
Variables Instances
AB0000 1317 6090
CR0000 1173 4313
CR0025 336 871
CR7070 74 253
AB0024 59 120
Context-insensitive Analysis Results
7

8. Results
Un-Initialized Variables
7000
6000
5000
4000
3000 Context-insensitive
2000
Context-sensitive
1000
0
AB0000 CR0000 CR0025 CR7070 AB0024
Program
8

9. Context-Insensitive Analysis
Paragraph • Paragraph - A set of statements
1. A. represented by a label. Can be executed
2. MOVE 0 TO VA as a unit.
3. PERFORM P.
4.
5. B.
6. MOVE 1 TO VB • Perform - Using PERFORM statement
7. MOVE 1 TO VA Perform one can execute a paragraph.
8. PERFORM P
9. MOVE VB TO MV.
10.
11. P.
12. MOVE 5 TO VF.
9

10. Context-Insensitive Analysis
1. A.
E
2. MOVE 0 TO VA
E
3. PERFORM P.
E
4. 6
5. B. 2
6. MOVE 1 TO VB
VA 12 7
7. MOVE 1 TO VA
8. PERFORM P 3 VA,
VB
9. MOVE VB TO MV.
8
10. X
11. P.
12. MOVE 5 TO VF. X 9
X
10

11. Context-Insensitive Analysis
1. A.
VA E
2. MOVE 0 TO VA
E
3. PERFORM P.
E
4. 6
5. B. 2
6. MOVE 1 TO VB
VA 12 7
7. MOVE 1 TO VA
8. PERFORM P 3 VA,
VB
9. MOVE VB TO MV.
8
10. X
11. P.
12. MOVE 5 TO VF. X 9
X
11

12. Context-Insensitive Analysis
1. A.
VA E
2. MOVE 0 TO VA
E
3. PERFORM P.
E
4. 6
5. B. 2
6. MOVE 1 TO VB
VA 12 7
7. MOVE 1 TO VA
8. PERFORM P 3 VA,
VB
9. MOVE VB TO MV.
8
10. X
11. P.
12. MOVE 5 TO VF. X 9
VA,
VF
X
12

13. Context-Insensitive Analysis
1. A.
VA E
2. MOVE 0 TO VA
E
3. PERFORM P.
E
4. 6
5. B. 2
6. MOVE 1 TO VB
VA 12 7
7. MOVE 1 TO VA
8. PERFORM P 3 VA,
VB
9. MOVE VB TO MV. VA, 8
10. VF X VA,
11. P. VF
12. MOVE 5 TO VF. X 9
VA,
VF
X
13

14. Context-Insensitive Analysis
1. A.
VA E
2. MOVE 0 TO VA
E
3. PERFORM P.
E
4. 6
5. B. 2
6. MOVE 1 TO VB
VA 12 7
7. MOVE 1 TO VA
8. PERFORM P 3 VA,
VB
9. MOVE VB TO MV. VA, 8
10. VF X VA,
11. P. VF
12. MOVE 5 TO VF. X 9
VA,
VF
X
14

15. Unrealizable Paths
E
E
E
6
2
12
7
3
8
X
X 9
X
15

16. Design Challenges
Perform Chain
Paragraph level information
Paragraph range level information
Data flow equations:
NBottom = [ Ntop – KillSump ] ∪ GenSump
GenSump = Defined (p)
KillSump = Ø
16

17. Context-Insensitive Analysis
1. A.
E
2. MOVE 0 TO VA
E
3. PERFORM P.
E
4. 6
5. B. 2
6. MOVE 1 TO VB
VA 12 7
7. MOVE 1 TO VA
8. PERFORM P 3 VA,
VB
9. MOVE VB TO MV.
8
10. X
11. P.
12. MOVE 5 TO VF. X 9
X
17

18. Context-Insensitive Analysis
1. A.
E
2. MOVE 0 TO VA
E
3. PERFORM P.
E
4. 6
5. B. 2
6. MOVE 1 TO VB
VA 12 7
7. MOVE 1 TO VA
8. PERFORM P 3 VA,
VB
9. MOVE VB TO MV.
8
10. X
11. P.
12. MOVE 5 TO VF. X 9
X
18

19. Context-Insensitive Analysis
1. A.
E
2. MOVE 0 TO VA
E
3. PERFORM P.
E
4. 6
5. B. 2
6. MOVE 1 TO VB
VA 12 7
7. MOVE 1 TO VA
8. PERFORM P 3 VA,
VB
9. MOVE VB TO MV.
8
10. X
11. P.
12. MOVE 5 TO VF. X 9
VF
X
19

20. Context-Insensitive Analysis
1. A.
E
2. MOVE 0 TO VA
E
3. PERFORM P.
E
4. 6
5. B. 2
6. MOVE 1 TO VB
VA 12 7
7. MOVE 1 TO VA
8. PERFORM P 3 VA,
VB
9. MOVE VB TO MV. VA, 8
10. VF X
VA,
11. P.
12. MOVE 5 TO VF. X 9 VB
VF ,VF
X
20

21. Results
Un-Initialized
Program
Variables Instances
AB0000 737 2945
CR0000 838 3001
CR0025 187 437
CR7070 30 60
AB0024 48 103
Context-sensitive Analysis Results
21

22. Heuristics
Bad Code Smells Removal
Utility-Parameter based Prioritization
Fan-in based Prioritization
22

23. Heuristics Results
3500
3000
2500
Context Sensitive
2000 Analysis
Code Smell Removal
1500
1000 Utility Parameter
removal
500
0
AB0000 CR0000 CR0025 CR7070
23

24. Future Work
Heuristics
– Error-path pruning
– Output-variable based
Dynamic Analysis
Un-Initialized path detection
24

25. Key Learning
Precise detection of un-initialized variables
Heuristics
Realizable data-flow analysis across Paragraphs for COBOL
Technique can be extended to other analyses – defect
detection, program understanding, code architecture discovery
25

26. Thank You
26