Precise detection of un-initialized variables in large, real-life COBOL programs in presence of unrealizable paths

Using variables before assigning any values to them are known to result in critical failures in an application. Few compilers warn about the use of some, but not all uses of un-initialized variables. The problem persists, especially in COBOL systems, due to lack of reliable program analysis tools. A critical reason is the presence of large number of control flow paths due to the use of un-structured constructs of the language. We present the problems faced by one of our big clients in his large, COBOL based software system due to the use of un-initialized variables. Using static data and control-flow analysis to detect them, we observed large number of false positives (imprecision) introduced due to the unrealizable paths in the un-structured COBOL code. We propose a solution to address the realizability issue. The solution is based on the summary based function analysis, which is adapted for COBOL Paragraphs and Sections, to handle the perform-through and fall-through control-flow, and is significantly engineered to scale for large programs (single COBOL program extending to tens of thousands of lines). Using this technique, we noted very large reduction, 45% on an average, in the number of false positives for the un-initialized variables.

I. Introduction

In software systems the use of un-initialized variables may lead to system outages, as the variables may have garbage values. Such failures may imply that the system does not behave as per its specifications. Further, the garbage value of an un-initialized variable may flow through the program resulting in incorrect computations, and the severity of the failure may increase multi-fold. The outcome of running such a program may simply be undeterminable. Tracking down a reason for this kind of failures and localizing the fault caused due to an un-initialized variable is a non-trivial task. As reported by one of our client, some of the faults took several months to be localized and traced. Certainly, such long time-frames for localizing a fault due to uninitialized variables are not desirable for the systems that are in production.