Possible Duplicate:
What is the difference between Static code analysis and code review?

What is the difference between static testing and code review?

I found some information on wikipedia that in both cases the programmer checks the syntax and code logic for bugs.

  • 1
    Code reviews are one type of static testing, you can have code inspections, code walk-throughs, code analysis by tools e.g. FxCop. – StuperUser Jan 11 '12 at 13:56

In a code review, the source code is read by a human. This is often someone other than the original developer, but that's not a requirement. For example, the Personal Software Process enables personal code reviews guided by checklists of specific problems to identify. Alternatively, there are a number of techniques that involve other people - pair programming, over-the-shoulder checks, and formal inspections.

Regardless of the technique used, there are a number of reasons why a code review would be performed, although some techiques lend themselves better to specific purposes. For example, a large amount of code written by a new developer could be reviewed to ensure that they are following the team's conventions and are understanding the design and implementation goals of the team. Code reviews also allow for checking for logic errors and security problems. Tests can also be reviewed to ensure that the test cases correspond to requirements and that they are providing appropriate coverage.

Static analysis of code is performed by various tools scanning the source files, and in some cases, the binary files, to identify potential problems, ranging from indexing errors to unneeded assignments to security holes. These tools typically produce reports that indicate the location and severity of possible issues.

Often, static analysis and code reviews are used together to provide coverage. In my experiences, individual developers run static analysis over their own code prior to a code review. After reviewing the results of the static analysis, they correct any issues that might cause problems, then submit their code for review. By finding and correcting problems that are easily identified automatically, the human code reviewers can focus their efforts on a different subset of problems.


The difference is in the who: Static testing is done by the programmer himself, preferably with the help of static testing tools. Code review is done by another human.

  • Technically, the developer can perform a review on his/her own work. It's not a requirement that another individual perform the review. – Thomas Owens Jan 11 '12 at 12:21
  • This is incorrect, a code review is a type of static testing. – StuperUser Jan 11 '12 at 13:56

One thing I haven't yet come across any static code analysis tool which will catch is logic mistakes. For example, the code may be absolutely beautiful and perfect from every technical angle, but if a method TransferMoney() calls targetAccount.withdraw() rather than targetAccount.deposit(), that's a pretty glaring error which any half-way thorough code review is going to catch because the human doing the code review is likely better at understanding the intended semantics of the TransferMoney() method. Similar mistakes can be made in ways that are far from as obvious, particularly to the developer writing the code.

Static analysis can only figure out if the code is correct technically, it cannot do much about the business logic implemented by that code.

  • It depends on what you mean by logic mistakes. Some tools can detect problems such as = versus ==, loops that will never end or code blocks that will never execute. – Thomas Owens Jan 11 '12 at 12:37
  • Good point. Still, I'm not sure I would consider particularly assignment versus equality comparison a logic mistake. That's a syntax mistake, plain and simple, which, depending on the language, may pass the compiler's syntax check because the language allows such constructs. – user Jan 11 '12 at 12:38
  • 1
    =/== might not be a logic error, but the other two are often the result of logic errors. Although the extent to which they are detected depends on the tool and the certainty of which the results will always be the same. – Thomas Owens Jan 11 '12 at 12:45

I'm in agreement with the other answers as to static analysis and code reviews. I'd like to add a couple points that I feel are important to both.

For static analysis (at least for c#) there are some really nice tools (FXCop) that are able to identify implementation issue such as the disposable pattern. It's also a good tool to identify some code smells, such as coupling or cyclomatic complexity. I'm not suggesting they are perfect, but I've found a number of these useful for identifying issues.

As for code reviews, the biggest thing code reviews are used for where I work is to break down knowledge silos and teach others what is it you have written. Usually a great conversation comes from the review about how code is written, challenging others with different view points, learning new conventions, etc.

As you can see, they are very different tasks both of which have use to most developers. Computers are also really good at finding things that violate very specific rules where humans are better at the opposite.

I hope you are asking so that you can utilize both, and not to choose one over the other.

Not the answer you're looking for? Browse other questions tagged or ask your own question.