Symbian Case Study

Overview

Symbian licenses Symbian OS to the world’s leading handset manufacturers and has built close co-operative business relationships with leading companies across the mobile industry. In Q1 2006, 11.7 million Symbian smartphones were sold worldwide to over 250 network operators, bringing the total number of Symbian OS phones shipped to over 70 million. Mobile phone manufacturers that license Symbian OS include Arima, Ben Q, Fujitsu, Lenovo, LG Electronics, Motorola, Mitsubishi, Nokia, Panasonic, Samsung, Sharp and Sony Ericsson.

Challenge

Symbian engineering management wanted to implement a static analysis tool to capture standard errors in the Symbian OS build process before they reached production. They needed a highly flexible and adaptive static analysis tool as Symbian OS, while based on the popular C++ development language, is a highly customized operating system and is written with proprietary extensions to C++.

Solution

Symbian OS is the world-leading open operating system that powers smartphones from the world’s leading handset manufacturers. Symbian OS is the industry standard open operating system for smartphones that not only feature calendars, contacts, messaging, push email and web browsing, but can also extend easily to any enterprise information system.

In addition to regular voice, messaging and email, the open nature of Symbian smartphones enables a range of advanced solutions, such as voice conferencing and push-to-talk, to maximize usage from the one converged device. Symbian enables the widest selection of solutions from the industry's leading players through the Symbian partner community. The company’s approach to enterprise connectivity ensures that Symbian smartphones can extend to any existing and future corporate infrastructure without lock-in to any particular solution and without the need for costly upgrading of infrastructure.

Selecting Coverity

Neil Taylor, Technology Architect at Symbian, needed tools to help manage a multi-country development staff of over 500 engineers to ensure the quality of all lines of code for Symbian OS. The company had never used a static analysis tool on the code base before. In addition, Taylor had to find an analysis tool based on C++ that could also work with highly customized extensions to C++. The options for commercial static analysis tools were limited. The biggest challenge for Symbian, however, was to better manage engineering’s time and efforts—the tool had to automatically capture errors to allow engineering to concentrate resources on higher-level issues.

The tool chosen by Taylor and his team would need to fit a number of parameters beyond the ability to work with the Symbian OS code base. The tool had to scale up to 5 million lines of code and capture standard errors in the build process while enabling feature tests for human code review. The chosen tool would have to allow for anyone in engineering to be able to write custom checkers to work against the unique Symbian OS code base. “We purchased Coverity because of Extend—Extend lets us write our own custom checkers. We would like to have all of Symbian engineering able to write checkers with Coverity,” said Taylor.

Symbian OS supports a wide array of form factors and the operating system is open to modifications by customers even before it is embedded within a smartphone. Because customers receive the full source code, Taylor needed to ensure that the tool chosen could address the special Symbian characteristics of the OS. “We have some peculiarities in our code, not C++, that the tool needed to work with right from the start. We call these peculiarities Symbianisms,” said Taylor.

Coverity Prevent was the only static code analysis tool Symbian evaluated in the three-month review phase because it was the only one that met all of their rigorous engineering requirements, Taylor said. Only Coverity could capture errors in the build process, test each software team’s work before it was merged to the master code base, provide best-of-breed security features, produce a high-level of accuracy of defects found, and the ability to write and manage checkers within the product. “We had an exhaustive list of requirements for introduction of a static code analysis tool and we looked at a number of products in the market—only Coverity could handle our requirements and complex code base. Coverity is the only static code analysis tool that we use,” said Taylor.

Coverity's Impact

While Symbian selected Coverity to help with code quality and code review, Symbian senior engineers were also trying to capture the measurable return on their investment. “Our Coverity investment is based on reducing our current man-days of effort to fix one error, which is currently three days,” said Taylor. The company is using Coverity to address and reduce these engineer-days of effort by reducing false-positive returns, quickly and accurately capturing errors in the build process, and improving engineer performance by reducing the trivial tasks associated with the peer review model.

Going from a peer review model to an automated static code analysis tool has generated positive returns both inside and outside the company.“With Coverity, we have more productive code reviews which translates to our licensees getting a better product and which means happy customers,” said Taylor. Additionally, Symbian continues to further integrate Coverity into engineering processes. The company aims to have every engineering team worldwide use Coverity, as many as 500 engineers. The engineering team has already developed a dozen custom checkers with Coverity with more planned. The company also plans to implement and integrate Coverity within the Symbian OS nightly build process. Symbian must also ensure the security of their engineering processes and deliverables and plan to look to Coverity for identification of application-level security vulnerabilities in their source code. By using Coverity to automate engineering processes including scanning, monitoring and reporting of vulnerabilities, Symbian expects to reduce and eliminate risk caused by flawed programming. Additionally, Symbian plans to leverage Coverity’s noninvasive ability to analyze all possible paths to find security gaps. “With the complexity of our code base and the absolute need to ensure to our customers the security of our code base, it is a natural extension for us to use Coverity’s security features as part of our engineering requirements,” said Taylor.

About Symbian
Symbian is a software licensing company that develops and licenses Symbian OS,™ the market leading open operating system for advanced, data-enabled mobile phones also known as smartphones.

Symbian has its headquarters in London, United Kingdom with offices in the United States, Europe (England and Sweden (UIQ Technology AB), Israel and Asia (India, P.R. China, Korea and Japan).