Mining understandable state machine models from embedded code

Program understanding is a time-consuming and tedious activity for software developers. Manually building abstractions from source code requires in-depth analysis of the code. Automatic extraction of such models is possible, but cannot derive meaningful abstractions that are not already contained in the code. The automated extraction even has problems to decide which aspects of the code are important and which are not. Therefore, interactive semi-automatic approaches are the compromise of choice. In this article, we describe how state machines that describe the behaviour of a function can be extracted from code. The approach includes interaction – the user decides which aspects of the identified potentially relevant information is really relevant and which is not. This helps to reduce the resulting state machines to an understandable degree. However, these state machines in their raw form have transition conditions that are very complex and thus not understandable for humans. Therefore, we also introduce a technique to reduce these guards to an understandable form. The technique is a combination of heuristic logic minimization, exploitation of infeasible paths, and using transition priorities. We evaluate the approach on industrial embedded C code, first in a case study with hundreds of extracted state machines, and then in two experiments with professional developers. The results show that the approach is highly effective in making the guards understandable, and that guards reduced by our approach and presented with priorities are easier to understand than guards without priorities. We also show that the overall approach is beneficial for program comprehension. The guard reduction approach itself is quite generic and can also be applied to other problems. We demonstrate that for the simplification of mode switch logic.