Static code analysis

Static code analysis tools - software which examines the code in detail and will identify poor programming practices and potentially unsafe commands and procedures (for example the use of pointers or recursive functions). 

Complies with Low-Level Requirements Results of a combination of analysis techniques and reviews/inspections, including code generation/refinement tools, formal method proofs that show internal consistency and technical agreement, static code analysis results that show technical agreement to requirements annotations, structured code/requirements walk-throughs and inspections. 

Verifiable Results of a combination of analysis techniques and reviews/inspections, including structured code walkthroughs and inspections against the coding standard verifiability criteria static code analysis that shows determinism verification results of the code against requirements (note some developers and certification authorities adopt the approach that if the requirement/design was verified, this implies it is verifiable, and the code was also) - the limitation with this approach is that the inference is made via an assumption about the extensiveness of verification (and is implicit), rather than specific evidence in this regard. 

Identifying the role of S/W reviews and inspections, formal methods, static code analysis and testing in S/W V V. 

B8.4 Static Code Analysis Static code analysis is the analysis of the source code before it is executed. Techniques include ... 

Barnes (2002) suggests that by using a combination of static analysis techniques, a variety of properties can be guaranteed about a computer program. An example of a well-known tool that performs such analysis is the SPARK Exanuner (for Ada). Other tools include PC-Lint, Splint, Parasoft s Static Code Analysis toolset and the Programming Research QA toolsets and related tools. There are many others. 

The first experimental results reveal that with an operand bit width of p = 4, at most 16 additions can be carried out in parallel by a 64-bit adder, and 2.7 in average. Another experiment performed by a static code analysis of SPECint2006 base benchmarks gave an average speedup factor of 3.19, showing the potential of PAMOS and PAROS. 

Static Code Analysis with valgrind and SPECint2006jbase Experiments... 

Static Code Analysis (SCA) has a proven track record as a powerful software verification technique providing the necessary rigour for safety-related software. A number of mature tools supporting SCA are available. However, static analysis also has a reputation as being costly and labour-intensive. This paper looks at recent advances in identifying objectives and processes for SCA and assesses the potential for such analyses to provide, in conjunction with new software safety standards such as the CAA s SWOl and Ministry of Defence s DEF STAN 00-56 Issue 3, a cost-effective and focussed method of gathering evidence that software performs safely. 

A review of the literature reveals a number of varying and contradictory understandings of static code analysis. A number of texts describe checking control flow and data flow properties such as unreachable code and uninitialised variables. Others concentrate on the measurement of software metrics such as McCabe s metric. Yet more papers describe detailed formal analysis of properties of the code. Often, techniques are defined in terms of the capabilities of software tools. Furthermore, there seems to be some confusion about the objectives of SCA. The following definition is from Wikipedia on-line encyclopaedia. 

The market place is crowded with a plethora of tools claiming to perform Static Code Analysis . Language-specific code checkers such as PC-Lint can be called... 

There is therefore a wide range of static code analysis tools and techniques, with variation in rigour, objectives and cost of application. The choice facing the safety engineer is not obvious. The presence of software in his safety-related system... 

Static code analysis, as a powerful software analysis technique, seems to offer the potential to reduce these risks to levels commensurate with failure rates demanded of safety-related software. 

The software properties list given in SWOl strike a good balance between conciseness and comprehensiveness. Static Code Analysis is ideally suited to gathering evidence for two of the properties listed functional properties and robustness. Indeed these are the two properties identified in Section 2 that SCA has historically been used for. 

Harrison (1999). Static Code Analysis on the C-130J Hercules Safety Critical Software. Aerosystems International, UK. Int. Systems Safety Conf. 1999... 

---