Static code analysis

From Exampleproblems

Static code analysis is a set of methods for analysing software source code or object code in an effort to gain understanding of what the software does and establish certain correctness criteria.

Schematically, there are several types of static analysis (which may be used in combination, even inside the same programming tool):

tools such as lint essentially look for constructs that "look dangerous" from an informal point of view;
formal methods consider the mathematical definition of the behaviors of programs, known as their semantics.

Some software metrics can also be seen as a form of static analysis.

Formal methods

Static analysis is a family of formal methods for automatically deriving information about the behavior of computer software (and also hardware). One possible application of static analysis is automated debugging aid, especially the finding of run-time errors – roughly speaking, events causing program crashes.

Briefly, program analysis — including finding possible run-time errors – is undecidable: there is no mechanical method that can always answer truthfully whether programs may or not exhibit runtime errors. This is a mathematically founded result dating from the works of Church, Gödel and Turing in the 1930s (see the halting problem and Rice's theorem). As with most undecidable questions, one can still attempt to give useful approximate solutions.

There exist two main families of formal static analysis:

model checking considers systems that have finite state or may be reduced to finite state by abstraction;
static analysis by abstract interpretation approximates the behavior of the system, either from above (considering more behaviors than can happen in reality), or from below.

Interest in the development of static analysis tools, especially for use on safety-critical computer systems, was renewed after the high profile disaster of Ariane 5 Flight 501, when a space rocket exploded shortly after launch due to a computer bug, surely one of the most expensive of such bugs in history.