High Integrity Systems are those where a failure will result in loss of life or significant loss of something of value to the organization. Such systems are typically referred to as safety-critical systems, security-critical systems, business-critical systems, or even socially-critical systems. These high integrity systems must be shown to be fully predictable in operation and have all the properties required of them. Besides the use of conventional testing, this must be augmented by analyzing the software.

     A variety of standards have emerged for many high-integrity domains such as airborne civil avionics, nuclear power plants, medical systems, pharmaceutical, defense, ground rail, security, automotive, and space. From these standards, 4 common approaches may be elicited to support the verification of software. These are traceability, reviews, analysis, and testing. This presentation focuses on the analysis aspects of software verification, and more precisely on what is referred to as “static analysis” or “code analysis”. Static analysis is commonly referred to as code analysis, as the analysis is performed statically by analyzing the source code where as dynamic analysis is performed while executing the executable code, hence “dynamic analysis”. Dynamic analysis is more properly considered to be the fourth part of verification, testing.

    An emerging role of code analysis is with its importance for information assurance and the building of assurance cases. An assurance case might have a Claim that the “software is of high quality”. An Argument to support that claim might be that “Static Analysis has identified no errors”. Evidence for this argument might be a variety of automated analyses identifying no errors detected.

    Some of the key methods of code analysis will be discussed.  Most of these lend themselves nicely to automatic code analysis and the building of assurance cases. Some of these can support prescribed quality requirements. Of high importance, static code analysis can detect anomalies within the application that are almost impossible to detect, yet can cause serious or even fatal software crashes. Code analysis can also be used to address design concerns, conformance to project coding/quality standards, performance issues, and maintenance issues. There is at least one ISO standard that supports automatic code analysis based on both syntactic and semantic code analysis. There are a number of commercially available tools available. Experiences using some of these code analysis tools will be discussed.

2 April 2004