static program analysis software development core activities processes requirements design engineering construction testing debugging deployment maintenance paradigms and models agile cleanroom incremental prototyping spiral v model waterfall methodologies and frameworks asd devops dad dsdm fdd iid kanban lean sd less mdd msf psp rad rup safe scrum semat tsp up xp supporting disciplines configuration management documentation software quality assurance sqa project management user experience practices atdd bdd cco ci cd ddd pp standup tdd tools compiler debugger profiler gui designer modeling ide build automation release automation infrastructure as code testing standards and bodies of knowledge babok cmmi ieee standards iso 9001 isoiec standards pmbok swebok itil glossaries artificial intelligence computer science electrical and electronics engineering vte static program analysis is the analysis of computer software that is performed without actually executing programs in contrast with dynamic analysis which is analysis performed on programs while they are executing in most cases the analysis is performed on some version of the source code and in the other cases some form of the object code the term is usually applied to the analysis performed by an automated tool with human analysis being called program understanding program comprehension or code review software inspections and software walkthroughs are also used in the latter case rationale the sophistication of the analysis performed by tools varies from those that only consider the behaviour of individual statements and declarations to those that include the complete source code of a program in their analysis the uses of the information obtained from the analysis vary from highlighting possible coding errors eg the lint tool to formal methods that mathematically prove properties about a given program eg its behaviour matches that of its specification software metrics and reverse engineering can be described as forms of static analysis deriving software metrics and static analysis are increasingly deployed together especially in creation of embedded systems by defining socalled software quality objectives a growing commercial use of static analysis is in the verification of properties of software used in safetycritical computer systems and locating potentially vulnerable code for example the following industries have identified the use of static code analysis as a means of improving the quality of increasingly sophisticated and complex software medical software the us food and drug administration fda has identified the use of static analysis for medical devices nuclear software in the uk the office for nuclear regulation onr recommends the use of static analysis on reactor protection systems aviation software in combination with dynamic analysis a study in 2012 by vdc research reports that 287 of the embedded software engineers surveyed currently use static analysis tools and 397 expect to use them within 2 years a study from 2010 found that 60 of the interviewed developers in european research projects made at least use of their basic ide builtin static analyzers however only about 10 employed an additional other and perhaps more advanced analysis tool in the application security industry the name static application security testing sast is also used sast is an important part of security development lifecycles sdls such as the sdl defined by microsoft tool types the omg object management group published a study regarding the types of software analysis required for software quality measurement and assessment this document on how to deliver resilient secure efficient and easily changed it systems in line with cisq recommendations describes three levels of software analysis unit level analysis that takes place within a specific program or subroutine without connecting to the context of that program technology level analysis that takes into account interactions between unit programs to get a more holistic and semantic view of the overall program in order to find issues and avoid obvious false positives for instance it is possible to statically analyze the android technology stack to find permission errors system level analysis that takes into account the interactions between unit programs but without being limited to one specific technology or programming language a further level of software analysis can be defined missionbusiness level analysis that takes into account the businessmission layer terms rules and processes that are implemented within the software system for its operation as part of enterprise or programmission layer activities these elements are implemented without being limited to one specific technology or programming language and in many cases are distributed across multiple languages but are statically extracted and analyzed for system understanding for mission assurance formal methods formal methods formal methods is the term applied to the analysis of software and computer hardware whose results are obtained purely through the use of rigorous mathematical methods the mathematical techniques used include denotational semantics axiomatic semantics operational semantics and abstract interpretation by a straightforward reduction to the halting problem it is possible to prove that for any turing complete language finding all possible runtime errors in an arbitrary program or more generally any kind of violation of a specification on the final result of a program is undecidable there is no mechanical method that can always answer truthfully whether an arbitrary program may or may not exhibit runtime errors this result dates from the works of church gdel and turing in the 1930s see halting problem and rices theorem as with many undecidable questions one can still attempt to give useful approximate solutions some of the implementation techniques of formal static analysis include abstract interpretation to model the effect that every statement has on the state of an abstract machine ie it executes the software based on the mathematical properties of each statement and declaration this abstract machine overapproximates the behaviours of the system the abstract system is thus made simpler to analyze at the expense of incompleteness not every property true of the original system is true of the abstract system if properly done though abstract interpretation is sound every property true of the abstract system can be mapped to a true property of the original system the framac value analysis plugin and polyspace heavily rely on abstract interpretation dataflow analysis a latticebased technique for gathering information about the possible set of values hoare logic a formal system with a set of logical rules for reasoning rigorously about the correctness of computer programs there is tool support for some programming languages eg the spark programming language a subset of ada and the java modeling languagejmlusing escjava and escjava2 framac wp weakest precondition plugin for the c language extended with acsl ansiiso c specification language model checking considers systems that have finite state or may be reduced to finite state by abstraction symbolic execution as used to derive mathematical expressions representing the value of mutated variables at particular points in the code datadriven static analysis datadriven static analysis uses large amounts of code to infer coding rules software testing portal code audit documentation generator formal semantics of programming languages formal verification list of tools for static code analysis shape analysis software syllabus and readings for alex aikens stanford cs295 course ayewah nathaniel hovemeyer david morgenthaler j david penix john pugh william 2008 using static analysis to find bugs ieee software 25 5 2229 doi101109ms2008130 brian chess jacob west fortify software 2007 secure programming with static analysis addisonwesley isbn9780321424778 flemming nielson hanne r nielson chris hankin principles of program analysis 1999 corrected 2004 ed springer isbn9783540654100 abstract interpretation and static analysis international winter school on semantics and applications 2003 by david a schmidt code quality improvement coding standards conformance checking ddj competition on software verification svcomp episode 59 static code analysis interview podcast at software engineering radio implementing automated governance for coding standards explains why and how to integrate static code analysis into the build process integrate static analysis into a software development process the samate project a resource for automated static analysis tools software testing portal 