Making source code analysis part of the software development process
By Andrew Yang, Code Integrity Solutions
Embedded.com (04/26/10, 06:41:00 AM EDT)
Modern source code analysis tools (sometimes called static analysis or SCA tools) analyze software programs at the earliest stage of development. SCA tools analyze a program to calculate metrics and find potential flaws and defects in the code.
Unlike tools of the past, which tended to do simple pattern matching, modern SCA tools (Figure 1, below perform sophisticated path and data flow analysis and can find surprisingly meaningful bugs with good accuracy.
Figure 1: Source code analysis detects problems in the earliest part of development
From a business perspective, SCA tools hold a lot of promise. By uncovering problems in the earliest part of the development process, SCA tools can dramatically lower the cost of quality and security for a product.
The effort required to get to value is relatively low. For most organizations, just a few hours of analysis will uncover hundreds to even thousands of potential defects. No testcases are required, and the reported defects literally point to the line or lines of code where a problem can occur.
While SCA tools are an easy sell for most organizations, in practice, users often struggle with the tool. Unrealistic expectations coupled with underinvestment result in failed or suboptimal deployments.
Instituting any toolchain change in an organization requires more than just installing it and sending out the URL to the developers. Real change requires effective planning and execution. Instituting SCA is no different.
Everyone has opinion and experience with SCM tools and bug tracking systems. Much fewer have experience with SCA tools. Because modern SCA tools are relatively new, the industry does not have a plethora of reference architectures by which to fall back upon.
What I hope in this article is to convey some of the hard lessons we've learned by working with a number of companies instituting SCA tools. We hope you don't make these mistakes when instituting change in your environment.
To read the full article, click here
Related Semiconductor IP
- USB 4.0 V2 PHY - 4TX/2RX, TSMC N3P , North/South Poly Orientation
- FH-OFDM Modem
- NFC wireless interface supporting ISO14443 A and B with EEPROM on SMIC 180nm
- PQC CRYSTALS core for accelerating NIST FIPS 202 FIPS 203 and FIPS 204
- USB Full Speed Transceiver
Related White Papers
- Source Code Analysis in an Agile World
- IP vendors making leap from source code to silicon
- Commentary: Synopsys memory IP users seek RTL source code
- Building more secure embedded software with code coverage analysis
Latest White Papers
- FastPath: A Hybrid Approach for Efficient Hardware Security Verification
- Automotive IP-Cores: Evolution and Future Perspectives
- TROJAN-GUARD: Hardware Trojans Detection Using GNN in RTL Designs
- How a Standardized Approach Can Accelerate Development of Safety and Security in Automotive Imaging Systems
- SV-LLM: An Agentic Approach for SoC Security Verification using Large Language Models