computer science

List of tools for static code analysis

List of tools for static code analysis is a computer science topic covered in the lgStudy science library. This page brings together a partial reference excerpt, illustrations, worked examples, real-world applications and a short study plan, so you can understand List of tools for static code analysis rather than just read about it. In short: This is a list of notable tools for static program analysis (program analysis is a synonym for code analysis). Static code analysis tools Languages Ada CodePeer ConQAT Fluctuat LDRA Testbed MALPAS Polyspace SofCheck Inspector Squore Understand C, C++ Astree Axivion Suite (Bauhaus) BLAST Clang Coccinelle Coverity CPAchecker Cppcheck Cppdepend Cpplint ECLAIR Eclipse Fluctuat Frama-C GCC Helix QAC Facebook Infer Klocwo…

Key takeaways

List of tools for static code analysis belongs to computer science; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect List of tools for static code analysis to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of List of tools for static code analysis from memory before moving on to harder problems.

Reference excerpt

This is a list of notable tools for static program analysis (program analysis is a synonym for code analysis).

Static code analysis tools

Languages

Ada

CodePeer ConQAT Fluctuat LDRA Testbed MALPAS Polyspace SofCheck Inspector Squore Understand

C, C++

Astree Axivion Suite (Bauhaus) BLAST Clang Coccinelle Coverity CPAchecker Cppcheck Cppdepend Cpplint ECLAIR Eclipse Fluctuat Frama-C GCC Helix QAC Facebook Infer Klocwork Lint LDRA Testbed Parasoft C/C++test PC-lint Plus Polyspace PVS-Studio SLAM project Sparse SonarQube Splint Understand Visual Studio

Axivion Suite (Bauhaus) Code Dx CodeScene CodeQL Coverity Fluid Attacks Kiuwan Klocwork .NET Compiler Platform PVS-Studio SonarQube Sotoarc StyleCop Squore Understand Visual Studio

IEC 61131-3 CODESYS Static Analysis – integrated add-on for CODESYS (application code realized e.g. in ST, FBD, LD)

Java

Coverity Facebook Infer Fluid Attacks Klocwork LDRA Testbed PMD RIPS Semgrep SourceMeter Understand

JavaScript ESLint – JavaScript syntax checker and formatter. Google's Closure Compiler – JavaScript optimizer that rewrites code to be faster and smaller, and checks use of native JavaScript functions. CodeScene – Behavioral analysis of code. Fluid Attacks JSHint – A community driven fork of JSLint. JSLint – JavaScript syntax checker and validator. Klocwork Semgrep – A static analysis tool that helps expressing code standards and surfacing bugs early. A CI service and a rule library is also available. Understand

Objective-C, Objective-C++ Clang – The free Clang project includes a static analyzer. As of version 3.2, this analyzer is included in Xcode. Infer – Developed by an engineering team at Facebook with open-source contributors. Targets null pointers, leaks, API usage and other lint checks. Available as open source on github. Understand

Opa Opa includes its own static analyzer. As the language is intended for web application development, the strongly statically typed compiler checks the validity of high-level types for web data, and prevents by default many vulnerabilities such as XSS attacks and database code injections.

Packaging Lintian – Checks Debian software packages for common inconsistencies and errors. Rpmlint – Checks for common problems in rpm packages.

Perl Perl::Critic – A tool to help enforce common Perl best practices. Most best practices are based on Damian Conway's Perl Best Practices book. PerlTidy – Program that acts as a syntax checker and tester/enforcer for coding practices in Perl. Padre – An IDE for Perl that also provides static code analysis to check for common beginner errors.

PL/SQL TOAD – A PL/SQL development environment with a Code xPert component that reports on general code efficiency as well as specific programming issues. Visual Expert – A PL/SQL code analysis tool that reports on programming issues and helps understand and maintain complex code (Impact Analysis, Source Code documentation, Call trees, CRUD matrix, etc.).

PowerBuilder, PowerScript Visual Expert – A tool scanning PowerBuilder libraries (PBLs) for code inspection, Impact Analysis, Source Code documentation, Call trees, CRUD matrix.

Python PyCharm – Cross-platform Python IDE with code inspections available for analyzing code on-the-fly in the editor and bulk analysis of the whole project. PyDev – Eclipse-based Python IDE with code analysis available on-the-fly in the editor or at save time. Pylint – Static code analyzer. Quite stringent; includes many stylistic warnings as well. Fluid Attacks Klocwork Semgrep – Static code analyzer that helps expressing code standards and surfacing bugs early. A CI service and a rule library is also available. Understand

Transact-SQL Visual Expert – A SQLServer code analysis tool that reports on programming issues and helps understand and maintain complex code (Impact Analysis, source code documentation, call trees, CRUD matrix, etc.).

Tools with duplicate code detection

Axivion Suite (Bauhaus) Code Dx CodeScene PMD SofCheck Inspector SonarQube SourceMeter Understand

Formal methods tools Tools that use sound, i.e. over-approximating a rigorous model, formal methods approach to static analysis (e.g., using static program assertions). Sound methods contain no false negatives for bug-free programs, at least with regards to the idealized mathematical model they are based on (there is no "unconditional" soundness). Note that there is no guarantee they will report all bugs for buggy programs, they will report at least one.

Astrée – finds all potential runtime errors by abstract interpretation, can prove the absence of runtime errors and can prove functional assertions; tailored towards safety-critical C code (e.g. avionics). CodePeer – Statically determines and documents pre- and post-conditions for Ada subprograms; statically checks preconditions at all call sites. ECLAIR – Uses formal methods-based static code analysis techniques such as abstract interpretation and model checking combined with constraint satisfaction techniques to detect or prove the absence of certain run time errors in source code. ESC/Java and ESC/Java2 – Based on Java Modeling Language, an enriched version of Java Frama-C – An open-source analysis framework for C, based on the ANSI/ISO C Specification Language (ACSL). Its main techniques include abstract interpretation, deductive verification and runtime monitoring. KeY – analysis platform for Java based on theorem proving with specifications in the Java Modeling Language; can generate test cases as counterexamples; stand-alone GUI or Eclipse integration MALPAS – A formal methods tool that uses directed graphs and regular algebra to prove that software under analysis correctly meets its mathematical specification. Polyspace – Uses abstract interpretation, a formal methods based technique, to detect and prove the absence of certain run time errors in source code for C/C++, and Ada SPARK Toolset including the SPARK Examiner – Based on the SPARK language, a subset of Ada.

See also Automated code review Best Coding Practices List of software development philosophies Dynamic program analysis Software metrics Integrated development environment (IDE) and comparison of integrated development environments. IDEs will usually come with built-in support for static program analysis, or with an option to integrate such support. Eclipse offers such integration mechanism for most different types of extensions (plug-ins).

References

… excerpt ends here. Continue reading the full article.

Worked examples

Example 1 — a first encounter with List of tools for static code analysis

Start with the simplest possible case. Write down what List of tools for static code analysis claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In computer science, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to List of tools for static code analysis before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about List of tools for static code analysis ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of List of tools for static code analysis

In research: List of tools for static code analysis appears in computer science research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses List of tools for static code analysis in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: List of tools for static code analysis is common in secondary-school and first-year university syllabi. It links to neighbouring topics Lists of software, Static program analysis tools, so understanding it makes those chapters shorter.
In everyday life: Look for List of tools for static code analysis outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

Affiliate

Preply — study more efficiently by working with a personal tutor. 50% off.

How to study List of tools for static code analysis in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what List of tools for static code analysis means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain List of tools for static code analysis out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is List of tools for static code analysis in simple terms?

This is a list of notable tools for static program analysis (program analysis is a synonym for code analysis). Static code analysis tools Languages Ada CodePeer ConQAT Fluctuat LDRA Testbed MALPAS Polyspace SofCheck Inspector Squore Understand C, C++ Astree Axivion Suite (Bauhaus) BLAST Clang Cocci…

Why does List of tools for static code analysis matter?

Because it connects several computer science ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study List of tools for static code analysis?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on List of tools for static code analysis.