Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.arch.embedded > #27601
| From | John Speth <johnspeth@yahoo.com> |
|---|---|
| Newsgroups | comp.arch.embedded |
| Subject | Re: Source code static analysis tool recommendations |
| Date | 2018-02-02 17:13 -0800 |
| Organization | Aioe.org NNTP Server |
| Message-ID | <p532dr$196u$1@gioia.aioe.org> (permalink) |
| References | <p52lfh$nrr$1@gioia.aioe.org> <teo97d1vcjb3g15npbtkci906cven11rf7@4ax.com> |
On 2/2/2018 3:24 PM, George Neuner wrote: > On Fri, 2 Feb 2018 13:32:42 -0800, John Speth <johnspeth@yahoo.com> > wrote: > >> Hi folks- >> >> Does anybody have any recommendations for static source code analysis >> tools based on practical use? >> >> My customer is asking us to apply a static source code analysis tool to >> an existing medical product. The product is undergoing changes for >> which the FDA requires another round of testing. The customer was >> dinged by the FDA for not using an analysis tool so they want to correct >> the process this time around. >> >> My concerns are: >> - cost >> - time to set up >> - effectiveness >> - too many false problems identified >> - open source vs paid product >> >> The project size is about 50K lines of code. >> >> Thanks - John > > What language(s) and what platform should the tool run on? > > > This is going back a ways [so take with a grain of salt] but circa > 2000 when I was in medical imaging the FDA was quite happy with Lint > for C or C++. > > If the code never has been linted previously, you are likely to get > many pages of warnings. Examining them, you are likely to find quite > a large percentage are trivial / ignorable, but checking a large code > base for the 1st time will not go quickly. > > All the tools I am familiar with allow to disable particular checks > that consistently produce ignorable results. But you have to > determine that by actually looking at the code. > > Whatever tool you use, you'll need to verify that the FDA will accept > the result ... I've been away from that arena for too long to know > what tools currently are acceptable. Thanks George. The code is in C. We'd like to run the tools on Windows computers. It happens that the first FDA submission was subject to only PC-Lint. The customer told me that the FDA did accept that test but I didn't believe it. PC-Lint is not a deep testing tool, in my opinion. I'll need to take a second look at that. JJS
Back to comp.arch.embedded | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Source code static analysis tool recommendations John Speth <johnspeth@yahoo.com> - 2018-02-02 13:32 -0800
Re: Source code static analysis tool recommendations George Neuner <gneuner2@comcast.net> - 2018-02-02 18:24 -0500
Re: Source code static analysis tool recommendations John Speth <johnspeth@yahoo.com> - 2018-02-02 17:13 -0800
Re: Source code static analysis tool recommendations George Neuner <gneuner2@comcast.net> - 2018-02-03 03:40 -0500
Re: Source code static analysis tool recommendations Stefan Reuther <stefan.news@arcor.de> - 2018-02-03 11:45 +0100
Re: Source code static analysis tool recommendations Grant Edwards <invalid@invalid.invalid> - 2018-02-03 16:37 +0000
Re: Source code static analysis tool recommendations Stefan Reuther <stefan.news@arcor.de> - 2018-02-04 10:18 +0100
Re: Source code static analysis tool recommendations Grant Edwards <invalid@invalid.invalid> - 2018-02-04 15:12 +0000
Re: Source code static analysis tool recommendations Stefan Reuther <stefan.news@arcor.de> - 2018-02-05 18:48 +0100
Re: Source code static analysis tool recommendations Hans-Bernhard Bröker <HBBroeker@t-online.de> - 2018-02-05 23:18 +0100
Re: Source code static analysis tool recommendations David Brown <david.brown@hesbynett.no> - 2018-02-06 09:34 +0100
Re: Source code static analysis tool recommendations Hans-Bernhard Bröker <HBBroeker@t-online.de> - 2018-02-06 19:25 +0100
Re: Source code static analysis tool recommendations David Brown <david.brown@hesbynett.no> - 2018-02-06 22:53 +0100
Re: Source code static analysis tool recommendations Richard Damon <Richard@Damon-Family.org> - 2018-02-06 21:34 -0500
Re: Source code static analysis tool recommendations David Brown <david.brown@hesbynett.no> - 2018-02-07 09:06 +0100
Re: Source code static analysis tool recommendations Jack <jack4747@gmail.com> - 2018-02-05 23:32 -0800
Re: Source code static analysis tool recommendations David Brown <david.brown@hesbynett.no> - 2018-02-06 09:34 +0100
Re: Source code static analysis tool recommendations David Brown <david.brown@hesbynett.no> - 2018-02-06 10:23 +0100
Re: Source code static analysis tool recommendations Stefan Reuther <stefan.news@arcor.de> - 2018-02-06 19:05 +0100
Re: Source code static analysis tool recommendations David Brown <david.brown@hesbynett.no> - 2018-02-06 23:02 +0100
Re: Source code static analysis tool recommendations Hans-Bernhard Bröker <HBBroeker@t-online.de> - 2018-02-07 02:02 +0100
Re: Source code static analysis tool recommendations David Brown <david.brown@hesbynett.no> - 2018-02-07 09:21 +0100
Re: Source code static analysis tool recommendations Hans-Bernhard Bröker <HBBroeker@t-online.de> - 2018-02-08 00:57 +0100
Re: Source code static analysis tool recommendations David Brown <david.brown@hesbynett.no> - 2018-02-08 10:46 +0100
Re: Source code static analysis tool recommendations Stefan Reuther <stefan.news@arcor.de> - 2018-02-07 20:04 +0100
Re: Source code static analysis tool recommendations David Brown <david.brown@hesbynett.no> - 2018-02-07 20:54 +0100
Re: Source code static analysis tool recommendations Stefan Reuther <stefan.news@arcor.de> - 2018-02-08 18:58 +0100
Re: Source code static analysis tool recommendations David Brown <david.brown@hesbynett.no> - 2018-02-09 09:17 +0100
Re: Source code static analysis tool recommendations Clifford Heath <no.spam@please.net> - 2018-02-10 20:55 +1100
Re: Source code static analysis tool recommendations Phil Hobbs <pcdhSpamMeSenseless@electrooptical.net> - 2018-02-10 19:59 -0500
Re: Source code static analysis tool recommendations Clifford Heath <no.spam@please.net> - 2018-02-10 20:49 +1100
csiph-web