Static analysis of medical device software using CodeSonar

Post-market investigators at the United States Food and Drug Administration may need to review medical device software to assess its integrity. They have to do this with little or no prior knowledge of the software. Historically, the only way to perform such a review has been to manually search the code for potential sources of error --- a process that is both tedious and error-prone. Static analysis tools can improve this process by providing a means for automated error detection. By using symbolic execution techniques to explore execution paths of the software, static analysis provides complete, or almost complete, coverage of the code, and helps detect potentially fatal errors that may not easily be detected through conventional testing methods. Using automated static analysis tools can help reduce the effort involved in analysis and provide a more accurate assessment of the software. In this paper, we discuss CodeSonar, a whole-program interprocedural static analysis tool for C/C++ programs, and illustrate how it was used to facilitate error detection during a post-market investigation.