Static analysis of medical device software using CodeSonar

Authors:
Raoul Praful Jetley;Paul L. Jones;Paul Anderson
Affiliations:
US Food and Drug Administration, Silver Spring, MD;US Food and Drug Administration, Silver Spring, MD;GrammaTech, Inc., Ithaca, NY
Venue:
Proceedings of the 2008 workshop on Static analysis
Year:
2008

Citing 4
Cited 1

PVS: A Prototype Verification System

CADE-11 Proceedings of the 11th International Conference on Automated Deduction: Automated Deduction
Uprooting Software Defects at the Source

Queue - Instant Messaging
Introductory paper

International Journal on Software Tools for Technology Transfer (STTT)
Formal Methods Based Development of a PCA Infusion Pump Reference Model: Generic Infusion Pump (GIP) Project

HCMDSS-MDPNP '07 Proceedings of the 2007 Joint Workshop on High Confidence Medical Devices, Software, and Systems and Medical Device Plug-and-Play Interoperability

Design challenges for secure implantable medical devices

Proceedings of the 49th Annual Design Automation Conference

Quantified Score

Hi-index	0.00

Visualization

Abstract

Post-market investigators at the United States Food and Drug Administration may need to review medical device software to assess its integrity. They have to do this with little or no prior knowledge of the software. Historically, the only way to perform such a review has been to manually search the code for potential sources of error --- a process that is both tedious and error-prone. Static analysis tools can improve this process by providing a means for automated error detection. By using symbolic execution techniques to explore execution paths of the software, static analysis provides complete, or almost complete, coverage of the code, and helps detect potentially fatal errors that may not easily be detected through conventional testing methods. Using automated static analysis tools can help reduce the effort involved in analysis and provide a more accurate assessment of the software. In this paper, we discuss CodeSonar, a whole-program interprocedural static analysis tool for C/C++ programs, and illustrate how it was used to facilitate error detection during a post-market investigation.