Date: Jan 15, 2011 Author: Joan M Zimmermann Source: MDA (
click here to go to the source)
by Joan M. Zimmermann/jzimmermann@nttc.edu
Software-assurance techniques once developed for MDA's computer systems are now helping the Food and Drug Administration (FDA) find glitches in medical device software.
GrammaTech, Inc. (Ithaca, NY), has developed a number of code-evaluation techniques to effectively quash defects in computer software. In particular, GrammaTech received Phase I and II SBIRs to develop tools for supporting C/C++ and Ada code for MDA and DOD applications, primarily to deal with legacy software applications for large programs like the former Theater High Altitude Area Defense (THAAD) system. In addition, the company worked on static analysis-based code assurance for MDA software in general. Combined with significant contracts from other Federal agencies, as well as private investment, GrammaTech further refined its techniques to produce a winning combination of analytical packages.
GrammaTech now sells two main products to help developers understand and analyze their programs. One product, CodeSonar®, is the workhorse that does the defect scouting. The other product, CodeSurfer®, builds a "picture" of the program structure for the programmer. CodeSonar works right out of the box and can perform a whole-program analysis on more than 10 million lines of source code. CodeSonar also can be used to analyze programs that use multiple languages, and it also can examine "binaries" or executables, the latter of which GrammaTech's vice president of products, Mark Zarins, considers a fairly unique feature. These binaries are pieces of code that have been compiled into machine code and are, therefore, more difficult to parse than human-friendly source code.
CodeSurfer and CodeSonar use so-called static analysis methods that are capable of detecting subtle errors, allowing detection of bugs earlier in the coding process than with dynamic analysis, which depends on the time-consuming and laborious process of using multiple test cases for sets of code. Neither dynamic nor static analysis can test all the possible paths of a computer program. Static analysis, however, can test significantly more scenarios by employing algorithms that explore the relationships between variables.
Translated into more practical terms, static analysis can turn up bugs that might not be apparent even after many runs in the real world. For example, such analysis can detect memory leaks that can lead to abrupt crashes. This feature attracted the interest of the Food and Drug Administration (FDA), which among its many duties also regulates and certifies medical devices, from pacemakers to medication infusion pumps and everything in between.
In particular, the FDA has been encouraging the use of static analysis and has used CodeSonar in recent efforts to improve post-market surveillance of medical devices. If a software-driven device fails in the field, the FDA's Center for Devices and Radiological Health (CDRH) must carry out an investigation that includes a thorough analysis of the source code. In addition, the CDRH wants to be able to reliably assess these types of devices for compliance with software and quality control standards. In a case study of one such device, conducted by CDRH, CodeSonar was able to uncover more than 100 defects underlying critical functions, using 210 person-hours to carry out the analysis. CDRH recognized this time savings as a considerably superior to the time that would have been required for a wholly manual analysis, and currently regards static analysis as a much more reliable method for tracking errors in software.
CodeSonar has built enough of a reputation to be well-regarded by architects of spacecraft. NASA's Jet Propulsion Laboratory (JPL) engineers have been using GrammaTech's CodeSonar in the development of future Mars exploration systems. Successfully launching a spacecraft to Mars has been likened to teeing off at St. Andrew's to achieve a hole-in-one at Pebble Beach. While Earthlings seem to have learned celestial mechanics well enough, writing the software that oversees the myriad commands to orbiting satellites and planet-scouring rovers is challenging. CodeSonar will help developers pinpoint bugs so they can be fixed before they cause problems.
GrammaTech's products continue to receive rave reviews and have been credited for reducing software inspection time for one customer by 30 percent, while reducing bugs by a factor of two. In addition, the company has been growing healthily, increasing its headcount by nearly 50 percent last year, and showing profits for the last ten years.
