Polyspace Static Analysis Notes
Read through the latest posts to learn more about Polyspace®下载188bet金宝搏产品。
Many companies that develop software for embedded systems are either investigating cloud platforms, planning pilot projects, or actively developing software in the cloud. These companies are often attracted to public cloud providers, such as Amazon Web Services (AWS®）和微软Azure®, because of competitive pricing and other advantages that cloud platforms offer.
发布2020A的多层空间®下载188bet金宝搏产品填写了许多现有的工作流程并介绍了一些新功能。PolySpace Bug Finder™现在支持所金宝app有证书C规则，PolySpace Access™产品可以分析导入到Simulink中的所有形式的C下载188bet金宝搏 / C ++代码。金宝app新的关键功能包括检测C ++代码中的潜在性能问题的验证器，来自用户策划函数的用户策划列表中的标志函数，并检查初始化代码中的问题。
In the past 20 years, advancements in technologies such as mobile, smart devices, IoT, and the cloud have led to creation of millions of new applications. To develop applications faster with quality and predictability, companies are evolving their software development processes. In the early 2000s, “lightweight” agile software development started gaining popularity. Agile is an iterative software development process that places importance on collaboration, continuous planning, and continuous testing.
发布2019B的PolySpace®products contains more checkers, supports more compilers, shows fewer false positives, and reduces setup activities further compared to previous releases. Key new features include a shared variables mode in Polyspace Code Prover™, the ability to verify custom C code in Simulink®以及更高支持编码标准，如Au金宝apptoSAR C ++ 14和Cert®C++ with new post-C++11 checkers.
一个问题经常出现：PolySpace是吗？®金宝app支持我使用的编译器?有时,一个variant of this question gets asked: Why does a static analysis tool like Polyspace need to know about a compiler? It’s not as if the tool compiles the code, creates a binary, and executes the binary to detect run-time errors. The run-time error detection does not involve executing the code at all.
PolySpace Bug Finder Access™和PolySpace代码Prover Access™使其轻松查看分析结果并促进团队协作。项目团队中的每个人都可以从Web界面查看，评论和分类结果。以下工作流程显示软件开发团队的不同成员如何使用PolySpace Access产品来监控其项目的软件质量和视图和分类代码分析和验证结果。下载188bet金宝搏
截至R2019A，PolySpace Bug Finder™已过渡到三个新产品：PolySpace Bug Finder，PolySpa下载188bet金宝搏ce Bug Finder Server™和PolySpace Bug Finder Access™。PolySpace代码箴言也转化为三种新产品：PolySpace代码先驱，PolySpace代码Prover Serv下载188bet金宝搏er™和PolySpace Code Prover Access™。
The 2018b release of Polyspace Bug Finder™ and Polyspace Code Prover™ offers many new features. Highlights include: easier set up, improved modularization, and increased support for security standards.
多层空间®开发团队考虑通过在您的环境中部署PolySpace产品的第一次互动中，考虑完整的客户体验。下载188bet金宝搏我们从这些交互中获得的信息驱动了我们的特色图和设计。
By Jay Abraham, Puneet Lal, and Anirban Gangopadhyay
This article outlines two improvements in R2018a that make reviewing data races and other multitasking-based results much easier.
By Anirban Gangopadhyay
Starting in R2018a, Polyspace Code Prover directly supports the AUTOSAR (Automotive Open System Architecture) methodology for software development. Whatever your role in the AUTOSAR software development workflow, you can now use Polyspace Code Prover as an AUTOSAR-aware static analysis tool.
By Jay Abraham
Software engineers rely on integrated development environments (IDEs) such as Eclipse™ to consolidate development activities to a single unified interface. With IDEs, you can edit, compile, execute, debug, and test your code.
By Ram Cherukuri and Anirban Gangopadhyay
Buffer overflows have plagued the C/C++ development community for years. While the C language empowers developers to access memory directly via pointers, it also opens the door to overflow problems. Safe coding practices help developers avoid buffer overflows to some extent (at the cost of performance), but sometimes buffer overflows can be subtle and complex to find and resolve.
By Ram Cherukuri
MISRA published an amendment to its latest MISRA C:2012 coding guidelines to mitigate the growing risk of cyber security vulnerabilities. Published in early 2016,the amendmentaddresses embedded security through additional coding guidelines. These 14 new coding guidelines are aimed at bridging the gap within the security guidelines published in ISO/IEC 17961:2013. The table below identifies the classification of these 14 rules in line with the MISRA C 2012 specification. To learn more about the classification system used in the MISRA C:2012 standard, viewUnderstanding Compliance to the MISRA C 2012 Coding Guidelines(33:29)。
By Ram Cherukuri
来自CERT C，ISO / IEC TS 17961，Misra C：2012修正案1的安全编码指南，CWE中示范的安全漏洞提供了一种分析和衡量嵌入式软件的安全性的方法。这些标准正在获得更多的接受，因为它们提供了在现有和新开发的代码中的理解，寻址和记录安全漏洞的共同框架。
By Ram Cherukuri
Organizations and teams adopt various models (i.e., V and Agile) for their software development processes. Within each model, there are differences variations, depending on the requirements of the application, the industry, and the maturity of the workflow. There are additional variations depending on the different steps in the software development workflow. For example, some organizations include a formal code review as part of their development process, given its benefits in improving the defect detection rates. Others rely solely or heavily on testing activities. Given these wide variations, there are at least a couple of best practices applicable to most modern embedded software development workflows.
By Ram Cherukuri
Polyspace Code Prover™ uses the color orange to highlight operations that can't be automatically proven to be error free under all circumstances. You can then review potential run-time issues that might lead to robustness or reliability concerns.
By Ram Cherukuri, Fred Noto, and Alexandre Langenieux
CERT C is a set of guidelines for software developers and is used for secure coding in C language. It was developed on the CERT community wiki following a community based development process, with the first edition released in 2008 and the second edition released in 2014.
By Ram Cherukuri
Code generation greatly simplifies the MISRA compliance process. The key objectives of coding standards (such as MISRA) are readability, maintainability, and portability, in addition to ensuring safety and reliability. Because the models are at the core of the development process and code can be generated from the model in a consistent manner for different platforms, it simplifies the portability and maintainability pieces.
By Ram Cherukuri
The previous posthighlighted the benefits of leveragingPolyspace static analysis帮助优化和减少验证周期的测试阶段的长度。这篇文章将讨论稳健性测试的低效率，并介绍如何解决这些挑战。
By Ram Cherukuri
Testing is a major part of the verification process at most embedded software development organizations. Studies estimate that around 25 – 30% of development time is spent on testing, and in some cases, this can be as high as 50% [1].
By Ram Cherukuri, Gary Ryu
The most recent version of the MISRA standard coding rules is MISRA C:2012, which succeeds MISRA C:2004 that has been widely adopted in the software community across industries for embedded systems.
由Ram Cherukuri，Stefan David
MISRA standard is a widely adopted coding standard across industries. It has become a commonplace best practice among embedded software development and quality assurance groups. A lot of these groups have a strict adherence policy to at least a subset of applicable rules—if not all of the coding rules. Such a compliance policy would require a review process to address the violations of the coding rules, and this process can often be resource intensive.
By Ram Cherukuri
This reminds me of the joke asking, “How many engineers does it take to change a light bulb?“
Many of our customers, especially those in the automotive industry, have used more than one static analysis tool as part of their software development and verification process.
One reason for the use of multiple tools is that, traditionally, the adoption of静态分析was fragmented into different activities such as coding rule compliance, bug finding, and so on. The development organization may have adopted a lint tool to perform local bug finding and a rule-checking tool to verify compliance to standards such as MISRA, while the quality assurance department may have adopted tools for code metrics such as code coverage, comment density, and cyclomatic complexity.
By Anirban Gangopadhyay and Ram Cherukuri
在这两个部分系列之一中，我们讨论了稳健性代码验证，这是一种方法，您可以在其中验证您的代码单位的代码单位。我们概述了一些例子，我们讨论了使用这种方法的利弊。
在此帖子中，我们将讨论上下文代码验证，在其中验证您的代码库上下文中的代码单位，其中将集成单位。这篇文章将通过与上一篇文章中的相同示例相同的示例来介绍上下文代码验证背后的概念，然后概述使用两种类型的代码验证（鲁棒性和上下文）的最佳实践。
By Anirban Gangopadhyay and Ram Cherukuri
This is part one of a two part series outlining code verification methods.
We begin with a question: At what stage of software development should I verify my code?
The answer is simple. You should verify it right after you have compiled it, when the code is fresh on your mind. Once you are shown potential errors, reviewing and fixing those errors can be almost trivial. Fixing errors never gets easier after that stage in the workflow.
由Ram Cherukuri，Jeff Chapple，Stefan David和Jay Abraham
更快的上市时间趋势可能是推动误解的静态分析只有找到bug。Software developers must eliminate as many bugs as possible and will use a quick bug finding tool, though it is likely that some bugs will remain. This practice may be sufficient for non safety-critical applications such as smartphone apps, but it may be insufficient for safety-critical applications. Safety-critical applications, therefore, require more rigorous methods to verify safety and robustness, which is where the other benefits of static analysis come in. In this article we will bust the misconception that static analysis is only about finding bugs, and prove that it can help verify compliance to coding standards, produce metrics about code quality, and be used at any stage of software development.
By Jay Abraham, Ram Cherukuri, and Christian Bard
In February 2014, technology blogs and news outlets were abuzz about a newly discovered vulnerability in Apple’s iOS iPhone, iPod, iPad, and Mac OS X devices. There was a problem in the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) code that could be exploited by what is known as Man in the Middle attack (MitM). The vulnerability was dubbed Goto Fail, and Apple quickly patched the defect with iOS 7.0.6 for its mobile platform and OS X 10.9.2 for the desktop platform.
