A static analysis tool (or static analyzer) has three major characteristics:

· Its input is the source code for a program in a programming language.
· It analyzes the program’s structure without executing the program.
· As its primary function, the tool outputs information that is relevant to humans developing or maintaining the program.

This general definition includes tools such as coding standard checkers, bug finders, and test case generators.

Many static analysis tools attempt to detect problematic constructs. Ideally, such a tool should identify all constructs in a given program—and only those constructs encountering the problem during execution. Unfortunately, mathematical computability theory shows that it is impossible to produce such a tool for analyzing arbitrary programs in any nontrivial programming language. So, in practice, a tool will suffer from either one or both of these deficiencies:

· Failure to detect a problem, yielding what is (perhaps confusingly) known as a false negative.
· Mistakenly flagging a correct construct as a problem, yielding a false alarm (known in the literature as a false positive).

A tool that does not generate false negatives is said to be sound. A tool’s precision is a measure of its ability to avoid generating false positives. Soundness and precision are tradeoffs, so the challenge for a tool provider is to strike an appropriate balance.