Producing a useful static analysis tool involves balancing a number of conflicting concerns, including at least the following:
- False positive (false alarm) rate
- False negative (uncaught bug) rate
- Run time and scalability
False positives are a critical concern with bug detection tools since they waste developer time. It's possible to eliminate false negatives, but for many types of bugs, including concurrency bugs, this would involve an unacceptable increase in the false positive rate. The rate of both false positives and false negatives can be decreased at the cost of increased run time, but the most accurate analysis techniques don't scale beyond small applications, and anyway they can't both be decreased to zero.
Dynamic analysis tools often claim a false positive rate of 0%, but that's because they only find bugs once they actually happen. For a race condition or deadlock that only happens once in a blue moon, that's not so useful.
For these reasons, ThreadSafe doesn't promise to find all concurrency bugs - it aims to find the most important ones, with a low false positive rate. Some users have tried ThreadSafe on code with a known concurrency bug that they spent days to find, and discover that it finds that bug - and often other genuine bugs that they didn't know about - with no false positives, within minutes.
A good place to start for information about ThreadSafe is this InfoQ article. For more, see the ThreadSafe website where you can sign up for a free trial.
(Disclosure: ThreadSafe is a commercial tool, and I'm co-founder of Contemplate, the company that produces it.)