Static Code Analysis and Verification

PC-lint Plus Catches Defects Before Testing Begins

Static analysis examines source code without executing it, identifying defects at the point they are introduced rather than when they surface during testing or integration. For embedded C and C++ development in regulated industries, running static analysis continuously from the start of a project prevents defect classes from accumulating through the codebase and reduces the volume of findings that need resolution before certification.

What Static Analysis Does

Static analysis tools work systematically through source code, applying a rule set to identify issues that would be difficult or impossible to find through testing alone. Unlike dynamic testing, results do not vary with test inputs or runtime conditions: the same code produces the same findings on every run.

Key techniques include:

  • Pattern matching against coding standard rules to flag violations and questionable constructs
  • Value tracking to monitor variable values across execution paths and catch invalid states
  • Boundary value checking to verify that variables stay within expected ranges
  • Abstract interpretation of control and data flow to identify dependencies and reachability issues

What Static Analysis Finds

The defect classes that static analysis reliably catches include, but are not limited to:

  • Null-pointer dereferences and out-of-bounds array access
  • Uninitialized variables and improper type conversions
  • Violations of coding standards including MISRA C:2025, MISRA C:2023, MISRA C++:2023, AUTOSAR C++, and CERT-C
  • Security weaknesses mapped to CWE classifications, including the CWE Top 25 and Top 10 KEV list
  • Unreachable code, logic errors, and resource leaks
  • Concurrency issues including race conditions and improper operation sequences

PC-lint Plus

PC-lint Plus is Vector's static analysis tool for C and C++ source code. It is certified by exida to IEC 61508 (SIL 1-3), ISO 26262 (ASIL A-D), IEC 62304, and EN 50716, and is certified for CWE compatibility.

PC-lint Plus supports MISRA C:2025, MISRA C:2023, MISRA C:2012 (Amendments 1-4), MISRA C++:2023, MISRA C++:2008, AUTOSAR C++, CERT-C, and CWE out of the box. It integrates into virtually any build chain and development environment, runs locally without telemetry or internet connectivity, and scales efficiently across large codebases using parallel processing. Suppression management is fully traceable: every suppression is documented, query-based exceptions can be defined at the rule level, and unused suppressions are flagged automatically.