What is Code Verification?
Code verification is the process of confirming that software correctly implements its intended design and requirements. In safety-critical development it runs continuously through the lifecycle, with each stage producing documented evidence that feeds into the compliance case.
Verification vs. Validation: The Short Version
The two terms are often used interchangeably, but they address different questions.
- Verification asks: Did we build the software correctly? Does the implementation match the specification?
- Validation asks: Did we build the right software? Does it meet the actual user need?
Code verification focuses on the former. It uses static analysis, structured reviews, and dynamic testing to confirm that the implementation faithfully reflects what was designed and specified.
What Code Verification Includes
A complete verification strategy typically combines several complementary activities.
Static code analysis
Source code is examined without execution. Tools like PC-lint Plus scan for coding standard violations, null-pointer dereferences, out-of-bounds access, undefined behavior, and hundreds of other defect classes before testing begins. More on Static Analysis
Unit testing
Individual functions, modules, classes, and components are tested in isolation. Developers verify correct behavior across normal inputs, boundary conditions, and error cases. Tools like VectorCAST automate test creation and execution, and measure how thoroughly the tests exercise the code. Explore more about unit testing
Code Coverage Measurement
Coverage metrics including statement, branch, and MC/DC provide evidence that the test suite exercises the code sufficiently. In regulated industries, achieving specific coverage levels is a mandatory requirement, not a target. Learn about Code Coverage
Requirements traceability
Each test case is linked to the requirement it verifies. Bidirectional traceability demonstrates that all requirements have been tested and that no test exists without purpose. This is a critical element of any safety audit.
Why Verification Cannot Be an Afterthought
Defects found during code verification cost significantly less to fix than those discovered during integration, system testing, or in the field. For embedded software, where recall costs and safety consequences can be severe, catching errors early through systematic verification is both economically and ethically essential.
Industry standards including ISO 26262, DO-178C, IEC 61508, and IEC 62304 all mandate documented verification activities with traceable evidence. Vector's tools are built specifically to meet these requirements.