TESSY + Helix QAC: MISRA Static Analysis + MC/DC Dynamic Testing for Complete ISO 26262 Verification

TESSY + Helix QAC: Complete ISO 26262 Part 6 Verification

ISO 26262 Part 6 does not ask for a choice between static analysis and dynamic testing. It points at both. Part 6 lists static code analysis and static analysis based on abstract interpretation among its software unit verification methods, alongside requirements-based test, interface test, fault injection test and resource usage evaluation. Static analysis is not a nice-to-have bolted on beside unit testing; it is one of the listed verification methods in its own right. Neither side is mandatory, because the standard’s strongest rating is highly recommended, but in practice assessors expect both.

Indian automotive teams achieve complete Part 6 verification by combining Perforce Helix QAC for MISRA C/C++ static analysis with Razorcat TESSY for MC/DC dynamic unit testing. The two tools cover complementary verification objectives, and together they produce the evidence package that safety assessors need.

What Static Analysis Catches (and Dynamic Testing Cannot)

Helix QAC enforces MISRA C:2012 and MISRA C++:2023 coding guidelines through deep semantic analysis. It detects:

• Undefined behaviour: signed integer overflow, null pointer dereference, use of uninitialized variables
• Implementation-defined behaviour: bit-field ordering, integer promotion, pointer arithmetic across objects
• Coding standard violations: MISRA rules that prevent common embedded programming errors
• Complexity metrics: cyclomatic complexity, nesting depth, and other metrics that correlate with defect density

These are properties of the source code itself, independent of any particular test input. Dynamic unit testing cannot detect them because they require analysis of all possible execution paths, not just the paths exercised by test cases.

What Dynamic Testing Catches (and Static Analysis Cannot)

TESSY executes the code with specific input values and verifies that outputs match expected results. It detects:

• Logic errors: the function computes the wrong result for a given input
• Off-by-one errors: loop boundaries, array indexing, threshold comparisons
• Missing error handling: functions that do not handle edge cases correctly
• Integration defects: when the function under test interacts incorrectly with its dependencies (tested through stub configuration)
• Coverage gaps: unreachable code, untested branches, MC/DC conditions that are never independently exercised

These defects are only detectable by running the code with concrete inputs and comparing actual outputs against expected outputs. Static analysis cannot determine whether a function produces the correct result for a specific input, that requires execution.

The Combined Workflow

A practical ISO 26262 Part 6 workflow for Indian teams uses both tools in a CI/CD pipeline:

Phase 1, Static Analysis (Helix QAC)

1. Developer pushes code to the repository
2. CI pipeline runs Helix QAC with the project’s MISRA configuration
3. New MISRA violations are flagged and reported
4. Critical violations block the merge; advisory violations are tracked for resolution
5. Compliance reports are generated for the safety case

Phase 2, Dynamic Unit Testing (TESSY)

1. Same CI pipeline triggers TESSY batch execution
2. TESSY compiles the units under test with the project’s cross-compiler
3. Test suites execute (host-based for speed, or on-target via SEGGER J-Link for certification evidence)
4. Coverage is measured, statement, branch, MC/DC
5. Coverage thresholds are enforced as quality gates (e.g., 100% MC/DC for ASIL D functions)
6. Coverage reports are generated for the safety case

Combined evidence: the safety case includes Helix QAC MISRA compliance reports and TESSY MC/DC coverage reports, satisfying both the static and dynamic verification requirements of ISO 26262 Part 6.

If your units are AUTOSAR software components, Phase 2 has an extra dependency: an SWC only executes through the RTE. TESSY 6 provides that RTE automatically from the ARXML model description file, so the AUTOSAR-specific version of this workflow is walked stage by stage in our complete AUTOSAR verification chain guide, which also covers AUTOSAR C++14 enforcement in Helix QAC and Klocwork.

Requirements Traceability Across Both Tools

TESSY imports requirements in ReqIF format (the OMG standard used by IBM DOORS, Polarion, and codebeamer) and links test cases to requirements for bidirectional traceability. Helix QAC’s findings can be mapped to the same requirements, creating a unified traceability matrix that shows:

• Requirement → MISRA compliance status (static analysis evidence)
• Requirement → Unit test cases → Coverage achieved (dynamic testing evidence)

For teams in Pune and Bengaluru building AURIX-based ECUs for European OEMs, this combined traceability matrix is exactly what the assessor requests during a safety assessment.

Why Not Use One Tool for Both?

Some tools attempt to provide both static analysis and dynamic testing. The challenge is that each discipline requires deep specialization:

• MISRA compliance checking requires understanding of language standards, compiler-specific behaviour, and the nuanced intent behind each MISRA rule. Helix QAC has decades of MISRA specialization; Perforce states that its safety experts actively participate in the MISRA C and C++ standards committees.
• MC/DC coverage measurement requires sophisticated code instrumentation, test harness generation, stub creation, and test data management. TESSY has been refined for this specific workflow since its creation.

Using best-of-breed tools for each discipline produces better results than using a single tool that attempts both. The integration point is the CI/CD pipeline, both tools run in the same pipeline, share the same codebase, and produce complementary evidence for the same safety case.

GSAS Supplies Both

This is the practical advantage for Indian teams: GSAS Micro Systems is the authorized Indian partner for both Razorcat (TESSY) and Perforce (Helix QAC). One purchase order, one vendor relationship, one support channel, covering the complete static + dynamic verification workflow.

Our engineers in Bengaluru, Hyderabad, Chennai, Pune, Mumbai, and Delhi NCR configure both tools on your project, set up the combined CI/CD pipeline, and help your team produce the verification evidence package that satisfies ISO 26262 Part 6 for your target ASIL level.

Why Buy from GSAS

GSAS Micro Systems provides TESSY + Helix QAC as a combined verification stack with INR invoicing, joint training workshops, and integrated CI/CD consulting. Whether your team is starting a new ASIL D powertrain project or adding verification to an existing ASIL B body controller, GSAS provides the tools and the local expertise to build a certification-ready verification infrastructure.

Request a TESSY + Helix QAC evaluation →