Helix QAC

Perforce Helix QAC (formerly PRQA QA-C/QA-C++) is a static code analysis tool for C and C++ that uses inter-procedural dataflow analysis to enforce MISRA and AUTOSAR coding standards, detect defects such as null pointer dereferences and buffer overflows, and support safety-critical certification with TÜV SÜD certified qualification kits.

• MISRA C:2025 and AUTOSAR C++14 coverage: Perforce reports 100% enforcement coverage for MISRA C:2025, MISRA C:2023, and MISRA C++:2023, plus 96% for AUTOSAR C++14
• TÜV SÜD certified for IEC 61508, ISO 26262, EN 50716, IEC 60880, and IEC 62304 up to Software Safety Class C, covering both the QAC (C) and QAC++ (C++) engines
• Inter-procedural dataflow engine with configurable analysis depth, extended in QAC 2026.1 to cross-language Rust / C / C++ dataflow for mixed-language embedded codebases
• Qualification kits for ISO 26262 (up to ASIL D), IEC 61508 (up to SIL 4), EN 50716, IEC 62304 (up to Class C), and IEC 60880 (nuclear power)
• CI/CD integration via Jenkins and incremental/delta analysis scoped to changed files and pull requests, plus AI-assisted remediation in VS Code and GitHub Copilot Chat
• Formerly sold as PRQA QA-C/QA-C++ before Perforce’s acquisition of PRQA; Perforce is a member of the MISRA Consortium Limited with experts on MISRA working groups

Helix QAC by Perforce is the industry reference for MISRA compliance analysis, built on dedicated parsing engines for C (QAC) and C++ (QAC++) that deliver over 2,000 checks per language. Unlike pattern-matching tools, Helix QAC performs full dataflow analysis to expose null pointer dereferences, buffer overflows, uninitialized object use, divide-by-zero, numeric wraparound, and dead code — defects that simpler checkers systematically miss. Sound analysis capability provides mathematical proof of defect absence, a critical factor for safety-critical certification where “no known bugs” is insufficient.

MISRA rule enforcement coverage is among the highest in the industry: 100% for MISRA C:2023 and MISRA C:2025, 100% for MISRA C++:2023, 96% for AUTOSAR C++14, and 100% for HIC++. Security-focused standards are equally comprehensive: 100% enforcement for CERT C/C++ and CWE, 98% for ISO/IEC TS 17961. The tool supports all modern ISO C standards (C90 through C23) and ISO C++ standards (C++11 through C++23), with the ability to create custom rules and compliance modules for organization-specific coding guidelines.

Why Perforce QAC Sets the Standard for MISRA Precision

Perforce is a member of the MISRA Consortium Limited, and its experts sit on the MISRA Working Groups that author the standard, Perforce (formerly PRQA) positions itself as a founding member of MISRA. In other words, the team behind QAC helps define MISRA, not just check against it. Perforce positions QAC as the gold standard for MISRA, providing 100% enforcement coverage for MISRA C:2025 and MISRA C:2023 through dedicated compliance modules, the most accurate, comprehensive MISRA checking it markets in the industry. Unlike broad multi-tool suites that treat static analysis as one capability bolted on among many, Helix QAC is purpose-built for precision MISRA enforcement, which Perforce frames as fewer false positives and more actionable results for engineering teams.

The depth behind that coverage is Perforce QAC’s inter-procedural dataflow engine. Perforce describes a configurable dataflow analyser with multiple selectable depth levels (its Depth settings), commonly described as five configurable analysis levels, that let teams tune analysis from fast incremental scans to deep whole-program flow analysis across function and translation-unit boundaries. This is what surfaces context-dependent defects that surface-level scanners miss. On timing: MISRA C:2025 enforcement shipped in Perforce QAC 2025.1 (April 2025). The founding-member role and dataflow depth behind that coverage are what differentiate QAC, rather than the calendar.

Compliance Standards Coverage

Qualification kits cover ISO 26262 up to ASIL D, IEC 61508 up to SIL 4, EN 50716 up to SW-SIL 4, IEC 62304 up to Software Safety Class C, and IEC 60880 for nuclear power — providing the tool confidence documentation that certification bodies require without months of custom qualification effort. Incremental analysis re-checks only changed files and their dependents, while delta analysis produces results scoped to feature branches or pull requests for CI/CD pipelines. Multi-threaded analysis detects race conditions and deadlocks through intra- and inter-thread analysis. Cross-module analysis (RCMA) operates like a linker across the full project, catching duplicate declarations, unused code, and recursion. AI-assisted code remediation integrates with VS Code and GitHub Copilot Chat, suggesting fixes informed by analysis results directly in the IDE. Centralized compliance dashboards with 68 code metrics — including cyclomatic complexity, nesting depth, and unreachable code ratios — give engineering managers and auditors quantitative visibility across entire codebases.

AI-assisted remediation in VS Code and GitHub Copilot provides context-aware fix suggestions with developer approval required, accelerating resolution without compromising code quality.

Rust, C, and C++ in One Analysis: QAC 2026.1

Perforce QAC 2026.1 adds a new analyzer component for the Rust programming language alongside C and C++. Crucially, Rust crates can link to C and C++ translation units and be analysed across the language boundary in Dataflow and RCMA (Recursive Cross-Module Analysis), delivering cross-language Rust / C / C++ inter-procedural dataflow analysis in a single tool. For Indian teams modernising mixed-language embedded codebases, where new Rust components interface with established C and C++ subsystems, this means one consistent static-analysis and MISRA-precision workflow spanning all three languages, with no gaps at the language boundary.

Perforce QAC for FDA & IEC 62304 Medical-Device Software

Perforce QAC, including its dedicated C (QAC) and C++ (QAC++) analysis engines, is certified by TÜV SÜD for safety-related software development across functional safety standards including IEC 61508, ISO 26262, EN 50716, IEC 60880, and IEC 62304 (medical devices) up to Software Safety Class C. Perforce documents how QAC supports the medical industry’s IEC 62304 workflows, and Perforce QAC, when used in conjunction with the MISRA coding standard, is independently certified to be suitable for the development of safety-related software according to IEC 62304. The FDA accepts demonstration of compliance to the standard as evidence that regulatory processes have been fulfilled (Source: perforce.com/blog/qac/fda-compliance-med-device).

For medical-device manufacturers and contract software houses in Bengaluru, Hyderabad, Chennai, and Pune, this combination, precision MISRA enforcement, TÜV SÜD certification, and IEC 62304 Class C qualification documentation, turns regulatory submission from a research project into a repeatable, audit-ready workflow. GSAS supports IEC 62304 baseline establishment and qualification-kit deployment for medical software teams across India.

For enterprise deployments managing multiple codebases and teams, Perforce Validate provides a centralized governance dashboard, a single pane of glass for all Helix QAC and Klocwork analysis data, compliance reporting, access control, and defect prioritization across the organization. Validate consolidates MISRA compliance status, qualification kit audit trails, and code quality metrics into a unified view for engineering leadership and certification auditors.

GSAS has delivered 50+ MISRA compliance workshops across India’s automotive, aerospace, and medical device sectors. Services include TÜV SÜD qualification kit deployment, build system integration (GCC, Green Hills, Arm Compiler, TI, Wind River), and MISRA baseline establishment for teams adopting compliance for the first time.

Helix QAC vs Other MISRA Compliance Tools in India

Engineering teams evaluating static analysis tools for MISRA C and AUTOSAR C++ compliance typically compare Helix QAC against alternatives such as PC-lint, Polyspace, and Cppcheck. Helix QAC differentiates through its dedicated parsing engines, separate full-syntax parsers for C (QAC) and C++ (QAC++) that perform dataflow analysis rather than pattern matching. This architecture enables sound analysis: the ability to mathematically prove the absence of specific defect classes, which is a requirement for safety-critical certification at higher integrity levels.

For coding standards enforcement, Helix QAC provides 100% coverage of MISRA C:2023, MISRA C:2025, MISRA C++:2023, and CERT C/C++ guidelines, with 96% coverage of AUTOSAR C++14. The tool ships with qualification kits for ISO 26262 (ASIL D), IEC 61508 (SIL 4), and IEC 62304 (Class C), pre-packaged for certification audits. Teams adopting MISRA compliance for the first time benefit from incremental analysis that integrates into CI/CD pipelines, checking only changed files and producing delta reports scoped to feature branches. This makes Helix QAC a practical code quality and compliance tool for teams scaling static analysis across large embedded codebases.

QAC + Tessy: A Complete Shift-Left Toolchain

Static and dynamic analysis solve different halves of the same problem, and the most defect-resistant teams run both, in the right order. The shift-left principle is simple: run Perforce QAC first so code is significantly cleaner before dynamic test. QAC’s precision MISRA enforcement and inter-procedural dataflow catch coding-standard violations and whole classes of latent defects at the desk, eliminating noise that would otherwise consume valuable dynamic-test cycles.

Pair QAC with Razorcat TESSY for the dynamic half: automated unit, module, and integration testing with structural code coverage, C0/C1, Decision, and MC/DC, that proves the cleaned code actually behaves correctly against requirements. MC/DC coverage is the evidence certification bodies expect at the highest safety levels (ISO 26262 ASIL D, IEC 62304 Class C, DO-178C).

Together, QAC (static, precision MISRA) + Tessy (dynamic, coverage) form a complete shift-left toolchain that catches defects earlier and more accurately, static enforcement up front, dynamic verification close behind. Unlike broad multi-tool suites that stitch together separate static, dynamic, and coverage point tools from different vendors, this is a purpose-built pairing of two tools, both available from a single authorized engineering partner. GSAS Micro Systems delivers QAC and Tessy together, one purchase order, one support relationship, for embedded teams in Bengaluru, Hyderabad, Chennai, Pune, Mumbai, and Delhi NCR. Explore the dynamic-testing side on the Razorcat partner page.

Watch the Helix QAC overview

GSAS Micro Systems is an authorized engineering partner for Perforce, providing Helix QAC licensing, deployment, and MISRA compliance consulting across India. Our team assists with build system integration, custom rule development for organization-specific coding guidelines, qualification kit documentation for safety certification audits, and developer training that accelerates adoption of MISRA-compliant coding practices. For complete shift-left coverage, GSAS also delivers Razorcat TESSY for dynamic unit testing and MC/DC code coverage, static and dynamic analysis from one partner.

References: Source, perforce.com/products/helix-qac · perforce.com/products/helix-qac/whats-new-helix-qac · perforce.com/blog/qac/fda-compliance-med-device · perforce.com/blog/qac/misra-compliance-static-analysis