Helix QAC

Perforce Helix QAC (formerly PRQA QA-C/QA-C++) is a static code analysis tool for C and C++ that uses inter-procedural dataflow analysis to enforce MISRA and AUTOSAR coding standards, detect defects such as null pointer dereferences and buffer overflows, and support safety-critical certification with TÜV SÜD certified qualification kits.

• MISRA C:2025 and AUTOSAR C++14 coverage: Perforce reports 100% enforcement coverage for MISRA C:2025, MISRA C:2023, and MISRA C++:2023, plus 96% for AUTOSAR C++14
• TÜV SÜD certified for IEC 61508, ISO 26262, EN 50716, IEC 60880, and IEC 62304, covering both the QAC (C) and QAC++ (C++) engines; Perforce states the IEC 62304 qualification reaches Software Safety Class C
• Inter-procedural dataflow engine with configurable analysis depth, extended in QAC 2026.1 to cross-language Rust / C / C++ dataflow for mixed-language embedded codebases
• Qualification kits for ISO 26262, IEC 61508, EN 50716, IEC 62304, and IEC 60880 (nuclear power); Perforce states these reach ISO 26262 up to ASIL D, IEC 61508 up to SIL 4, EN 50716 up to SW-SIL 4, and IEC 62304 up to Class C
• CI/CD integration via Jenkins and incremental/delta analysis scoped to changed files and pull requests, plus AI-assisted remediation in VS Code and GitHub Copilot Chat
• Formerly sold as PRQA QA-C/QA-C++ before Perforce’s acquisition of PRQA; Perforce states that its safety experts actively participate in the MISRA C and C++ standards committees

Helix QAC by Perforce is a static analysis tool for MISRA compliance analysis, built on dedicated parsing engines for C (QAC) and C++ (QAC++) that Perforce reports deliver over 2,000 checks per language. Unlike pattern-matching tools, Helix QAC performs full dataflow analysis to expose null pointer dereferences, buffer overflows, uninitialized object use, divide-by-zero, numeric wraparound, and dead code, defect classes that simpler checkers can miss. Perforce positions QAC as the gold standard for MISRA; that is Perforce’s characterisation of its own product, and the coverage figures below are Perforce-reported.

Perforce reports enforcement coverage of 100% for MISRA C:2023 and MISRA C:2025, 100% for MISRA C++:2023, 96% for AUTOSAR C++14, and 100% for HIC++. On security-focused standards Perforce reports 100% enforcement for CERT C/C++ and CWE, and 98% for ISO/IEC TS 17961. The tool supports all modern ISO C standards (C90 through C23) and ISO C++ standards (C++11 through C++23), with the ability to create custom rules and compliance modules for organization-specific coding guidelines.

Why Perforce QAC Sets the Standard for MISRA Precision

Perforce states that its safety experts actively participate in the MISRA C and C++ standards committees. In other words, the team behind QAC helps shape MISRA, not just check against it. Perforce positions QAC as the gold standard for MISRA, providing 100% enforcement coverage for MISRA C:2025 and MISRA C:2023 through dedicated compliance modules, and markets that as the most accurate and comprehensive MISRA checking in the industry. Unlike broad multi-tool suites that treat static analysis as one capability bolted on among many, Helix QAC is purpose-built for precision MISRA enforcement, which Perforce frames as fewer false positives and more actionable results for engineering teams.

The depth behind that coverage is Perforce QAC’s inter-procedural dataflow engine. Perforce describes a configurable dataflow analyser with multiple selectable depth levels (its Depth settings), commonly described as five configurable analysis levels, that let teams tune analysis from fast incremental scans to deep whole-program flow analysis across function and translation-unit boundaries. This is what surfaces context-dependent defects that surface-level scanners miss. On timing: MISRA C:2025 enforcement shipped in Perforce QAC 2025.1 (April 2025). The standards-committee participation and dataflow depth behind that coverage are what differentiate QAC, rather than the calendar.

Compliance Standards Coverage

Enforcement coverage figures in this table are Perforce-reported.

Qualification kits cover ISO 26262, IEC 61508, EN 50716, IEC 62304, and IEC 60880 for nuclear power, providing tool qualification documentation as an input to your own tool confidence argument rather than evidence you build from scratch; Perforce states these kits reach ISO 26262 up to ASIL D, IEC 61508 up to SIL 4, EN 50716 up to SW-SIL 4, and IEC 62304 up to Software Safety Class C. Incremental analysis re-checks only changed files and their dependents, while delta analysis produces results scoped to feature branches or pull requests for CI/CD pipelines. Multi-threaded analysis detects race conditions and deadlocks through intra- and inter-thread analysis. Cross-module analysis (RCMA) operates like a linker across the full project, catching duplicate declarations, unused code, and recursion. AI-assisted code remediation integrates with VS Code and GitHub Copilot Chat, suggesting fixes informed by analysis results directly in the IDE. Centralized compliance dashboards report code metrics such as cyclomatic complexity, nesting depth and unreachable code ratios, giving engineering managers and auditors quantitative visibility across entire codebases.

AI-Assisted Code Remediation in Helix QAC

Perforce has extended AI-assisted code remediation across both of its static analysis engines, so this is a Helix QAC capability and not a Klocwork-only one. Perforce describes the assistant as one that “analyzes each found defect using deep contextual data from QAC or Klocwork and suggests highly accurate, compliant code corrections”, and lists the feature under both Perforce QAC and Perforce Klocwork.

The delivery mechanism is an MCP server. Perforce states that the feature is “Delivered via the Perforce Static Analysis MCP server, any MCP-compatible host can connect and apply remediations using its own configured LLM”, summarising the design as “Your LLM. Your IDE. Your Environment.” On editor support Perforce is specific: “While there is an out-of-the-box plugin for use with VS Code (across development platforms), the feature is MCP-based and therefore designed as an IDE-agnostic and Code-Assist tool-agnostic solution.” In practice that means the shipping out-of-the-box integration today is VS Code, most commonly paired with GitHub Copilot, with the Model Context Protocol server introduced in the 2026.1 release providing the standardised basis for other IDEs and AI assistants.

Four properties matter for a MISRA evidence trail:

• Human approval is mandatory. Perforce states that “Every fix requires explicit developer approval before it is applied”, and that the suggestion “is still only a proposed solution and therefore maintains the developer-in-the-loop review and approval step”. Perforce also notes that code reviews remain a key and often mandatory practice for safety-critical and security-critical projects.
• Air-gapped deployment is supported. Perforce states that “Support for private, air-gapped environments means no data leaves your network”, and that teams can use an AI solution they have already approved without additional approvals. For Indian defence, aerospace and space programs developing on networks with no egress, this is the property that decides whether AI-assisted remediation is usable at all.
• Re-analysis is automatic. Perforce states that “Automated re-analysis runs after each proposed fix is generated”, so the finding is re-checked by the QAC engine rather than assumed resolved.
• Compliance reporting is generated. Perforce states that “Compliance-ready reports are automatically generated, making it safer and easier to demonstrate regulatory adherence”.

The separation of duties is what keeps this compatible with a certification program. The compliance finding is produced by the QAC dataflow engine, which is the tool carrying TUV SUD certified qualification for ISO 26262, IEC 61508, IEC 62304, EN 50716 and IEC 60880. The language model is not qualified for functional safety and is not being asked to rule on whether code conforms to MISRA C:2025; it proposes a correction for a defect the qualified engine already found, and an engineer approves it. Perforce headlines the feature with “Boost Remediation Accuracy from 20% to over 70%”, citing Carnegie Mellon University research finding “vulnerability resolution accuracy from 20-30% when AI operates alone to 72-90% when enriched with static analysis data about the defect”; Perforce names no paper for that research, so treat the figures as vendor-cited rather than independently verified.

For the full workflow, including an interactive demo of the assistant inside the IDE, see AI-Assisted Code Remediation for Safety-Critical C and C++.

Rust, C, and C++ in One Analysis: QAC 2026.1

Perforce QAC 2026.1 adds a new analyzer component for the Rust programming language alongside C and C++. Crucially, Rust crates can link to C and C++ translation units and be analysed across the language boundary in Dataflow and RCMA (Recursive Cross-Module Analysis), delivering cross-language Rust / C / C++ inter-procedural dataflow analysis in a single tool. For Indian teams modernising mixed-language embedded codebases, where new Rust components interface with established C and C++ subsystems, this means one consistent static-analysis and MISRA-precision workflow spanning all three languages, with no gaps at the language boundary.

Perforce QAC for FDA & IEC 62304 Medical-Device Software

Perforce QAC, including its dedicated C (QAC) and C++ (QAC++) analysis engines, is certified by TÜV SÜD for safety-related software development across functional safety standards including IEC 61508, ISO 26262, EN 50716, IEC 60880, and IEC 62304 (medical devices); Perforce states the IEC 62304 qualification reaches Software Safety Class C. Perforce documents how QAC supports the medical industry’s IEC 62304 workflows, and Perforce QAC, when used in conjunction with the MISRA coding standard, is independently certified to be suitable for the development of safety-related software according to IEC 62304. The FDA accepts demonstration of compliance to the standard as evidence that regulatory processes have been fulfilled (Source: perforce.com/blog/qac/fda-compliance-med-device).

For medical-device manufacturers and contract software houses in Bengaluru, Hyderabad, Chennai, and Pune, this combination, precision MISRA enforcement, TÜV SÜD certification, and IEC 62304 qualification documentation (Perforce states up to Software Safety Class C), turns regulatory submission from a research project into a repeatable, audit-ready workflow. GSAS supports IEC 62304 baseline establishment and qualification-kit deployment for medical software teams across India.

For enterprise deployments managing multiple codebases and teams, Perforce Validate provides a centralized governance dashboard, a single pane of glass for all Helix QAC and Klocwork analysis data, compliance reporting, access control, and defect prioritization across the organization. Validate consolidates MISRA compliance status, qualification kit audit trails, and code quality metrics into a unified view for engineering leadership and certification auditors.

GSAS delivers MISRA compliance workshops across India’s automotive, aerospace, and medical device sectors. Services include TÜV SÜD qualification kit deployment, build system integration (GCC, Green Hills, Arm Compiler, TI, Wind River), and MISRA baseline establishment for teams adopting compliance for the first time.

Helix QAC vs Other MISRA Compliance Tools in India

Engineering teams evaluating static analysis tools for MISRA C and AUTOSAR C++ compliance typically compare Helix QAC against alternatives such as PC-lint, Polyspace, and Cppcheck. Helix QAC differentiates through its dedicated parsing engines, separate full-syntax parsers for C (QAC) and C++ (QAC++) that perform dataflow analysis rather than pattern matching. Perforce positions that architecture as the source of fewer false positives on complex, cross-function code paths than pattern-matching checkers produce.

For coding standards enforcement, Perforce reports 100% coverage of MISRA C:2023, MISRA C:2025, MISRA C++:2023, and CERT C/C++ guidelines, with 96% coverage of AUTOSAR C++14. The tool ships with qualification kits for ISO 26262, IEC 61508, and IEC 62304, pre-packaged for certification audits; Perforce states these reach ASIL D, SIL 4, and Class C respectively. Teams adopting MISRA compliance for the first time benefit from incremental analysis that integrates into CI/CD pipelines, checking only changed files and producing delta reports scoped to feature branches. This makes Helix QAC a practical code quality and compliance tool for teams scaling static analysis across large embedded codebases.

QAC + Tessy: A Complete Shift-Left Toolchain

Static and dynamic analysis solve different halves of the same problem, and the most defect-resistant teams run both, in the right order. The shift-left principle is simple: run Perforce QAC first so code is significantly cleaner before dynamic test. QAC’s precision MISRA enforcement and inter-procedural dataflow catch coding-standard violations and whole classes of latent defects at the desk, eliminating noise that would otherwise consume valuable dynamic-test cycles.

Pair QAC with Razorcat TESSY for the dynamic half: automated unit, module, and integration testing with structural code coverage, C0/C1, Decision, and MC/DC, that proves the cleaned code actually behaves correctly against requirements. MC/DC is the structural coverage metric safety programmes typically target at the highest integrity levels, including ISO 26262 ASIL D and DO-178C Level A. Whether your evidence is accepted remains your assessor’s decision, not a property of the tool.

Together, QAC (static, precision MISRA) + Tessy (dynamic, coverage) form a complete shift-left toolchain that catches defects earlier and more accurately, static enforcement up front, dynamic verification close behind. Unlike broad multi-tool suites that stitch together separate static, dynamic, and coverage point tools from different vendors, this is a purpose-built pairing of two tools, both available from a single authorized engineering partner. GSAS Micro Systems delivers QAC and Tessy together, one purchase order, one support relationship, for embedded teams in Bengaluru, Hyderabad, Chennai, Pune, Mumbai, and Delhi NCR. Explore the dynamic-testing side on the Razorcat partner page.

Watch the Helix QAC overview

GSAS Micro Systems is the authorized engineering partner for Perforce, providing Helix QAC licensing, deployment, and MISRA compliance consulting across India. Our team assists with build system integration, custom rule development for organization-specific coding guidelines, qualification kit documentation for safety certification audits, and developer training that accelerates adoption of MISRA-compliant coding practices. For complete shift-left coverage, GSAS also delivers Razorcat TESSY for dynamic unit testing and MC/DC code coverage, static and dynamic analysis from one partner.

References: Source, perforce.com/products/helix-qac · perforce.com/products/helix-qac/whats-new-helix-qac · perforce.com/products/sca/ai-assisted-code-remediation · perforce.com/blog/qac/fda-compliance-med-device · perforce.com/blog/qac/misra-compliance-static-analysis