In industrial and embedded systems, safety standards impose two requirements on the code side: structural coverage of tests (up to MC/DC) and adherence to coding rules. Testwell CTC++ and TiCS address both.
A mapping between the main standards in your sectors — functional safety and, now, cybersecurity with the Cyber Resilience Act — and what each tool contributes. The details by language and integration are on the vendors' data sheets.
| Sector & standard | Requirement on the code side | Testwell CTC++ | TiCS |
|---|---|---|---|
| Automotive ISO 26262 · MISRA · AUTOSAR |
Structural coverage up to MC/DC (ASIL D); adherence to MISRA C/C++ and AUTOSAR rules. | All coverage levels up to MC/DC; qualification kit. | Checks MISRA / AUTOSAR rules and quality metrics, with quality gates. |
| Aerospace & defense DO-178C |
Structural coverage required by level (up to MC/DC at Level A). | Measures MC/DC on host and target; qualification kit. | Coding standards, compiler warnings, and continuous quality tracking. |
| Medical IEC 62304 |
Test coverage and quality control according to the safety class. | Statement / decision / condition / MC/DC coverage. | Measures and tracks product quality (ISO/IEC 25010). |
| Rail EN 50716 (formerly EN 50128) |
Structural coverage and static analysis according to the SIL level. | Coverage up to MC/DC; qualification kit. | Aggregated static analysis and coding rules. |
| Industrial & automation IEC 61508 |
Structural coverage and static verification according to the SIL. | All coverage levels; qualification kit. | Quality metrics, duplication, complexity, dead code. |
| Nuclear IEC 60880 |
High coverage requirements (statement / decision / MC/DC). | Coverage proven on host and embedded targets. | Continuous quality tracking and dashboards. |
| All sectors — cybersecurity Cyber Resilience Act (CRA) · IEC 62443 |
Supply-chain transparency: inventory of third-party components (SBOM), known vulnerabilities in dependencies, and CVE handling over the support period. | Test coverage as evidence of product verification. | Generates the SBOM (SPDX / CycloneDX), software composition analysis (SCA), and vulnerability tracking. |
Indicative table: the exact levels (SIL, ASIL, DAL) and required artifacts depend on your project. Precilog supports you in the selection and configuration.
Beyond functional safety, cybersecurity regulation is gaining ground. The European Cyber Resilience Act (CRA) notably expects transparency across the software supply chain.
An SBOM (Software Bill of Materials) is the machine-readable inventory of all of a software's components and dependencies — open-source, third-party, and proprietary libraries. It lets you trace known vulnerabilities, check licenses, and react quickly when an alert hits (like Log4j).
TiCS covers this through software composition analysis (SCA) and SBOM generation in standard formats (SPDX, CycloneDX), in preparation for the Cyber Resilience Act. The results integrate into the same quality dashboard as the rest of your metrics.
The exact scope and timeline of the Cyber Resilience Act are evolving: Precilog helps you locate your obligations and tool up the approach.
A coverage analyzer for C and C++ (Java and C# add-ons). It measures every level required by safety standards, from statement rate up to MC/DC and multicondition, on host as well as on embedded target. Qualification kits attest to its correct operation in your toolchain.
A framework that aggregates a broad set of static analyzers and maps their results to a single quality model (ISO/IEC 25010). It checks coding standards (MISRA, AUTOSAR…), compiler warnings, and many metrics, with quality gates at each stage of the cycle.
Structural coverage (CTC++) and adherence to coding rules (TiCS) together make up most of the "code" requirements in safety frameworks. Precilog helps you combine them according to your sector and criticality level.
Let's talk about your sector, your criticality level, and the artifacts your auditor expects.
