Stuttgart, 19. Mai 2021 – Axivion, Hersteller innovativer Software-Lösungen zur statischen Code-Analyse und zum Schutz vor Software-Erosion, wird zum Wegbereiter für das autonome Fahren und softwaredefinierte Fahrzeuge: Apex.AI, ein Unternehmen zur Entwicklung zukunftsweisender sicherheitszertifizierter Automobilsoftware, hat sich für die Axivion Suite als bevorzugtes Tool für die statische Analyse entschieden – vor allem wegen der hohen Abdeckung des AUTOSAR C++ 14 Standards und der einfachen Integration in die Continuous-Integration (CI)-Workflows. Die Axivion Suite unterstützt nicht nur die Entwicklung von Apex.OS, einer sicheren und zuverlässigen Software-Kommunikationsschicht für selbstfahrende Anwendungen, und Apex.Middleware, einer vollständigen und integrierten Lösung für die Intra- und Inter-ECU-Kommunikation. Die Toolsuite von Axivion unterstützte auch die Zertifizierung von Apex.OS und Apex.Middleware nach ISO 26262 ASIL D.

LATEST RELEASE 7.1.6: The new release of Axivion Suite comes beside other features and bugfixes with a reduced memory consumption in function-by-function mode, an option to exclude specific side-effects from CERTC++-PRE31, support for _DATE_ and _TIME_ in precompiled header and an improved graphical configuration interface (descriptions for selected values from dropdown options. The example cmake toolchain has been improved and examples for code annotations have been added.

Ensuring reliability and quality of software has become a necessity. This is especially true for safety critical systems. To do so, different techniques have been established in industry and academia. For instance, coding standards such as the MISRA ruleset or the AutosarC++14 ruleset have been developed. Additionally, software testing, static analysis and even model checking and formal proof are used. These approaches differ with respect to the effort needed and the environments they can be used efficiently in. In this paper, we will present a simple case study. Following the development of a light and speed control system, we will highlight how and when verification techniques can be employed and how selected requirements can be translated into properties to be checked. In particular, we outline how to employ the mentioned techniques, how they work and which results to expect from them. Furthermore, we highlight strengths and weaknesses of the different methods and discuss possible combinations. [By Dr. Sebastian Krings – originally published at Embedded World DIGITAL conference 2021]

Ein Programmierfehler in uftpd, einem in C implementierten FTP-Server, kann Safety und Security beeinträchtigen – und unter bestimmten Bedingungen missbraucht werden. Mit einfachen Programmiertechniken und Tools lassen sich solche Sicherheitsrisiken minimieren oder vermeiden.

If you work on a software project with safety and/or security background, you will have to use some sort of programming guide. In automotive industry, MISRA and Autosar C++14 standards are widely used, and therefore other industries also take these standards as a starting point for defining best practise rules. When you are not „forced“ to comply with a certain safety standard but still want to use a programming guide for aligning the „style“ of programming in your teams, it is a good idea to discuss the rules to be followed with your team upfront.

LATEST RELEASE 7.1.5: The new release of Axivion Suite comes beside other features and bugfixes with improved import of AUTOSAR models by an increased robustness of the arxml importer for partial arxml files; Generic Entity Marker Rules to mark analysed rules; reduced memory consumption for large projects, improved MISRA C:2012 checks; improved parallelization support in AxivionLinker rule; support for linking with large archives containing a 64 bit symbol table, an added VSCode plugin command to open the Axivion logging channel and better assistance for setting correct file system permission for the dashboard.

For use in Safety or Security, a range of Standard Programming Guides is available. In automotive industry, MISRA and AUTOSAR C++14 standards are widely used. While covering many different aspects, the standards leave it up to the user to define additional project or company specific rules.

AXIVION SUITE Axivion´s core product is Axivion Suite, the next generation of static code analysis for software systems implemented in C, C++ and C#. In addition to static code analysis, the tool suite includes innovative software tools for architecture verification and clone management. Moreover, the tool suite detects software erosion factors such as cycles, dead code and violations of programming rules. Axivion’s MISRA checker covers 100% of all automatically testable MISRA rules for the standards MISRA C:2004, MISRA C:2012, and MISRA C++:2008. Furthermore, the AUTOSAR C++14 styleguide as well as the CERT® programming rules for secure software development and rules for C Secure Coding (ISO/IEC TS 17961) are supported.

AXIVION SUITE Axivion´s core product is Axivion Suite, the next generation of static code analysis for software systems implemented in C, C++ and C#. In addition to static code analysis, the tool suite includes innovative software tools for architecture verification and clone management. Moreover, the tool suite detects software erosion factors such as cycles, dead code and violations of programming rules. Axivion’s MISRA checker covers 100% of all automatically testable MISRA rules for the standards MISRA C:2004, MISRA C:2012, and MISRA C++:2008. Furthermore, the AUTOSAR C++14 styleguide as well as the CERT® programming rules for secure software development and rules for C Secure Coding (ISO/IEC TS 17961) are supported.

In cooperation with our research partners in academia, we offered a bachelor thesis in the field of program analysis at Heinrich-Heine-University Düsseldorf. The recently finished thesis of a Bachelor student who was supervised by Axivion investigated static analysis of Python programs by creating a program dependency graph. Features like "late bound everything", "monkey patching", missing entry points or the fact that "everything is a mutable object" pose a challenge in static modelling of dependencies and make it hard or impossible to create an exact dependency graph.