Suresofttech Source Code Static Analysis Tool

STATIC from Suresofttech (SURESOFTTECH) is a static analysis tool that analyzes source code without executing it to detect coding rule violations and runtime errors. Following coding guidelines, it finds critical errors and potential security holes in the source code, catching defects early in development that the compiler does not report. It supports coding rules such as MISRA and CERT and CWE-based security weakness checks, and its static analysis results can be used as verification evidence when responding to safety standards such as ISO 26262 and IEC 61508. It comes in two forms: STATIC Enterprise, a centrally managed web server environment, and STATIC Standalone, a VS Code based IDE.

STATIC checks three types of issues. First, it checks coding rule violations such as MISRA, CERT, and AUTOSAR, and security weaknesses mapped to CWE IDs. Second, it detects runtime errors without running the code, including memory errors (invalid access, memory leaks, NULL dereferences, invalid deallocation), arithmetic errors (complex operations, unnoticed type conversions), and array-bound errors (buffer overflow and underflow). Third, it checks violations of software quality metric thresholds such as cyclomatic complexity and nesting depth. C/C++ defects are provided with severity, confidence, and the source code location. Confidence is not provided for Java, C#, Kotlin, and Python, and some other provided items such as function information also differ from C/C++.

STATIC Enterprise is a centrally managed web server environment that assigns and tracks the defects of multiple developers and projects from a dashboard and supports five languages: C/C++, C#, Java, Kotlin, and Python. It provides project objective setting and burndown charts, APU Grid distributed analysis, an Open API, and configuration management integration. STATIC Standalone is a VS Code based standalone IDE that supports C/C++ and lets developers review and fix violations on a single screen in the environment where they write code. It supports local installation and dongle licensing, so it can be used at customer sites or on air-gapped networks. Enterprise is recommended when organization-wide quality management is needed, and Standalone when the goal is immediate review and remediation by an individual developer.

STATIC Enterprise supports C/C++, C#, Java, Kotlin, and Python, and STATIC Standalone supports C/C++. Analysis requests reuse your existing build environment: Visual Studio and Makefile for C/C++, Visual Studio solution and project files for C#, and Maven and Gradle for Java and Kotlin. Compiler support is identical in Enterprise and Standalone, with built-in toolchain configurations for IAR, Keil uVision, TASKING (AURIX), Renesas CS+, TI Code Composer Studio, Microchip Studio and MPLAB X IDE, STM32CubeIDE, Xilinx Vitis Unified, MCUXpresso IDE, Code Warrior, GNU, LLVM, and Visual Studio. Compilers not on the list can be configured in Manual Mode; applicability is determined after reviewing the compiler specification and the project environment.

Yes, STATIC supports MISRA C and MISRA C++ coding rule checking. It provides MISRA C/C++ rule sets including MISRA C 2004, 2012, 2023, and 2025, as well as AUTOSAR C++14. You can build a rule set from only the rules your project needs, create custom rule sets, and import rule sets from other projects. The rule manual provides a description of each rule together with violating (Bad) and compliant (Good) code examples, so you can make fixes with a clear understanding of the intent behind the rule. The supported MISRA editions and the detection scope per rule vary by edition and product version, so they should be confirmed before adoption. The full list of supported rule sets is available in Coding Rules and Industry Standards.

STATIC traces the execution paths and data flow of the source code through semantic analysis to identify, at the code level, conditions under which an error could occur at runtime. For example, it tracks the value range of a variable used as an array index to determine whether it could go out of bounds, and it checks whether allocated memory is released on all paths. The Enterprise analysis engine performs more than 1,200 pattern checks and more than 30 kinds of semantic analysis. That said, static analysis is a prediction made before execution, so the actual impact must be reviewed in the context of the code; confidence is provided for C/C++ and is not provided for Java, C#, Kotlin, or Python.

STATIC provides several mechanisms for managing false positives. C/C++ defects are labeled with a confidence grade, and defects can be managed in a Suppressed state with a specified reason such as intended code, false positive, or duplicate. Project members can leave comments on a defect and review it together. Smart Suggestion in Enterprise recommends past suppression records similar to the current defect and lets you compare the original defect with the recommended case before accepting or rejecting it.

Yes, this is possible with the Baseline feature in Enterprise. Once you set a reference point and run an analysis, defects from earlier analyses are excluded from the managed set so you can focus on defects introduced after the reference point. This avoids a situation where existing defects in legacy code fill the list and bury problems in new code. Baseline can be turned off in the project settings, so once you have capacity you can bring all defects back into the managed set. Used together with the project objective feature, you can set a target for remaining defects by severity along with a period and track reduction progress with a burndown chart — allowing you to prioritize the quality of new code while reducing legacy defects in stages. The related features are described in Defect Management and Objective Tracking.

Yes, the coding rule checks and static analysis results from STATIC can be used as verification evidence in the process of responding to safety standards. In projects applying safety and life cycle standards such as ISO 26262, DO-178C, IEC 61508, IEC 62279·EN 50128, IEC 62304, and IEC 60880, coding rule compliance and runtime error detection results can be retained as deliverables. STATIC provides the coding rule sets that these standards require, including MISRA C/C++, AUTOSAR C++14, and CERT, and detection results are tracked as defect information including the source location and severity. For C/C++, confidence is provided as well. Tool qualification materials for certification audits are available, and the supported scope per standard is summarized in Coding Rules and Industry Standards.

Yes. STATIC Enterprise can be installed with its web server (WAS) and analysis agents (APU) inside your internal network and operated without an external internet connection. STATIC Standalone is installed on a local PC and supports dongle licensing, so it can be used at customer sites and in network-separated environments. Note that AI features such as Smart Suggestion and STATIC Agent Chat require an LLM URL and API key configuration. The LLM configurations and supported models available in an air-gapped environment may vary by edition, version, and license, so they should be confirmed before adoption. The air-gapped installation procedure and licensing options can be explained together with your environment details when you contact us about adoption.

Yes, Enterprise can analyze codebases of several million lines. After the initial full analysis, incremental analysis inspects only the changed portions, and APU Grid distributed analysis uses the resources of multiple analysis agents to shorten analysis time. In a measurement example configured with a dedicated APU server, roughly 300 C++ source files were analyzed in under a minute. Even on large projects you can integrate with CI and run an analysis on every build, and you can check the request history and progress status on the analysis management screen. That said, actual analysis time varies greatly with code size, language, applied rule sets, and agent configuration, so if you share your project size and target analysis cycle when evaluating adoption, we can help identify a suitable server and agent configuration.

Both Enterprise and Standalone can integrate with continuous integration (CI) environments such as Jenkins, though the details of the integration differ by edition. With CI integration, static analysis runs automatically during the build, so the process can enforce analysis across the entire path from development to deployment. Enterprise automatically assigns detected defects to the responsible developer based on Git commit information, reducing the management overhead of distributing defects. It also provides an access key based Open API, issued from the user profile, for feeding analysis results and quality indicators into your in-house quality management system. Among our own tools, VPES integrates with both editions, and the V-SPICE link is provided in Enterprise. The specific integration configuration must be confirmed against the CI and configuration management tools and versions you use.

STATIC is distinguished from general-purpose overseas tools by the fact that it embeds, as rule sets, the verification guidelines required of Korean safety-critical and embedded projects, and by its broad support for embedded compilers. It supports the DAPA Software Reliability Assessment Guidelines with 92 items for C/C++, 100% of the ES95489-23 C and C++ rule sets, and the HKMC verification guidelines with 60 items across grades A/B/SE. Whether a cross compiler can be interpreted often determines whether adoption is feasible at all, and both Enterprise and Standalone ship with built-in build configurations for the IAR, Keil, TASKING, Renesas, TI, Microchip, and NXP toolchain families. Beyond detection, defects are managed through rule compliance rate (RCR) trends, and Smart Suggestion finds and recommends similar cases from past suppression records, reducing the burden of repeated assessments. Compiler enablement, rule set tuning, and guideline interpretation can be discussed in Korean through local technical support. The actual supported scope must be confirmed against your edition and product version.