Tool specific news: Company
Testwell CMT++/CMTJava
Testwell CTC++
GrammaTech CodeSonar
CodeSentry
Imagix
Events/Seminars
ALL NEWS

CodeSonar 5.2 with Static Application Security Testing (SAST) Available
(Ithaca/New York/USA, Offenburg/Germany, 19 December 2019)
Version 5.2 of GrammaTech CodeSonar is now available for download. The new version of the Static Analysis Tools expands software teams' abilities to perform best-in-class Static Application Security Testing (SAST) across embedded and enterprise customers.
CodeSonar now supports AUTOSAR C++14, the latest C++ coding guidelines from AUTOSAR. With MISRA compliance included in previous releases, the addition of AUTOSAR support now sets CodeSonar at the forefront of the MISRA/AUTOSAR merging of standards.
The release of CodeSonar 5.2 also includes improved compiler support and open standards.
CodeSonar 5.2 continues its tight integration with JuliaSoft by supporting the latest release of the Julia engine, which provides high recall, high precision detection of security vulnerabilities in Java and C#.
Additionally, GrammaTech is expanding support for CodeSonar for Binaries.
The update is available as a free upgrade to eligible customers under active support and maintenance contracts. A 30-day trial of CodeSonar 5.2 is also available.

Verifysoft assigns Advalange as Distributor for Testwell Tools in Russia
(Moscow/Russia, Offenburg/Germany, 16 December 2019)
ADVALANGE is a leading, efficient and experienced software developer. The team of Advalange is excellent in different stacks of software technologies along with a profound understanding of applicable standards. They are specialized in software for safety-critical and mission critical systems including, amongst other things, automotive, aviation and aerospace, medical and laboratory equipment.
The synergy of high-end technologies and instruments onboard, flexible management and organizational structure add up to every project success. We are confident that our shared experiences can make the world safer, that’s why we look forward to a productive and good partnership!
more information here

Free Webinar: What is New in CodeSonar 5.2?
Tuesday, December 17, 11am EST (17:00 Uhr CET, Berlin, Wien, Zürich) and 8pm EST (02:00 Uhr CET, Berlin, Wien, Zürich)
CodeSonar has been the preferred static analysis solution for software development teams building safety and security critical software built in C and C++. In recent releases CodeSonar has been expanding its language coverage through the use of open standards and it has added support for Java, C#, Objective C and C++, Python as well as JavaScript to its arsenal.
This expansion expands the domain in which CodeSonar can help software teams perform Static Application Security Testing (SAST). Software teams from embedded to enterprise domains can use CodeSonar to improve the quality and security of their software.
In this webinar, we will present the new features of CodeSonar 5.2, then use a variety of different projects to demonstrate CodeSonar’s deep static analysis capability on the crazyflie quadcopter by BitCraze, on GnuChess, a desktop application in C/C++, an IoT Edge application as well as some additional code in Python and JavaScript.
We will use Docker to run CodeSonar on these applications and view the warnings in both CodeSonar’s web GUI and visualization tool as well as in Microsoft Visual Code.

Embraer is using Testwell CTC++ to accomplish the objectives of DO-178C DAL A
(São José dos Campo/Brazil, Offenburg/Germany, 3 November 2019)
"Testwell CTC++ automates the code instrumentation as well as the evaluation of the structural coverage results in a neat report. Thus the user sees where he has to increment our tests in order to cover the whole code base. Embraer has integrated Testwell CTC++ in the continuous verification flow", says Joao Carlos Davison, responsible for the elaboration of the software verification plan.
Mateus Lucas Alves Ferreira, product development engineer of Embraer expresses that Testwell CTC++ installation is straightforward and the tool usage is based on a command-line interface that is simple and easy to learn.
Read full Customer Testimonial here

Imagix 4D: Version 9.2 Available
(San Luis Obispo/USA, Offenburg/Germany, 30 October 2019)
It is available on Windows as well as Linux (both 32-bit and 64-bit).
Version 9.2 of Imagix 4D considerably extends the data flow analysis in reports and with data flow diagrams. These are powerful tools for pointer tracking and change analysis in projects. Sequence diagrams as an enhanced version of control flow graphs are now available in Imagix 4D.
Source code analysis is extended to the latest versions of MSVC 2019 and GCC 9 with features from C++14 and C++17. The review tool now supports the latest Common Weakness Enumeration (CWE) 3.3 checklist.
Learn more

Verifysoft also in 2019 very successful: previous record sales of 2018 are already exceeded in September.
(Offenburg, 25 October 2019)
Software quality has no limits: Test technologies from Verifysoft are currently in use at more than 600 customers in more than 38 countries. In order to meet rising demand, we recently hired a number of other sales and technical support staff.
There are still vacancies in support. Become part of our team here.

Imagix 4D podcast: Software developer Anna has got a problem
(Offenburg, 15 October 2019)
Then Anna comes across the tool Imagix 4D, which determines the actual state of software based on the source code. Through the generated graphs, documentation and reports, Anna quickly identifies the causes of the errors and can fix them more easily than expected. Anna immediately informs her customers, who are more than relieved...
Watch the video now

GrammaTech honours Verifysoft for the "Top Overall Deal" in Fiscal Year 2019
(Ithaca/New York/USA, 10 October 2019)
Verifysoft sets another milestone in the history of the longstanding cooperation with GrammaTech, which is on persistent growth since the beginning of their cooperation in 2013. GrammaTech´s static code analysis tool CodeSonar is successfully used by many customers in german speaking countries, among other things at leading car manufacturers, but also in a lot of other sectors like medical care, aerospace and defending or the agricultural engineering technology to improve their quality management.

How Imagix 4D supports the understanding of software based on source code
(Offenburg/Germany, 25 September 2019)
This work will show how Imagix 4D improves the process of exploring and understanding unfamiliar source code. An introduction into why and where such a process is required will be followed by a description of the methods Imagix 4D introduces to support such source code analysis.
Read the white paper here

GrammaTechs webinars in autumn
(Ithaca/New York/USA, Offenburg/Germany, 15 August 2019)
Wednesday, September 25, 10:00 am EST, 04:00 pm CEST
In this webinar, GrammaTech will share how combining model driven analytical software development with static analysis provides the means to handle the increase in complexity and rapidly build robust, reliable and resilient cyber-physical systems based on strong foundations. Register here
Applying Aviation Cyber-Security via DO-326A / ED-202A
Wednesday, October 3, 12:00 pm EST, 06:00 pm CEST
This 1-Hour Technical Training webinar provides the basic info necessary to start planning your Aviation Cyber-Security needs to meed the year-end 2019 mandates. The new DO-326A (ED-202A), DO-355, DO-356 et al ecosystem is non-trivial but affects virtually everyone involved with aviation development and deployment. This AFuzion / Grammatech webinar prepares YOU to begin preparing TODAY for TOMORROW's threats, and mandates. Register here

Free Webinar: Preparing for ISO 26262 Version 2
(Ithaca/New York/USA, Offenburg/Germany, 13 August 2019)
Date: Tuesday, 13th August 2019, 06:00 pm CEST, 11:00 am EST
Register here
GrammaTech CodeSonar 5.1 Available
(Ithaca/New York/USA, Offenburg/Germany, 21 June 2019)
Grammatech has released version 5.1 of the static code analysis tool CodeSonar. The new version has the following new features and enhancements:
- CodeSonar now integrates with the static analysis tool named Julia for the analysis of Java and C#
- Support of SARIF (SARIF is a new standard for representing the results of static analysis tools. As the standard has not been finalized yet, CodeSonar supports importing and exporting the 11/28 version. This is compatible with the version of SARIF exported by the Clang Static Analyzer.
- Pylint Integration: CodeSonar now integrates with Pylint through SARIF. Warnings generated by Pylint can be imported into the CodeSonar user interface and managed just like other warnings.
- HTML 5 Visualization: There is a new interface for browsing call trees, invokable from the info window. This functionality will be extended in future releases to replace the old Java-based visualization applet.
- Enhanced Return Code Checking: The return code checker now covers many more functions than previously, covering libraries such as Qt, the GNU C Library, OpenSSL, the GLib GNOME Library, libPNG, and several others.
- C++-17 Support: CodeSonar now has better compatibility with C++-17, as is used by newer
- Decompiler for Intel 64-bit: The decompiler in CodeSonar for binaries can now show code decompiled from the Intel-64 instruction set architecture.
GrammaTech participates in the MISRA Committee / Merging of the MISRA C++ and AUTOSAR C++ Guidelines
(Ithaca/New York, Offenburg/Germany, 21 June 2019)
The MISRA Consortium recently announced the merger of MISRA C++ 2008 and AUTOSAR C++14 into a common guideline. This is positive news since it combines two key standards for coding in C++.
Verifysoft’s partner GrammaTech is an active participant in the MISRA committee and is collaborating in merging these standards.
GrammaTech’s Vice President of Engineering Paul Anderson is now an official member of the MISRA committee and will be working with the other members to develop new versions of the MISRA standards. Learn more about MISRA C++ 2008 and AUTOSAR C++14 merger

zepp.solutions uses Testwell CTC++ to fulfill the requirements of IEC 61508
(Delft/Netherlands, Offenburg/Germany, 10 May 2019)
"One of the requirements from IEC 61508 SIL 2 is to achieve 100% decision coverage. In order to verify this requirement, the coverage needs to be measured. We chose for Testwell CTC++ to do the job. (...) The flexibility of Testwell CTC++ allows it to be used not only for target tests, but also for host tests, as multiple compilers are easily supported."
>Read full Customer Testimonial here

Recorded Webinar: "Code Coverage for safety-critical embedded targets"
(Offenburg/ Germany, 8 May 2019)
Errors in embedded software can be life-threatening. With no margin for errors, it is critical that your software development adopts a rigorous approach to compliance. This webinar will give you information about Safety Standards and Code Coverage on embedded targets.
Specialists from Verifysoft will take you through Testwell CTC++ to demonstrate how to face up to the challenges of ensuring Code Coverage:
- What is Code Coverage and why measure it?
- Code Coverage Levels and Safety Standards
- How to measure Code Coverage?
- Testwell CTC++ Test Coverage Analyse
- Tool Qualification for ISO 26262
- Platforms, Integrations and Customers
- The Code Coverage Solutions for Embedded Projects in Automotive Industry
Have a look at our recorded webinar here
You can also register to our next webinar

Free Webinar "Refactoring using Imagix 4D" on Tuesday, 7th of May 2019
Sometimes it pays off to perform refactoring of legacy code. In that case the program has potential to be reused in the latest projects. Thereby the code is revised towards an improved maintainability and extensibility while keeping its functionality. Imagix 4D is the ideal tool to assist you in performing the refactoring process. A comprehensive and well-arranged visualization of the existing architecture facilitates achieving a fast understanding of component interaction. Modifications can be performed smoothly.
Find out, how Imagix 4D can help to support with refactoring in our free webinar "Refactoring using Imagix 4D" on Tuesday, 7th of May 2019.

User Testimonial: Exonetik Canada chooses Testwell CTC++ for Aviation Sector
(Sherbrooke/Kanada, Offenburg, 9. April 2019)
Exonetik joins 600+ satisfied customer in 38 countries on all continents. >Read full Customer Testimonial here

Verifysoft expands Distributor Network in China
(Beijing/China, Offenburg/Germany, 5 April 2019)
Due to the increasing demand in the Chinese market, QTronic China will be a further distributor in addition to Beijing Siener Electronics.
More information: Verifysoft distributors

Architectgroup becomes SLEXN Inc.
(Seoul/Republic of Korea (ROK), Offenburg/Germany, 4 April 2019)
Having started as a software-based consulting company, SLEXN Inc. became a supplier of technical services and tools in various areas. They create an individual IT infrastructure based on the demands of the customer. SLXN Inc. always provides long lasting professional solutions rather than just a strategic advice. They implement concrete strategies and technologies to obtain a high value within the new environment of the client with a clear view towards future developments.
Elvior has released TestCast T3 version 6.14.1
(Tallinn/Estonia, Offenburg/Germany, 26 March 2019)
Elvior has released a new version of the test execution tool TestCast with the following features:
- TTCN-3:2019 support (ES 201 873-1 4.11.1, ES 201 873-6 4.11.1, ES 201 873-9 4.10.1)
- Faster start of execution of scripts that are already loaded in the memory
- TCI-TL: tliVar support
- Support of CDATA in XML codec
- Configurable timeout of synchronous TCI call initiated by a remote interface implementation (TRI, TCI)
- Minor changes in the way how critical test environment errors (such as TRI connection termination) are reported and presented to the user
Improvements and bug fixes: - Incorrect namespace search used for processing parameterized types
- Several issues with jumping to a log or source code line from session reports
- Issue with resolving variant attributes when the encoding attribute has changed
- Run-time crash occurring during resolution of module parameters
- Synchronized TLI calls were not properly finalized when exiting the testing mode
- Deadlock occurring in some cases when TRI returns TriError
- Error in processing TRI broadcast reply in java lib
- Missing connection acceptance checks for TCI-CD and TCI-TL over TCP/IP
- Autocomplete didn’t correctly display options for function calls (starting from the 2nd parameter)
Release of Testwell CMT++ Version 7.0 and CMTJava 4.0
(Offenburg/Germany, 25 March 2019)
Verifysoft releases the new versions of the tools Testwell CMT++ 7.0 and Testwell CMTJava 4.0 with some bug-fixes. As a new feature, reports can now be generated in JSON format. After installation, the detailed list of changes can be found in version.txt..
Further information: Testwell CMT++ 7.0 and Testwell CMTJava 4.0.
Further information: Testwell CMT++ 7.0 and Testwell CMTJava 4.0.

“Testwell CTC++ generates clear and easy-to-analyze Code coverage reports”: New Testwell CTC++ customer testimonial from the automotive industry (NPP ITELMA LLC, Russia)
(Offenburg/Germany, Moscow/Russia, 20 March 2019)
In the process of software development, the company adheres to the V-cycle, which is the de facto standard in the automotive industry. One of the most important stages of the V-cycle is unit testing of software. Without a tool analyzing code coverage tests, it is difficult or even impossible to assess how fully the unit testing has been completed.
After trying many different tools for Code Coverage analyzation, NPP ITELMA selected Testwell CTC++. “It is very simple to use, and at the same time very fast and efficient”, says Mr. Dolozov.
In the following Customer Testimonial Mr. Dolozov explains the advantages of Testwell CTC++. "The tool generates clear and easy-to-analyze coverage reports and in addition, can be used to certify safety-critical projects, which is an important criterion for choosing a tool for automotive applications. With the help of Testwell CTC++, we found many uncovered sections of code and conditions".
“The missing tests were written in time, which allowed to detect many errors in the early stages of development. As a result, the overall quality of the firmware has improved significantly. The Testwell CTC++ tool thus took its honored place in our V-development cycle”. >Read full Customer Testimonial here

Deep Static Analysis Everywhere: Transferring the lessons learned from safety and security critical software to other software domains - Webinar 9th May, 10:30am
(Offenburg/Germany, Verona/Italy, 19 March 2019)
Learn how demands on static analyzing tools have been changed due to increasing dispersion of IoT and rise of cybersecurity issues (e.g. SQL Injection). The webinar outlines, in which phases of the development cycle a tool based static analysis may improve your software’s security. Moreover it will point out how semantic analyzers, in comparison to syntactic ones, are capable to discover more complex vulnerabilities. On the basis of examples will be demonstrated how possible SQL injections can be uncovered by using Julia Static Code Analyzer. Julia Static Code Analyzers.
Further information and registration

Embedded World 2019: Safety und Security for Embedded Software with Tools from Verifysoft Technology
(Nuremberg/Germany, 28 February 2019)
Verifysoft Technology participated in the Embedded World 2019, for the 15th time in its 16 years of company history. Due to increasing connectivity, safety and security become a pressing issue in the embedded environment.
Our Code Coverage Analyser Testwell CTC++ is mostly used for safety reasons but can also be deployed for security. In this area the tool is being used for Penetration-Tests in order to prove that code is not being executed through hacker attacks. In contrast to the traditional usage of code coverage, the objective during penetration testing is that no code is being processed. Attacked parts of code can be identified precisely due to coverage analysis. This simplifies the detection of safety gaps.
The new connectivity that comes with the internet of things bears new challenges. Embedded Software, usually written in C or C++, is traditionally classified as safety critical, but the same is now true for connected software that is written in Java or C#.
To make it possible that this software can be tested as well, Verifysoft and Grammatech formed a partnership with JuliaSoft. The Julia Static Analyzer tool offers semantic static analysis of enterprise software in Java and C#.
The integration of the Julia Static Analyzer into GrammaTech CodeSonar provides a complete and integrated solution for improving the quality of these “Embedded software”, hardware and enterprise programming domains.
Further information here / Watch our video here

Webinar with ARM and Wind River "Automotive Safety from the Ground Up: Hardware, OS and Static Analysis"
(Offenburg, 18 February 2019)
There are various software systems in a car, each with different security and safety requirements. In the webinar ARM, Wind River and GrammaTech highlight the capabilities on offer that help to build complex safety critical software systems.
ARM provides an overview on how their IP portfolio and the Arm Safety Ready Program enable customers to achieve functional safety. Wind River covers their operating system layer and how VxWorks works. This scalable, safety certified real-time operating system can provide OS features and flexibilities such as virtualization, in safety certifiable configurations.
Finally GrammaTech outlines how CodeSonar’s static analysis for source and binary helps write secure software. Furthermore, the section provides an overview on how the Tool Safety Manual, generated by CodeSonar’s Qualification Kit, guides users of static analysis in their safety argumentation.
Read the full article here.

Real World Benchmark for Static Code Analysis Tools
(Ithaca/New York, Offenburg, 4 February 2019)
Software development and quality managers that are looking to measure the benefit of static analysis can now use BugInjector, a tool that can inject Common Weakness Enumeration (CWE) based bug patterns into existing code bases, thus delivering real-world benchmarks. This independent real-world benchmarks have been created by GrammaTech under contract for the Department of Homeland Security (DHS) Science and Technology Directorate (S&T) and are now available in the Software Assurance Marketplace (SWAMP) at no cost.
"There is an urgent need for benchmarks, such as those from GrammaTech, to allow software developers to evaluate static analysis tools in a comprehensive and real-world setting," says Barton Miller, Professor of Computer Sciences at the University of Wisconsin – Madison and Chief Scientist of SWAMP. "Also, developers of static analysis tools now have the ability to enhance their tools or benchmark new static analysis technologies with realistic test cases. Integrating these benchmarks into the SWAMP platform increases their effectiveness and availability."
Read the post here.

New GrammaTech Blog Posts
(Ithaca/New York, Offenburg/Germany, 24 January 2019)
The Role of Static Application Security Tools (SAST) in DevSecOps is an article which explains the role of static application security tools (SAST) such as GrammaTech CodeSonar and how they can be used in Dev(Sec)Ops and continuous development pipelines to improve quality and security.
Read the post here.
An other GrammaTech post with the title How Does the OWASP Top 10 Apply to C/C++ Development? shows a top ten list of the most critical web application security risks and how static code analysis helps to avoid this risks.
Read the post here.

Joint Webinar of Samsung and Verifysoft: "Make Unit Testing and Code Coverage part of your Continuous Integration Flow"
While there's no silver bullet in code coverage, the findings from various organizations reveal that increasing code coverage decreases field related defects and increases a high level of confidence in the quality of the code that is being deployed. Find out why many of these organizations from various industry verticals have set up a Continuous Integration/Continuous Development pipeline using an industry leading commercial code coverage solution Testwell CTC++ as a crucial metric for test effectiveness.
Dedicated to Software Quality, Testwell CTC++ fits into current DevOps tool chains driving more value in the Continuous Integration environment. Join Sasikumar Sathasivam, Group Head, Samsung Research Institute Bangalore, on 29 January 2019 at 9:30 h German/French time / 2:00 PM Indian Standard Time for our live webinar "Make unit testing and code coverage part of your continuous integration flow", as he talks about how the world’s largest consumer electronics giant uses code coverage as measure of quality to test the mobile devices and mobile applications used by billions of people worldwide.
This webinar will cover:
Need for Code Coverage as part of your Continuous Integration (CI) Pipeline
How Code Coverage was deployed in one of the most challenging build/development environments
Metrics Management: Code Coverage as tool for giving management visibility into the quality of code being delivered
ROI benefits of Code Coverage
To register visit: https://attendee.gotowebinar.com/register/7538807369714742273

DARPA Awards GrammaTech $8.4M USD for Autonomous Cyber Hardening Technology
(Ithaca/New York, January 2019)
GrammaTech announced that it has been awarded a $8.4 million USD, 4-year contract from Defense Advanced Research Projects Agency (DARPA), an agency of the U.S. Department of Defense, to develop technology that generates and deploys secure configurations to commercial off-the-shelf (COTS) equipment rapidly and largely autonomously.
Read the full article here.

Verifysoft cooperates with JuliaSoft for Support and Sales of Julia Static Analyzer for Java, Android and .Net Code
(Offenburg/Germany, Verona/Italy, 14 January 2019)
Verifysoft cooperates with JuliaSoft for support and sales of Julia, a static analyzer for Java, Android and .Net code.
Julia helps clients to guarantee their application security and quality by providing them with the best possible solutions for in-depth analysis of software. The uniqueness of Juliasoft’s core technology results in a particularly deep and accurate analysis of Java, Android and .Net code, as demonstrated by open, repeatable comparisons (see OWASP Benchmark). A profound understanding of the scientific principles at the base of the technology and an internal research team guarantee that JuliaSoft's solutions always keep at the forefront of innovation.
JuliaSoft was founded in 2010 as a spin-off of the University of Verona (Italy). Since June 2015 JuliaSoft is part of Corvallis Group, one of the top Italian IT service companies.
Verifysoft will distribute Julia in German speaking countries.

Verifysoft achieves 2018 best Sales Performance Ever
(Offenburg/Germany, 11 January 2019)
After sales records in 2016 and 2017, Verifysoft Technology achieved also in 2018 an increase of it's sales.
"The demand for good software quality assurance tools continues to be very high. In addition to product safety, the security of software becomes more and more important. Internet of Things and Industry 4.0 have high security needs, which can only be guaranteed by using appropriate tools", says Klaus Lambertz, CEO and founder of Verifysoft. "Within the next few weeks we will reach the number of 600 customers. Our tools are already used in 37 countries on all continents."
We are currently looking for new team menbers, expecially for pre-sales and technical support: job offers.