DevOps setup guide

Parasoft C++test +
TI Arm Clang Compiler

MISRA C 2025 & Flow Analysis Setup Guide for DevOps

TI Arm Clang 5.1.0.LTS · Parasoft C++test Standard 2026.1.2 · MISRA C 2025

← Swipe to navigate →

Prerequisites

What You Need Before You Start

Item	Example
Parasoft C++test Standard installed	`C:\Projects\...\cpptest\`
TI Arm Clang compiler installed	`...\ti-cgt-armllvm_5.1.0.LTS\bin\tiarmclang.exe`
DTP / License Server running	`https://<dtp-host>:8443` (admin/admin)
Your C project source files	Any `.c`/`.h` project

tiarmclang.exe --version  →  "TI Arm Clang Compiler 5.1.0.LTS, Target: arm-ti-none-eabi"
Test-NetConnection -ComputerName <dtp-host> -Port 8443

Compiler strategy

TI Arm Clang is NOT on the Supported Compiler List

Parasoft C++test ships approximately 45 supported compiler configurations. tiarmclang is LLVM/Clang-based and is not one of them.

Config ID	Targets	Works with tiarmclang?
`tiarm_20_2`	Legacy TI armcl (EDG-based, uses `-fc=`, `-fr=`)	NO — wrong flag syntax
`tiarmgcc_7`	TI ARM GCC 7.x (GCC/Clang-style: `-c`, `-I`, `-std`)	YES — Clang accepts same flags

Solution: Use tiarmgcc_7 as the compiler family

Step 1

Configure License & DTP Settings

parasoft.eula.accepted=true
cpptest.license.use_network=true
cpptest.license.network.edition=server_compliance_edition
license.network.url=https://<dtp-host>:8443
license.network.use.specified.server=true
license.network.auth.enabled=true
license.network.user=admin
license.network.password=admin
dtp.url=https://<dtp-host>:8443
dtp.user=admin
dtp.password=admin
cpptest.configuration=builtin://MISRA C 2025
cpptest.compiler.family=tiarmgcc_7

For CI/CD, use a per-project localsettings.properties file instead.

Step 2

Scan Your Build with cpptestscan

cpptestscan intercepts compiler calls and records them into a .bdf file.

set CPPTEST_SCAN_OUTPUT_FILE=cpptestscan.bdf
set CPPTEST_SCAN_PROJECT_NAME=YourProject
set CPPTEST_SCAN_RUN_ORIG_CMD=0

cpptestscan.exe tiarmclang.exe -c -I. -std=c11 file1.c
cpptestscan.exe tiarmclang.exe -c -I. -std=c11 file2.c
cpptestscan.exe tiarmclang.exe -c -I. -std=c11 file3.c

For CMake projects, use compile_commands.json with the -compiler-commands flag instead.

Step 3

Run MISRA C 2025 Static Analysis

cpptestcli.exe ^
    -localsettings localsettings.properties ^
    -config "builtin://MISRA C 2025" ^
    -compiler tiarmgcc_7 ^
    -bdf cpptestscan.bdf ^
    -report report

Flag	Purpose
`-localsettings`	Per-project settings file
`-config`	Rule set (MISRA C 2025, CERT C, CWE, etc.)
`-compiler`	Compiler front-end config (`tiarmgcc_7`)
`-bdf`	Build Data File from cpptestscan
`-report`	Output directory for HTML/XML reports

Analysis pipeline

What Happens During the Run

License check — connects to DTP, validates all rule features
Scope collection — reads BDF, determines which files to analyze
Code Analysis — pattern-based static rules (fastest)
Flow Analysis — dataflow (null deref, buffer overflow, etc.)
Global Static Analysis — cross-translation-unit rules
Report generation — writes report.html and report.xml

Example output

Timer Project Results: 167 Violations

Count	Rule	Description
35	RULE_17_7-a	Unused function return value
26	RULE_7_4-a	String literal as non-const pointer
15	DIR_4_6-b	Standard integer type 'int' should not be used
15	RULE_17_3-a	Function called before prototype
10	RULE_8_2-c	Function not in prototype form
10	RULE_21_10-b	time.h functions not allowed
6	RULE_8_7-a	Referenced only in defining TU
5	RULE_2_8-c	Local variable declared but not used

30 distinct MISRA C 2025 rules triggered across 4 source files.

Flow Analysis

Flow Analysis Standard: Bug Detective

After MISRA C 2025 validated the compiler setup, we tested Flow Analysis Standard — Parasoft's interprocedural bug-detection engine — on a project with 13 C files containing intentionally seeded defects.

What Flow Analysis Does

Builds control-flow graphs across functions
Tracks taint from external inputs (console, file, socket)
Detects null deref, buffer overflow, resource leaks, division by zero, SQL injection, and more
Interprocedural: follows values through function calls

How We Ran It

cpptestcli.exe ^
  -localsettings localsettings.properties ^
  -config "builtin://Flow Analysis Standard" ^
  -compiler tiarmgcc_7 ^
  -bdf cpptestscan.bdf ^
  -report report

Same compiler config, same BDF approach — just a different analysis config.

Flow Analysis Results

Detection Matrix: 10 of 11 Defects Found (91%)

File	Expected Defect	Detected?	Rule(s)
`divisionByZero.c`	Division by zero	✅ Yes	BD-PB-ZERO
`bufferOverflow.c`	Buffer overflow	✅ Yes	BD-PB-OVERFWR, BD-SECURITY-OVERFWR
`arrayOutOfBounds.c`	Array out of bounds	✅ Yes	BD-PB-ARRAY, BD-SECURITY-ARRAY
`nullPointerDeref.c`	Null pointer deref	✅ Yes	BD-PB-NP (4 findings)
`memoryLeaks.c`	Memory leak	✅ Yes	BD-RES-LEAKS
`integerOverflow.c`	Integer overflow	✅ Yes	BD-SECURITY-INTOVERF
`sqlInjection.c`	SQL injection	✅ Yes	BD-SECURITY-TDSQL
`unreachableCode.c`	Unreachable code	✅ Yes	BD-PB-CC, BD-PB-SWITCH
`useBeforeInit.c`	Use before init	✅ Yes	BD-PB-NOTINIT
`nullPointerDerefBenchmark.c`	Benchmark (TP + FP)	✅ 3 TP, 0 FP	BD-PB-NP
`fileLeaks.c`	File/resource leak	⚠️ Partial	Other issues found, leak missed

41 total violations across 13 files. The file leak in fileLeaks.c (fclose commented out) was not flagged with BD-RES-LEAKS, likely because the file handle flows through an interprocedural helper.

Flow Analysis Deep Dive

What the Bug Detective Caught

🏆 Top Detections

Division by zero — found both instances (struct field and function parameter)
SQL injection — traced file input → fread → sprintf → SQLExecDirect (taint tracking)
Integer overflow — detected socket-controlled length used in arithmetic
Null pointer deref — 7 findings, including interprocedural paths through helper1() and helper2()
Buffer overflow — both definite (1000 bytes into 999) and possible (arbitrary length)
Unreachable code — 6 findings: always-true/false conditions + unreachable switch case

🎯 Benchmark Accuracy

nullPointerDerefBenchmark.c has 6 "noFalseViolation" functions that should NOT trigger
Flow Analysis produced 0 false positives on these
All 3 findings were on intentionally buggy paths (trueViolation, functionCall_trueViolation1/2)
This validates the precision of the interprocedural null-tracking engine

41 violations · 19 distinct rules · 13 files analyzed · 0 setup problems · 0 preprocessing errors

Automation

Integrate into Your CI/CD Pipeline

Jenkins

bat "cpptestcli -localsettings ... -compiler tiarmgcc_7 -bdf ... -report ... -fail"
publishHTML(target: [reportDir: 'report', reportFiles: 'report.html'])

Azure DevOps

- task: CmdLine@2
  script: cpptestcli -localsettings ... -compiler tiarmgcc_7 -bdf ... -report ... -fail
- task: PublishBuildArtifacts@1

GitHub Actions

- run: cpptestcli -localsettings ... -compiler tiarmgcc_7 -bdf ... -report ... -fail
- uses: actions/upload-artifact@v4
  with: { name: parasoft-report, path: report/ }

Team visibility

Publish Results to DTP for Team Dashboards

report.dtp.publish=true
dtp.project=YourProjectName
build.id=YourProjectName-${time:yyyy-MM-dd}

✓ Track violation trends over time

✓ Filter by rule, severity, author, file

✓ Set quality gates and compliance policies

✓ Generate compliance reports for audits

Diagnostics

Troubleshooting

Problem	Fix
License activation failed	Set `edition=server_compliance_edition`
EULA not accepted	Set `parasoft.eula.accepted=true`
DTP services not found	Check `dtp.url` and context path
Compiler crash/hang	Use `tiarmgcc_7`, NOT `tiarm_20_2`
Missing files in analysis	Re-scan with cpptestscan, check BDF
Preprocessor errors	Pass exact `-I` and `-D` flags from your build
0 violations in report	Check BDF has entries, verify file paths

Implementation plan

Checklist: Adapt for Your Project

Verify your TI compiler path → tiarmclang.exe --version
Verify your DTP server URL → Test-NetConnection
Create localsettings.properties with your DTP host/user/password
Scan your build → cpptestscan for each source file with real flags
Set your project name → CPPTEST_SCAN_PROJECT_NAME
Run the analysis → cpptestcli -compiler tiarmgcc_7 -bdf ... -report ...
Choose your rule set → MISRA C 2025, CERT C, CWE Top 25, etc.
Wire into CI → Jenkins, Azure DevOps, or GitHub Actions

Summary

Key Takeaways

1. TI Arm Clang is NOT on Parasoft's supported list → use tiarmgcc_7 (GCC/Clang-style)

2. cpptestscan intercepts your build to create the BDF → use exact compiler flags

3. One command runs all three analysis engines → static, flow, global

4. Reports in HTML + XML → publish to DTP or CI artifacts

5. Flow Analysis found 10/11 seeded defects (91%) with 0 false positives on benchmarks

6. Same setup works for both MISRA C 2025 and Flow Analysis — just change -config

Questions? Check the full guide in the project repository.

Build machine

Files on the Build Machine

cpptest\
├── cpptestcli.properties              ← global config
└── your-project\
    ├── localsettings.properties       ← per-project settings
    ├── cpptestscan.bdf                ← build data file
    ├── run_misra_analysis.bat         ← convenience script
    └── report\
        ├── report.html                ← human-readable report
        └── report.xml                 ← machine-readable report

Parasoft C++test +TI Arm Clang Compiler

What You Need Before You Start

TI Arm Clang is NOT on the Supported Compiler List

Configure License & DTP Settings

Scan Your Build with cpptestscan

Run MISRA C 2025 Static Analysis

What Happens During the Run

Timer Project Results: 167 Violations

Flow Analysis Standard: Bug Detective

What Flow Analysis Does

How We Ran It

Detection Matrix: 10 of 11 Defects Found (91%)

What the Bug Detective Caught

🏆 Top Detections

🎯 Benchmark Accuracy

Integrate into Your CI/CD Pipeline

Jenkins

Azure DevOps

GitHub Actions

Publish Results to DTP for Team Dashboards

Troubleshooting

Checklist: Adapt for Your Project

Key Takeaways

Files on the Build Machine

Parasoft C++test +
TI Arm Clang Compiler