News

Shift-Left Embedded Software Quality: Finding Defects Before Testing
In embedded software development, defects discovered during integration, system testing, or field validation often become significantly more expensive to resolve than those identified during implementation. Industry studies suggest that fixing defects late in the development lifecycle can cost 10 to 100 times more than addressing them earlier, resulting in increased debugging effort, delayed releases, and higher project risk. Unlike traditional software applications, embedded systems introduce additional complexity through hardware interactions, real-time constraints, communication protocols, and safety requirements. For example, a runtime defect identified during hardware integration may require extensive debugging across software, drivers, and target hardware, whereas the same issue discovered during development can often be resolved much more efficiently. This is why many engineering organizations are adopting a shift-left approach to software quality. Shift-left development focuses on moving verification activities earlier in the development process, allowing teams to identify and resolve issues before they reach integration and system validation stages. A practical shift-left strategy for embedded software combines coding standards enforcement, static analysis, and automated unit testing. Using QA·MISRA, development teams can automatically enforce MISRA coding guidelines during implementation, helping improve code quality and reduce reliance on manual code reviews. With Astrée, engineers can perform deep static analysis to identify potential runtime issues such as arithmetic overflows, invalid memory accesses, and uninitialized variables without requiring execution on target hardware. Finally, Cantata enables automated unit testing, code coverage analysis, and early validation of software behavior before full system integration begins. A modern embedded verification workflow may therefore follow this sequence: Develop → QA MISRA → Astrée → Cantata → Integration Testing → System Testing By introducing verification activities earlier in the development lifecycle, embedded teams can reduce defect escape rates, shorten debugging cycles, improve software reliability, and increase confidence in project schedules and product releases. Rather than treating quality as a final-stage activity, shift-left development transforms software verification into a continuous engineering practice. To learn more about our embedded software quality solutions, please contact Hrutik Champaneri at hrutik.champaneri@joraltechnologies.com Register HERE for our upcoming webinar to see Astrée static analysis integrated directly into Visual Studio Code.
Learn more
VS Code and the Modern Embedded Workflow
Visual Studio Code has become a preferred development environment for many embedded software teams thanks to its flexibility, lightweight design, and extensive extension ecosystem. However, as embedded projects grow in complexity, writing code is only part of the challenge. Teams must also ensure software quality, compliance, test coverage, and verification while still meeting aggressive release schedules. The challenge is that many of these activities are still performed later in the development lifecycle, where defects become significantly more expensive to resolve. Industry studies have shown that software defects discovered during integration or system testing can cost up to 10x more to fix than those identified during development. For this reason, many organizations are shifting verification activities earlier in the software lifecycle to reduce project risk, improve quality, and avoid costly rework. Rather than forcing developers to abandon their preferred development environment, a modern VS Code-based workflow allows quality and verification activities to be integrated directly into day-to-day development. Developers can use Keil MDK to build and debug Arm Cortex-M applications while continuing to work within a familiar VS Code environment. Powered by Arm Compiler and the CMSIS ecosystem, Keil MDK provides optimized code generation, comprehensive device support, and advanced debugging capabilities specifically designed for Arm-based systems. This enables teams to accelerate development while building on a trusted toolchain widely used across safety, industrial, automotive, and IoT applications. Coding standards compliance is often another source of engineering effort, particularly for projects operating under safety, security, or regulatory requirements. QA MISRA helps identify coding standard violations as code is written, allowing issues to be corrected before formal reviews begin. Organizations that introduce coding standards verification earlier in development often report reduced review effort, improved code consistency, and fewer compliance related surprises during audits and certification activities. With the QA·MISRA extension integrated directly into VS Code, developers can identify violations and receive feedback within the editor, helping them address issues before they become larger development or compliance challenges. Static analysis provides another opportunity to identify defects before they become schedule impacting problems. AbsInt Astrée analysis tools help detect runtime anomalies, stack usage concerns, and software defects before code reaches target hardware. Finding issues during development rather than during integration testing can substantially reduce debugging effort while improving software reliability and reducing verification risk. Similar to QA MISRA, Astrée integrates with VS Code and highlights analysis results directly within the development environment, enabling engineers to identify and resolve issues earlier in the software lifecycle. Verification through testing remains equally important. QA Systems Cantata enables automated unit and integration testing for C and C++ applications, helping teams continuously verify functionality throughout development. Studies have shown that automated testing can reduce manual test execution effort by 30–50% while improving repeatability, coverage, and traceability. For organizations operating in regulated industries, automated testing also helps generate evidence required for standards such as ISO 26262, IEC 61508, IEC 62304, and DO-178C. With Cantata's VS Code integration, developers can generate test cases, execute tests, and review code coverage directly within their development environment, helping teams build quality into the software lifecycle from the start. Modern development workflows increasingly rely on CI/CD pipelines to improve efficiency, consistency, and software quality. VS Code integrates seamlessly with source control and automation platforms, making it easier to manage branches, reviews, builds, testing, and deployments. When combined with tools such as Keil MDK, QA·MISRA, AbsInt, and Cantata, teams can automate quality checks, compliance verification, static analysis, compilation, and testing throughout the development lifecycle. This unified workflow improves traceability, strengthens collaboration between development and quality teams, and helps identify issues earlier, reducing the risk of costly late-stage defects while providing greater confidence that software meets quality, security, and compliance requirements before release. Together, VS Code, Keil MDK, QA MISRA, AbsInt, and Cantata support multiple stages of the embedded software V-model from implementation and debugging through compliance, static analysis, testing, and verification. The result is not simply better tooling, but a more predictable development process, fewer escaped defects, reduced rework, and higher confidence in software quality before release. Interested in learning how these tools can fit into your development workflow? Reach out to Hrutik Champaneri at hrutik.champaneri@joraltechnologies.com to discuss your project requirements, compliance goals, or embedded software development challenges. Explore our VS Code Ecosystem page to discover tools for embedded development, static analysis, MISRA compliance, automated testing, and CI/CD integration, all within a modern VS Code workflow.
Learn more
Virtual Hardware for Modern Embedded Software Workflows
Embedded Software development has traditionally relied on access to physical hardware. While development boards and prototype remain essential, they can also create bottlenecks when hardware availability is limited, teams are distributed across locations, or multiple engineers need access to same platform. These challenges can slow development, testing, and debugging activities, particularly during the early stages of project when rapid iteration is critical. Virtual hardware platforms are helping engineering teams overcome many of these challenges by providing software-accessible representations of physical devices. Solutions such as Arm Virtual Hardware (AVH) allow developers to begin software development, testing, and validation before physical hardware is available. By enabling scalable, cloud-based execution environments, virtual platforms support modern development practices such as continuous integration, automated testing, and remote collaboration while reducing dependence on limited hardware resources. Corellium builds on the concept of virtual hardware by providing Arm-based virtual platforms that support embedded software development, testing, debugging, and validation workflows. By giving developers on-demand access to virtual target platforms, teams can begin software development earlier and avoid delays caused by limited hardware availability. Virtual platforms can also simplify testing by making it easier to run repeatable test scenarios, perform regression testing, and integrate automated validation into CI/CD pipelines. Developers can currently explore supported platforms including Raspberry Pi 4, NXP i.MX 93, NXP i.MX 8M, and the STM32U5 IoT Discovery Kit, providing a practical way to evaluate virtual hardware workflows on widely used Arm-based devices. This flexibility allows development and testing activities to scale more easily while helping teams maintain consistency across projects and locations. As embedded systems continue to grow in complexity, development teams are looking for ways to improve efficiency without compromising quality. Virtual hardware is increasingly becoming a valuable complement to physical devices, helping teams start software development sooner, test more effectively, and support distributed engineering workflows. Platforms such as Corellium make it possible to reduce dependence on hardware availability, allowing engineers to spend more time developing and validating software and less time waiting for access to target platforms. Published by Hrutik Champaneri | Joral TechnologiesFor more information about Corellium and virtual hardware solutions, contact hrutik.champaneri@joraltechnologies.com Learn how virtual hardware can accelerate embedded software development in our on-demand webinar:
Learn more
AI-Powered Verification for Embedded Software: Reducing Testing Effort by 50%
For many embedded software teams, writing code is no longer the biggest challenge. Verification, validation, traceability, compliance, and maintaining test cases often consume more engineering effort than development itself. As systems become more complex and standards such as ISO 26262, DO-178C, IEC 61508, and EN 50128 grow increasingly demanding, verification activities can account for up to 50% of overall development effort in safety-critical projects. This is where Developair takes a different approach. Using AI-assisted verification and validation, Developair helps teams standardize requirements, address gaps, establish traceability, and automatically generate test artifacts. By reducing repetitive manual tasks, engineering teams can improve coverage, maintain consistency, and spend less time managing tests and documentation. Working directly from requirements and specifications, Developair connects requirements, test cases, and verification activities into a streamlined workflow. This helps reduce the risk of missed coverage, simplifies compliance efforts, and accelerates development cycles. For organizations looking to improve software quality while reducing verification costs, AI-assisted validation provides a practical and scalable path forward. As embedded systems continue to evolve, verification is becoming one of the largest bottlenecks in software development. Tools from Developair are helping organizations modernize this process by bringing automation, intelligence, and scalability to activities that have traditionally required extensive manual effort. Interested in learning how Developair can support your verification and validation workflow? Know More About Developair Solutions Learn more about Developair and how AI-powered verification and validation can support your development process. To learn more, contact hrutik.champaneri@joraltechnologies.com. Check Out a Demo Video of the Tool Below
Learn more
Understanding KEIL MDK User-Based Licensing (UBL) and Its Benefits
Perpetual licenses have been a trusted option for Keil MDK users for many years. However, as development environments become more connected and automated, Keil MDK User-Based Licensing (UBL) offers additional flexibility for modern development teams. Why consider UBL? User-based access – Licenses are assigned to users rather than individual machines, making it easier to work across multiple approved systems. Supports modern development workflows – Integrates well with CI/CD pipelines, automated build environments, and distributed development teams using Keil MDK. Designed for VS Code and modern IDE workflows – Enables engineers to take advantage of today's development ecosystem, including VS Code extensions, AI-assisted coding tools, and productivity-enhancing integrations while continuing to use Keil development tools. Simplified license management – Provides administrators with greater visibility and control over license allocation and usage across engineering teams. Access to the latest Arm tools – Includes current Arm development tools such as Arm Compiler for Embedded (Arm Compiler 6), along with ongoing updates and enhancements. Legacy toolchain support – UBL Professional also provides access to older Arm toolchains when maintaining existing products and long-term projects. Perpetual licenses remain a valid option for many projects, but for organizations adopting modern development practices, Keil MDK UBL offers a flexible licensing model aligned with today's engineering workflows. Get Started with Keil MDK UBL
Learn more
ARCHITECTURE OF TRUST: STRENGTHENING SECURITY IN MODERN CORTEX-M SYSTEMS
As embedded devices continue to expand into connected and safety-critical applications, security has become a fundamental design requirement rather than an optional feature. From industrial controllers and medical devices to automotive and IoT systems, developers must address increasingly sophisticated threats while maintaining performance and reliability. Modern Arm Cortex-M processors have evolved significantly to meet these challenges. While earlier Cortex-M architectures provided strong performance and low-power operation, newer generations introduce hardware enforced security features designed to protect software, data, and system resources from both accidental faults and malicious attacks. One of the most significant advancements is TrustZone for Arm Cortex-M, which enables the separation of applications into Secure and Non-Secure environments. By isolating sensitive assets such as cryptographic keys, authentication services, and security-critical firmware, TrustZone helps reduce the attack surface and limits the impact of compromised software components. Recent Cortex-M architectures further strengthen security through features such as Stack Limit Registers, PAN (Privileged Access Never), PXN (Privileged Execute Never), Pointer Authentication and Branch Target Identification (PACBTI), enhanced Memory Protection Unit (MPU) capabilities, and secure gateway mechanisms. Together, these technologies help mitigate common attack vectors including stack overflows, code injection, privilege escalation, control-flow hijacking, and cross-domain attacks. These hardware assisted protections are particularly valuable as embedded systems become increasingly connected and exposed to external threats. Security mechanisms that were once implemented primarily in software can now be enforced directly by the processor, improving both robustness and system resilience. As cybersecurity requirements continue to evolve, modern Cortex-M security features provide developers with practical tools to implement a defense in depth strategy. By combining hardware isolation, memory protection, privilege controls, and control-flow integrity mechanisms, organizations can build more secure and trustworthy embedded systems for the next generation of connected devices. To learn more about the security features discussed in this article, watch the full webinar here.
Learn more
CompCert: Advancing Confidence in Safety-Critical Software Development
In the modern age where everything is run by software, the reliability of software toolchains plays a crucial role in safety critical industries such as aerospace, automotive and industrial applications. Traditional compilers are, although highly capable, can occasionally introduce miscompilation issues that may impact system behaviour in unexpected ways. This brings us to CompCert, which is the world's first commercially available formally verified optimizing C compiler, and is being qualified for its use in highly critical avionics applications at Airbus. Unlike conventional compilers that primarily rely on extensive testing, CompCert uses mathematical proofs to demonstrate semantic preservation, ensuring generated executable code behaves consistently with the original source code. By reducing the risks associated with compiler errors and while still maintaining optimization capabilities, this approach can help improve confidence and efficiency in software development workflows, reducing the time in verification in safety critical applications. As safety requirements continue to evolve, technologies like CompCert, which are backed by mathematical proof rather than testing alone, represent an important step toward building more reliable embedded systems. If you would like to evaluate CompCert or need any further information, please feel free to reach out to Robert Campbell at Robert.Campbell@joraltechnologies.com Qualifying CompCert for Safety-Critical Avionics Software - Click here to review the full article. Visit the CompCert Product Page
Learn more
Safe and Efficient AUTOSAR Development with ISO 26262 Verification
AUTOSAR defines how software is structured. QA Systems tools prove that the software is safe. AUTOSAR provides a standardised software architecture that underpins much of today’s automotive ECU development. While it delivers structural consistency and standardised interfaces, functional safety certification is determined by how the underlying C/C++ software is verified and not by architecture alone. When combined with rigorous static and dynamic verification, it enables OEMs and Tier 1 suppliers to achieve ISO 26262-compliant, ASIL-aligned software verification across powertrain, chassis, ADAS, and software-defined vehicle platforms. Why AUTOSAR Alone Is Not Enough for ISO 26262 ISO 26262 compliance is achieved through rigorous software verification, regardless of whether a project uses Classic or Adaptive AUTOSAR. This includes: Mandatory coding-standard compliance Unit and integration testing Structural coverage, including MC/DC at higher ASILs Full traceability and audit-ready evidence This is where QA-MISRA and Cantata integrate directly into AUTOSAR workflows, providing the static and dynamic verification evidence required to support ISO 26262 safety cases. Where AUTOSAR Is Used in Safety-Critical Automotive Systems Classic AUTOSAR Domains: Powertrain ECUs (torque control, fuel injection, emissions) Braking, steering and chassis systems (ABS, ESC, EPB, steer-by-wire) Adaptive AUTOSAR Domains: ADAS and automated driving controllers (AEB, ACC, LKA) Software-defined vehicle platforms, OTA, V2X, EV energy management Modern vehicles often combine Classic ECUs for actuation with Adaptive controllers for perception and planning, creating end-to-end safety-critical chains from sensor to actuator. Using QA-MISRA in an AUTOSAR Workflow QA-MISRA provides static analysis and coding-standard enforcement aligned with ISO 26262 Part 6 for AUTOSAR software implementation. It analyses: MISRA C MISRA C++ AUTOSAR C++14 This ensures that BSW drivers, RTE glue code, and SWCs avoid undefined behaviour, data races, memory errors, and unsafe constructs. Typical QA-MISRA AUTOSAR Flow Generated and handwritten C/C++ is analysed in CI pipelines Project-specific rule profiles are derived from ASIL targets and HARA The QA-MISRA Tool Qualification Support Kit (QSK) provides ISO 26262 tool-confidence evidence Benefits: Reduced manual code reviews Early detection of integration regressions Consistent enforcement across multi-supplier AUTOSAR projects Using Cantata to Verify AUTOSAR Components Cantata provides ISO 26262-aligned dynamic unit and integration testing and is independently certified for use up to ASIL D. Typical Cantata Applications in AUTOSAR Unit testing of safety-critical SWCs (e.g. brake pressure control, steering assist, torque arbitration) Using RTE and BSW stubs to achieve: statement coverage branch coverage MC/DC coverage Integration testing of end-to-end safety chains (e.g. sensor fusion → motion control → brake/steering actuation) on target hardware Cantata’s TÜV certification and ISO 26262 qualification kits provide regulators with confidence that test results can be relied upon in the safety case. Bringing It All Together for Safety-Critical Projects A pragmatic and certifiable approach for safety-critical automotive development is: AUTOSAR → architectural backbone QA-MISRA → static verification & defect prevention Cantata → dynamic verification, coverage & regression AUTOSAR defines the structure. QA-MISRA and Cantata provide the verification evidence that the C/C++ implementation is robust, compliant, and tested to ASIL-appropriate coverage levels. AUTOSAR Classic vs Adaptive: How QA Systems Maps Across Both QA Systems tools operate horizontally across both Classic and Adaptive AUTOSAR. They do not replace AUTOSAR services, they verify the software that implements them. AUTOSAR Classic: Control-Centric ECUs Used for powertrain, chassis, airbags, EPS, and body ECUs. QA-MISRA enforces MISRA/AUTOSAR coding rules and provides ISO 26262 tool-qualification evidence Cantata performs unit and integration testing of SWCs and BSW using RTE/MCAL stubs, certified up to ASIL D AUTOSAR Adaptive: Service-Oriented Platforms Used for ADAS, central compute, connectivity, OTA, and domain controllers. QA-MISRA enforces safe C++ coding across complex Adaptive services Cantata validates safety-relevant shared libraries and services using structural coverage, regression testing, and fault-response validation Cross-Cutting ISO 26262 and Tool Qualification Classic and Adaptive AUTOSAR share the same ISO 26262 tool-qualification requirements. Cantata: TÜV-certified (ISO 26262 TCL 1, up to ASIL D) QA-MISRA: ISO 26262 Tool Qualification Support Kit Together they provide the complete tool-confidence argument required by OEMs and Tier 1 suppliers. Practical Mapping Summary Classic domain: powertrain, chassis, airbags, EPS → verify low-level C code with QA-MISRA + Cantata, apply MC/DC where required Adaptive domain: ADAS, central compute, connectivity, OTA → verify C/C++ services with QA-MISRA for defect prevention and Cantata for regression & safety-mechanism testing. © 2026 QA Systems. Published by JORAL Technologies.
Learn more
Embedded Debugging Tools: How Atlas Hardware Models with Arm DS IDE
If you’ve ever tried to validate embedded behavior in a virtual environment, you know the pain: you can observe what the system does, but the moment you need to interact with it—drive a pin high, simulate a button press, flick an LED on and off—you’re suddenly deep in custom tooling, rewrites, and one-off scripts.
That’s exactly where I started in a recent customer engagement bringing up their system in Corellium Atlas.
CoreModel is the set of interfaces which we use to virtualize peripherals. We already provide a coremodel-gpio example that could monitor GPIO pins. Great for visibility. Not enough for real testing. I needed true bidirectional GPIO control—the kind that lets you build realistic scenarios, poke the SoC like real hardware would, and keep iterating without restarting your app.
I used Kiro’s spec-driven development flow to go from a rough idea to production-quality C code fast.
What You’ll Learn in This Guide
How to build interactive digital twin sensors using Corellium Atlas
How to control GPIO inputs and outputs in a virtual environment
How to use AWS Kiro’s agentic AI to generate C code from specs
How to automate embedded system testing with CLI commands
How to simulate real hardware behavior without physical devices
Why bidirectional control is essential for firmware validation
How to speed up development with spec-driven design workflows
Here’s what that journey looked like—and why it changed the way I build low-level tooling.
Why GPIO Monitoring Isn’t Enough for Digital Twins
CoreModel is a C API library for remote peripheral interaction in Corellium virtual machines. It’s powerful, lean, and designed for serious systems work. But the GPIO example was limited to read-only behavior.
For my use case, that wasn’t just inconvenient—it was a blocker.
I needed to:
Drive GPIO pins at specific voltage levels (0–5V)
Monitor pins for real-time voltage changes
Switch modes on the fly during runtime
Control multiple pins at once
Test interactively using a CLI (not rebuild-run-repeat)
I wanted to create a real board’s behavior—LEDs, buttons, bidirectional handshakes—inside a Corellium Atlas i.MX93.
That meant writing a new example that fit CoreModel’s patterns, used its select-based event loop correctly, and handling errors accordingly.
Using Agentic AI to Accelerate Development with AWS Kiro
Traditional path:
Start coding
Hit unknowns
Redesign mid-flight
Refactor
Repeat until it works
I needed to accelerate the development of the working solution to quickly hit a timeline for when it would be implemented. I couldn’t sift through every single line of code just figure out how to connect the pieces of the API together.
Instead, I used Kiro’s spec feature.
Specs allowed me to move quickly through the problem in order:
What needs to exist
How it should work
What tasks get us there
Then code
Step-by-Step: Creating Spec-Driven GPIO Controls
That structured approach enabled me to be able to focus on delivery of a working solution faster than reading documentation and reviewing my code line by line.
Step 1: Requirements from the Spec
I had Kiro write a requirements spec that included:
5 clear user stories (output control, input monitoring, runtime commands, docs, error handling)
17 measurable acceptance criteria (so “done” was unambiguous)
Firm boundaries on scope (to produce a working MVP)
Kiro made these into clean, testable requirements. The biggest win wasn’t documentation—it was momentum. With these specific requirements, implementation became an easier direct task.
Step 2: Designs to take action on
With requirements done, Kiro guided a design doc that mapped cleanly to CoreModel’s structure:
Components: argument parser, GPIO manager, command handler, main loop integration
Data model: a simple gpio_config_t to track pin modes and voltage
API plan: using established CoreModel calls like coremodel_gpio_set() and coremodel_attach_gpio()
Error strategy: fail fast, clean up always, no leaks, no undefined behavior
The doc included ASCII diagrams and function signatures, so when coding began, Kiro could easily follow the blueprint it created.
Step 3: Automatic task breakdown
Then Kiro generated an implementation plan:
8 major tasks → 18 subtasksEach tied back to requirements.
With the tasks created, it was easy to follow the logic that Kiro used to build the code for the solution. It was clear what Kiro was working on and building on top of.
Real-Time CLI Testing and Event Handling
Once the tasks existed, the coding phase was the easiest part of the process.
1) Parsing mixed GPIO specs
The CLI had to support hybrid input/output configs like:
./coremodel-gpio-rw 10.10.0.3:1900 gpio1 0 1=3300 2 3=1800
Meaning:
pins 0 and 2 → inputs (monitoring)
pins 1 and 3 → outputs at 3.3V and 1.8V
Kiro helped me implement robust parsing with strict validation and clear user errors without having to worry about cumbersome argument handling.
2) Integrating stdin into CoreModel’s event loop
CoreModel uses select() for its event loop. I needed to extend it without breaking established flow.
The custom loop:
calls coremodel_preparefds()
adds stdin to the read set
handles both model events and interactive commands
supports clean shutdown from signals or quit
This was a subtle integration point—and the spec made it predictable.
3) Interactive runtime commands
The CLI supports:
set


