CI/CD Pipeline | Safety Critical Continuous Integration Tools

Embedded software teams face growing pressure to deliver complex, high-quality systems at speed. To stay competitive, organizations must adopt agile methods that support both innovation and compliance.

Continuous Integration and Continuous Delivery (CI/CD full form) help streamline development, but safety critical industries (automotive, aerospace, medical, industrial, rail, space…) still require strict adherence to safety and regulatory standards. This is where Continuous Verification (CV) comes in – integrating compliance checks throughout the life cycle to catch issues early, reduce risk, and avoid costly delays.

By combining CI/CD with CV, teams can boost software quality, safety, and security while reducing time-to-market.

What is CI/CD (Continuous Integration and Continuous Delivery/Deployment)?

CI/CD full form is Continuous Integration and Continuous Delivery/Deployment. As the name suggests, it involves the application of CI & CD in tandem, automating and streamlining the software development life cycle from code integration to deployment. It consists of is a set of engineering practices and automation pipelines that govern how code changes move from development to release.

CI integrates and tests changes frequently.
CD automates delivery/deployment to production or a controlled release baseline.
In standards language, CI/CD sits within the development-environment infrastructure, providing build, integration, and verification automation.

CI/CD is applicable across a broad range of software development and IT operations practices, including:

DevOps
DevSecOps
Agile development
Mobile app development

What is Continuous Integration (CI) in CI/CD?

Continuous Integration (CI) is a development practice that automates the merging of code changes from multiple developers into a single code repository. When a change is submitted, the CI process can be used to run the necessary tests to verify that it is correct before it is merged into the main branch within the source code management system.

What are the benefits of Continuous Integration (CI)?

Key benefits include faster bug detection, reduced integration risks, improved team collaboration, consistent code quality, and accelerated time-to-market for software releases.

What is Continuous Delivery (CD) in CI/CD?

Continuous Delivery (CD – although that can also mean Continuous Deployment) is a development practice that enables automates the distribution of software updates to users as soon as they pass all required tests and checks. Changes are deployed on request enabling fast delivery of new features, bug fixes, and improvements. This approach relies on robust automation and validation to maintain quality and stability in live environments.

What is Continuous Deployment (CD) in CI/CD?

Continuous Deployment (CD – although that can also mean Continuous Delivery) is a development practice that automates the distribution of software updates to users as soon as they pass all required tests and checks. Changes are deployed immediately ensuring fast delivery of new features, bug fixes, and improvements. This also approach relies on robust automation and validation to maintain quality and stability in live environments.

What is the difference between Continuous Integration (CI) and Continuous Deployment (CD)?

Although CI/CD is often referenced as a single term, it does therefore reference two discrete but related activities. CI focuses on automating code integration and testing, while CD automates the release process, ensuring code is always ready for production deployment.

What is the difference between Continuous Delivery and Continuous Deployment?

As the descriptions suggest, Continuous Delivery and Continuous Deployment are similar but not identical. Continuous deployment extends continuous delivery by automatically releasing every change that successfully passes all stages of the production pipeline to customers. This process requires no human intervention.

What is DevOps?

DevOps is a broader cultural and organisational approach that brings development and operations closer together. It covers collaboration practices and enabling technologies such as infrastructure as code, monitoring and observability, incident response, security integration (“DevSecOps”), and continuous improvement.

In a critical application development environment, DevOps is best viewed as a process framework or organisational practice, not merely a toolchain.

How does CI/CD relate to DevOps?

CI/CD = the pipeline practices and tools that automate build, test, and release.
DevOps = the culture, processes, and collaboration model within which CI/CD typically operates.

What is CI/CD DevOps?

The term “CI/CD DevOps” isn’t formally defined but is commonly used to describe a DevOps implementation where CI/CD pipelines are the primary enabler. In other words, it’s a specific interpretation of DevOps practice in which the culture and collaboration are realised chiefly through automated pipelines that continuously build, verify, and deliver software.

How does CI/CD apply to safety critical embedded software?

In safety-critical development, CI/CD provides the automated path from change to release as is the general case. The primary difference in critical software development is that assurance checks are included at every stage. In other words, wiring those checks into the pipeline so they run on every change is how to implement continuous verification.

Such an approach contributes to the world of DO-178C automation tools, ISO 26262 automation tools, IEC 61508, IEC 62304, EN 50716 – and so on.

Why is a generic CI/CD approach inappropriate for critical embedded systems?

A generic CI/CD pipeline is unsuitable for critical embedded software because it prioritises speed over the assurance needed for certification and safety:

- No built-in compliance: No support for enforcement of standards such as DO-178C, ISO 26262, IEC 61508, and EN 50716.
- Shallow verification: Limited verification omits more demanding verification techniques such as structural coverage, coupling analysis, and requirements-based testing.
- Poor traceability: No demonstrable bidirectional linkage between requirements, code, and tests.
- Unqualified tooling: No requirement to meet qualification needs for build, test, and verification tools.
- Hardware blind spots: No requirement to support hardware-dependent testing.

How is CI/CD implemented in embedded systems?

Implementing CI/CD in embedded systems requires specialized tools for cross-compilation, hardware-in-the-loop testing, and automated verification. LDRA tools integrate with Jenkins, GitLab CI, and other platforms for embedded CI/CD pipelines.

What is Continuous Verification (CV)?

Continuous Verification (CV) is a development practice where compliance, quality, and safety checks are integrated throughout the software life cycle, rather than applied only at the end. It ensures that code is continuously assessed against requirements, standards, and test criteria as it evolves, helping teams catch issues early, reduce risk, and maintain traceability. This ongoing validation supports faster, more reliable delivery and is particularly valuable in critical systems.

In general, the approach is to adopt automation for repeatable checks and integrate explicit human review to satisfy independence and rigour requirements.

For example, consider civil aviation and DO-178C.

What is Continuous Verification (CV) in aerospace software?

Continuous Verification (CV) in aerospace integrates DO-178C objectives into the development pipeline so compliance checks run continuously. Traceability, analysis, testing, and structural coverage analysis activities continue as the code evolves, and evidence is captured and stored appropriately.

Crucially, CV does not replace mandated human oversight. Manual approvals occur at defined stage gates (e.g., requirements, design, test-readiness, release) with independence appropriate to the DAL, and SOI reviews (SOI-1 to SOI-4) involve human inspection by the certification authority or its delegates of plans, processes, results and anomalies.

How does Continuous Verification (CV) support DO-178C compliance?

CV automates DO-178C verification activities (requirements traceability, test execution, code-coverage analysis, aggregation of evidential artefacts) so that compliance is always maintained. Manual gates ensure assurance involves people where the standard demands it – for example, evidence packs are produced for stage-gate sign-off, independent reviewers record approvals, and findings feed back into the pipeline ahead of SOI events.

How is CI/CD with CV pertinent to DevOps and DevSecOps?

CI/CD with CV provides a practical foundation for the implementing of DevOps and DevSecOps in critical embedded software development. By automating integration, deployment, and verification, it enables faster delivery while maintaining control over quality, safety, security, and compliance.

CI/CD v DevOps In a DevOps context, CI/CD promotes collaboration between development and operations teams through seamless, automated workflows. CI/CD DevOps with CV adds rigour to this process by embedding verification throughout the life cycle.
CI/CD with CV v DevSecOps In this case security is treated as a shared responsibility from the outset so Continuous Verification (CV) plays a vital role – ensuring that security and regulatory checks are performed continuously, not just at the end. Together, CI/CD with CV helps teams deliver reliable, secure, and compliant software at speed.

What is CI/CD with CV (Continuous Integration, Continuous Delivery/Deployment, and Continuous Verification)?

CV full form is Continuous Verification. CI/CD with CV (or CI/CD/CV) combines Continuous Integration, Continuous Deployment, and Continuous Verification into a unified development pipeline. The addition of CV into CI/CD makes the efficiency gains implicit in a CI/CD process available to developers of critical software by applying quality, compliance, and safety checks throughout the process.

Together, they enable teams to deliver updates rapidly without compromising on reliability, conformance to standards, or regulatory requirements.

What is a CI/CD pipeline with CV?

A CI/CD development pipeline consists of a sequence of steps required to deliver a new software version. Effective pipelines leverage automation throughout the development life cycle to enhance software delivery and reduce the risk associated with new releases.

Integrating CV into the CI/CD pipeline enables developers of critical software to benefit from the efficiency inherent in CI/CD, while embedding quality, compliance, and safety checks at every stage of the process. CI/CD pipelines typically use an integration of several different types of tools.

What are the four phases of a CI/CD pipeline with CV?

The CI/CD pipeline combines continuous integration, delivery and/or deployment into four major phases: source, build, test and deliver/deploy.

Source: The developer initiates the pipeline by committing a change to the source code repository.
Build: The build server builds binaries from the source code
Test: The code is passed through a series of tests to verify its readiness for deployment as provided by the LDRA tool suite. The additional Continuous Verification (CV) element reflects the automation of the formal processes required for critical embedded software development and applies tests on an ongoing basis.
Deploy: The code changes are delivered, or deployed to a staging or production environment

What tools support CI/CD for safety-critical software?

There are many different tools performing different functions in a typical CI/CD pipeline, so the phrase “CI/CD tool” can mean many different things. Consider GitHub and Jenkins as examples.

CI/CD GitHub

Role: Configuration and change management system within the development-environment infrastructure. GitHub Actions provide the infrastructure or platform in which software tools are executed and their verification or development activities are carried out – that is, the tool operational environment.
With CV: Using tools typified by the LDRA tool suite, GitHub Actions orchestrate continuous verification by running coding-standard checks, static analysis, unit tests, coverage, and security scans on pull requests and protected branches, producing objective evidence and enforcing gates before merge/release.

CI/CD Jenkins

Role: Build and integration orchestration environment within the development-environment infrastructure. Jenkins provides the infrastructure in which tools are executed, such that:
- The “controller” schedules pipelines and coordinates jobs, and
- “agents” (the worker machines or containers) execute the pipeline steps.

Together, the controller and agents form basis of the tool operational environment in which tools run.

With CV: Using tools typified by the LDRA tool suite, Jenkins pipelines implement continuous verification by coordinating builds, static/dynamic analysis, unit and integration tests, coverage, and compliance/security checks, aggregating objective evidence and enforcing automated gates (with optional independent review) before release.

LDRA tools integrated into the CI/CD pipeline contribute by extending the continuous processing implied by CI/CD to include standard compliance through verification, validation, and requirements traceability.

How are CI/CD pipelines with CV supported by the LDRA tool suite?

The LDRA tool suite extends the use of CI/CD pipelines into embedded safety critical system development. LDRA CI/CD tools support CI/CD pipelines with CV by embedding core verification activities into automated workflows and integrating with leading CI platforms, ensuring continuous software quality, security, and compliance.

Standard CI/CD pipelines fall short of meeting the requirements of applications that must comply with safety- and cybersecurity-critical software standards. Integrating LDRA tools into the pipeline addresses that deficit.

Which Continuous Verification (CV) techniques are supported by the LDRA tool suite?

The core verification activities prescribed by safety, security, and regulatory standards remain critical irrespective of how development processes evolve. Activities supported by the LDRA tool suite in a CI/CD environment with CV include:

Static Code Analysis
This automated code “inspection” identifies coding issues early, evaluates code quality and complexity, and highlights deviations from coding standards (e.g., MISRA, CERT, CWE…).
Dynamic Code Analysis
Runtime behaviour analysis validate performance on target or under simulation leveraging techniques including code coverage, traceability to requirements, and worst-case execution time (WCET).
Unit & integration testing
These dynamic analysis techniques verify code at the component and module level respectively. Support for testing in simulated environments using Digital Twins is pertinent in the context of CI/CD with CV.
Control & data flow analysis
Static & dynamic flow analyses result in user-friendly representations of variable use, decision logic and execution paths to confirm software behaves as intended across all branches and conditions.
Structural (code) coverage analysis
Measures how much of the code has been exercised by tests, as required for compliance with safety-related standards including DO-178C, ISO 26262, and IEC 62304. Techniques such as MC/DC and OCV are used for high-integrity systems.
Bidirectional Requirements Traceability
Links requirements to implementation and test results, enabling compliance evidence for requirements management tools typified by IBM Requirements Management DOORS, Siemens Polarion, and Jama Connect. The demonstration of traceability is essential for safety-critical development.

What is code coverage analysis in CI/CD?

Code (or structural) coverage analysis measures the percentage of code executed during testing by leveraging instrumented code. Code coverage analysis is a required activity for compliance with DO-178C and most functional safety standards (IEC 61508, ISO 26262, IEC 62304…) LDRA tools report on the different coverage metrics required by the standards (including MC/DC) as part of a CI/CD pipeline.

Which Continuous Integration (CI) platforms are supported by LDRA tools?

LDRA’s continuous integration solutions are designed to seamlessly integrate with many leading CI platforms, providing with powerful tools for code review, code coverage, and unit testing as part of an automated build process.

Supported platforms include:

Jenkins: LDRA tool suite and Productivity Packages include CI/CD Jenkins plugins for Code Review and Code Coverage with results and trend information displayed directly within the Jenkins workspace.
Docker: LDRA solutions work within containerized environments to deliver CI/CD Docker solutions with continuous static and dynamic code analysis.
GitLab & GitHub: Integrate LDRA tools with CI/CD GitLab & CI/CD GitHub pipelines to enhance the development process. Automate code reviews, enforce coding standards, and monitor quality metrics directly within a GitLab or GitHub environment to improve efficiency and consistency.
Azure DevOps: Leverage LDRA’s integration with Azure DevOps to enrich CI/CD Azure workflows. LDRA tools provide real-time feedback on code quality and security, ensuring that every stage of your development pipeline meets the highest standards.

How scalable are LDRA’s Continuous Verification (CV) solutions?

LDRA’s continuous verification solutions are built to scale with your needs, whether you’re handling small projects or large-scale enterprise applications.

Automated Code Review: Reduce manual effort with automated coding standard compliance and code quality LDRA’s static code analysis identifies potential issues early, enhancing code quality by preventing source code with new violations entering the main branch of the development project.
Comprehensive Code Coverage: Achieve thorough test coverage with LDRA’s dynamic analysis tools and hardware-in-loop testing as part of a CI process. Detailed metrics on code coverage deliver effective tests and a robust codebase.
Detailed Unit Test Results: Validate each software component by incorporating LDRA’s unit testing capabilities into the CI pipeline. Access detailed test results and reports to quickly address any issues and improve software reliability.

How can LDRA’s Continuous Verification (CV) solutions optimize development?

LDRA’s Continuous Verification (CV) solutions streamline and strengthen your development workflow through:

Seamless integration: Embed LDRA’s tools into Docker, GitLab, GitHub, or Azure DevOps environments with minimal configuration.
Continuous analysis: Perform continuous static and dynamic code analysis to ensure code quality and security at every stage.
Rigorous testing: Incorporate unit tests and measure code coverage to maintain high standards of software reliability and performance.
Insightful reporting: Access real-time insights and detailed reports to drive informed decision-making and enhance your development process.

How can LDRA’s CI solutions enhance a DevSecOps process?

LDRA’s solutions are designed to support and enhance DevSecOps practices, integrating security, quality, and compliance into the CI/CD pipeline.

Integrated Security Checks: Embed security analysis, using CWE, CERT, MISRA, and more, into the continuous integration process. LDRA’s tools help to detect vulnerabilities early and enforce security standards throughout the development life cycle.
Compliance and Reporting: Generate comprehensive reports and other artifacts to demonstrate compliance with industry standards and regulatory requirements, track progress, and address any issues proactively.

Additional information

Free CI/CD/CV downloads

CI/CD tutorials and CI/CD examples with CV

Video: Performing code review with Jenkins and the LDRA tool suite

Video: Configuring Jenkins and the LDRA tool suite to automate code reviews within a CI/CD environment

Video: Leveraging GitLab, QNX Momentics v8, ARM64, and the LDRA tool suite in a CI/CD pipeline

On Demand Webinar: DevSecOps for WCET Multicore software development

On Demand Webinar: DevSecOps – Best Practice for V&V in the cloud

Continuous Integration and Continuous Delivery (CI/CD) with Continuous Verification (CV)