Proof. Request demo

Compare · LDRA

Proof vs LDRA

LDRA measures MC/DC on certified C and Ada. Proof measures it on the Go you ship. VectorCAST, Cantata, and Parasoft sit on this page.

proof mcdc measure ./... --engine go

Not an LDRA alternative. Keep the qualified toolchain if you certify airborne software.

Request demo How they compare

01 · Answers

How Proof compares to LDRA

The comparison, as a list. Click the instrument for the same split.

  1. How does Proof compare to LDRA? Same criterion (MC/DC). Different toolchain. LDRA pairs with a qualified C/Ada compiler. Proof instruments the stack you ship.
  2. Is Proof an LDRA alternative? No. Keep LDRA if you certify airborne software. Proof is not DO-330.
  3. What does LDRA still win? Ada, C in a qualified pairing, the report a DER already knows. VectorCAST, Cantata, and Parasoft sit here.
  4. Is there an LDRA alternative if I'm not certifying avionics? For Go in ordinary CI, yes: Proof. That is not a replacement for the avionics lab.

02 · The distinction

MC/DC is a coverage criterion. The toolchain is the product.

LDRA (and VectorCAST, Cantata, Parasoft) measure modified condition/decision coverage on the languages a DO-178C shop already compiles. That is a real product. It is not a Go, TypeScript, or Rust measurement.

When someone types this question, the named tools are the avionics incumbents. They pair with a qualified compiler, produce a certification artefact, and charge for the toolchain. The criterion they implement is the same one aviation wrote down: each condition in a decision has to be shown to flip the outcome on its own.

Proof is the other product. proof mcdc measure ./... --engine go instruments the source in a staged workspace and runs go test. The artefact is a per-decision verdict under .proof/mcdc/go/latest.json. The public corpus is jsonparser. On C and C++, Proof does not instrument: the gate imports llvm-cov or gcov that your build already produced. That row is theirs.

03 · The exhibit

Same criterion. Two toolchains. Two stacks.

A cache helper in Go is a real decision. Statement coverage needs the serve-from-cache line to run. MC/DC needs each condition shown to flip the result on its own.

Avionics lab

  • Reads C, C++, Ada
  • Product DO-330 qualified toolchain
Certification artefact

Go

LDRA was not built to instrument go test.

Not this stack

Avionics lab

Keep it for DAL-A and Ada. Proof does not replace Testbed.

Not DO-330

Ordinary CI

  • Command proof mcdc measure ./... --engine go
  • Decision fresh && (hit || !stale)
go test

Same criterion. Two toolchains. Click the tabs.

Axis LDRA / avionics toolchain Proof
What it reads C, C++, Ada in a qualified compiler pairing. The stack you ship. Go is the public corpus. JS/TS, Rust, Java, C#, PHP, Zig, Solidity are native. C/C++ is imported, not instrumented.
Pass means Structural coverage for the object the qualified toolchain built. Each scoped condition shown to flip the outcome. Unmeasurable shapes are counted and reported, never dropped.
Where it runs The avionics lab. Tool qualification (DO-330) is the product. Ordinary CI. proof audit --check code_mcdc_coverage is an exit code.
What you keep The qualified toolchain, the certification artefact, the compiler pairing. Keep them. A per-decision JSON, a CI gate, a public miss on jsonparser.
Where they win DAL-A airborne software. Ada. The report a DER already knows how to read. Go, and the other languages those tools were not built to read.

The split is the stack, not a score from their analyzer.

func serveCached(e Entry) bool {
    if e.fresh && (e.hit || !e.stale) {
        return true  // serve from cache
    }
    return false
}
proof mcdc measure ./... --engine go

# statement: the serve-from-cache line ran
# branch: the if was taken and not-taken
# MC/DC: fresh, hit, and stale each flipped the result alone

04 · The honest loss

Proof does not replace LDRA.

LDRA still wins at the work it was built for: a qualified avionics toolchain, Ada and C, a certification artefact a DER already knows how to read.

Keep LDRA if you are certifying airborne software. Proof is not DO-330. On C and C++, their row is the honest one: Proof imports compiler coverage, it does not pretend to be Testbed. VectorCAST, Cantata, and Parasoft are the same cluster: named here, not a twin page.

Request demo How the Go measurement works