6 ms·

JPL C Coding Standard [pdf]

79 points by c0rtex 11y ago

narsil 11y ago
> There shall be no direct or indirect use of recursive function calls. > [The] absence of recursion prevents runaway code, and helps to secure predictable performance for all tasks. I can see the reasoning here, but wow, banning recursion..
- projectileboy 11y ago
  Well, when your code runs on an interplanetary spacecraft, you tend to be extra cautious.
  - mturmon 11y ago
    Yes, these guidelines do not dictate how ground software, and especially research codes, are written at JPL. See the section of the doc under "Scope."
- dahart 11y ago
  That sorta goes hand-in-hand with "There shall be no use of dynamic memory allocation after task initialization." Which in my experience is the harder rule to deal with. It's not that often that you really truly need recursion. It happens, just not often. But no allocations, that radically changes how one codes. But, these rules are for safety on embedded systems with very small amounts of memory. These represent the best lessons learned, the best ways to guarantee your function will finish in finite time and not run out of memory.
  - fsloth 11y ago
    "But no allocations, that radically changes how one codes." But this does not forbid implementing ones own memory manager that uses blocks from a huge continuous buffer.
    - dahart 11y ago
      True. Though I don't work at JPL or speak to what they would allow or forbid, but if you did implement your own memory manager, I imagine that you'd still need to write code that guarantees it will never run out, which might be harder to do if you have this abstraction. The spirit of these rules is to be enable code writing that is obviously correct and finite in time and space, at a glance. So I'm in pure speculation land here, but I could see JPL frowning on rolling your own memory manager. Though I also imagine many applications of these rules happen on hardware that is small enough to make writing a memory manager overkill anyway.
nwmcsween 11y ago
> The goto statement shall not be used... > ...often results in improved code clarity Um not really, if goto is used _right_ it clarifies code immensely.
- alayne 11y ago
  They're avoiding the "not used right" problem in flight control software. The full quote is "Simpler control flow translates into stronger capabilities for both human and tool-based analysis and often results in improved code clarity. Mission critical code should not just be arguably, but trivially correct." So there are reasons beyond code clarity. Seems reasonable to me.
  - AbacusAvenger 11y ago
    Gotos are trivial. They map directly to unconditional jumps at the assembly level. They're one of the best ways to implement exception handling in C (look at how the Linux kernel uses them). It's also not unusual to have conditionals that don't nest. Of course, if you really want to avoid using a goto, you have the option of duplicating a lot of code in order to satisfy all the code paths, decreasing readability and making it harder to maintain. Or you can just use a goto and not worry about it. I do understand why people want to avoid 'goto', but Dijkstra wasn't always right...
    - deleted 11y ago
      [deleted]
    - nitrogen 11y ago
      If the compiler in question does tail call optimization (or even if not), maybe one could write a cleanup function that takes the place of the goto block, but this looks pretty ugly with all the parameters: int cleanup(void *ptr1, char *ptr2, struct foo *ptr3, int *ptr4, union xyz *ptr5, int ret) { free(ptr1); // etc. return ret; } // later... if(fail1) { return cleanup(a, b, c, d, e, -1); }
    - hyc_symas 11y ago
alayne 11y ago
https://news.ycombinator.com/item?id=4339999 https://news.ycombinator.com/item?id=4339999
c0rtex 11y ago
Here's a great video with a bit more background about why you'd want to adopt such a standard. https://www.usenix.org/conference/hotdep12/workshop-program/presentation/holzmann https://www.usenix.org/conference/hotdep12/workshop-program/...
dahart 11y ago
It's lovely reading a coding standards document that is 100% focused on code safety, and has zero stylistic argument. These rules are a good reminder for me, too. A lot of them were habit when I was doing C/C++ on game consoles. Using more dynamic scripting languages on machines with more and more memory over the years has helped me forget. But most, if not all, of these rules have valid analogues in any language that can be aspired to.
Nickersf 11y ago
Why were parts of the standard omitted? Money, national security, or both?
- neals 11y ago
  Yes.
- skissane 11y ago
  According to the document itself - copyright. LOC-5 and LOC-6 can't be reproduced because they are copyright MISRA, and Appendix A can't be reproduced because it is copyright ISO. Both documents are publicly available to anyone willing to pay for them. So national security / government secrecy doesn't appear to be a reason here.
technion 11y ago
>The JPL recommended static analyzers are fast, and produce sparse and accurate messages. I'm interested in what analyzers they may be recommending. I think this is a field that's come a long way since 2009. A lot of these standards could actually be implemented as rules in modern products, which would assist with using them.
- mturmon 11y ago
  The lead author of this standard is Gerard Holzmann, a Fellow of the ACM and a member of the NAE. He works at JPL, and has been instrumental in introducing code analysis to flight software (e.g., http://lars-lab.jpl.nasa.gov http://lars-lab.jpl.nasa.gov). The analyzers JPL currently uses are Coverity, Semmle, CodeSonar, and Klocwork. Coverity seems most common. Of course, Gerard was an author of Spin (http://spinroot.com/spin/whatispin.html http://spinroot.com/spin/whatispin.html).
pisipisipisi 11y ago
Anyone happens to have a link to MISRA-C PDF ? :)
- bionsuba 11y ago
  I hope you realize your asking people to publicly commit a crime. Not making any value judgements, I just wanted to make sure you're aware.
  - DanBC 11y ago
    Breaking the law, sure, but crime? Simple copyright infrineent tends not to be criminal. Other stuff is meeded - like selling the copyright material.
    - bionsuba 11y ago
      The colloquial use of the word crime means an action that breaks a law.
      - DanBC 11y ago
        No, the colloquial use doesn't include stuff for which you can't be punished by the state. It's not a colloquialism, it's just an error.
  - pisipisipisi 11y ago
    Last time I googled, I ended up with nothing. This time it works much better: google:"filetype:pdf MISRA-C" and hitting "I'm feeling lucky" takes me to somewhere where is a PDF. I would not bet that I've committed a crime by searching the web for information (what the web is for), I think that where I live (northern part of EU) this is an OK thing to do.
- skissane 11y ago
  It's not expensive: http://www.misra.org.uk/Buyonline/tabid/58/Default.aspx http://www.misra.org.uk/Buyonline/tabid/58/Default.aspx I sympathise with people who complain about ISO and friends charging mega-bucks for standards, but MISRA's prices seem rather reasonable.
ilogik 11y ago
I was hoping there would be a mention of always using metric units.

79 points by c0rtex 11y ago

> There shall be no direct or indirect use of recursive function calls. > [The] absence of recursion prevents runaway code, and helps to secure predictable performance for all tasks. I can see the reasoning here, but wow, banning recursion..

projectileboy 11y ago
Well, when your code runs on an interplanetary spacecraft, you tend to be extra cautious.
- mturmon 11y ago
  Yes, these guidelines do not dictate how ground software, and especially research codes, are written at JPL. See the section of the doc under "Scope."
dahart 11y ago
That sorta goes hand-in-hand with "There shall be no use of dynamic memory allocation after task initialization." Which in my experience is the harder rule to deal with. It's not that often that you really truly need recursion. It happens, just not often. But no allocations, that radically changes how one codes. But, these rules are for safety on embedded systems with very small amounts of memory. These represent the best lessons learned, the best ways to guarantee your function will finish in finite time and not run out of memory.
- fsloth 11y ago
  "But no allocations, that radically changes how one codes." But this does not forbid implementing ones own memory manager that uses blocks from a huge continuous buffer.
  - dahart 11y ago
    True. Though I don't work at JPL or speak to what they would allow or forbid, but if you did implement your own memory manager, I imagine that you'd still need to write code that guarantees it will never run out, which might be harder to do if you have this abstraction. The spirit of these rules is to be enable code writing that is obviously correct and finite in time and space, at a glance. So I'm in pure speculation land here, but I could see JPL frowning on rolling your own memory manager. Though I also imagine many applications of these rules happen on hardware that is small enough to make writing a memory manager overkill anyway.

nwmcsween 11y ago

> The goto statement shall not be used... > ...often results in improved code clarity Um not really, if goto is used _right_ it clarifies code immensely.

alayne 11y ago
They're avoiding the "not used right" problem in flight control software. The full quote is "Simpler control flow translates into stronger capabilities for both human and tool-based analysis and often results in improved code clarity. Mission critical code should not just be arguably, but trivially correct." So there are reasons beyond code clarity. Seems reasonable to me.
- AbacusAvenger 11y ago
  Gotos are trivial. They map directly to unconditional jumps at the assembly level. They're one of the best ways to implement exception handling in C (look at how the Linux kernel uses them). It's also not unusual to have conditionals that don't nest. Of course, if you really want to avoid using a goto, you have the option of duplicating a lot of code in order to satisfy all the code paths, decreasing readability and making it harder to maintain. Or you can just use a goto and not worry about it. I do understand why people want to avoid 'goto', but Dijkstra wasn't always right...
  - deleted 11y ago
    [deleted]
  - nitrogen 11y ago
    If the compiler in question does tail call optimization (or even if not), maybe one could write a cleanup function that takes the place of the goto block, but this looks pretty ugly with all the parameters: int cleanup(void *ptr1, char *ptr2, struct foo *ptr3, int *ptr4, union xyz *ptr5, int ret) { free(ptr1); // etc. return ret; } // later... if(fail1) { return cleanup(a, b, c, d, e, -1); }
  - hyc_symas 11y ago

alayne 11y ago

https://news.ycombinator.com/item?id=4339999 https://news.ycombinator.com/item?id=4339999

c0rtex 11y ago

Here's a great video with a bit more background about why you'd want to adopt such a standard. https://www.usenix.org/conference/hotdep12/workshop-program/presentation/holzmann https://www.usenix.org/conference/hotdep12/workshop-program/...

dahart 11y ago

It's lovely reading a coding standards document that is 100% focused on code safety, and has zero stylistic argument. These rules are a good reminder for me, too. A lot of them were habit when I was doing C/C++ on game consoles. Using more dynamic scripting languages on machines with more and more memory over the years has helped me forget. But most, if not all, of these rules have valid analogues in any language that can be aspired to.

Nickersf 11y ago

Why were parts of the standard omitted? Money, national security, or both?

neals 11y ago
Yes.
skissane 11y ago
According to the document itself - copyright. LOC-5 and LOC-6 can't be reproduced because they are copyright MISRA, and Appendix A can't be reproduced because it is copyright ISO. Both documents are publicly available to anyone willing to pay for them. So national security / government secrecy doesn't appear to be a reason here.

technion 11y ago

>The JPL recommended static analyzers are fast, and produce sparse and accurate messages. I'm interested in what analyzers they may be recommending. I think this is a field that's come a long way since 2009. A lot of these standards could actually be implemented as rules in modern products, which would assist with using them.

mturmon 11y ago
The lead author of this standard is Gerard Holzmann, a Fellow of the ACM and a member of the NAE. He works at JPL, and has been instrumental in introducing code analysis to flight software (e.g., http://lars-lab.jpl.nasa.gov http://lars-lab.jpl.nasa.gov). The analyzers JPL currently uses are Coverity, Semmle, CodeSonar, and Klocwork. Coverity seems most common. Of course, Gerard was an author of Spin (http://spinroot.com/spin/whatispin.html http://spinroot.com/spin/whatispin.html).

pisipisipisi 11y ago

Anyone happens to have a link to MISRA-C PDF ? :)

bionsuba 11y ago
I hope you realize your asking people to publicly commit a crime. Not making any value judgements, I just wanted to make sure you're aware.
- DanBC 11y ago
  Breaking the law, sure, but crime? Simple copyright infrineent tends not to be criminal. Other stuff is meeded - like selling the copyright material.
  - bionsuba 11y ago
    The colloquial use of the word crime means an action that breaks a law.
    - DanBC 11y ago
      No, the colloquial use doesn't include stuff for which you can't be punished by the state. It's not a colloquialism, it's just an error.
- pisipisipisi 11y ago
  Last time I googled, I ended up with nothing. This time it works much better: google:"filetype:pdf MISRA-C" and hitting "I'm feeling lucky" takes me to somewhere where is a PDF. I would not bet that I've committed a crime by searching the web for information (what the web is for), I think that where I live (northern part of EU) this is an OK thing to do.
skissane 11y ago
It's not expensive: http://www.misra.org.uk/Buyonline/tabid/58/Default.aspx http://www.misra.org.uk/Buyonline/tabid/58/Default.aspx I sympathise with people who complain about ISO and friends charging mega-bucks for standards, but MISRA's prices seem rather reasonable.

ilogik 11y ago

I was hoping there would be a mention of always using metric units.