3 ms·

MISRA and other such standards are great places to start thinking about reliability and safety. That said, I think there is a danger in believing that code whi

MISRA and other such standards are great places to start thinking about reliability and safety. That said, I think there is a danger in believing that code which complies with a certain set of standards is safe. Attempting to bring non-safety code into compliance with MISRA may increase safety, but safety, like security, is something that needs to be designed in, both to the software and the overall system. Standards compliance is often just a CYA move to avoid legal and financial liability. Often, trying to make a codebase compliant with a standard like MISRA will reduce overall code quality as good software design practices take a backseat to compliance metrics and QA reports.

wcunning 7y ago
This is precisely why the industry is adopting ISO 26262 safety standards which then require that all safety critical code be MISRA compliant, but not necessarily that non-safety critical code be compliant, as long as safety critical code is isolated from the non-safety critical portions.
dognotdog 7y ago
While many items in MISRA are sensible (some I do find quite counterproductive, if code quality in terms of readability and maintainability is also a concern), I have seen MISRA standards being applied to a legacy embedded codebase with terrible effects. What was being done, for example, was putting explicit typecasts everywhere a warning popped up respective mismatched integer sizes or similar, instead of refactoring the code to improve variable typing. The best end result was largely unreadable code. Why? Because the junior developers tasked with the MISRA compliance efforts were measured by reducing the number of warnings instead of improving code quality. The bonus was actual breakage in the field, as the test coverage of the legacy code being converted was particularly abysmal. But not to worry, another junior dev was tasked with creating unit tests for every function! With a codebase unsuitable to unit testing through fuzzy interfaces, that effort was about as effective as one would expect, too. </rant>

wcunning 7y ago

This is precisely why the industry is adopting ISO 26262 safety standards which then require that all safety critical code be MISRA compliant, but not necessarily that non-safety critical code be compliant, as long as safety critical code is isolated from the non-safety critical portions.

dognotdog 7y ago

While many items in MISRA are sensible (some I do find quite counterproductive, if code quality in terms of readability and maintainability is also a concern), I have seen MISRA standards being applied to a legacy embedded codebase with terrible effects. What was being done, for example, was putting explicit typecasts everywhere a warning popped up respective mismatched integer sizes or similar, instead of refactoring the code to improve variable typing. The best end result was largely unreadable code. Why? Because the junior developers tasked with the MISRA compliance efforts were measured by reducing the number of warnings instead of improving code quality. The bonus was actual breakage in the field, as the test coverage of the legacy code being converted was particularly abysmal. But not to worry, another junior dev was tasked with creating unit tests for every function! With a codebase unsuitable to unit testing through fuzzy interfaces, that effort was about as effective as one would expect, too. </rant>