3 ms·

Together with the JPL coding standards [0], and the linux kernel coding style [1], this determines a pleasant, safe and sane subset of C. (Note: this does not

Together with the JPL coding standards [0], and the linux kernel coding style [1], this determines a pleasant, safe and sane subset of C. (Note: this does not mean that these rules should be followed blindly in all cases; but one should be familiar with them and understand their purpose before breaking them.) [0] https://en.wikipedia.org/wiki/The_Power_of_10:_Rules_for_Developing_Safety-Critical_Code https://en.wikipedia.org/wiki/The_Power_of_10:_Rules_for_Dev... [1]https://github.com/torvalds/linux/blob/79c70c304b0b443429b2a0019518532c5162817a/Documentation/CodingStyle https://github.com/torvalds/linux/blob/79c70c304b0b443429b2a...

FirmwareBurner 3y ago
Might I suggest better alternatives as more pleasant alternatives to the stuffy MISRA C book: - "Embedded C Coding Standard" by Michael Barr [1], CTO and co-founder of Barr Group, the guy who inspected the ECU code and testified in Toyota's unintended acceleration lawsuit [2]. Good stuff. - "Embedded System development Coding Reference guide" written by the Software Reliability Enhancement Center of Japan [3], which covers and expands on MISRA C and more. It's a joy in examples, explanations and eye-pleasing aesthetic. I love it. [1] https://barrgroup.com/sites/default/files/barr_c_coding_standard_2018.pdf https://barrgroup.com/sites/default/files/barr_c_coding_stan... [2] https://www.safetyresearch.net/Library/BarrSlides_FINAL_SCRUBBED.pdf https://www.safetyresearch.net/Library/BarrSlides_FINAL_SCRU... [3] https://www.ipa.go.jp/publish/qv6pgp00000011mh-att/000065271.pdf https://www.ipa.go.jp/publish/qv6pgp00000011mh-att/000065271...
ndesaulniers 3y ago
Linux kernel doesn't use a subset; it uses a superset of nearly every GNU C extension. Linux could only be compiled with GCC for so long due to its excessive use of GNU C extensions which tightly bound the codebase to one tool chain. (We fixed this in clang by implementing most GNU C extensions, at least the good ones). VLAs are banned, those are c99.
smcl 3y ago
I'm sorry, but you've clearly just skimmed this and haven't worked with, nor understood, the purpose of MISRA C. For starters, unless it's changed substantially since I worked with it, MISRA C forbids use of functions like malloc which rules it out for an enormous number of applications. Plus it's a little bit fuzzy in how some of the rules should be interpreted. Like there was one where it says there shouldn't be commented-out fragments of code (our response was to try to parse the lines of each comment, if they succeeded raise a MISRA-specific compile error). There were a few more weird things with MISRA C, but these were a couple that stuck with me. It's not a "sane" subset of C you can just pick up and run with. It's a narrow subset of C for a very specific use case.
- cbsks 3y ago
  Every place that I’ve worked chooses a subset of MISRA rules to follow and ignores the rest. A rationale for the ignored rules is written in a document somewhere which can be provided to safety auditors. A deviation for a rule in the “required” set can be made for specific cases. The “no commented-out fragments of code” is a weird one. It was not required at my previous employer, but it is at my current. It means that you can’t have comments like this without a deviation: // This function is only called from // main() Which is much more readable to me than: // This function is only called from // main I see what they are trying to prevent, which is people commenting out code instead of removing it. In my experience, code that is commented out usually means that it was committed accidentally, or the author didn’t really understand what the old code was doing so they didn’t delete it entirely.
  - smcl 3y ago
    Yep, I know. But my gripe was someone suggesting MISRA C was something it wasn’t.
    - cbsks 3y ago
      I wasn’t disagreeing with you, just adding my 2c :)
- eternityforest 3y ago
  MISRA is pretty narrow, but I think the comment still stands because almost all the stuff I'd actually enjoy doing in C, can probably be done with MISRA. If it needs malloc, it might be something that could be C++ or Rust
  - pjmlp 3y ago
    That would be AUTOSAR, which is now being integrated into MISRA as well. https://www.autosar.org/news-events/detail?tx_news_pi1%5Baction%5D=detail&tx_news_pi1%5Bcontroller%5D=News&tx_news_pi1%5Bnews%5D=39&cHash=e4f521f7b674bdfd7c1fade308cf2ea8 https://www.autosar.org/news-events/detail?tx_news_pi1%5Bact...
chrsw 3y ago
The Linux coding style in [1] seems to be in love with K&R. It's adamant about indentation being 8 characters (1 tab, not spaces) yet K&R uses 4 character indentation.
rcxdude 3y ago
MISRA is either an enumeration of specific things that will caused undefined behaviour and you should avoid doing anyway, or a list of arbitrary restrictions which don't really do very much to improve the safety of the code. I think it's mostly worth learning either if you are forced to work with it or as a negative example (of how to write a useful coding standard).

FirmwareBurner 3y ago

Might I suggest better alternatives as more pleasant alternatives to the stuffy MISRA C book: - "Embedded C Coding Standard" by Michael Barr [1], CTO and co-founder of Barr Group, the guy who inspected the ECU code and testified in Toyota's unintended acceleration lawsuit [2]. Good stuff. - "Embedded System development Coding Reference guide" written by the Software Reliability Enhancement Center of Japan [3], which covers and expands on MISRA C and more. It's a joy in examples, explanations and eye-pleasing aesthetic. I love it. [1] https://barrgroup.com/sites/default/files/barr_c_coding_standard_2018.pdf https://barrgroup.com/sites/default/files/barr_c_coding_stan... [2] https://www.safetyresearch.net/Library/BarrSlides_FINAL_SCRUBBED.pdf https://www.safetyresearch.net/Library/BarrSlides_FINAL_SCRU... [3] https://www.ipa.go.jp/publish/qv6pgp00000011mh-att/000065271.pdf https://www.ipa.go.jp/publish/qv6pgp00000011mh-att/000065271...

ndesaulniers 3y ago

Linux kernel doesn't use a subset; it uses a superset of nearly every GNU C extension. Linux could only be compiled with GCC for so long due to its excessive use of GNU C extensions which tightly bound the codebase to one tool chain. (We fixed this in clang by implementing most GNU C extensions, at least the good ones). VLAs are banned, those are c99.

smcl 3y ago

I'm sorry, but you've clearly just skimmed this and haven't worked with, nor understood, the purpose of MISRA C. For starters, unless it's changed substantially since I worked with it, MISRA C forbids use of functions like malloc which rules it out for an enormous number of applications. Plus it's a little bit fuzzy in how some of the rules should be interpreted. Like there was one where it says there shouldn't be commented-out fragments of code (our response was to try to parse the lines of each comment, if they succeeded raise a MISRA-specific compile error). There were a few more weird things with MISRA C, but these were a couple that stuck with me. It's not a "sane" subset of C you can just pick up and run with. It's a narrow subset of C for a very specific use case.

cbsks 3y ago
Every place that I’ve worked chooses a subset of MISRA rules to follow and ignores the rest. A rationale for the ignored rules is written in a document somewhere which can be provided to safety auditors. A deviation for a rule in the “required” set can be made for specific cases. The “no commented-out fragments of code” is a weird one. It was not required at my previous employer, but it is at my current. It means that you can’t have comments like this without a deviation: // This function is only called from // main() Which is much more readable to me than: // This function is only called from // main I see what they are trying to prevent, which is people commenting out code instead of removing it. In my experience, code that is commented out usually means that it was committed accidentally, or the author didn’t really understand what the old code was doing so they didn’t delete it entirely.
- smcl 3y ago
  Yep, I know. But my gripe was someone suggesting MISRA C was something it wasn’t.
  - cbsks 3y ago
    I wasn’t disagreeing with you, just adding my 2c :)
eternityforest 3y ago
MISRA is pretty narrow, but I think the comment still stands because almost all the stuff I'd actually enjoy doing in C, can probably be done with MISRA. If it needs malloc, it might be something that could be C++ or Rust
- pjmlp 3y ago
  That would be AUTOSAR, which is now being integrated into MISRA as well. https://www.autosar.org/news-events/detail?tx_news_pi1%5Baction%5D=detail&tx_news_pi1%5Bcontroller%5D=News&tx_news_pi1%5Bnews%5D=39&cHash=e4f521f7b674bdfd7c1fade308cf2ea8 https://www.autosar.org/news-events/detail?tx_news_pi1%5Bact...

chrsw 3y ago

The Linux coding style in [1] seems to be in love with K&R. It's adamant about indentation being 8 characters (1 tab, not spaces) yet K&R uses 4 character indentation.

rcxdude 3y ago

MISRA is either an enumeration of specific things that will caused undefined behaviour and you should avoid doing anyway, or a list of arbitrary restrictions which don't really do very much to improve the safety of the code. I think it's mostly worth learning either if you are forced to work with it or as a negative example (of how to write a useful coding standard).