MISRA C is a set of software development guidelines for the C programming language developed by MISRA (Motor Industry Software Reliability Association). Its aims are to facilitate code safety, security, portability and reliability in the context of embedded systems, specifically those systems programmed in ISO C / C90 / C99.
There is also a set of guidelines for MISRA C++ not covered by this article.
- 1 History
- 2 Adoption
- 3 Guideline classification and categorization
- 4 Achieving compliance
- 5 MISRA C published documents
- 6 Example suite
- 7 Tools
- 8 Criticism
- 9 See also
- 10 References
- 11 External links
- Draft: 1997
- First edition: 1998 (rules, required/advisory)
- Second edition: 2004 (rules, required/advisory)
- Third edition: 2012 (directives; rules, Decidable/Undecidable)
- MISRA compliance: 2016
For the first two editions of MISRA-C (1998 and 2004) all Guidelines were considered as Rules. With the publication of MISRA C:2012 a new category of Guideline was introduced - the Directive whose compliance is more open to interpretation, or relates to process or procedural matters.
Although originally specifically targeted at the automotive industry, MISRA C has evolved as a widely accepted model for best practices by leading developers in sectors including automotive, aerospace, telecom, medical devices, defense, railway, and others. For example:
- The Joint Strike Fighter project C++ Coding Standards are based on MISRA-C:1998.
- The NASA Jet Propulsion Laboratory C Coding Standards are based on MISRA-C:2004.
- Part 6 of ISO 26262-1:2011 Functional Safety - Road Vehicles cites MISRA C 2004 and MISRA AC AGC as being an appropriate sub-set of the C language.
- The AUTOSAR 4.2 General Software Specification (SRS_BSW_00007) requires that If the BSW Module implementation is written in C language, then it shall conform to the MISRA C 2004 Standard.
- The AUTOSAR 4.3 General Software Specification (SRS_BSW_00007 changed) requires that If the BSW Module implementation is written in C language, then it shall conform to the MISRA C 2012 Standard.
Guideline classification and categorization
When a new software project is started, the latest MISRA standard should be used. Previous standards are still available for use with legacy software projects that need to refer to it.
Each Guideline is classified as Mandatory (new for MISRA C:2012), Required or Advisory. Furthermore, the MISRA Compliance document permits Advisory guidelines to be Disapplied
- Mandatory guidelines shall always be complied with
- Required guidelines shall be complied with, unless subject to a Deviation
- Advisory guidelines are considered good practice, but compliance is less formal.
The rules can be divided logically into a number of categories:
- Avoiding possible compiler differences, for example, the size of a C integer may vary but an INT16 is always 16 bits. (C99 standardized on
- Avoiding using functions and constructs that are prone to failure, for example,
- Produce maintainable and debuggable code, for example, naming conventions and commenting.
- Best practice rules.
- Complexity limits.
MISRA C:2012 classifies the rules (but not the directives) as Decidable or Undecidable.
In April 2016, MISRA published MISRA Compliance:2016, which provides enhanced guidance on achieving compliance to MISRA C and MISRA C++.
In order for a piece of software to claim to be compliant to the MISRA C Guidelines, all mandatory rules shall be met and all required rules and directives shall either be met or subject to a formal deviation. Advisory rules may be disapplied without a formal deviation, but this should still be recorded in the project documentation.
Note: For compliance purposes, there is no distinction between rules and directives.
Many MISRA C rules can be characterized as guidelines because under certain condition software engineers may deviate from rules and still be considered compliant with the standard. Deviations must be documented either in the code or in a file. In addition; proof must be provided that the software engineer has considered the safety of the system and that deviating from the rule will not have a negative impact, requirements for deviations also include:
- The rule deviated from.
- Rationale for deviation.
MISRA C published documents
MISRA C:2012 Amendment 1
In April 2016, MISRA published (as free downloads) Amendment 1 to MISRA C:2012 which added fourteen new security guidelines, together with Addendum 2 to MISRA C:2012, which outlines the coverage of MISRA C:2012 against ISO/IEC TS 17961:2013 - C secure coding rules.
In 2013, MISRA C:2012 was announced. MISRA C:2012 extends support to the C99 version of the C language (while maintaining guidelines for C90), in addition to including a number of improvements that can reduce the cost and complexity of compliance, whilst aiding consistent, safe use of C in critical systems.
MISRA-C:2012 contains 143 rules and 16 "directives" (that is, rules whose compliance is more open to interpretation, or relates to process or procedural matters); each of which is classified as mandatory, required, or advisory. They are separately classified as either Single Translation Unit or System. Additionally, the rules are classified as Decidable or Undecidable.
In 2004, a second edition "Guidelines for the use of the C language in critical systems", or MISRA-C:2004 was produced, with many substantial changes to the guidelines, including a complete renumbering of the rules.
MISRA-C:2004 contains 142 rules, of which 122 are "required" and 20 are "advisory"; they are divided into 21 topical categories, from "Environment" to "Run-time failures".
The first edition of MISRA C, "Guidelines for the use of the C language in vehicle based software", which was published in 1998 and is officially known as MISRA-C:1998.
MISRA-C:1998 has 127 rules, of which 93 are required and 34 are advisory; the rules are numbered in sequence from 1 to 127.
An exemplar suite (for MISRA-C:2004 and MISRA C:2012) is available from the MISRA GitLab repository. This allows tool-users to evaluate and compare the checking support provided by the various MISRA tools; additionally, it gives tool-implementers some guidance as to the intent of the MISRA Guidelines.
While there exist many software tools that claim to check code for "MISRA conformance", there is no MISRA certification process.
Tools that check code for MISRA conformance include:
- Astrée by AbsInt
- Axivion Bauhaus Suite by Axivion GmbH. MISRA C:2004, C:2012, C:2012 Amendment 1, C++:2008, Compliance:2016.
- CodeSonar by GrammaTech
- Coverity by Synopsys - Static Analysis
- Cppcheck - Open source Static Analysis tool for C/C++
- ECLAIR by BUGSENG
- Goanna by Red Lizard Software – A software analysis tool for C/C++.
- IBM Rational Logiscope (discontinued since 2012, see Kalimetrix)
- Rational Test RealTime by IBM - A cross-platform solution for component testing, static and runtime analysis
- Kalimetrix Logiscope (previously known as IBM Rational Logiscope or Telelogic Logiscope)
- Klocwork by Rogue Wave Software
- LDRA Testbed by Liverpool Data Research Associates
- mutator by Farzad Sadeghi.
- Parasoft C/C++test by Parasoft
- PC-Lint by Gimpel Software. MISRA C:1998, C:2004, C:2012, C++:2008.
- Polyspace by MathWorks
- QA-C by Programming Research
- RESORT for C and C++ by Soft4Soft
- SonarQube by SonarSource (Open Source with some commercial plug-in components)
- SQuORE by Squoring Technologies
- Telelogic Logiscope (discontinued since 2008, see Kalimetrix Logiscope)
- Understand by SciTools
C/C++ compilers that support MISRA conformance include:
- Green Hills Software
- IAR Systems - MISRA C:1998, C:2004, C:2012, C++:2008.
- TASKING - MISRA C:1998, C:2004, C:2012.
- TI Compilers
Some research results question the effectiveness of MISRA.
In view of the apparent widening influence of the MISRA C standard, this paper attempts to assess whether important deficiencies in the original standard have been addressed satisfactorily. Unfortunately, they have not and the important real to false positive ratio is not much better in MISRA C 2004 than it was in MISRA C 1998 and it is unacceptably low in both.
He goes on to state:
In its present form, the only people to benefit from the MISRA C 2004 update would appear to be tool vendors and it is to be hoped that steps will be taken both to simplify the wording and to reduce the false positive ratio in future revisions by taking a little more notice of published experimental data and being less tempted to invent rules on the basis that they seem a good idea.
From the data obtained, we can make the following key observations. First, there are 9 out of 72 rules for which violations were observed that perform significantly better (α = 0.05) than a random predictor at locating fault-related lines. The true positive rates for these rules range from 24-100%. Second, we observed a negative correlation between MISRA rule violations and observed faults. In addition, 29 out of 72 rules had a zero true positive rate. Taken together with Adams' observation that all modifications have a non-zero probability of introducing a fault, this makes it possible that adherence to the MISRA standard as a whole would have made the software less reliable.
- "MISRA C and MISRA C++ Compliance". Programmingresearch.com. Retrieved 2014-06-30.
- "MISRA checker". Cosmic Software. Retrieved 2014-06-30.
- "Misra C/C++". Ldra. Retrieved 2014-06-30.
- In spring 1997 software engineers at the Austin Rover Group (ARG) sent a draft C coding standard to Programming Research Ltd (PRL) for review. The review was performed by PRL's then senior consultant, David Blyth, who proposed replacing the draft with an appreciably stronger set of coding rules. Those rules, with minor changes, formed the basis of the first edition of MISRA C.
- JSF AV C++ Coding Standards
- NASA JPL C Coding Standards
- "AUTOSAR 4.2 General Software Specification" (PDF).
- "AUTOSAR 4.3 General Specification of Basic Software Modules" (PDF). AutoSAR. November 30, 2016. Retrieved May 29, 2017.
- MISRA publications
- "Fact Sheet: MISRA C:2012 (PDF)" (PDF). programmingresearch.com. Retrieved 10 June 2013.
- "MISRA Compliance:2016 (PDF)". MISRA. Retrieved 22 July 2016.
- "Achieving MISRA C:2012 Compliance". Parasoft. Retrieved May 29, 2017.
- "MISRA C:2012 Amendment 1 (PDF)". MISRA. Retrieved 9 June 2016.
- "MISRA C:2012 Addendum 2 (PDF)". MISRA. Retrieved 18 June 2016.
- "MISRA C:2012 release date announced". MISRA. 26 February 2013. Retrieved 10 June 2013.
- "A brief history of MISRA C". MISRA. 2013-03-18. Retrieved 2014-06-30.
- MISRA GitLab repository
- "MISRA C FAQ list." MISRA Consortium
- Axivion Bauhaus Suite.
- Project mutator
- MISRA conformance checking, PC-lint/FlexeLint, Gimpel Software.
- Languages and Standards; iar.com
- Language subsetting in an industrial context: a comparison of MISRA C 1998 and MISRA C; Les Hatton; University of Kingston; 2004.
- Assessing the Value of Coding Standards: An Empirical Study; C.J. Boogerd and L. Moonen; Delft University of Technology; 2008.
- Official website
- "Introduction to MISRA C". embedded.com.
- "MISRA C: Safer Is Better". Electronic Design magazine.
- "Commentary on the first edition of the MISRA C guidelines". knosof.co.uk.
- "New Version of MISRA C: Why Should You Care?". Electronic Design magazine.
- "MISRA C:2012: Plenty Of Good Reasons To Change". Electronic Design magazine.
- "MISRA C:2012 fact sheet" (PDF). programmingresearch.com.
- "MISRA C:2012 ensures automotive software safety". EE Times magazine.
- "Compliance to MISRA C: Code Generation". Mathworks.