View source for MISRA C

{{Short description|Software development standard for the C programming language}}
{{TOC right}}
'''MISRA C''' is a set of software development guidelines for the [[C (programming language)|C]] [[programming language]] developed by [[Motor Industry Software Reliability Association|The MISRA Consortium]]. Its aims are to facilitate code [[safety]], [[Computer security|security]],  [[porting|portability]] and reliability in the context of [[embedded systems]], specifically those systems programmed in [[ISO C]] / C90 / [[C99]].<ref>{{cite web |title=MISRA clarifies safe and secure uses of the C language |url=https://www.misra.org.uk/LinkClick.aspx?fileticket=JMG_JlEytqY%3D&tabid=59 |url-status=dead |archive-url=http://web.archive.org/web/20200804032713/https://www.misra.org.uk/LinkClick.aspx?fileticket=JMG_JlEytqY%3D&tabid=59 |archive-date=2020-08-04 |access-date=2019-10-09 |publisher=www.misra.org.uk}}</ref>

There is also a set of guidelines for MISRA C++ not covered by this article.
{{toclimit|limit=2}}
==History==
* Draft: 1997<ref>In spring 1997 software engineers at the [[Austin Rover Group]] (ARG) sent a draft C coding standard to Programming Research Ltd (PRL) for review. The review was performed by PRL's then senior consultant, David Blyth, who proposed replacing the draft with an appreciably stronger set of coding rules. Those rules, with minor changes, formed the basis of the first edition of MISRA C.</ref>
* First edition: 1998  (rules, required/advisory)
* Second edition: 2004 (rules, required/advisory)
* Third edition: 2012 (directives;  rules, Decidable/Undecidable)
* MISRA compliance: 2016, updated 2020
* MISRA C:2023 (MISRA C Third edition, Second revision)

For the first two editions of MISRA-C (1998 and 2004) all Guidelines were considered as Rules.  With the publication of MISRA C:2012 a new category of Guideline was introduced - the ''Directive'' whose compliance is more open to interpretation, or relates to process or procedural matters.

==Adoption==
Although originally specifically targeted at the automotive industry, MISRA C has evolved as a widely accepted model for best practices by leading developers in sectors including automotive, aerospace, telecom, medical devices, defense, railway, and others.
For example:

* The [[Joint Strike Fighter program|Joint Strike Fighter]] project C++ Coding Standards<ref name="JSF-C++">{{Cite web|url=http://www.stroustrup.com/JSF-AV-rules.pdf|title=Joint Strike Fighter Air Vehicle C++ Coding Standards|access-date=2019-07-16}}</ref> are based on MISRA-C:1998.
* The [[NASA]] [[Jet Propulsion Laboratory]] C Coding Standards<ref name="JPL-C">{{Cite web|url=https://andrewbanks.com/wp-content/uploads/2019/07/JPL_Coding_Standard_C.pdf|title=JPL Institutional Coding Standard for the C Programming Language|access-date=2019-07-16}}</ref> are based on MISRA-C:2004.
* IEC 81001-5-1:2021 ''Health software and health IT systems safety, effectiveness and security - Part 5-1: Security - Activities in the product lifecycle'' cites MISRA C as an example of secure coding best practices.
* [[ISO 26262]] ''Functional Safety - Road Vehicles'' cites MISRA C as being an appropriate sub-set of the C language:
** ISO 26262-6:2011 ''Part 6: Product development at the software level''<ref>{{Cite web|url=https://www.iso.org/standard/51362.html|title=ISO 26262-6:2011 Road vehicles -- Functional safety -- Part 6: Product development at the software level|website=iso.org|publisher=ISO|access-date=2019-07-16}}</ref> cites MISRA-C:2004 and MISRA AC AGC.
** ISO 26262-6:2018 ''Part 6: Product development at the software level''<ref>{{Cite web|url=https://www.iso.org/standard/68388.html|title=ISO 26262-6:2018 Road vehicles -- Functional safety -- Part 6: Product development at the software level|website=iso.org|publisher=ISO|access-date=2019-07-16}}</ref> cites MISRA C:2012.
* The [[AUTOSAR]] General Software Specification (SRS_BSW_00007) likewise cites MISRA C:
** The AUTOSAR 4.2 General Software Specification<ref>{{Cite web|url=https://www.autosar.org/fileadmin/user_upload/standards/classic/4-2/AUTOSAR_SWS_BSWGeneral.pdf|title=AUTOSAR 4.2 General Software Specification|website=autosar.org|access-date=2019-07-16}}</ref> requires that ''If the BSW Module implementation is written in C language, then it shall conform to the MISRA C:2004 Standard.''
** The AUTOSAR 4.3 General Software Specification<ref name="AUTOSAR-C">{{cite web|url=https://www.autosar.org/fileadmin/user_upload/standards/classic/4-3/AUTOSAR_SWS_BSWGeneral.pdf|title=AUTOSAR 4.3 General Specification of Basic Software Modules|date=2016-11-30|website=autosar.org|publisher=AutoSAR|access-date=2019-07-16|issue=4.3.0}}</ref> requires that ''If the BSW Module implementation is written in C language, then it shall conform to the MISRA C:2012 Standard.''

==Guideline classification and categorization==
When a new software project is started, the latest MISRA standard should be used.  Previous standards are still available for use with legacy software projects that need to refer to it.<ref name="MISRA-Pubs">[http://www.misra.org.uk/Publications/tabid/57/Default.aspx MISRA publications]</ref>

===Classification===
Each Guideline is classified<ref name="PRQA-factsheet">{{cite web | url=http://www.programmingresearch.com/content/misc/PRQA-MISRAC2012-FactSheet.pdf | title=Fact Sheet: MISRA C:2012 (PDF) | publisher=programmingresearch.com | access-date=10 June 2013}}</ref> as ''Mandatory'' (new for MISRA C:2012), ''Required'' or ''Advisory''.  Furthermore, the MISRA Compliance document permits ''Advisory'' guidelines to be ''Disapplied''.

* ''Mandatory'' guidelines shall always be complied with
* ''Required'' guidelines shall be complied with, unless subject to a ''Deviation''
* ''Advisory'' guidelines are considered good practice, but compliance is less formal.

===Categorization===
The rules can be divided logically into a number of categories:

* Avoiding possible compiler differences, for example, the size of C's <code>int</code> type may vary but <code>int16_t</code> (standardized in C99) is always 16 bits.
* Avoiding using functions and constructs that are prone to failure, for example, <code>malloc</code> may fail.
* Produce maintainable and debuggable code, for example, naming conventions and commenting.
* Best practice rules.
* Complexity limits.

===Scope===
MISRA C:2012 separately classifies each guideline as either ''Single [[Translation unit (programming)|Translation Unit]]'' or ''System''.<ref name="PRQA-factsheet"/>

===Decidability===
MISRA C:2012  classifies the ''rules'' (but not the ''directives'')  as ''Decidable'' or ''Undecidable''.

==Achieving compliance==

===MISRA compliance===
MISRA published documents to provide additional guidance to understand and achieve MISRA compliance.
* ''MISRA Compliance:2016'', was released by MISRA in April 2016.<ref name="Compliance2016">{{cite web |url=http://misra.org.uk/LinkClick.aspx?fileticket=w_Syhpkf7xA%3d&tabid=57 |title=MISRA Compliance:2016 (PDF) |publisher=MISRA |access-date=22 July 2016}}</ref>
* ''MISRA Compliance:2020'', revised edition, was released in February 2020.<ref name="Compliance2020">{{cite web |url=https://www.misra.org.uk/app/uploads/2021/06/MISRA-Compliance-2020.pdf |title=MISRA Compliance:2020 (PDF) |publisher=MISRA |access-date=8 April 2020}}</ref>

===Compliance===
In order for a piece of software to claim to be compliant to the MISRA C Guidelines, all ''mandatory'' rules shall be met and all ''required'' rules and directives shall either be met or subject to a formal deviation.  ''Advisory'' rules may be disapplied without a formal deviation, but this should still be recorded in the project documentation.

Note: For compliance purposes, there is no distinction between ''rules'' and ''directives''.

===Deviations===
Many MISRA C ''rules'' can be characterized as ''guidelines'' because under certain condition software engineers may deviate from rules and still be considered compliant with the standard. Deviations must be documented either in the code or in a file. In addition; proof must be provided that the software engineer has considered the safety of the system and that deviating from the rule will not have a negative impact, requirements for deviations also include:

* The rule deviated from.
* Rationale for deviation.<ref>{{cite web |url=http://alm.parasoft.com/achieving-misra-c-2012-compliance-with-a-development-testing-platform |title=Achieving MISRA C:2012 Compliance |publisher=Parasoft |access-date=May 29, 2017}}</ref>

==Published documents==

===MISRA C:1998===
The first edition of MISRA C, "Guidelines for the use of the C language in vehicle based software", which was  published in 1998 and is officially known as ''MISRA-C:1998''.<ref>{{cite web|url=http://www.misra-c.com/Activities/MISRAC/tabid/160/Default.aspx |title=A brief history of MISRA C |publisher=MISRA |date=2013-03-18 |access-date=2014-06-30}}</ref>

MISRA-C:1998 has 127 rules, of which 93 are required and 34 are advisory; the rules are numbered in sequence from 1 to 127.

===MISRA C:2004===
In 2004, a second edition "Guidelines for the use of the C language in '''''critical systems'''''", or ''MISRA-C:2004'' was produced, with many substantial changes to the guidelines, including a complete renumbering of the rules.

MISRA-C:2004 contains 142 rules, of which 122 are "required" and 20 are "advisory"; they are divided into 21 topical categories, from "Environment" to "Run-time failures".

===MISRA C:2012===
====Main document====
In 2013, the third edition, MISRA C:2012, was published. MISRA C:2012 extends support to the [[C99]] version of the C language (while maintaining guidelines for C90), in addition to including a number of improvements that can reduce the cost and complexity of compliance, whilst aiding consistent, safe use of C in critical systems.<ref name="2012-announced">{{cite web |url=http://www.misra.org.uk/LinkClick.aspx?fileticket=SAG1iH3YwNE%3d&tabid=59 | title=MISRA C:2012 release date announced | publisher=MISRA | date=26 February 2013 | access-date=10 June 2013}}</ref>

MISRA-C:2012 contains 143 rules and 16 "directives" (that is, rules whose compliance is more open to interpretation, or relates to process or procedural matters); each of which is classified as ''mandatory'', ''required'', or ''advisory''. They are separately classified as either ''Single Translation Unit'' or ''System''. Additionally, the rules are classified as ''Decidable'' or ''Undecidable''.

====Amendment 1====
In April 2016, MISRA published (as a free download) ''MISRA C:2012 - Amendment 1: Additional Security Guidelines''<ref name="C2012Amend1">{{cite web | url=https://misra.org.uk/LinkClick.aspx?fileticket=V2wsZxtVGkE%3d&tabid=57 | title=MISRA C:2012 - Amendment 1 (PDF) | publisher=MISRA | date=April 2016 | access-date=31 October 2019}}</ref> which added fourteen new [[computer security|security]] guidelines.

====Amendment 2====
In February 2020, MISRA published (as a free download) ''MISRA C:2012 - Amendment 2: Updates for ISO/IEC 9899:2011/18 Core functionality''<ref name="C2012Amend2">{{cite web | url=https://misra.org.uk/LinkClick.aspx?fileticket=42UepuUAjQ4%3d&tabid=57 | title=MISRA C:2012 - Amendment 2 (PDF) | publisher=MISRA | date=February 2020 | access-date=6 January 2021}}</ref> which adds mapping for the undefined, unspecified and implementation defined behaviours within C11/C18.

====Supporting documents====
MISRA have published the following addenda to support MISRA C:2012:

* ''MISRA C:2012 - Addendum 1: Rule Mappings'',<ref>{{Cite web|url=https://www.misra.org.uk/forum/download/file.php?id=629|title=MISRA C:2012 - Addendum 1: Rule Mapping (PDF)}}</ref> which contains bi-directional rule mappings between MISRA C:2004 and the new version. It is intended to assist users in migration.
* ''MISRA C:2012 - Addendum 2: Coverage of MISRA C:2012 against ISO/IEC TS 17961:2013 "C Secure"''<ref>{{Cite web|url=https://www.misra.org.uk/LinkClick.aspx?fileticket=Ne5llHFRTtY%3d&tabid=57|title=MISRA C:2012 - Addendum 2: Coverage of MISRA C:2012 against ISO/IEC TS 17961:2013 "C Secure" (PDF)}}</ref>
* ''MISRA C:2012 - Addendum 3: Coverage of MISRA C:2012 against CERT C''<ref>{{Cite web|url=https://www.misra.org.uk/LinkClick.aspx?fileticket=PLS6_EzbAl0%3d&tabid=57|title=MISRA C:2012 - Addendum 3: Coverage of MISRA C:2012 against CERT C (PDF)}}</ref>

===MISRA C:2023===
In May 2023 MISRA published MISRA C:2023 (MISRA C Third edition, Second revision) which incorporates Amendments 2 – 4 (AMD2, AMD3, AMD4) and Technical Corrigendum 2 (TC2) and incorporates support for [[C11 (C standard revision)|C11]] and [[C17 (C standard revision)|C17]] language features. <ref>{{Cite web|url=https://misra.org.uk/misra-c2023-released/ |title=MISRA }}</ref>

==Example suite==
An exemplar suite (for MISRA-C:2004 and MISRA C:2012) is available from the MISRA [[GitLab]]<ref>[https://gitlab.com/MISRA/MISRA-C/ MISRA GitLab repository]</ref> repository (login required). This allows tool-users to evaluate and compare the checking support provided by the various MISRA tools; additionally, it gives tool-implementers some guidance as to the intent of the MISRA Guidelines.

==Tools==
{{See also|List of tools for static code analysis}}

While there exist many software tools that claim to check code for "MISRA conformance", there is no MISRA certification process.<ref>[http://www.misra-c.com/MISRACFAQ/tabid/168/Default.aspx "MISRA C FAQ list."] ''MISRA Consortium''</ref>

Most of the guidelines can be checked using tools that perform [[static code analysis]].  The remaining guidelines require the use of [[dynamic code analysis]].

Tools that check code for MISRA conformance include:
* [[Astrée (static analysis)|Astrée]] by [[AbsInt]]
* [[Axivion Bauhaus Suite]] by Axivion GmbH. ''MISRA C:2004, C:2012, C:2012 Amendment 1, C++:2008, Compliance:2016''.
* [[CodeSonar]] by [[GrammaTech]]
* [[Coverity]] by [[Synopsys]] - Static Analysis
* [[Cppcheck]] - Open source Static Analysis tool for C/C++
* [[ECLAIR]] by BUGSENG srl. ''MISRA C:2004, C:2012, C:2012 Amendment 1, C++:2008''.
* [[Helix QAC]] by [[Perforce Software]]. ''MISRA C:1998, C:2004, C:2012, C++:2008''.<ref>{{Cite web|url=https://www.perforce.com/products/helix-qac|title = Helix QAC for C and C++ &#124; Perforce}}</ref>
* [[Klocwork]] by [[Rogue Wave Software]] (now owned by Perforce Software<ref>{{Cite web|url=https://www.roguewave.com/company/news/2019/perforce-software-acquires-rogue-wave-software|title=Clearlake Capital-Backed Perforce Software to Acquire Rogue Wave Software &#124; Perforce}}</ref>). ''MISRA C:2012, C:2012 Amendment 1, C++:2008''.<ref>{{Cite web|url=https://www.perforce.com/products/klocwork|title=Klocwork for C, C++, C#, Java, and JavaScript &#124; Perforce}}</ref>
* [[LDRA Testbed]] by [[Liverpool Data Research Associates]]
* [[Parasoft C/C++test]] by Parasoft. ''MISRA C 1998, MISRA C 2004, MISRA C 2012 AMD1, AMD2 and AMD3, MISRA C++ 2008, Draft version of MISRA C++ 202x''.<ref>{{cite web|url=https://docs.parasoft.com/display/CPPTESTPROEC20222/Built-in+Test+Configurations|title=C/C++ Built-in Test Configurations|publisher=Parasoft|date=17 October 2022|access-date=9 March 2023}}</ref>
* [[PC-Lint]] by Gimpel Software (now owned by Vector Informatik GmbH). ''MISRA C:1998, C:2004, C:2012, C++:2008''.<ref>[http://www.gimpel.com/html/misra.htm MISRA conformance checking, PC-lint/FlexeLint, Gimpel Software.]</ref>
* [[Polyspace]] by [[MathWorks]]
* [[PVS-Studio]] by Program Verification Systems
* [[SonarQube]] by [[SonarSource]] ([[open source]] with some commercial plug-in components)
* [[SQuORE]] by Squoring Technologies
* [[Understand (software)|Understand]] by SciTools

C/C++ compilers that support MISRA conformance include:
* [[Green Hills Software]]
* [[IAR Systems]] - ''MISRA C:1998, C:2004, C:2012, C++:2008''.<ref>[https://www.iar.com/iar-embedded-workbench/language-standards/ Languages and Standards; iar.com]</ref>
* [[Altium|TASKING]] - ''MISRA C:1998, C:2004, C:2012''.

==Criticism==
Some research results question the effectiveness of MISRA C 2004.

In a paper that compares earlier work on MISRA C:1998 with MISRA C:2004, [[Les Hatton]] comes to the conclusion that:<ref name="MISRA_comp_1105">[http://www.leshatton.org/Documents/MISRA_comp_1105.pdf Language subsetting in an industrial context: a comparison of MISRA C 1998 and MISRA C; Les Hatton; University of Kingston; 2004.]</ref>

{{bquote|In view of the apparent widening influence of the MISRA C standard, this paper attempts to assess whether important deficiencies in the original standard have been addressed satisfactorily. Unfortunately, they have not and the important real to false positive ratio is not much better in MISRA C 2004 than it was in MISRA C 1998 and it is unacceptably low in both.}}

He goes on to state:<ref name="MISRA_comp_1105"/>

{{bquote|In its present form, the only people to benefit from the MISRA C 2004 update would appear to be tool vendors and it is to be hoped that steps will be taken both to simplify the wording and to reduce the false positive ratio in future revisions by taking a little more notice of published experimental data and being less tempted to invent rules on the basis that they seem a good idea.}}

A study at the [[TU Delft]], by Cathal Boogerd and Leon Moonen, empirically assesses the value of MISRA C:2004. It comes to similar results:<ref>[http://resolver.tudelft.nl/uuid:646de5ba-eee8-4ec8-8bbc-2c188e1847ea Assessing the Value of Coding Standards: An Empirical Study; C.J. Boogerd and L. Moonen; Delft University of Technology; 2008.]</ref>

{{bquote|From the data obtained, we can make the following key observations. First, there are 9 out of 72 rules for which violations were observed that perform significantly better (α <nowiki>=</nowiki> 0.05) than a random predictor at locating fault-related lines. The true positive rates for these rules range from 24-100%. Second, we observed a negative correlation between MISRA rule violations and observed faults. In addition, 29 out of 72 rules had a zero true positive rate. Taken together with Adams' observation that all modifications have a non-zero probability of introducing a fault, this makes it possible that adherence to the MISRA standard as a whole would have made the software less reliable.}}

==See also==
* [[Programming style]]

==References==
{{Reflist|30em}}

==External links==
* {{official website}}
* {{cite web | url = https://www.embedded.com/introduction-to-misra-c/ | title = Introduction to MISRA C | date = July 2002 | publisher = embedded.com }}
* {{cite web | url = http://electronicdesign.com/embedded/misra-c-safer-better | title = MISRA C: Safer Is Better | date = 3 February 2003 | publisher = Electronic Design magazine }}
* {{cite web | url = http://www.knosof.co.uk/misracom.html | title = Commentary on the first edition of the MISRA C guidelines | publisher = knosof.co.uk }}
* {{cite web | url = http://electronicdesign.com/dev-tools/new-version-misra-c-why-should-you-care | title = New Version of MISRA C: Why Should You Care? | date = 25 February 2013 | publisher = Electronic Design magazine }}
* {{cite web | url = http://electronicdesign.com/dev-tools/misra-c2012-plenty-good-reasons-change | title = MISRA C:2012: Plenty Of Good Reasons To Change | date = 25 February 2013 | publisher = Electronic Design magazine }}
* {{cite web | url = http://www.programmingresearch.com/content/misc/PRQA-MISRAC2012-FactSheet.pdf | title = MISRA C:2012 fact sheet | publisher = programmingresearch.com }}
* {{cite web | url = http://www.automotive-eetimes.com/en/design-center/full-design-center.html?cmp_id=71&news_id=222902845 | title = MISRA C:2012 ensures automotive software safety | publisher = EE Times magazine }}
* {{cite web | url = http://www.mathworks.com/solutions/automotive/standards/misra-c.html | title = Compliance to MISRA C: Code Generation | publisher = Mathworks}}

{{C programming language}}
{{Embedded systems}}

[[Category:C (programming language)]]
[[Category:C programming language family]]
[[Category:Embedded systems]]
[[Category:Hinckley and Bosworth]]
[[Category:History of computing in the United Kingdom]]
[[Category:Programming language standards]]
[[Category:Science and technology in Leicestershire]]