Objectives of Coding Standards MISRA C Clive Pygott

Objectives of Coding Standards & MISRA C++ Clive Pygott, Systems Assurance Group, Qineti. Q Chris Tapp, Keylevel Consultants & MISRA C++ chair © Copyright Qineti. Q limited 2006

DARP Workshop April 2006 Conclusions Participants at the last Defence Aerospace Research Partnership C++ workshop were asked: ‘what do you want to see in a generic software vulnerabilities standard’ • Predictability: behaviour, time, memory usage • A requirement for more precise definition of the language/subset to be used in a high integrity environment • A requirement for a more structured and capable means of recording ‘intent’ and invariants in source code Verification • A requirement for a means of collecting data on the effectiveness of any high-integrity guidelines © Copyright Qineti. Q limited 2006 2

Reasons for coding standards • To avoid undefined behaviour • To avoid implementation defined behaviour • To improve clarity for review and maintenance • To provide a consistent style across a program or set of programs • To avoid common programmer errors • To incorporate good practice, particularly with regard to ‘future proofing’ © Copyright Qineti. Q limited 2006 3

4 Who are MISRA? • Motor Industry Software Reliability Association • Started in 1990 • Mission: “to provide assistance to the automotive industry in the creation and application of safe and reliable software in vehicle systems” • The original project was part of the UK Government’s “Safe. IT” programme • Now self-supported – and used far outside the automotive industry © Copyright Qineti. Q limited 2006

5 MISRA C++ • Extension of MISRA-C • No language feature totally barred (except goto – for a better reason than in MISRA-C) • Target date for draft for peer review – January 2007 • Being developed by a working group including – Software safety consultants/researchers – Tool vendors – Users © Copyright Qineti. Q limited 2006

MISRA C++ sources • Identification of Issues – Qineti. Q Vulnerabilities Report • Evaluation of Existing Material – Other Coding Standards • MISRA-C • JSF++ • Medical Systems • Transportation • Tool Vendors (‘real world’ experience). – Other Publications • Scott Meyers • Stephen Dewhurst • Etc. © Copyright Qineti. Q limited 2006 6

MISRA C++ Aims • Predictability – mostly functional • Portability • Clarity for review/maintenance • Avoiding common errors Not systematically addressed • Predictability – temporal, memory usage Not • Consistency of style • Good practice/future proofing © Copyright Qineti. Q limited 2006 7

8 MISRA C++ (&C) rule structure • Rule Structure – Rule Number and category (Mandatory…) – Headline Text • (should be) precise and testable – Issue and Existing Material References – Explanation of the issue(s) and rule justification. – Examples of non-conforming and, where appropriate, conforming code. – Expected deviations (if appropriate and may include ‘none’!) © Copyright Qineti. Q limited 2006