Motor Control Lighting Development Tools Motor ... - ICC Media GmbH

TOOLS & SOFTWAREThe launch of the newMISRA C: 2012 (MISRA C3) GuidelinesPaul Burden, Senior Technical Consultantand PRQA representative on the MISRAworking committee, talked about the newguidelines with ECE Magazine editorWolfgang Patelay.ECE: So, Paul, give me a bit of backgroundto MISRABurden: The MISRA mission statement speaksof providing assistance to the automotive industryin the application and creation withinvehicle systems of safe and reliable software.MISRA has published a variety of documentsover the years. It has contributed significantlyto developments in functional safety, particularlythe ISO 26262 standard, and the developmentof coding guidelines for C and C++ -MISRA C and MISRA C++. MISRA C wasfirst published in 1998. It provided some badlyneeded guidance to engineers, often with verylimited experience in software engineering, ata time when software reliability was becominga critical issue. To start with, it was a modestinitiative within the UK motor industry, but itrapidly developed into a project of major significance.A second version of MISRA C appearedin 2004, and a third version, MISRAC:2012, was launched on 18 March 2013.ECE: So how significant is this particularupdate to the MISRA C coding guidelines?Burden: A lot of work has gone into the latestversion and the result is a better document.MISRA C has a large following and I wouldexpect the new version to be of interest to anyonedeveloping systems in C who cares aboutsoftware quality.ECE: But why was it necessary to produceanother edition?Burden: It is not an easy decision to changesomething that is widely accepted and widelyused, so there had to be a good reason to bringout a new version of MISRA C. In fact, therewere several key reasons: support for C99, respondingto user feedback and an acknowledgementthat improvements could be made.Paul Burden,Senior TechnicalConsultant andPRQA representativeon the MISRAworking committeeECE: Is MISRA C just an automotivestandard?Burden: Not at all. MISRA C is now in useworldwide. It is used in a wide range ofdifferent industries – aerospace, defence, medicalinstruments, process control, nuclear power,consumer electronics and critical systems infinance. It is the most widely used set ofcoding guidelines for development in the Clanguage.ECE: So what are the key differencescompared to the previous version?Burden: There are the following five main differences.First the language: C has evolved.Support is now provided for C99 as well asC90. Second the document structure: MISRAC3 includes 16 directives and 143 rules. Compliancewith a rule can be determined solelyfrom analysis of the source code. Compliancewith a directive may be open to some measureof interpretation or may, for example, requirereference to design or requirements documents.Third the deviation classification: Each directiveor rule is classified as Mandatory, Required orAdvisory.Deviations are optional for Advisory rules butcompulsory for Required rules – as in MISRAC:2004. Mandatory rules may not be deviated– ever! No circumstances are envisaged whereit would ever be desirable or necessary toviolate these rules. Fourth the analysis scope:Compliance with many rules can be assuredby analysis of the code in each translationunit in isolation. Other rules require analysisof all code in the program. Each rule is nowclassified explicitly as either a single translationunit rule or a system rule. This distinction isimportant for two reasons.Firstly because ensuring compliance with systemrules requires more extensive analysis; andsecondly because some system rules are undecidable.If a rule is undecidable, no tool, howeversophisticated, can guarantee to identify everynon-compliance. And last but not least fifththe improved rule definition: Rules are nowmore rigorously defined and better explained.ECE: What does this mean for legacy codewhich is already MISRA C:2004 compliant?Burden: Each version of MISRA C has beenlarger than the last but the number of ruleshas not increased greatly. In MISRA C:2012 afew new rules have been added – mainly forC99, and a few have been removed or redrafted.The document is larger, mainly because ofmany improvements in the explanation anddefinition of rules. There are new requirementsbut these are relatively few and code whichcomplies with MISRA C:2004 is likely to complywith MISRA C:2012 with relatively littlemodification.ECE: Are there any pre-approved/validated/ -certified MISRA C3 checker tools available?Burden: No, MISRA does not endorse toolsor provide certification services. However,TERA-Labs, a division of the University ofAntwerp, recently completed a comparativestudy of 8 MISRA C checking tools. Our product,QA C, was confirmed as the best codeanalysis tool for enforcing MISRA C2 complianceand we have continued to build on thislead in our enforcement of MISRA C3.ECE: So are PRQA tools ready to supportMISRA C3?Burden: Yes! We announced at EmbeddedWorld availability of our MISRA C:2012 compliancemodule for QA C and we were readyto start supporting customers as soon as theGuidelines were published. 23 April 2013