EN
Back to the archive

The encyclopedia · Engineering & Operations · Technical decision · 1998–2004

MISRA C turned C coding rules into a checkable standard for safety software

MISRA C's 1998 rule subset made safety-critical C checkable; ISO 26262 and AUTOSAR now cite it and static analyzers enforce it.

MISRA Consortium

the move

As cars filled with embedded software, suppliers needed a way to keep C programs reliable. The MISRA project started in 1990, and the first edition of MISRA C appeared in 1998: a set of guidelines defining a safe subset of C, originally targeted at the automotive sector.

The design choice was enforceability. Rules are classified as mandatory, required or advisory, with a documented deviation process for justified exceptions, so a compliance claim is auditable rather than aspirational. The arXiv survey describes MISRA C as a coding standard defining a subset of the C language, initially targeted at the automotive sector but now adopted across all industry sectors that develop safety- or security-critical C software.

Adoption became contractual: ISO 26262, the automotive functional-safety standard, cites MISRA C, and AUTOSAR requires C implementations to conform to it; the Joint Strike Fighter and NASA JPL coding standards were based on earlier editions. Static analyzers turned the rules into an automated check.

why it works

  • A defined subset of C removes the language's most dangerous corners
  • Mandatory, required and advisory rules make compliance auditable
  • Static analyzers can check the rules automatically
  • ISO 26262 and AUTOSAR cite it, making it a contractual requirement
the payoffA finite rule set makes C code checkable and safeclever

what transfers

Safety standards spread when compliance becomes contractual: a finite, mechanically checkable rule set is far easier to enforce than a vague best-practices essay.

what came after

MISRA C:2012 (revised 2023) is the current edition, adopted beyond automotive into aerospace, medical devices, telecom, defense and railway; every major static-analysis vendor ships MISRA checking.

references

spotted an error? The archive wants to know.

same kind of clever