Safety and Security Safety-critical software: MISRA C++:2023 from A to Z

Related Vendor

Wuxi InfiMotion Technology Co., Ltd.

MISRA C++:2023 supports companies that use the programming language C++ in the development of safety-critical software. With the new MISRA standard, developers can meet the requirements for static analysis specified by functional safety standards such as ISO 26262, by ensuring and documenting the MISRA compliance of their software applications.

Michał Rozenau is an active member of the MISRA C and MISRA C++ working groups and a project engineer at Parasoft.

AUTOSAR and MISRA have jointly developed a set of programming guidelines that enable secure programming with C++17. The published document is titled MISRA C++:2023. MISRA C++ consists of a collection of coding guidelines that define a subset of the C++ language for use in critical systems, to minimize the risk of errors and non-conforming programs.

The C++ Standard does not completely define the language. There are situations where behavior is undefined, unspecified, or implementation-defined. If a C++ program is based on such situations, there's no guarantee that it will behave predictably or be portable. This is exactly where the MISRA guidelines come into play – they help identify such situations to ensure the safety and reliability of the software. Additionally, compliant programs can be written in a way that clearly indicates an error in the code or is highly likely to be misinterpreted by developers. The MISRA guidelines target such cases.

Gallery

The development of MISRA C++

The first version of MISRA C++ from 2008 focused on C++03 and was very popular, but it was overtaken by the further development of C++ and new features in C++11. To close this gap, the AUTOSAR consortium published the AUTOSAR C++ Guidelines as part of the Adaptive Platform in March 2017.

Adaptive AUTOSAR uses C++14 as its language of choice, and the platform needed a safety-oriented coding standard to support developers. About 70 percent of the unchanged MISRA C++2008 guidelines were adopted in AUTOSAR C++. With the continuous evolution of the language, there are 17 new language features for C++, which generated a need for new programming guidelines. MISRA and AUTOSAR decided to consolidate the standards in one publication, and MISRA undertook the work on the new edition of the standard with all necessary updates for C++17. The result of this work is MISRA C++:2023, released in October 2023.

Guidelines and rules

MISRA C++:2023 Guidelines are classified as rules or guidelines (directives). Rules are those guidelines that contain a complete definition of conformity and non-conformity. For guidelines, it is not possible to provide the complete description required for a conformity check because, for example, they depend on design decisions made within the context of a specific project.

Every guideline is assigned to one of the following categories:

• mandatory

• required

• advisory

Rules/directives are also classified according to decidability and scope.

Mandatory guidelines must be followed without the possibility of deviation. Deviations from required guidelines are possible – provided that the formal deviation procedure is followed and all potential issues are resolved otherwise. Advisory guidelines are a kind of recommendation that should be followed as much as possible.

"Decidability" defines whether the rule can generally be analyzed by automated tools or not. "Scope" indicates whether a guideline should be checked through the analysis of a single translation unit or the entire system.

There are 179 MISRA C++:2023 Guidelines, four directives and 175 rules, which are grouped into sections that correspond to the sections of the C++ standard. These are:

• Basic concepts

• Standard conversions

• Expressions

• Statements

• Special member functions

• Exception handling

Some of these rules are derived from the AUTOSAR Coding Guidelines or the old MISRA C++:2008. However, the MISRA guidelines focused solely on implementation, whereas AUTOSAR also provided recommendations for design, toolchain infrastructure, or documentation. Generally, MISRA C++:2023 focuses on the semantics of the code and error avoidance without imposing too many stylistic requirements.

Conformance with MISRA C++:2023

According to MISRA C++:2023, the conformance processes defined in the compliance document must be adhered to. This is a separate document that is shared by the MISRA C and MISRA C++ standards. The latest version was published in 2020 and replaces the previous version from 2016.

MISRA Compliance contains a collection of requirements for the conformance process and reporting. It defines specific reports that are expected as compliance artifacts.

• The Guideline Enforcement Plan defines all technical means used to enforce the guidelines.

• The Guideline Recategorization Plan describes all changes to the guideline categories that have been introduced for the specific project.

  Subscribe to the newsletter now

  Don't Miss out on Our Best Content

  Business E-mail

  Please enter a valid mailadress.

  Subscribe

  By clicking on „Subscribe to Newsletter“ I agree to the processing and use of my data according to the consent form (please expand for details) and accept the Terms of Use. For more information, please see our Privacy Policy. The consent declaration relates, among other things, to the sending of editorial newsletters by email and to data matching for marketing purposes with selected advertising partners (e.g., LinkedIn, Google, Meta)

  Unfold for details of your consent

  Date: 08.12.2025

  Naturally, we always handle your personal data responsibly. Any personal data we receive from you is processed in accordance with applicable data protection legislation. For detailed information please see our privacy policy.

  Consent to the use of data for promotional purposes

  I hereby consent to Vogel Communications Group GmbH & Co. KG, Max-Planck-Str. 7-9, 97082 Würzburg including any affiliated companies according to §§ 15 et seq. AktG (hereafter: Vogel Communications Group) using my e-mail address to send editorial newsletters. A list of all affiliated companies can be found here

  Newsletter content may include all products and services of any companies mentioned above, including for example specialist journals and books, events and fairs as well as event-related products and services, print and digital media offers and services such as additional (editorial) newsletters, raffles, lead campaigns, market research both online and offline, specialist webportals and e-learning offers. In case my personal telephone number has also been collected, it may be used for offers of aforementioned products, for services of the companies mentioned above, and market research purposes.

  Additionally, my consent also includes the processing of my email address and telephone number for data matching for marketing purposes with select advertising partners such as LinkedIn, Google, and Meta. For this, Vogel Communications Group may transmit said data in hashed form to the advertising partners who then use said data to determine whether I am also a member of the mentioned advertising partner portals. Vogel Communications Group uses this feature for the purposes of re-targeting (up-selling, cross-selling, and customer loyalty), generating so-called look-alike audiences for acquisition of new customers, and as basis for exclusion for on-going advertising campaigns. Further information can be found in section “data matching for marketing purposes”.

  In case I access protected data on Internet portals of Vogel Communications Group including any affiliated companies according to §§ 15 et seq. AktG, I need to provide further data in order to register for the access to such content. In return for this free access to editorial content, my data may be used in accordance with this consent for the purposes stated here. This does not apply to data matching for marketing purposes.

  Right of revocation

  I understand that I can revoke my consent at will. My revocation does not change the lawfulness of data processing that was conducted based on my consent leading up to my revocation. One option to declare my revocation is to use the contact form found at https://contact.vogel.de. In case I no longer wish to receive certain newsletters, I have subscribed to, I can also click on the unsubscribe link included at the end of a newsletter. Further information regarding my right of revocation and the implementation of it as well as the consequences of my revocation can be found in the data protection declaration, section editorial newsletter.

• The "Guideline Compliance Summary" documents the degree of conformity with each individual guideline.

Furthermore, the compliance document recommends a complete procedure for handling deviations, which includes requirements for recording deviations, the use of deviation permits, and a list of reasons for which deviations are permissible.

Standardized requirements to confirm the MISRA conformity of projects help companies to ensure an appropriate level of confidence and to combine conformity reports when multiple modules supplied by contractors are integrated. Prerequisite: A MISRA C/C++ code review has been carried out for each of these modules.

Some of the guidelines can be verified using the code review process, even though it is labor-intensive. Others, especially those that require analysis of the entire system, including guidelines that necessitate data and control flow analysis of the entire application source code, cannot practically be checked manually. Therefore, it is important to use automated static code analysis tools like Parasoft C/C++Test. These tools offer full support for MISRA C++:2023, analyzing the code against the appropriate guidelines and creating the relevant conformity documents.

MISRA C++:2023 and secure software

MISRA C++ aims to provide a safe subset of the C++ language. This is achieved through various requirements and restrictions on the C++ source code to improve the safety of applications.

Error avoidance

The C++ Standard specifies certain situations as undefined behavior, mainly to allow compilers to generate more efficient code. Compilers are allowed to assume that the situation of undefined behavior never occurs and make additional optimizations based on this assumption. This carries the risk of the program's behavior being unpredictable if the situation arises. And in some cases, this means that the program behaves correctly during test execution but fails in production, which can render the entire verification process meaningless. MISRA C++ provides guidelines that directly or indirectly protect against undefined behavior. An example of this is the evaluation of the indeterminate value of an object, which is prevented by "Rule 11.6.2 An object’s value shall not be read before it has been set."

Maintainability of the code

Certain aspects of the abstract machine are described in the C++ standard as implementation-defined. This means that the behavior of the code is well-defined. It must be documented, however, that it can vary from implementation to implementation.

However, it is not easy to port such a program to another target.

An example of such behavior is sizeof(int), which affects the behavior of arithmetic calculations. For instance, all operands with narrower types are promoted before the actual arithmetic operation. This can lead to different results of the arithmetic operation, depending on the compilation target. The MISRA C++ guidelines avoid such problems with their standard conversion rules.

Risk management

The MISRA guidelines also address a number of potential risks that can arise from confusion or misunderstanding by the developer about valid C++ source code. For example, the code if (x = y) is valid C++ code, but most likely the result of a typing error where the assignment operator was used accidentally instead of the equality operator. The "Rule 8.18.2 The result of an assignment operator shall not be used" ensures that such code is reported and checked for correctness.

Conclusion

The use of sensible programming guidelines and a safe language subset is not without reason required by the standards for functional safety. Companies that can demonstrate compliance with MISRA C++:2023 improve the safety of their C++ applications. (se)