The Motor Industry Software Reliability Association MISRA C++:2008 Guidelines for the use of the C++ language in critical systems Licensed to: Insigma Rail Transport. Engineering Co. He Yulin. 12 Oct 2010. Copy 1 of 1 June 2008 First published June 2008 MIRA Limited Watling Street Nuneaton Warwickshire CV10 0TU UK www.misra-cpp.com © MIRA Limited, 2008. “MISRA”, “MISRA C” and the triangle logo are registered trademarks of MIRA Limited, held on behalf of the MISRA Consortium. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical or photocopying, recording or otherwise without the prior written permission of the Publisher. ISBN 978-1-906400-03-3 paperback ISBN 978-1-906400-04-0 PDF Printed by Hobbs the Printers Ltd British Library Cataloguing in Publication Data. A catalogue record for this book is available from the British Library This copy of MISRA C++:2008 - Guidelines for the use of the C++ language in critical systems is issued to He Yulin of Insigma Rail Transport. Engineering Co. at No.9 Hangda Road, Hangzhou, Zhejiang, 310007. The file must not be altered in any way. No permission is given for distribution of this file. This includes but is not exclusively limited to making the copy available to others by email, placing it on a server for access by intra- or inter-net, or by printing and distributing hardcopies. Any such use constitutes an infringement of copyright. MISRA gives no guarantees about the accuracy of the information contained in this PDF version of the Guidelines. The published paper document should be taken as authoritative. Information is available from the MISRA web site on how to purchase printed copies of the document. Licensed to: Insigma Rail Transport. Engineering Co. He Yulin. 12 Oct 2010. Copy 1 of 1 The Motor Industry Software Reliability Association MISRA C++:2008 Guidelines for the use of the C++ language in critical systems June 2008 i Licensed to: Insigma Rail Transport. Engineering Co. He Yulin. 12 Oct 2010. Copy 1 of 1 MISRA Mission Statement: To provide assistance to the automotive industry in the application and creation within vehicle systems of safe and reliable software. MISRA, The Motor Industry Software Reliability Association, is a collaboration between vehicle manufacturers, component suppliers and engineering consultancies which seeks to promote best practice in developing safety-related electronic systems in road vehicles and other embedded systems. To this end MISRA publishes documents that provide accessible information for engineers and management, and holds events to permit the exchange of experiences between practitioners. www.misra.org.uk Disclaimer Adherence to the requirements of this document does not in itself ensure error-free robust software or guarantee portability and re-use. Compliance with the requirements of this document, or any other standard, does not of itself confer immunity from legal obligations. ii Licensed to: Insigma Rail Transport. Engineering Co. He Yulin. 12 Oct 2010. Copy 1 of 1 Foreword “C makes it easy to shoot yourself in the foot; C++ makes it harder, but when you do it blows your whole leg off.” — Bjarne Stroustrup Few could have predicted the effect that MISRA C would have within embedded systems engineering. Since its launch in 1998, it has become the dominant coding standard used for the development of critical systems with the C programming language. Given this success, the fact that C++ is now being used within critical systems (e.g. the Joint Strike Fighter, jet-engine controllers and medical systems), and that there is currently no universally accepted set of guidelines for its use in these systems, MISRA committed itself to the development of a similar set of guidelines for C++. To that end, the MISRA C++ Working Group was established towards the end of September 2005. Its objectives were to: • Produce, using techniques similar to those within MISRA C, a C++ subset suitable for use in critical systems; • Gather existing C++ guidelines from many diverse sources into a single repository; • Add new guidance so as to significantly enhance the state-of-the-art; • Establish a single, generic set of guidelines for the use of C++ in critical systems; • Produce guidelines that are understandable to the majority of programmers. The work to produce the guidelines made a rapid start, and was greatly assisted by the many in- house coding standards that were made available to the group — thanks are due to all those who contributed. These, and the guidelines available from other sources, formed a solid foundation on which to base many rules. Focus then moved on to the production of guidelines for Templates, Inheritance and Exception Handling, with these areas being specifically targeted as the existing state-of-the-art did not provide adequate coverage. The issues associated with Unnecessary Constructs were also selected for investigation. This document contains the results of these activities. The group hopes that MISRA C++ will go on to become as successful and widely-adopted as MISRA C. Finally, I would like to give my personal thanks to all of those who sat on the Working Group. I have, as always, learnt a lot from them during the development process. I just hope I have managed to put enough back into the project to repay part of the debt I owe them all. Chris Tapp, BSc (Hons), MIEE MISRA C++ Chairman 15 April 2008 iii Licensed to: Insigma Rail Transport. Engineering Co. He Yulin. 12 Oct 2010. Copy 1 of 1 Acknowledgements The MISRA consortium would like to thank the following individuals for their significant contribution to the writing of this document: Richard Corden Programming Research Ltd Mike Hennell LDRA Ltd Derek Jones Knowledge Software Ltd Keith Longmore Lotus Cars Ltd Clive Pygott QinetiQ Ltd Chris Tapp Keylevel Consultants Ltd The MISRA consortium also wishes to acknowledge contributions from the following individuals during the development and review process: Dave Banham Al Grant Frank Martinez John Ridgway Martin Beeby Christopher Hall Jason Masters Iris Rödder Fergus Bolger Frank Haug Jürgen Mottok Walter Schilling Martin Bonner Stefan Heinzmann Chris Mycock Ben Smith Michael R. Bossert Robert Hooper Tadanori Nakagawa Andreas Stangl Antonio Cavallo Elmar Hufschmid Hans Odeberg Toshihiro Tajima Ian Chalinder Paul Jeary Charles Osborn David Ward Kwok Chan Josef Kollar Rob Pearce Andrew Warren Valéry Creux Albert Kreitmeyr PremAnand M Rao Andrew Watson David Crocker Fred Long Derek Reinhardt Ashley Wise Thomas M. Galla Andreas Ludwig David Reversat iv Licensed to: Insigma Rail Transport. Engineering Co. He Yulin. 12 Oct 2010. Copy 1 of 1 Contents 1. Background ........................................................................................................................... 1 1.1 The use of C++ in critical systems .................................................................................. 1 1.2 Language insecurities and the C++ language .................................................................. 1 1.2.1 The developer makes mistakes ............................................................................... 1 1.2.2 The developer misunderstands the language .......................................................... 2 1.2.3 The compiler does not do what the developer expects ........................................... 2 1.2.4 The compiler contains errors .................................................................................. 2 1.2.5 Run-time errors ...................................................................................................... 2 1.3 The use of C++ for safety-related systems ...................................................................... 2 1.4 C++ standardization ......................................................................................................... 3 2. The vision ............................................................................................................................. 4 2.1 Rationale for the production of MISRA C++ .................................................................. 4 2.2 Objectives of MISRA C++ .............................................................................................. 4 3. Scope .................................................................................................................................... 5 3.1 Base language issues ........................................................................................................ 5 3.2 Issues not addressed ......................................................................................................... 5 3.3 Applicability .................................................................................................................... 5 3.4 Prerequisite knowledge .................................................................................................... 5 3.5 Library issues ................................................................................................................... 5 3.6 Auto-generated code issues ............................................................................................. 6 4. Using MISRA C++ ............................................................................................................... 7 4.1 The software engineering context .................................................................................... 7 4.2 The programming language and coding