What You Need to Know About the Next MISRA® Standard: Introduction to MISRA C++:2023®

MISRA C++:2023® is the widely anticipated next version of the MISRA C++ standard. The new version integrates the AUTOSAR C++ 14 guidelines and support more recent versions of C++.

The MISRA® set of C and C++ coding guidelines are some of the best standards not just for the Automotive industry, but any industry that uses embedded systems. 

To help you prepare for the recent release, we’re kicking off a blog series with an overview of MISRA C++:2023 by our MISRA expert, Dr. Frank van den Beuken, who contributed to the public review.

Read along or jump ahead to the section that interests you most:

The last version of MISRA C++ was first published in 2008. It provides expert guidance for the development of safety-related software written in ISO C++ 2003. This set of guidelines has been widely adopted and compliance has become mandatory in many safety-critical projects. However, since then, the C++ language has changed considerably, with new versions introducing new language features and changing existing ones.

Projects using more recent C++ language versions may not comply with all MISRA C++:2008 rules, and new features may not be covered by them. To provide guidelines for these later versions, AUTOSAR developed new guidance for C++14, based on MISRA C++:2008 but enhanced with rules from other standards. The MISRA C++ Working Group is currently working on an update to MISRA C++ applicable to C++17 based on the AUTOSAR guidelines but encompassing MISRA’s established best practices for safety-related C++ development. 

There is much interest in the new MISRA C++ guidelines. However, as MISRA C++:2008 has been adopted by many projects, there are some concerns regarding the effects of switching to the new guidelines.

MISRA C++:2023® Blog Series Preview

In this blog series we will discuss a number of aspects of the new standard.

History of C++ and MISRA C++

Finally, we will devote some blogs to a number of novel guidelines.

 MISRA C++:2023 will provide rules with guidance for defining the interface of class types. It promotes the "Rule of Zero," meaning that it prefers not to specify special member functions for which the language standard already guarantees that the compiler already provides the intended implementation.

This contradicts other guidance like the “Rule of Five” (or "Six" if you also count the default constructor separately), which states that you need to always explicitly specify all special member functions. We will discuss how the new rule addresses the vulnerabilities covered by existing guidance. 

However, there is also a risk to that, as can be seen with the compliant example that is provided for AUTOSAR Rule A12-0-1:

class A // Compliant - the class A follow the "Rule of six" rule 
    { 
    public: 
      A(); // Non-default constructor 
      ~A() = default; 
      A(A const&) = default; 
      A& operator=(A const&) = default; 
      A(A&&) = delete; 
      A& operator=(A&&) = delete; 
    }; 

We can see that only the move functions are deleted, and the copy functions and destructor are defaulted. Code like this may be the result of a developer extending code that followed the “Rule of Three” to “Rule of Five”, but attempting to preserve old behavior by deleting the new move functions. This combination of special member functions will not be allowed by MISRA C++; if a class provides copy functions, it must also provide move functions. The problem with the class is that it cannot be used with containers, e.g., when attempting to declare a vector of the type, a compilation error will occur because of the missing move functions. Note that this example was corrected in the 18-03 release of the AUTOSAR standard, and the wording of the rule was also changed but does not explicitly require move functions to be provided when copy functions are available. 

MISRA C++:2023 will have guidelines that restrict the use of standard conversions. Developers who are familiar with MISRA C:2012 may expect to have similar type conversion rules as defined with MISRA C essential types—but that is not the case. 

MISRA C++:2023 is much stricter, and for a reason: As opposed to C, C++ provides function overloading, which depends on the exact type of expression and the auto placeholder type specifier, where the type is derived from an expression. When the rules are not obeyed, it may be that including a header file contributes a function overload that matches better than the function matched before, which is probably unexpected. There is a safe way to avoid implicit conversion by using a type-safe enumeration type with an integral underlying type. Values of such strong types are not subject to an implicit conversion.

Ensure MISRA Compliance with Helix QAC