Welcome, Guest
You have to register before you can post on our site.

Username
  

Password
  





  Rule 19.4 -TC1 example incorrect?
Posted by: Graham Andrews - 17-04-2008, 04:19 PM - Forum: 6.19 Preprocessing Directives - Replies (1)

The rule states that C macros shall only expand to ...
This implies that the rule should only be invoked when the macro is expanded.
So for the not compliant example

Code:
#define CAT PI  /* non-parenthesised expression */
A checking tool should not attempt to check the violation until the macro is used.
In fact when CAT is being processed for expansion, it requires PI to be expanded. PI expands to 3.14159F, which is a constant, so its expansion is o.k. The expansion of CAT looks for other preprocessing tokens after PI has been substituted. There are no more tokens, so CAT expands to 3.14159F and is therefore not in violation of rule 19.4.
If the example had been written as
Code:
#define CAT PI + PI
Then the expansion of CAT would be to a non-parenthesised expression and rule 19.4 violated.

Print this item

  Rule 8.9 and macros
Posted by: william.forbes - 02-04-2008, 07:12 AM - Forum: 6.8 Declarations and Definitions - Replies (5)

I believe that a macro has no linkage and is not an object and therefore is not covered by rule 8.9 (or indeed rule 8.4)

My problem is that C allows for multiple definitions of the same macro provided that the definitions are identical:

#define BILL some text
.
.
.
#define BILL some text

As far as I can tell, the above is legal C code and appears to not violate any MISRA rule. This is obviously undesirable!

Is my understanding correct or is there a MISRA rule to forbid such code?

Thanks,
Bill Forbes.

Print this item

  MISRA-C: 1998 rule 107 rescinded
Posted by: richardb - 18-03-2008, 11:33 AM - Forum: MISRA-C:1998 to MISRA-C:2004 migration - Replies (1)

Can anyone tell me why the original MISRA-C rule 107 was rescinded in MISRA-C2? It related to not dereferencing the null pointer.
Thanks,
Richard.

Print this item

  Rule 3.6: Reserved words and standard library function names
Posted by: tria1312 - 12-03-2008, 11:39 AM - Forum: 6.3 Documentation - Replies (4)

Hi,

I'm using a tool from the USA called codechk.

When performing check on my code I get this message:

Code:
u16_t f29( void );
Quote:error: (REQUIRED) MISRA rule 116 ( 3.6 ) violated: Reserved words and standard library function names shall not be used { DECL }

But I dont see any reserved words or standard library function names. Can anyone help me out? Do you need some more code or infos?


Bjoern

Print this item

  Question regarding Integrity Analysis
Posted by: david ward - 04-03-2008, 12:42 PM - Forum: MISRA SA discussions - Replies (1)

The following question has been received by MISRA and is posted on behalf of the questioner:

Quote:Both the MISRA Integrity Report and the Safety Analysis Guidelines refer to the following probabilities:

Reasonably Possible
Unlikely
Remote
Very Remote
Extremely Improbable

However there is never an explicit definition of the probablities associated with these categories and the categories do not directly map onto the probabilities defined in Table A.2 of the integrity report. Are there explicit definitions for these categories or can I assume the following?

Probable = Reasonably Possible
Occasional = Unlikely
Remote = Remote
Improbable = Very Remote
Implausible = Extremely Improbable

Print this item

  Misra rule 42
Posted by: JeroenBoonen - 28-02-2008, 09:45 AM - Forum: General Questions - Replies (2)

Hi,

I have a question concerning rule 42, which states : \"comma operator shall not be used, except in the control expression of a for loop\".

Now what is \"the control expression\" in following instruction : for(i = 0; i < 10; i++) {...}

Is it \"i = 0\" or \"i < 10\" or \"i++\" ?

Currently we use a GreenHills compiler with build-in misra checking and they are saying it is \"i < 10\".
Searching on google:
IAR and ABRAXAS says it is \"i = 0\" and \"i++\"

Now hopefully you can give me the correct answer.

Thank you,

Jeroen

Print this item

  Rule 9.2 in TC1
Posted by: Lundin - 20-02-2008, 02:53 PM - Forum: 6.9 Initialisation - Replies (1)

I question the practical use of the text added to rule 9.2 in TC1. According to that rule, zero initialization of an array or struct can only occur at top level.

How do you write MISRA-C compatible code for this case:

Code:
typedef struct
{
  BOOL enabled;
  uint8_t buffer [5000];

} DataBuffer;


DataBuffer db = {TRUE};            /* not compliant, non-zero initialization */
DataBuffer db = {TRUE, {0} };      /* not compliant, zero initialization at sub level*/

DataBuffer db = {TRUE, /* what goes here? */ };

As the rule is now, the programmer who happens to have a data structure like the one above will have to type out 5000 zeroes in his source file to conform to MISRA-C.

I don't see why the second of those lines can't be allowed. The two non-compliant examples above are perfectly safe and will set the whole buffer to zero. ISO C is clear:

ISO 9899:1999, chapter 6.7.8 Initialization Wrote:21 If there are fewer initializers in a brace-enclosed list than there are elements or members of an aggregate, or
fewer characters in a string literal used to initialize an array of known size than there are elements in the array,
the remainder of the aggregate shall be initialized implicitly the same as objects that have static storage duration.
(I can only cite C99, not C90, though they are identical in this case)

The buffer is implicitly initialized as if it had static storage duration and is therefore set to zero.

The argument "the struct can be initialized to zero and the Boolean member can then be set to TRUE in runtime" is not valid, as the struct might be const.

Print this item

  Example for rule 11.1
Posted by: stefansta - 20-02-2008, 12:21 PM - Forum: MISRA-C:2004 Exemplar Suite - Replies (2)

Hello,
I have a question according to the example for the rule 11.1 (mc2_1101.c). My misra checker detects that the line \"pif32 int32p_fun = &get_int32\" violates rule 11.1, but I think this line is correct.
Am I right?

Print this item

  Rule 10.5
Posted by: Lundin - 15-02-2008, 09:14 AM - Forum: 6.10 Arithmetic Type Conversions - Replies (4)

First of all, in the explaining text to Chapter 6.10 you can read the following below \"Balancing conversions\":

\"Notice that the operands of the bitwise shift operators (>) are not balanced. The type of the result is the promoted type of the first operand.\"

The balancing refers to the \"usual arithmetic conversions\" and I believe that the text is correct.

Then in the example for rule 10.5 the following code is posted:

Code:
uint8_t port = 0x5aU;
uint8_t result_8;
uint16_t result_16;

result_8 = (~port) >> 4;  /* not compliant */
...
result_8 = ((uint8_t)(~port)) >> 4; /* compliant */
result_16 = ((uint16_t)(~(uint16_t)port)) >> 4; /* compliant */

The last line with result_16 is incorrect and not compliant to rule 10.5 nor rule 10.3. The result of that line will be 0x0FFA and not 0x000A.

The rule 10.5 states that the result of an expression shall be immediately cast to the underlying type. Underlying type is defined as the type an expression would have if not for the integer promotions. If not for the integer promotions, the type of the expression (~port) would be uint8_t and the type of the expression (~port) >> 4 would be also be uint8_t, since the usual arithmetic conversions aren't used, see the text on top of this post.

First error in that line:

~(uint16_t)port

The operand is casted instead of the result.

Second error on that line:
The result is not casted to the underlying type which is uint8_t.

Third error on that line:
result_16 = (uint16_t) ...

The result is not casted to the underlying type of the expression
\"uint8_t result\" >> 4
which is uint8, since the usual arithmetic conversions aren't used on shift operators.

So not only does the line break rule 10.5, it also breaks rule 10.3 in MISRA C:2004 TC1: \"The value of a complex expression of integer type shall only be cast to a type of the same signedness that is no wider than the underlying type of the expression\".

I believe that the correct line will look like this:

Code:
result_16 = (uint8_t) ( ((uint8_t)~port) >> 4U ); /* compliant */
However, that line looks quite horrible. I suggest that the following code is used instead:

Code:
result_8  = (uint8_t) ~port;
result_16 = (uint8_t) (result_8 >> 4U);

Print this item

  Rule 16.4
Posted by: Lundin - 04-02-2008, 02:22 PM - Forum: 6.16 Functions - Replies (3)

I wonder if rule 16.4 fills a purpose, as it seems to be well-covered by several other MISRA rules.

\"16.4 The identifiers used in the declaration and definition of a function shall be identical.\"

\"8.3 For each function parameter the type given in the declaration and definition shall be identical, and the return types shall also be identical.\"

8.3 has both the parameters and the return type covered, all is fine there. Therefore I assume that rule 16.4 only applies to the function name itself. Ie it would be interpreted as \"the function identifier used in declaration and definition shall be identical\".

So as far as I understand it, rule 16.4 would only apply when the names in the function definition and the declaration are different, ie the scenario where the function definition is \"apples\" but the function declaration is \"bananas\" (although their parameters and return types are identical, as covered by rule 8.3):

Code:
static void apples  (uint8_t n);

static void bananas (uint8_t n)
{

}

int main()
{
  apples(x);  /* A linker error will occur, apples() isn't found and the program won't be executed. */

  bananas(x); /* This will work fine but the prototype \"apples\" is redundant. */
}

The above behavior is the same if the function definition is placed in a h-file and the function is called from another file.

The \"bananas\" case will never result in faulty program behavior, assuming rule 8.3 is fulfilled. Also, this case would violate rule 8.1 \"Functions shall have a prototype...\". And if the bananas function had been placed below main() instead of above, the code wouldn't even compile.

So I fail to see the point of rule 16.4, it seems redundant to me.

Print this item

Search Forums

(Advanced Search)

Forum Statistics
» Members: 6,309
» Latest member: 1fuhd
» Forum threads: 1,066
» Forum posts: 2,933

Full Statistics

Online Users
There are currently 115 online users.
» 0 Member(s) | 111 Guest(s)
Bing, Facebook, Google, UptimeRobot

Latest Threads
13.2 Was TC2 correctly ap...
Forum: 8.13 Side effects
Last Post: misra-c
08-10-2026, 12:47 PM
» Replies: 1
» Views: 624
20.12 Does the stringific...
Forum: 8.20 Preprocessing directives
Last Post: misra-c
08-10-2026, 12:40 PM
» Replies: 1
» Views: 554
13.3 Should side effects ...
Forum: 8.13 Side effects
Last Post: misra-c
08-10-2026, 12:37 PM
» Replies: 1
» Views: 426
11.6 pointer to pointer t...
Forum: 8.11 Pointer type conversions
Last Post: misra-c
08-10-2026, 12:21 PM
» Replies: 2
» Views: 1,032
What is the UTLR of -1?
Forum: 8.10 The essential type model
Last Post: misra-c
08-10-2026, 12:15 PM
» Replies: 1
» Views: 597
10.3 Clarify if narrower ...
Forum: 8.10 The essential type model
Last Post: misra-c
08-10-2026, 11:57 AM
» Replies: 1
» Views: 508
It 8.12 intended to be so...
Forum: 8.8 Declarations and defnitions
Last Post: misra-c
08-10-2026, 11:50 AM
» Replies: 1
» Views: 455
Rule 0.1.1 Example f4
Forum: 4.0 Language independent issues
Last Post: cgpzs
07-10-2026, 11:07 AM
» Replies: 3
» Views: 719
Rule 6-2-2 Usage of std::...
Forum: 6.6 Statements (C++)
Last Post: misra cpp
25-09-2026, 05:43 PM
» Replies: 1
» Views: 435
M5-0-4 switch over unscop...
Forum: 6.5 Expressions (C++)
Last Post: misra cpp
25-09-2026, 01:00 PM
» Replies: 3
» Views: 532