Exercises — MISRA C — rules for safety-critical C code

Compliant nahi hai. Yeh Rule 21.3 (Required) violate karta hai — <stdlib.h> ke memory allocation/deallocation functions (malloc, calloc, realloc, free) use nahi hone chahiye. Kyun banned hai: dynamic allocation runtime par fail ho sakta hai, heap ko unpredictably fragment kar sakta hai, aur timing non-determinism inject kar sakta hai — yeh sab ek hard real-time system mein fatal hain (dekho Real-Time Operating Systems (RTOS)). Fix: compile-time bound ke saath static allocation karo.

#define BUF_LEN 64
int buf[BUF_LEN];

Rule 10.1 (Required) violate hota hai — bitwise/shift operators essentially signed operands par apply nahi hone chahiye. Kyun: ek signed value ko right-shift karna implementation-defined hai (compiler top bit ko sign bit se ya zeros se fill kar sakta hai). Negative int ka bit pattern two's-complement details par depend karta hai jis par kabhi rely nahi karna chahiye. Fix: operands ko unsigned banao.

unsigned int flags = 0xF0U;
unsigned int high  = flags >> 4;   /* logical shift, defined */

Compliant nahi hai. Rule 15.6 (Required) violate hota hai — selection/iteration statement ki body ek compound statement ({ }) honi chahiye. Trap: indentation jhooth bol rahi hai. Sirf arm() if se guarded hai; fire() unconditionally chalti hai. Yeh classic dangling-body bug hai. Fix:

if (ready) {
    arm();
}
fire();   /* now visibly unconditional */

Yeh write implicit signed→unsigned conversion par rely karta hai jo silently wrap karta hai. 32-bit unsigned int par, $-1$ ban jaata hai $2^{32}-1=4294967295=\text{0xFFFFFFFF}$. Yeh essential type model (Rule 10.3, Required) ko offend karta hai kyunki tum ek unsigned object ko signed constant assign kar rahe ho. Fix — intended pattern directly likho:

unsigned int u = 0xFFFFFFFFU;   /* value visible, no hidden wrap */

Ab $u=4294967295$ deliberately hai, aur reviewer intent dekh sakta hai.

Rule 18.7 (Required) violate hota hai — automatic storage wale object ka address kisi aisi cheez mein copy nahi hona chahiye jo use outlive kare. (Historical MISRA C:2004 Rule 17.6.) Kyun fatal hai: reading stack par rehta hai. Jaise hi get_reading return karta hai, woh stack slot free ho jaata hai reuse ke liye; returned pointer dangle karta hai. Dekho Memory Safety. Fix — value se return karo:

int get_reading(void) {
    int reading = 42;
    return reading;   /* a copy travels out, no address escapes */
}

Do problems hain, dono Rule 18.1 (Required) se — arithmetic se produce hone wala pointer same array ke element ko address karta rehna chahiye (one-past-the-end hold karna allowed hai lekin dereference karna nahi). Aakhri iteration par (i == 4) loop *p dereference karta hai jab p one past the end point karta hai — undefined behaviour aur garbage read. Fix: < n use karo, aur agar loop simple rakho toh raw pointer ki zaroorat hi nahi.

int data[4] = {1, 2, 3, 4};
int s = 0;
for (int i = 0; i < 4; i++) {   /* strictly less-than */
    s += data[i];
}
/* s == 10 */

Correct sum: $1+2+3+4=10$.

Promotion analysis. adc * 130 mein, adc (ek uint8_t) int mein promote hota hai aur 130 int hai, toh product int mein compute hota hai. adc = 255 ke liye: $255\times 130=33150$, kya yeh 16-bit int ke guaranteed range mein fit hota hai? Nahi — C standard sirf guarantee karta hai ki int $[-32767,32767]$ hold kare, aur $33150>32767$. 16-bit target par yeh signed int overflow → undefined behaviour hai. Yahi essential-type danger hai jiski MISRA warning deta hai: int ki width par rely karna. Fix: ek wide unsigned intermediate force karo taaki math defined aur portable ho. Neeche ke uint32_t/int16_t types bhi <stdint.h> se aate hain.

#include <stdint.h>
 
uint8_t  adc;
int16_t  celsius;
uint32_t scaled = ((uint32_t)adc * 130U);   /* defined, wide */
celsius = (int16_t)(scaled / 255U) - 40;

Values:

• adc = 255: $\lfloor 255\cdot 130/255\rfloor -40=130-40=90$.
• adc = 0: $0-40=-40$. Dono [-40, 125] mein hain, toh int16_t inhe safely hold karta hai.

$n=4$ exit paths hain (A, B, C, D). unlock sirf exit D se pehle hai.

• Exits A, B, C lock hold karte hue return karte hain → 3 buggy paths (next entry par deadlock).
• Exit D → 1 correct path. Exactly isliye Rule 15.5 (Advisory) single exit recommend karta hai: $n$ returns ke saath tumhare paas up to $n$ jagah hain jahan cleanup bhool sakti hai. Ek exit par collapse karne se unlock ek jagah hota hai. Single-exit fix:

int handle(int x) {
    int result;
    lock(&m);
    if (x < 0)        { result = -1; }
    else if (x == 0)  { result =  0; }
    else if (x > 100) { result = -2; }
    else              { result =  x; }
    unlock(&m);        /* one guaranteed release */
    return result;
}

Original mein buggy paths: 3.

Two's complement mein -1 all-ones hai (0xFFFF...).

• Arithmetic shift (sign-preserving): top bit sign se fill hota hai → all-ones rehta hai → result -1.
• Logical shift (zero-fill): top bit 0 ban jaata hai → 0x7FFF... → 32-bit par result $2^{31}-1=2147483647$. Kyunki choice implementation-defined hai, Rule 10.1 essentially-signed operands ko shift karna bilkul forbid karta hai. Portable code sirf unsigned shift karta hai.

#include <stdint.h>
#define TABLE_LEN (8U)
#define SENTINEL  (0xFFFFU)
 
static uint16_t lookup(uint16_t idx);   /* Rule 8.2 prototype form */
 
static uint16_t lookup(uint16_t idx) {
    static const uint16_t table[TABLE_LEN] =
        { 10U, 20U, 30U, 40U, 50U, 60U, 70U, 80U };
    uint16_t result;
    if (idx < TABLE_LEN) {          /* 14.4: genuine Boolean compare */
        result = table[idx];        /* 18.1: idx proven in-range */
    } else {                        /* 15.6: braces on both arms */
        result = SENTINEL;
    }
    return result;                  /* 15.5: single exit */
}

Justifications:

• static const table → koi malloc nahi (21.3), flash mein rehta hai, compile-time bounded.
• idx < TABLE_LEN ek comparison hai → essentially Boolean, 14.4 satisfy karta hai; yeh subsequent index ko 18.1 ke liye valid bhi prove karta hai.
• Har branch braced (15.6); end mein ek return (15.5).
• Sab arithmetic unsigned mein — koi signed shift/mask concerns nahi (10.1).
• uint16_t <stdint.h> se aata hai (top par included). Test values: lookup(0) == 10, lookup(7) == 80, lookup(8) == 0xFFFF (=65535), lookup(100) == 65535.

Rule 21.3 Required hai (Mandatory nahi), toh deviation possible hai lekin free nahi. Option 1 — Formal documented deviation. Kyunki Required rules sirf formal, recorded deviation ke saath deviation allow karte hain, tumhe: rationale document karna hoga, safety analysis dikhani hogi ki residual risk controlled hai (jaise sabhi hal_alloc calls sirf init par hote hain, hard-real-time loop mein kabhi nahi), ise review/approve karwana hoga, aur log karna hoga. Yeh ISO 26262 / DO-178C-style paper trail hai. Option 2 — Redesign. hal_alloc ko startup par allocate hone wale static pool se replace karo, violation ko completely eliminate karo. ASIL-D ke liye preferred hai kyunki hazard ko argue karne ki jagah remove karta hai. Note: agar 21.3 Mandatory hota (C:2012 mein new category), toh koi deviation allowed nahi hota aur sirf Option 2 rehta.

Violations found (with rule numbers):

1. out return karna → Rule 18.7 (Required). out mein automatic storage hai (ek stack array); scale return karte hi returned pointer dangle karta hai.
2. i <= n off-by-one → Rule 18.1 (Required) + Rule 14.2 loop discipline. Aakhri iteration par yeh src[n] read karta hai aur out[n] write karta hai, dono intended range se ek element aage; aur bura, out ke paas sirf 8 slots hain, toh koi bhi n >= 8 stack buffer overrun kar dega (dekho Memory Safety).
3. src[i] << 1 signed context mein → Rule 10.1 (Required). src[i] shift se pehle int (signed) mein promote hota hai, toh ek essentially-signed operand par shift apply hota hai — implementation-defined aur banned.
4. if aur else bodies par missing braces → Rule 15.6 (Required).
5. Implicit narrowing out[i] = v (int → int8_t) → Rule 10.3 (Required), essential-type model. Assignment silently ek wide signed type ko kisi explicit cast ke bina int8_t mein narrow karta hai.
6. Multiple exit / structure concerns → Rule 15.5 (Advisory). Original end mein ek pointer return karta hai; neeche ka redesign void return karta hai aur caller-owned buffer ke through write karta hai, dangling-pointer class ko completely sidestep karta hai.

Compliant rewrite — caller output buffer ka maalik hai (koi dangling pointer nahi, toh 18.7 satisfied hai); bounded loop buffer tak clamped (18.1); unsigned math (10.1); har body par braces (15.6); explicit narrowing cast (10.3); single exit (15.5):

#include <stdint.h>
#define OUT_LEN (8U)
 
static void scale(const uint8_t *src, uint16_t n, int8_t *out);
 
static void scale(const uint8_t *src, uint16_t n, int8_t *out) {
    uint16_t i;
    uint16_t count = (n < OUT_LEN) ? n : OUT_LEN;  /* clamp to buffer */
    for (i = 0U; i < count; i++) {                 /* strict <, bounded */
        uint16_t v = ((uint16_t)src[i]) << 1U;     /* unsigned shift */
        if (v > 127U) {
            out[i] = 127;
        } else {
            out[i] = (int8_t)v;                    /* explicit narrow */
        }
    }
}

Worked value check: src[i] = 100 → v = 200, clamped to 127. src[i] = 40 → v = 80, stays 80. src[i] = 0 → 0.

Har ek ko double karo, phir 127 par saturate karo:

• $10\to 20$
• $60\to 120$
• $100\to 200\to$ 127 (clamped)
• $128\to 256\to$ 127 (clamped)

Output = {20, 120, 127, 127}.

Rule 21.3 bans ::: dynamic memory (malloc/free from <stdlib.h>) Rule 18.1 requires ::: pointer arithmetic same array ke andar rahti hai Rule 18.7 prevents ::: automatic (stack) storage ka address return/store karna Rule 10.1 forbids ::: essentially signed operands par bitwise/shift operators Rule 10.3 forbids ::: explicit cast ke bina incompatible essential types mein assignment Rule 15.6 requires ::: har if/else/loop body ke around braces Rule 15.5 (Advisory) recommends ::: function mein ek single exit point Exact-width types uint8_t/int16_t/etc. aate hain ::: standard header <stdint.h> se C:2012 ki teen categories hain ::: Mandatory, Required, Advisory