Re: [EE] Ideas about improving safety in C language

On Fri, Apr 18, 2025 at 1:10 PM Sean Breheny <[email protected]> wrote:
>
> There is a subset of C, combined with extra rules about use and software
> which checks to make sure the rules are being followed, which is called
> MISRA C and is often used for life critical safety applications. It has a
> pretty good record from what I understand. It is rather old now (it was
> developed 30 years ago but has been updated several times and is still in
> widespread use. They supposedly have a version for C++ but since C++ relies
> on garbage collection and other background tasks I don't see how it really
> can be "safe" unless you essentially reduce it to C with a few minor
> enhancements.
>
> I have written safety-critical FPGA logic in VHDL and had it pass the
> requirements placed on it by auditors (after I made some changes they
> requested). I was not required to use special synthesis software or
> restrict the language constructs I used (other than the usual
> recommendations and restrictions which are needed for synthesizability).
> This was for a SIL 2 application so not like a nuclear power plant or
> airplane autopilot. Just a safety system for industrial machines. On my own
> I made almost every part of the logic check itself periodically and
> lock-out if it failed the test. Many of the functions were redundant with
> lock-out on comparison failure and some of them were 2 of 3 redundant (two
> out of 3 have to fail to cause a dangerous fault). I also forced the
> synthesis engine to put the safety part of the logic in one section of the
> FPGA and constrained the IO from it to the rest of the logic to a minimum
> number of signals and we did extensive testing at that interface level and
> at each submodule.  We could then freely make changes to the bulk of the
> logic without re-approval as long as we didn't touch the safety logic.
> FPGA's lend themselves well to this kind of safety structure. With C code
> compiled and running on processors, you often also need to run multiple
> processors in lock-step and compare their outputs as well as run periodic
> diagnostics. All of that is separate from MISRA standards.
>

I tend to think the OP is talking more about security (eg: IEC62443 and others)
and not functional safety (eg: IEC61508 and others).

For the industrial automation space, in terms of embedded software development,
I do not think C/C++ can be replaced any time soon, maybe not even 20
years later.
Design for Security best practices like secure coding standards will
of course be
adopted and customers may start to demand IEC62443 certification for
some products.

--
Xiaofan

-- 
http://www.piclist.com/techref/piclist PIC/SX FAQ & list archive
View/change your membership options at
https://mailman.mit.edu/mailman/listinfo/piclist