Coding and Security Guidelines

MISRA (Motor Industry Software Reliability Association) publishes the most widely adopted coding guidelines for safety-critical and embedded software. Despite the automotive origin of the name, MISRA guidelines are used across aerospace, medical, industrial, and railway development wherever C or C++ is the implementation language.

MISRA C targets the C programming language. Its rules are designed to eliminate constructs that are undefined, implementation-defined, or otherwise hazardous in embedded contexts: uninitialized variables, implicit type conversions, unreachable code, and hundreds of similar patterns. MISRA C++ extends the same discipline to C++.

The guidelines evolve with the language standards. MISRA C:2025 and MISRA C++:2023 are the current editions.

AUTOSAR (Automotive Open System Architecture) is a global automotive industry partnership that defines a standardized software architecture for electronic control units. Its C++ coding guidelines specify rules for writing C++ code that integrates correctly into AUTOSAR-compliant ECUs from different suppliers.

AUTOSAR C++ guidelines address code quality, reliability, and safety in the context of automotive software systems. Compliance supports interoperability between components developed by different teams and suppliers and provides a pathway toward ISO 26262 functional safety compliance for C++ codebases.

PC-lint Plus supports AUTOSAR17 and AUTOSAR19 out of the box.

The CERT-C Coding Standard was developed by the CERT Division at the Software Engineering Institute (SEI) at Carnegie Mellon University. It provides coding guidelines and best practices for C specifically targeting security vulnerabilities and reliability failures.

CERT-C is domain-agnostic. It is used in aerospace, automotive, healthcare, and financial software wherever secure and reliable C code is required. It is recognized under Common Criteria and ISO 27001 compliance frameworks and is frequently adopted alongside MISRA C for projects that need both safety and security coverage.

PC-lint Plus supports many of the statically enforceable guidelines of CERT-C, covering a broad range of the standard's security and reliability rules.

CWE is a community-maintained list of common software and hardware weakness types, maintained with data from NIST and CISA. Its goal is to make weaknesses known so they can be eliminated during development rather than discovered after deployment.

The CWE Top 25 Most Dangerous Software Weaknesses and the CWE Top 10 KEV (Known Exploited Vulnerabilities) Weaknesses List provide prioritized targets for development teams and tool vendors. Certification to CWE compatibility demonstrates that a static analysis tool covers the weaknesses on these lists in a documented and verifiable way.

PC-lint Plus version 2.1 and above is certified CWE-compatible. It covers all weaknesses relevant to C and C++ on the CWE Top 10 KEV Weaknesses List and most of the CWE Top 25.

Published coding standards cover common defect classes and language hazards. Most projects also carry constraints specific to their architecture, organization, or domain that fall outside any published guideline. PC-lint Plus supports both through a query-based custom rule mechanism that applies the same static enforcement to project-specific constraints as it does to MISRA or AUTOSAR rules.

PC-lint Plus's query system walks the Abstract Syntax Tree (AST) generated during analysis, using a statically typed domain-specific language to specify exactly what the check looks for. Custom rules can enforce architectural constraints, flag anti-patterns, or define organization-specific safety rules.

The same query mechanism is used to define justified exceptions: precise, pattern-based suppressions that apply only when specific conditions are met, rather than broad suppressions that silence an entire rule category. This keeps suppression files clean, auditable, and intentional.

Static analysis against an existing codebase will surface findings that need review, justification, or suppression. Without a structured approach to managing those decisions, suppression files accumulate stale exceptions, justified deviations go undocumented, and the configuration drifts away from the state the original audit approved.

PC-lint Plus provides suppression at the level of individual findings, code regions, files, and rule categories. Every suppression is documentable and traceable. Diagnostic Accounting flags suppressions that are no longer needed, preventing the accumulation of stale exceptions that undermine audit confidence.