Safe & Defensive Embedded C (MISRA C)

Coding rules, compile-time checks and watchdogs that keep firmware predictable when failure is not an option.

Firmware in cars, medical devices and industrial controllers must behave predictably for years. Large parts of C's danger come from undefined and implementation-defined behaviour, so these industries restrict the language with coding standards and back it up with runtime safety nets.

Runtime safety nets

void SysTick_Handler(void) { IWDG->KR = 0xAAAA;... } Kick the watchdog in the main loop after every task has checked in

A timer ISR keeps running even when the main loop is deadlocked, so the watchdog would never fire when it is needed.

uint8_t len = packet[0]; memcpy(buf, &packet[1], len);

if (len > sizeof buf) { reject(); } before copying Data from outside the device is untrusted; an unchecked length is a buffer overflow.

Name four typical MISRA C restrictions.

No dynamic memory after init, no recursion, every switch has a default, no implicit narrowing/sign-changing conversions (also: no goto into blocks, single point of exit is advised, no undefined behaviour).

Why should the watchdog not be kicked from a periodic interrupt?

Interrupts can keep running while the main application is stuck, so the watchdog would never detect the hang.