Correct Use of Integers in Safety-critical Systems
summary
Argues that MISRA and AUTOSAR rules requiring replacement of standard integers with exact-width typedefs make code less safe and less portable, showing concrete failures from integer promotions (e.g., unsigned 16-bit multiply producing UB when promoted to int), compiler divergence, and ABI pain. Recommends using standard C/C++ types for ordinary arithmetic, reserving exact-width types for registers, protocols and file layouts, adding static_asserts to document assumptions, and relying on static analysis vendors that pragmatically relax the rule.
AI-written summary · about
chapters (20)
- 0:00Integer portability in safety systems
- 1:08Functional safety and portability
- 3:16Portability types and C terms
- 7:10Problems with conforming programs
- 9:21Portability versus safety
- 11:09MISRA C integer type rules
- 17:55MISRA C++ 2023 exact-width types
- 23:08Exact-width types harm portability
- 27:04Undefined behavior with uint16
- 29:56MISRA compliance and type mismatches
- 33:10Portable code without exact-width types
- 36:24Portability trade-offs in safety code
- 38:33Conforming code and reference platforms
- 41:46Integer type selection and API design
- 45:27When to use exact-width types
- 47:58MISRA rules and alternatives
- 51:11MISRA rule rationale and knowledge
- 51:31Regulation compliance and liability
- 53:16Portability versus target architecture
- 56:10Balancing portability, performance, safety
related talks
01h 00mint != safe && int != ℤ
01h 05mSafer C++ with MISRA-C++ 2023
01h 20mSafer C++: MISRA-C++ : 202X Rules and Beyond
01h 13mPractical Tips for Safer C++
53mFrom Chaos to Control: Overcoming C and C++’s Inherent Unsafety
01h 02mPractical Tips for Safer C++
59mTo Int or To Uint
58mMisra Parallelism Safety-critical Guidelines for C++11, 17, Then C++20, 23