You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Evaluation of Alternatives: Identify and evaluate free tools for MISRA compliance. Assess whether standard open-source C++ checkers (e.g., cppcheck, Clang-Tidy) can be configured or extended for MISRA rules and whether they provide reasonable coverage (e.g., >20% of the MISRA C++17 standard).
According to the cppcheck documentation, the MISRA checks are part of an add-on named misra.
The documentation states the following:
misra.py Used to verify compliance with MISRA C 2012 - a proprietary set of guidelines to avoid such questionable code, developed for embedded systems. Since this standard is proprietary, cppcheck does not display error text by specifying only the number of violated rules (for example, [c2012-21.3]). If you want to display full texts for violated rules, you will need to create a text file containing MISRA rules, which you will have to pass when calling the script with --rule-texts key. Some examples of rule texts files available in tests directory.
Apparently, depending on our organization, MISRA can provide us with a license to use the rules internally in this way ( have rules.txt file with the rule set).
We do offer a license to use the headline rule text in conjunction with a tool such as CPPcheck where the tool vendor has not licensed the rules themselves, please use the contact form (on the main website) if you would like to discuss this further.
Later edit : cppcheck only has support for MISRA C 2012 ( so that's just C code)
The second option would be clang-tidy, which is also very straightforward to install and run
apt install clang-tidy
Clang-Tidy does not natively support checking against the full set of MISRA C++:2023 rules. However, it can help enforce many of the best practices and guidelines that overlap with MISRA standards. With some configuration, Clang-Tidy can provide partial compliance with MISRA rules.
Common checks include:
cppcoreguidelines-*: Enforces core C++ best practices.
modernize-*: Encourages the use of modern C++ features.
performance-*: Detects performance issues.
readability-*: Ensures code readability.
bugprone-*: Identifies potential bugs.
Doing a mapping between the available checks and the ruleset of MISRA is not a trivial task.
Add Custom Rules for MISRA
For deeper MISRA compliance, we could implement custom checks using Clang-Tidy’s extensible framework:
Write a custom Clang-Tidy plugin to implement MISRA-specific Guide
This proves that in theory we could right our own plug-in to match to the MISRA ruleset. And the plugin could be developed in such a way that a rules.txt could be given as a parameter - with the actual rule names and descriptions ( which would require paying a license fee).
Decision (hopefully documented somewhere... but I'll just write it up again):
we use clang-tidy, especially if/when BMW can open source additional checks
Reasons: It's free. It's open source. It does more good than harm in any constellation.
try GitHub CodeQL
Reasons: It's free for S-CORE. It's open source. Potentially has the best integration into GitHub workflows. Rumors about great quality checks, although potentially low MISRA coverage.
Important: A lot code analysis comes from compilers... if we were to activate the warnings. This is more important than any additional tool.
Activity
dcalavrezo-qorix commentedon Feb 6, 2025
One things that needs to be clarified is whether referencing rules and directive from the MISRA C++:2023 document poses any copyright infringements.
dcalavrezo-qorix commentedon Feb 6, 2025
Polyspace lists the summary of the rules & directives on their website
https://www.mathworks.com/help/bugfinder/misra-cpp-2023-rules-and-directives.html?s_tid=CRUX_lftnav
AlexanderLanin commentedon Feb 6, 2025
It's not only a summary. You can click each rule for more details and examples.
However, I would refrain from a formal mapping of tools to rules just yet. That's a lot of work.
dcalavrezo-qorix commentedon Feb 6, 2025
The first option to analyze is
cppchecker.The tool is straightforward to install:
... and is also very easy to execute
dcalavrezo-qorix commentedon Feb 6, 2025
According to the
cppcheckdocumentation, the MISRA checks are part of an add-on namedmisra.The documentation states the following:
misra.py Used to verify compliance with MISRA C 2012 - a proprietary set of guidelines to avoid such questionable code, developed for embedded systems. Since this standard is proprietary, cppcheck does not display error text by specifying only the number of violated rules (for example, [c2012-21.3]). If you want to display full texts for violated rules, you will need to create a text file containing MISRA rules, which you will have to pass when calling the script with --rule-texts key. Some examples of rule texts files available in tests directory.
Apparently, depending on our organization, MISRA can provide us with a license to use the rules internally in this way ( have rules.txt file with the rule set).
Later edit :
cppcheckonly has support for MISRA C 2012 ( so that's just C code)dcalavrezo-qorix commentedon Feb 6, 2025
... and a breach of their licensing apparently. Check the comment from above
dcalavrezo-qorix commentedon Feb 6, 2025
The second option would be clang-tidy, which is also very straightforward to install and run
Clang-Tidydoes not natively support checking against the full set ofMISRA C++:2023rules. However, it can help enforce many of the best practices and guidelines that overlap withMISRAstandards. With some configuration,Clang-Tidycan provide partial compliance with MISRA rules.Common checks include:
Doing a mapping between the available checks and the ruleset of MISRA is not a trivial task.
Add Custom Rules for MISRA
For deeper MISRA compliance, we could implement custom checks using Clang-Tidy’s extensible framework:
Write a custom Clang-Tidy plugin to implement MISRA-specific Guide
Integrate the plugin into our Clang-Tidy setup.
There are some attempts available on GitHub, that add MISRA C++:2008 checkers for clang-tidy
https://github.com/rettichschnidi/clang-tidy-misra
This proves that in theory we could right our own plug-in to match to the MISRA ruleset. And the plugin could be developed in such a way that a
rules.txtcould be given as a parameter - with the actual rule names and descriptions ( which would require paying a license fee).dcalavrezo-qorix commentedon Feb 6, 2025
Created a table with the set of rules checked by
clang-tidy:[-]Prepare Decision: code analysis tool[/-][+]C++: Prepare Decision: code analysis tool[/+]25 remaining items
FScholPer commentedon Jun 12, 2025
Open Source Projects can use Coverity also with hudson report for Eclipse Projects: https://scan.coverity.com/faq. Sounds like a good way for me
FScholPer commentedon Oct 30, 2025
@dcalavrezo-qorix can we compare that with https://github.com/eclipse-score/inc_daal/blob/main/.github/workflows/codeql.yml?
FScholPer commentedon Jan 5, 2026
Already done. Next step: #2385
AThums commentedon Jan 13, 2026
where can I find the final decision?
AlexanderLanin commentedon Jan 13, 2026
Decision (hopefully documented somewhere... but I'll just write it up again):
Important: A lot code analysis comes from compilers... if we were to activate the warnings. This is more important than any additional tool.