Shifting Left (see Figure 1) is a core principle of DevSecOps and development methodologies such as Continuous Integration / Continuous Deployment (CI/CD). Consider that it takes only a moment to mistakenly code a bug but can take months to uncover it later. The sooner bugs can be identified (Shifting Left), the less costly they tend to be to identify and resolve.

Arguably, the best way of dealing with bugs is not to put them in your code in the first place.

Figure 1: Uncovering bugs sooner in the development lifecycle mitigates risk and often leads to a less costly resolution. (Source: https://ldra.com/capabilities/devsecops/)

Functional Safety Throughout the Development Process

Most software testing is dynamic, that is, it is performed while software is being executed. Static analysis first takes place at an earlier stage, as the code is being written. Static analysis can identify a number of potential bugs just from how the code is written. It isn’t that the C language is flawed. Rather, it has a philosophy of “trust the programmer,” whereas developers may be tempted to take shortcuts that are also risky coding practices. For example, a misuse of pointers can result in memory errors that can cause intermittent system failure. Making sure program code follows certain guidelines when using pointers can help avoid common mistakes that are easy to make.

Given the importance of functional safety, many industry standards such as ISO 26262 require developers to use static analysis to help verify the reliability of software. MISRA C is a guideline for static analysis named in many standards and used worldwide.

For over 25 years, the MISRA C standard has helped promote safety, security, and reliability in software-intensive embedded systems. Every guideline (whether directive or rule) has been designed to help developers avoid introducing errors into their code. After all, you don’t have to pay to fix a bug if it never gets in.

MISRA C:2023 was a major update to the MISRA C:2012 standard, introducing specific rules and directives to address multithreading functionality and atomic types. It also consolidated previous updates into a single, comprehensive standard to facilitate compliance. The most recent update, MISRA C:2025, further simplified the process of developing robust code for mission-critical systems with substantive policy changes, enhancements, and new guidelines. MISRA C:2025 also sets the foundation for supporting all the new additions to C24 (also known as C23), the latest version of the C standard released in October 2024.

Continuous Verification

Rather than waiting to verify software during a later test phase, integrating static analysis functionality like MISRA C into the development environment can help developers avoid many coding pitfalls early in the design process. In addition, when MISRA C is integrated across the design lifecycle, it enables more robust CI/CD through Continuous Verification to improve code clarity, facilitate more comprehensive testing, and simplify long-term maintainability. After all, as new code is constantly being added to systems, the need to avoid introducing new bugs never goes away.

For complex systems and geographically diverse development teams, automating static analysis is essential. No matter what their level of expertise, developers can make mistakes. Static analysis is a simple and effective way to support development teams by catching bugs they might have missed. The result is faster time to market with higher quality code, all while improving system safety, security, and reliability.

By Andrew Banks

LDRA Technical Specialist and MISRA C Working Group chair

Read published article here – Embedded Computer design