Static analysis matters in general, and coding standards in particular, are often seen as an inconvenience to those who are tasked with applying them. But here’s an example of what they seek to avoid, and why they are worthwhile.

In July 2021, Google issued an update to its Chrome OS in the form of version 91.0.4472.165. According to Google’s bulletin, a major bug prevented users from logging in to their devices.

Although the effect was somewhat catastrophic, the extent of the error wasn’t the result of any complex and convoluted algorithm. It was a simple missing ampersand; a typo of the kind that turns a logical AND into a bitwise AND, as illustrated in the example.

Missing ampersand A missing ampersand character can have a devastating effect

It’s such an easy mistake to make. A sticky key or just typing in a hurry to get something finished – we’ve all done it. What’s more, it results in perfectly legitimate (but suspect) code that no compiler has any issues with. It’s even easy to miss in a read-through because we’re all inclined to see what we think we’ve typed, rather than what is on the screen or page.

Coding standards get a bad rap, especially from newcomers to environments that demand them. But there is a reason why functional safety standards (IEC 61508, ISO 26262, EN 50128…) and cybersecurity guidelines (CWE, IEC 62443, ISO/SAE 21434…)  almost universally recommend, or insist on, their use.

They don’t do that to stop you from using your favourite construct, to slow you down, or to get in your way. They do it because the use of standards such as those from MISRA, AUTOSAR (like the example) and CERT prevent these mistakes from propagating into released code.

If you ever come to doubt that just remind yourself of Google’s hiccup. Static analysis matters.