The Zephyr® Project aims to build a safe, secure and flexible real-time operating system (RTOS) for space-constrained devices. With more than 1200 contributors, Zephyr is one of the fastest growing open source and broadly contributed RTOS projects of its kind. It currently supports more than 350 boards, more than any other RTOS.
As the community evolves the project to support new hardware, developer tools, sensors, and device drivers, improvements are frequently delivered to incorporate enhancements in security, device management capabilities, connectivity stacks, and file systems. Zephyr is already being used in several products including hearing aids, industrial wearables, tracking devices, wind turbines and more. As Zephyr is being used in more wearables, IoT and IIoT devices, one of its key goals is to be the RTOS for the development of safety-related systems. For this reason, the Zephyr project has adopted a set of coding guidelines based on MISRA C.
“As more advanced and complex embedded systems are developed, software compliance is becoming a greater challenge,” said Kate Stewart, Vice President of Dependable Embedded Systems at the Linux Foundation. “This is especially true given that such systems often include proprietary code, commercial software, and open source software components. Because of this sensitivity, it was important for the Zephyr Project to work closely with one of the MISRA Consortium experts to facilitate code safety, security, portability and reliability in the context of embedded systems.”
When the Zephyr Safety Committee first engaged BUGSENG, the technical team was already following Zephyr RTOS (Zephyr is one of the open source projects kept under MISRA check at https://eclairit.com). After initial coordination, BUGSENG took a couple of weeks to produce a feasibility study, in the form of a report. The report provided a broad classification of the violations and specific advices on the main classes, along with the possible remediation; essentially listing all the actions required to bring the zephyr-v2.7-auditable branch into the desired level of MISRA compliance. Note that the Zephyr Project could have decided to stop here and use the report guidelines to carry out the remaining work on its own, if desired.
Based on the results of the feasibility study, the Zephyr team made the decision to continue work with BUGSENG.
The approach for the second part of the engagement entailed BUGSENG personnel submitting pull requests for MISRA fixes to a holding branch, before being submitted, discussed and then applied upstream into the zephyr-v2.7-auditable branch on GitHub.
Over the course of 5 months, an initial 500k violations of the MISRA C:2012 guidelines were brought down to less than 10k (the residual violations, while not difficult to fix or deviate, require the direct intervention of Zephyr developers). For users and product makers this is an extremely important result: users of Zephyr with MISRA compliance requirements will now have a much easier task in obtaining the required certification for their products.
“There is increasing attention to quality in the open-source community.” said Lavinia Battaglia, President of BUGSENG BOD. “Often organizations don’t realize that taking on a MISRA compliance troubleshooter is the most effective solution to get the job done and train their teams along the way. BUGSENG has extensive experience in the application of the MISRA coding standards to new as well as existing projects, so it’s an ideal partner.”
About BUGSENG
BUGSENG is a leading provider of solutions and services for software verification. BUGSENG’s ECLAIR Software Verification Platform has been designed to help engineers develop higher-quality software, effectively, by changing the traditional rules of the game. BUGSENG consulting services help industry leaders improving their development processes and complying with functional-safety standards. BUGSENG is also a renowned resource for advanced professional training. Visit: http://bugseng.com
