MISRA C and C++ Compliance: Automated Code Checking With Static Analysis & AI

MISRA C and C++ coding guidelines help teams build safer, more reliable software across industries like automotive, aerospace, and medical devices. Learn how static analysis automates MISRA compliance, how to enforce it continuously in CI/CD, and how AI helps with remediation.

MISRA C and C++ compliance helps developers build safer, more reliable, and maintainable software by following coding guidelines that reduce the risk of defects and unpredictable behavior. The latest standards, MISRA C:2025 and MISRA C++:2023, provide guidance for C and C++ development, particularly in safety- and security-critical embedded systems.

But achieving MISRA C compliance isn’t a one-time exercise. As codebases grow and evolve, teams must manage legacy code, continuous integration, and AI-assisted development while keeping compliance on track. This means identifying violations, verifying corrections, and maintaining compliance evidence as code changes. The question for your team shifts from "Does our code comply?" to "How do we keep it compliant?"

What Is MISRA?

MISRA, originally established by the Motor Industry Software Reliability Association, provides coding guidelines for developing safer, more reliable C and C++ software. The MISRA coding standard helps developers avoid language features and programming practices that can introduce defects, unpredictable behavior, or security vulnerabilities.

C and C++ offer powerful capabilities, but certain language constructs can lead to undefined, unspecified, or implementation-dependent behavior. MISRA rules place restrictions on how these languages are used, so teams can improve software safety, reliability, portability, maintainability, and security.

Originally developed for the automotive industry, MISRA has since been adopted across aerospace, medical devices, industrial automation, rail, and other embedded and safety-critical applications.

Importantly, MISRA compliance doesn’t automatically make software functionally safe. It helps reduce coding-related risks. But functional safety also requires appropriate requirements, architecture, testing, verification, and validation.

Examples of MISRA Rules

Here are four examples that illustrate how MISRA helps developers avoid common programming risks.

• MISRA C:2025 Rule 17.7 — Unused return values. Requires use of non-void function return values to prevent errors or important results from being overlooked.
• MISRA C:2025 Directive 4.12 — Dynamic memory allocation. Restricts dynamic memory allocation to avoid memory fragmentation, allocation failures, and unpredictable resource usage.
• MISRA C:2025 Rule 10.1 — Essential type restrictions. Restricts inappropriate operations on expressions based on their essential types, reducing unintended conversions and unexpected behavior.
• MISRA C++:2023 Rule 0.0.1 — Unreachable code. Requires programs to avoid unreachable code, which helps eliminate unnecessary logic and potential maintenance issues.

What Are the Current MISRA C and C++ Standards?

The latest standard for C, MISRA C:2025, builds on previous editions to address evolving development practices and clarify existing guidelines. Since its introduction in 1998, MISRA C has evolved through updates in 2004, 2012, 2023, and 2025.

Parasoft C/C++test provides a dedicated MISRA C:2025 configuration so your team can identify violations and enforce coding guidelines throughout development.

For C++, MISRA C++:2023 is the current standard, replacing the 2008 edition with updated guidance for modern C++ development.

The Technical Corrigenda 1 (TC1:2026) clarifies existing guidelines instead of replacing the standard. Its updates to rule interpretations, exceptions, and analysis requirements can affect how compliance is evaluated. C/C++test supports the applicable changes.

Many established projects still follow MISRA C:2012, MISRA C++:2008, or AUTOSAR C++14 due to existing development processes, customer requirements, or certification activities. Moving to a newer standard isn’t always practical when you’re in the middle of a project.

For existing projects, evaluate which version best aligns with your requirements and development timelines. For new projects, consider adopting the latest applicable guidance.

What Does MISRA Compliance Mean?

Achieving MISRA compliance takes more than running static analysis and getting a clean report. It requires a documented process for:

• Enforcing coding guidelines.
• Addressing violations.
• Managing exceptions
• Demonstrating that the software meets the project’s compliance requirements.

The MISRA Compliance:2020 framework defines how organizations establish and document this process. Key elements include:

• Mandatory, Required, and Advisory guidelines. Mandatory guidelines must be satisfied. Required guidelines allow formally approved deviations. Advisory guidelines provide recommendations that projects may choose to enforce.
• Decidable vs. undecidable rules. Some rules can be conclusively checked through analysis, while others may require additional investigation or review.
• Automated and manual enforcement. Static analysis detects many violations, but some guidelines require manual inspection or other verification activities.
• Deviations. Exceptions must be justified, documented, and approved. Simply suppressing a finding doesn’t establish an approved deviation.
• Re-categorization. Projects can adjust guideline classifications within MISRA’s permitted constraints to meet their specific requirements.
• Project-specific enforcement policies. Teams define applicable guidelines, enforcement methods, and how violations and exceptions are handled.
• Compliance documentation. The Guideline Enforcement Plan, Guideline Re-categorization Plan, Deviation Reports, and Guideline Compliance Summary provide evidence of how to manage and demonstrate compliance.

MISRA compliance is ultimately about applying coding guidelines consistently and maintaining the evidence needed to demonstrate compliance throughout development.

How Static Analysis Automates MISRA Compliance

Detect MISRA Violations as Code Is Written

Why wait until the end of development to check for MISRA violations?

With static analysis, you can identify issues early, directly within their development environment. Tools like Parasoft C/C++test integrate with IDEs, including Visual Studio Code, Visual Studio, CLion, and Eclipse, making it easier to analyze code and review findings as they work.

Analyze individual files or entire codebases without executing the software. Incremental analysis enables your team to focus on new or modified code so that they can address violations before they accumulate.

Catching issues early reduces rework and helps you maintain consistent coding practices throughout development.

Find Problems a Basic MISRA Checker Misses

Not all static analysis tools provide the same depth of analysis. A basic MISRA C checker may focus on individual coding rules, while advanced static code analysis can examine relationships between functions, data, and execution paths.

Techniques like semantic analysis, data flow and control flow analysis, interprocedural analysis, and path-sensitive analysis, uncover potential runtime defects without executing the software.

For example, Parasoft’s flow analysis can identify issues that aren’t typically apparent through simple rule checking alone, including null-pointer dereferences, buffer overflows, uninitialized memory, resource leaks, division by zero, and dead code.

Advanced analysis complements MISRA code checking by identifying defects that could affect software safety, security, and reliability. If you’re evaluating solutions, compare the best MISRA compliance tools to understand differences in analysis capabilities and compliance support.

Enforce MISRA Continuously in CI/CD

Identifying violations during development is only part of the process. You also need to prevent new violations from entering the codebase as software evolves.

Integrating static analysis into CI/CD pipelines allows MISRA checks to run automatically during commits, pull requests, and automated builds. Quality gates help enforce coding policies, flag violations, and require corrective action before changes are accepted.

As the workflow below illustrates, developers identify violations in their IDE, commit changes, and run automated analysis in CI/CD.

After finding issues, developers investigate the findings, make corrections, and rerun analysis to verify the results. Compliance reporting then helps document the checks performed, track violations, and maintain evidence of approved deviations.

This continuous cycle of analysis, remediation, verification, and reporting helps your team maintain MISRA compliance throughout development rather than relying on periodic checks before a release.

How AI Fits Into MISRA Static Analysis

AI is changing how developers write, analyze, and maintain C and C++ software. When combined with static analysis, AI helps identify and resolve coding violations faster while maintaining the verification practices needed for MISRA compliance.

AI-Generated Code Still Needs Deterministic Verification

AI coding assistants can generate code, suggest improvements, and accelerate development. But AI-generated code must meet the same coding standards as code written by a developer.

Static analysis provides a systematic, repeatable way to check code against MISRA guidelines. It also identifies potential defects and security vulnerabilities. By integrating these checks into development workflows, your team can benefit from AI-driven productivity while maintaining consistent verification practices.

Use AI to Understand and Fix Violations, With Developers in Control

AI can help developers investigate static analysis findings by explaining why a MISRA guideline was triggered, examining the surrounding code, and recommending potential corrections. This reduces the time spent researching violations to address issues more efficiently.

Through its Model Context Protocol (MCP) integration and agentic workflows, Parasoft C/C++test lets AI coding assistants analyze code, identify violations, and propose or apply corrections. The same workflow can also incorporate compilation, unit testing, and structural code coverage, including MC/DC, as the workflow below illustrates.

AI can help developers address coding violations, failed tests, and coverage gaps. The relevant analysis and testing activities are repeated to verify the changes.

AI accelerates remediation, but developers remain responsible for reviewing and approving changes.

• Static analysis provides repeatable checks against MISRA guidelines.
• Unit testing verifies software behavior.
• Code coverage helps identify testing gaps.

Together, these practices support a more comprehensive approach to AI-assisted static analysis and software verification without replacing the engineering judgment and documentation required for MISRA compliance.

How to Demonstrate MISRA Compliance

Demonstrating MISRA compliance means having the documentation to show how your team did the following throughout development:

• Enforced coding guidelines.
• Addressed violations.
• Managed exceptions.

The MISRA Compliance:2020 framework identifies four key documents that help you establish a consistent compliance process and provide evidence for internal reviews, customer assessments, and audits.

• Guideline Enforcement Plan (GEP). Defines how applicable MISRA guidelines will be enforced through automated analysis, manual review, or other verification activities. Development teams and reviewers use it to understand the project’s compliance approach.
• Guideline Re-categorization Plan (GRP). Documents permitted changes to guideline classifications and the reasons behind them. It helps teams and assessors understand how guidelines have been tailored to project requirements.
• Deviation Reports. Document and justify exceptions to applicable MISRA guidelines, including supporting evidence. Developers, technical leads, and reviewers use them to evaluate and approve deviations.
• Guideline Compliance Summary (GCS). Summarizes the project’s compliance status, including guideline enforcement and approved deviations. It gives stakeholders, customers, and auditors an overview of how compliance has been demonstrated.

Maintaining this documentation manually can become challenging as code changes. Parasoft C/C++test and Parasoft DTP automate compliance reporting, generate supporting documentation, and centralize analysis results and compliance evidence, making it easier to demonstrate and maintain MISRA compliance throughout development.

Applying MISRA to Legacy and Adopted Code

Achieving MISRA compliance in legacy code can be challenging, especially in embedded systems with large, established codebases. Instead of trying to fix every violation at once, your team can take an incremental approach that improves compliance and prevents new issues.

Establish a Baseline

Analyze the existing codebase to identify MISRA violations and establish its current compliance state. Use these results to measure progress and identify areas needing attention.

Prevent New Violations

Adopt a "no new violations" policy for new or modified code. Integrating MISRA checks into development workflows and CI/CD pipelines helps catch issues early and maintain compliance as code evolves.

Prioritize Existing Findings

Address violations incrementally based on project risk, guideline classification, and potential impact on safety, security, and reliability.

Manage Deviations Rather Than Hiding Findings

When exceptions are necessary, document and justify them through an approved deviation process. Simply suppressing a finding doesn’t establish compliance or replace the need for supporting evidence.

MISRA in Safety-Critical Development and How Parasoft Supports It

MISRA coding guidelines help reduce coding defects and improve software reliability in safety-critical applications. They complement industry standards such as ISO 26262 for automotive, IEC 61508 for industrial systems, IEC 62304 for medical devices, EN 50716 for rail, and DO-178C for aerospace. While MISRA supports these broader safety objectives, it does not replace their verification and validation requirements.

Safety-critical projects may also require tool qualification or supporting certification evidence. Parasoft C/C++test and C/C++test CT are TÜV SÜD-certified for specified safety-related development contexts, helping your team address applicable tool requirements for activities such as ISO 26262 compliance. Parasoft also provides tool qualification support aligned with DO-330 for applicable aerospace projects.

Parasoft’s MISRA compliance solution supports MISRA C:2025 and MISRA C++:2023, including TC1:2026 updates with advanced static and flow analysis, IDE and CI/CD integration, AI-assisted violation explanation and remediation, and compliance reporting through DTP. Together, these capabilities help your team identify and address violations while maintaining compliance evidence throughout development.

See these capabilities in the Embedded Demo Video Library, including MISRA C:2025 analysis with AI-assisted remediation in VS Code and MISRA C++:2023 analysis with AI remediation in CLion.

Conclusion: Move From MISRA Checking to Continuous Compliance

MISRA compliance isn’t a one-time scan before a software release. It’s a continuous engineering process that helps your team improve code quality, reduce risk, and maintain compliance throughout development.

A practical approach to MISRA C and C++ compliance follows seven steps:

1. Define. Select the appropriate MISRA standard and establish your project’s coding guidelines and compliance policy.
2. Analyze. Use Parasoft C/C++test to identify MISRA violations early and throughout development.
3. Remediate. Address findings manually or use AI assistance to understand violations and accelerate corrections.
4. Verify. Rerun deterministic static analysis to confirm corrections and identify any new violations.
5. Integrate. Enforce MISRA guidelines through CI/CD pipelines and pull-request workflows to prevent new violations from accumulating.
6. Document. Maintain approved deviations, guideline re-categorization, enforcement plans, and compliance evidence.
7. Monitor. Track compliance continuously rather than waiting until the next release or audit.

By combining deterministic static analysis, AI-assisted remediation, CI/CD automation, and compliance reporting, Parasoft helps teams make MISRA compliance a consistent, manageable part of everyday software development.

"MISRA", "MISRA C" and the triangle logo are registered trademarks of The MISRA Consortium Limited. ©The MISRA Consortium Limited, 2021. All rights reserved.