Electrical Engineering Stack Exchange is a question and answer site for electronics and electrical engineering professionals, students, and enthusiasts. It only takes a minute to sign up.
Sign up to join this community
While reading this file on software hazards this slide says:
"No Back Branch in the Code"
I wonder what does it mean? Normally when we write code in C-language then we don't actually do branching explicitly as in the case of assembly language programming. Does it mean that the above design rule is only possible to follow at assembly level and not at the c-level programming?
Back branches create loops. And any module that contains a loop becomes subject to the Halting Problem — to wit, you cannot write a program that can in all cases determine whether the module will exit the loop.
When you're writing software for real-time systems that have hard deadlines, you want to be able to prove that the deadlines are always met. Modules without loops have definite execution times for every path through the code. Modules with loops do not.
There are of course, broad classes of code with loops for which you CAN predict a maximum execution time, so this theoretical constraint is overly restrictive in the context of modern tools.
Manually writing safety-critical code in assembler is considered dangerous practice nowadays (by for example IEC 61508), since having complete low-level access to everything makes it too easy to create bugs. This is not what that document refers to.
Rather, "no back branches" means that safety-critical high level language code is not allowed to have any non-conditional branching upwards in high level code. "High level language" in this context means either C or Ada, where only a safe subset of the language is used. Other languages aren't considered suitable.
How to write the code is regulated by industry standards like MISRA-C and DO-178, which in turn explicitly ban non-conditional branching upwards.
Example with goto:
loop:
...
goto loop; // non-conforming
Example with continue:
while(x)
{
if(something)
continue; // non-conforming
...
}
The above is not necessarily incorrect code, but it could have been written in different ways. The problem is that it could lead to "spaghetti programming". Safety standards seek to eliminate hazards and that's why they ban such branching completely.
And as it turns out, the presence of these keywords is often a clear indication of badly written loops that could be simplified - it is "code smell".
Now of course the automatically generated assembler will contain branches upwards, but that's another story, related to compiler validation etc.
