| name | en50128-implementation |
| description | C programming patterns with MISRA C:2012 compliance for EN 50128 railway safety software |
| license | Proprietary |
| compatibility | opencode |
| metadata | {"standard":"EN 50128:2011","domain":"railway-software","language":"C","coding-standard":"MISRA C:2012"} |
EN 50128 Implementation Skill
This skill provides the IMP agent with authoritative reference data, the source code
generation algorithm, MISRA C technique table, and defect remediation logic for software
implementation per EN 50128 §7.5 and Table A.4.
Load this skill before performing any IMP activity.
1. Authoritative Sources
| What you need | Where to find it |
|---|
| Phase 5 activities, deliverable paths, completion criteria | activities/phase-5-implementation-testing.yaml |
| Item 18 ownership, doc ID, SIL obligations | activities/deliverables.yaml |
| Annex C Table C.1 — full deliverable ownership catalogue | DELIVERABLES.md |
| Traceability rules T1–T15 (human-readable) | TRACEABILITY.md |
| Traceability obligations T1–T15 (machine-readable, agent consumption) | activities/traceability.yaml |
| Authority structure, two-track loop, CCB re-entry | WORKFLOW.md |
| Independence matrix (IMP = No at all SIL levels) | ORGANIZATION.md |
| §7.5 implementation requirements, Table A.4 techniques | std/EN50128-2011.md |
| C header template (.h stub) | [PROJECT_ROOT] deliverables/implementation/C-Header-Template.h |
| C module template (.c stub) | [PROJECT_ROOT] deliverables/implementation/C-Module-Template.c |
| MISRA C:2012 patterns (all 178 rules + 16 directives) | resources/misra-c-coding-patterns.md |
| Unit testing patterns (Unity framework, mocking, coverage) | resources/unit-testing-patterns.md |
| Code review checklist (124 items, 11 categories) | resources/code-review-checklist.md |
| Common implementation pitfalls (40+ with fixes) | resources/common-pitfalls.md |
| Component Design Spec (IMP input, item 15) | CM query-location --doc component-design-spec |
| Canonical source code path at runtime | CM query-location |
2. IMP Phase Footprint
IMP is the primary agent for Phase 5 (source code only).
| Annex C Item | Document | Owner | Phase |
|---|
| 18 | Software Source Code and supporting documentation | IMP | 5 |
| 19 | Software Source Code Verification Report | VER | 5 |
| 20 | Software Component Test Report | TST | 5 |
- IMP independence: Not required at any SIL level (see
ORGANIZATION.md).
- IMP MUST NOT test own code for SIL 3–4 (TST is independent tester).
- IMP MUST NOT contact QUA or VER directly — route all submissions through PM.
3. implement-modules Algorithm (item 18)
Follow these steps in order. Do not skip steps.
-
Invoke CM query-location via task tool with --doc source-code. Record the
canonical src/ path. Never write to a hard-coded path.
-
Read .workspace to confirm active project name, SIL level, and base path.
-
Verify Phase 5 prerequisites: locate the Software Component Design Specification
(item 15). If missing, halt and report to PM.
-
Load templates [PROJECT_ROOT] deliverables/implementation/C-Header-Template.h and [PROJECT_ROOT] deliverables/implementation/C-Module-Template.c
as stubs. For each component in the SCDS:
- Create
<component>.h — public interface only (types, function declarations).
- Create
<component>.c — implementation with file-header traceability block.
-
File header traceability block (mandatory SIL 3–4, HR SIL 2, R SIL 0–1):
/* Module: <component name>
* Implements: REQ-FUN-NNN [, REQ-SAFE-NNN, ...]
* Design ref: SCDS §<section> (item 15)
* SIL: <level>
*/
-
Apply MISRA C:2012 (mandatory SIL 2+):
- Fixed-width types only:
uint8_t, uint16_t, uint32_t, int8_t, etc.
- Static allocation only: no
malloc, calloc, realloc, free.
- No variable-length arrays.
- No recursion (HR SIL 2+).
- No function pointers (HR SIL 2+).
- Validate all pointer parameters before first use.
- Check all function return values — never discard.
- Named constants for all numeric literals (
#define or enum).
-
Enforce complexity limits: SIL 0–1: ≤20; SIL 2: ≤15; SIL 3–4: ≤10 cyclomatic
complexity per function. Refactor functions that would exceed the limit.
-
Apply defensive programming (HR all SIL levels):
- Validate all inputs at function entry (NULL, range, plausibility).
- Validate all outputs before returning.
- Use safe arithmetic helpers for add/multiply/divide where overflow is possible.
- Return an error code from every non-void function.
-
Run lizard on the completed source tree to confirm complexity within limits.
Fix any violations before reporting to PM.
-
Return the list of created source files and a traceability summary
(files created, requirements covered, any gaps) to PM.
4. Table A.4 Techniques (§7.5)
| # | Technique/Measure | Ref | SIL 0 | SIL 1–2 | SIL 3–4 |
|---|
| 1 | Formal Methods | D.28 | – | R | HR |
| 2 | Modelling | A.17 | R | HR | HR |
| 3 | Structured Methodology | D.52 | R | HR | HR |
| 4 | Modular Approach | D.38 | HR | M | M |
| 5 | Components | A.20 | HR | HR | HR |
| 6 | Design and Coding Standards | A.12 | HR | HR | M |
| 7 | Analysable Programs | D.2 | HR | HR | HR |
| 8 | Strongly Typed Programming Language | D.49 | R | HR | HR |
| 9 | Structured Programming | D.53 | R | HR | HR |
| 10 | Programming Language | A.15 | R | HR | HR |
| 11 | Language Subset | D.35 | – | – | HR |
| 12 | Object Oriented Programming | A.22 | R | R | R |
| 13 | Procedural Programming | D.60 | R | HR | HR |
| 14 | Metaprogramming | D.59 | R | R | R |
Mandatory: Entry 4 (Modular Approach) SIL 2+; Entry 6 (Design and Coding Standards) SIL 3–4.
MISRA C:2012 is the EN 50128 platform's coding standard for entry 6.
Coverage (Table A.21): No percentage thresholds in EN 50128:2011.
Table A.21 Req.1 requires a quantified measure defined per project (in the SVP/SQAP).
Technique recommendations: SIL 1: Statement R, Branch HR; SIL 2: Statement HR, Branch HR;
SIL 3–4: Branch HR, Compound Condition HR.
5. Defect Remediation (fix-defects)
When PM routes QUA/VER findings to IMP, apply this table:
| Finding Code | Description | Action | Confidence |
|---|
M001 | Dynamic memory allocation (malloc/free) | Replace with static array + index counter | HIGH — auto-fix |
M002 | Variable-length array | Replace with fixed-size #define array | HIGH — auto-fix |
M003 | Non-fixed-width type (int, long, etc.) | Replace with uint32_t / int32_t etc. | HIGH — auto-fix |
M004 | Unchecked return value | Add err = f(); if (err != SUCCESS) { ... } | HIGH — auto-fix |
M005 | NULL pointer not validated | Add NULL guard at function entry | HIGH — auto-fix |
M006 | Magic number literal | Extract to named #define or enum | HIGH — auto-fix |
M007 | Recursion (SIL 2+) | Refactor to iterative equivalent | MEDIUM — flag for review |
C001 | Cyclomatic complexity > limit | Decompose function into sub-functions | MEDIUM — flag for review |
C002 | Traceability comment missing (SIL 3–4) | Escalate to PM — requires SCDS lookup | LOW — escalate |
C003 | Algorithmic correctness defect | Escalate to PM — requires DES review | LOW — escalate |
Escalation rule: LOW-confidence findings MUST be escalated to PM with a written
description of the gap. IMP MUST NOT invent traceability links or change algorithms
without DES approval.
6. Document Interactions
Component Design Spec (item 15, DES) + SRS (item 6, REQ)
└─► IMP reads: SCDS (item 15), SRS requirement IDs
│
└─► IMP writes: Source Code (item 18)
│
├─► TST reads: source code → executes Component Test Spec (item 16)
│ → writes Component Test Report (item 20) [TST owns]
└─► VER reads: source code → writes Source Code VER Report (item 19) [VER owns]
IMP provides to: TST (source code for unit test execution), VER (source code
for static analysis and verification), INT (compiled modules for integration).
IMP receives from: DES (SCDS item 15), REQ (SRS requirement IDs for traceability),
PM (task assignment, defect routing).
IMP does NOT contact: QUA or VER directly. All submissions go through PM.
