Embedded C++ & Safety-Critical Engineering: MISRA, Freestanding, Placement New & std::expected

// FORBIDDEN after initialization in safety-critical code:
auto data = std::make_unique<SensorData>(); // Heap allocation!
std::vector<int> v;
v.push_back(1); // Heap reallocation!
std::string s = "hello"; // Heap allocation!

// ALLOWED: static storage (known at compile time):
static SensorData data;           // Single global instance
std::array<int, 100> buffer;      // Fixed-size stack array
std::string_view sv = "hello";    // No allocation — view of literal
std::span<int> view(buffer);      // No allocation — view of buffer

#include <new>
#include <cstddef>

// Method 1: alignas + char array (classic approach)
alignas(NetworkPacket) char packet_storage[sizeof(NetworkPacket)];
NetworkPacket* pkt = nullptr;

void init_system() {
    // Construct NetworkPacket at startup in static storage:
    pkt = new (packet_storage) NetworkPacket(); // Placement new!
    // No heap allocation — uses packet_storage
}

// Method 2: Pre-allocated object pool:
template<typename T, size_t N>
class StaticPool {
    alignas(T) char storage_[N * sizeof(T)];
    bool  used_[N] = {};
    
public:
    T* allocate() {
        for (size_t i = 0; i < N; i++) {
            if (!used_[i]) {
                used_[i] = true;
                return new (storage_ + i * sizeof(T)) T(); // Placement new
            }
        }
        return nullptr; // Pool exhausted
    }
    
    void deallocate(T* p) {
        // Find index and call destructor explicitly:
        size_t idx = (reinterpret_cast<char*>(p) - storage_) / sizeof(T);
        p->~T(); // MUST call destructor manually for placement new objects!
        used_[idx] = false;
    }
};

static StaticPool<SensorReading, 32> sensor_pool; // 32 pre-allocated sensors

void handle_sensor_event() {
    SensorReading* sr = sensor_pool.allocate(); // No heap!
    if (sr) {
        sr->timestamp = get_tick_count();
        sr->value     = read_adc();
        process_reading(sr);
        sensor_pool.deallocate(sr); // Explicit destructor + return to pool
    }
}

#include <expected>
#include <cstdint>

enum class SensorError { Timeout, Overrange, CalibInvalid, I2CBusError };
enum class MotorError  { OverCurrent, EncoderFault, PositionLimit };

// Error-returning function (no exceptions):
std::expected<float, SensorError> read_temperature(uint8_t sensor_id) {
    if (!i2c_select(sensor_id)) return std::unexpected(SensorError::I2CBusError);
    
    uint16_t raw = i2c_read_u16();
    if (raw == 0xFFFF) return std::unexpected(SensorError::Timeout);
    
    float temp = (raw / 65535.0f) * 200.0f - 40.0f; // Convert to Celsius
    if (temp < -40.0f || temp > 125.0f)
        return std::unexpected(SensorError::Overrange);
    
    return temp; // OK — contains temperature
}

// Composing multiple fallible operations:
std::expected<void, SensorError> run_calibration() {
    auto t1 = read_temperature(SENSOR_A);
    if (!t1) return std::unexpected(t1.error());
    
    auto t2 = read_temperature(SENSOR_B);
    if (!t2) return std::unexpected(t2.error());
    
    calibrate(t1.value(), t2.value());
    return {}; // Success
}

// C++23 monadic operations — chain without explicit if:
void start() {
    auto result = read_temperature(SENSOR_A)
        .and_then([](float t) -> std::expected<float, SensorError> {
            return t > 100.0f ? std::unexpected(SensorError::Overrange) : t;
        })
        .transform([](float t) { return t * 1.8f + 32.0f; }) // Celsius to Fahrenheit
        .or_else([](SensorError e) -> std::expected<float, SensorError> {
            log_error(e);
            return 0.0f; // Default on error
        });
}

// MISRA-compliant error handling pattern:
[[nodiscard]] bool initialize_sensor(SensorConfig& config) noexcept {
    // All paths must return a value
    if (!hardware_present()) return false;
    config.calibration_offset = read_eeprom_config();
    return true;
}

// MISRA: Always check [[nodiscard]] return values
bool ok = initialize_sensor(config);
if (!ok) { handle_init_failure(); return; } // Must handle

// ISR in C++ — restrictions:
// - No heap allocation
// - No exceptions
// - No blocking operations
// - Minimal stack usage
// - Shared state must be volatile or atomic

#include <atomic>

// Shared flag between ISR and main loop:
volatile uint32_t tick_count = 0; // volatile for ISR-accessed globals

// Or prefer atomic for read-modify-write:
std::atomic<uint32_t> event_flags{0};
constexpr uint32_t SENSOR_READY_BIT = (1u << 0);
constexpr uint32_t UART_RX_BIT      = (1u << 1);

// ISR (platform-specific attribute):
extern "C" __attribute__((interrupt)) void TIM2_IRQHandler() {
    ++tick_count; // OK: volatile increment (32-bit aligned, atomic on ARM)
    event_flags.fetch_or(SENSOR_READY_BIT, std::memory_order_relaxed);
    // Clear interrupt flag (platform-specific register write):
    TIM2->SR &= ~TIM_SR_UIF;
}

// Main loop reads events:
void main_loop() {
    while (true) {
        auto flags = event_flags.exchange(0, std::memory_order_acquire);
        if (flags & SENSOR_READY_BIT) { process_sensor(); }
        if (flags & UART_RX_BIT)      { process_uart();   }
        // Enter low-power sleep if no work
        __WFI(); // Wait for interrupt (ARM Cortex-M instruction)
    }
}