4. Small Projects

For small projects, the scope, budget, and timeline are typically more constrained than large-scale endeavors. However, adhering to coding methods, standards, and criteria is equally critical to ensure software reliability, maintainability, and security. The following simplified guidance is tailored for small projects to streamline the process while maintaining quality and compliance.

1. Start Simple: Use Existing Standards and Tools

Leverage Established Standards

• Avoid creating custom coding standards for small projects unless absolutely necessary. Instead, adopt readily available and well-documented standards such as:
  • MISRA-C for C-based safety-critical systems.
  • PEP 8 for Python projects.
  • CERT C for secure coding practices across critical C programs.
  • NASA’s STD-8739.8 for software assurance and safety-critical requirements (if applicable).

Use Tools for Automation

• Simplify verification by relying on free or affordable static analysis tools designed for the selected coding language:
  • For C/C++: Use tools like Cppcheck, Clang-Tidy, or SonarQube Community Edition.
  • For Python: Use tools like Pylint and Bandit.
  • For Java: Use tools like Checkstyle or SpotBugs.
• These tools:
  • Automatically enforce adherence to coding standards.
  • Highlight potential bugs, code smells, and security vulnerabilities.

2. Tailor Standards to Small Project Needs

Focus on Essential Rules

• Small projects do not always require the strict enforcement of hundreds of coding rules. Instead, focus on a small subset of essential rules that address:
  • Code maintainability and readability.
  • Safe memory management.
  • Error handling and logging practices.
  • Security practices to prevent common vulnerabilities.

Keep It Lightweight

• Publish a one- or two-page coding standard document with guidelines relevant to the project’s scope. Key contents may include:
  • Naming conventions (e.g., camelCase for variables, PascalCase for classes).
  • Module size restrictions (e.g., limit a function to 50 lines of code).
  • Rules for global variables and memory use (e.g., "do not use uninitialized variables").
  • Error-handling protocols (e.g., "all exceptions must be logged").
  • Testability practices (e.g., "every function must have corresponding unit tests").

3. Planning and Integration

Set Expectations Early

• Define and adopt coding methods, standards, and criteria at the start of the project to align the team on expectations.
• For small teams or solo developers:
  • Use a shared document repository (e.g., GitHub, GitLab, or Bitbucket) to store the coding standard and ensure visibility.
  • Include a coding practice checklist as part of project planning.

Low Overhead for Compliance

• For small teams, perform lightweight peer reviews to verify adherence during regular team meetings or at each milestone.
• Use Continuous Integration (CI) to automatically check standards compliance during builds (e.g., GitHub Actions, GitLab CI with integrated linters).

4. Ensure Traceability to Project Goals

Align With Project Requirements

• Even in small projects, each coding standard or criterion should link directly to project goals, such as:
  • Meeting mission-critical objectives (e.g., for experimental hardware or prototypes).
  • Ensuring security and accuracy for sensitive data handling.
  • Reducing the likelihood of defects in the operational environment.

Traceability Practices

• Keep the design and code tightly aligned with requirements:
  • Use a simple traceability matrix to map requirements → design → code modules.
  • For teams with minimal resources, consider using a spreadsheet for this purpose.

5. Efficient Verification and Testing

Static Code Analysis

• Run static code analysis tools regularly during development (e.g., once per day during active coding). They can identify:
  • Violations of naming and formatting conventions.
  • Memory leaks, null pointer dereferences, or use of unsafe library functions.
  • Security vulnerabilities, such as missing input sanitization.

Peer Reviews (Lightweight)

• Regular peer reviews ensure that coding standards are being followed while avoiding an onerous process for small teams:
  • Use a simple coding standard checklist during each review.
  • Focus on detecting issues early, such as inconsistent formatting, poor module design, or unsafe practices.
  • Example Checklist Items:
    • Did this code adhere to the error-handling guidelines?
    • Are variables named appropriately and consistently styled?
    • Are complex or risky operations (e.g., recursion, dynamic memory allocation) justified and clearly documented?

6. Security Considerations for Small Projects

Adopt Secure Coding Practices

• Even small systems are vulnerable to attacks and bugs if secure coding practices are not implemented:
  • Avoid using unsafe functions like gets() in C.
  • Sanitize all inputs to prevent injection attacks and data corruption.
  • Implement proper error logging while taking care not to expose sensitive data via logs.

Use Minimal Tooling

• Security practices do not have to be resource-intensive:
  • Use tools like Bandit for Python or Flawfinder for C/C++ to scan for common vulnerabilities.
  • Follow simple recommendations from CERT C or OWASP for web-related projects.

7. Practical Example for Small Projects

Imagine a small team working on a Python project to control a science instrument.

Adopting Standards

• Use PEP 8 (Python coding style) for naming conventions and formatting.
• Document the team's additional rules, such as:
  • "Avoid global variables—use parameter passing between functions."
  • "All exceptions must include meaningful error messages and be logged in errors.log."
• Enforce standards automatically with Pylint.

Verification Process

• Each developer runs Pylint before committing code changes.
• Before a milestone, the team runs automated static analysis tools and conducts a short peer review using a coding standards checklist.

Delivering Results

• Publish a one-page document summarizing adherence to the standards at the end of development.
• Include key metrics, such as output from static tools (e.g., % compliance with PEP 8).

8. Final Recommendations for Small Projects

1. Start with Simplicity:

   • Choose one or two widely accepted coding standards and stick to them.
   • Avoid over-complicating by adding unnecessary rules.

2. Automate Whenever Possible:

   • Use lightweight tools to automate compliance checks.
   • Schedule these checks regularly through CI pipelines.

3. Train Developers Quickly:

   • Provide team members with a short training session or tutorial on the key coding rules.

4. Document and Enforce:

   • Maintain a simple coding standard document.
   • Use code reviews and static analysis to ensure compliance.

5. Keep It Iterative:

   • Periodically review your coding standards and verification processes to ensure they’re practical for small project constraints.

By following these streamlined recommendations, small projects can effectively apply Requirement 4.4.3, ensuring consistency, reliability, and maintainability without unnecessary overhead. These practices support the successful completion of small-scale development efforts while ensuring compliance with NASA standards and best practices.

5. Resources

5.1 References

5.2 Tools

6. Lessons Learned

6.1 NASA Lessons Learned

Lessons Learned from NASA’s History with Coding Standards

The NASA Lessons Learned database provides key insights into the importance of coding standards based on prior mission experiences. These lessons underscore the role of coding standards in ensuring maintainability, cost control, and error reduction in projects across the software development lifecycle. The following entries from the database provide critical lessons for implementing coding standards effectively:

1. Software Design for Maintainability

Lesson Number 0838

• Key Insight: Software maintenance represents one of the largest cost drivers for NASA systems. Early and consistent planning for maintainability—using appropriate coding standards, styles, and configuration management—can significantly reduce life cycle costs.
• Implication for Coding Standards:
  • By establishing consistent coding practices upfront, maintenance efforts (e.g., bug fixes, enhancements) are made simpler and less error-prone.
  • Projects should ensure that coding standards are well-documented and accessible to all developers during the entire lifecycle, from initial development through decommissioning.

2. Mars Pathfinder Flight Software Development Process (1997)

Lesson Number 0590

• Key Insight: The Mars Pathfinder project demonstrated the benefit of tailoring coding standards to the needs of a specific project. However, this tailoring must balance the need for flexibility against the costs associated with future upgrades and reuse potential.
• Key Takeaways for Coding Standards:
  • Developing customized, project-specific coding standards can optimize project success; however:
    • Tailored standards may need to be harmonized or redefined for future upgrades or if the code will be reused in new mission contexts.
  • Consider the balance between tailoring and standardization:
    • If extensive code reuse is anticipated, strive to maintain alignment with broader NASA, industry (e.g., MISRA-C, CERT C), or widely-used standards.

3. Static Software Analysis of the NASA Autonomous Flight Termination Software

Lesson Number 24503

• Key Insights:
  1. Specify Detailed Coding Standards: Coding standards should be explicitly chosen and applied to all relevant software, including both flight software and ground utilities.
  2. Optimize Static Analysis Tools: The configuration of static analysis tools should match the established coding standard. This ensures that the tool functions as an effective verification asset.
  3. Define Issue Resolution Processes: The project team should define clear processes for reviewing and resolving issues flagged by static analysis. Guidelines should specify:
     • What constitutes a defect.
     • Which issues require mandatory correction.
• Recommendations for Projects:
  • Define coding standards early, and configure static analysis tools accordingly to validate compliance systematically.
  • Include fault resolution procedures in the coding standard policy to avoid ambiguity during verification.

Key Application of Lessons Learned to Small and Large Projects

These historical lessons emphasize NASA's ongoing focus on the importance of disciplined and consistent coding practices. Regardless of project size, the following actions should be taken to incorporate these lessons effectively:

1. Adopt Standards Early:

   • Incorporate coding standards into project planning and allocate resources for training and verification.
   • Small projects should leverage existing, well-established coding standards to reduce the overhead associated with tailoring.

2. Configure Tools for Compliance:

   • Make use of static analysis tools that are compatible with the selected coding standards. For instance:
     • Ground and Flight Software Example: Configure tools like Klocwork, Coverity, or Polyspace to enforce MISRA-C or CERT C for C language projects.
     • Clearly document which errors or warnings are actionable.

3. Prioritize Maintainability:

   • Use consistent coding practices to lower the burden of ongoing maintenance, especially for long-duration projects with multiple personnel transitions.

4. Reuse and Tailoring:

   • When tailoring standards, account for potential future reuse of the code. Reuse potential may dictate a higher alignment with established NASA or industry-wide standards rather than significant deviations.

5. Review Processes:

   • Formalize coding standard adherence as a criterion for peer reviews, static analysis reports, and milestone inspections to minimize the potential for unforeseen defects.

Integrating Lessons Learned into Current NASA Projects

Using the lessons from past projects, the following procedural steps can help integrate coding standards effectively into NASA projects:

1. Establish Standards and Tools:

   • Define coding standards in the project's requirements specification document.
   • Select a static analysis tool that aligns well with the chosen coding standard.

2. Operationalize Lessons:

   • Clearly define how issues flagged by static tools will be classified, managed, and resolved.
   • Ensure the project schedule includes time for static analysis, issue resolution, and fixing flagged problems prior to formal reviews.

3. Monitor and Improve Practices:

   • Use lessons learned repositories as a dynamic input to refine and improve coding standards for future software efforts.

Examples of Common Lessons to Implement in Practice

Lesson/Application: For projects reusing code from prior missions:

• Take into account compatibility between the original coding standards of the reused software and the new project’s expected standards.

Lesson/Application: When adopting static analysis tools:

• Configuration must be customized for the coding standard in use. For example, ensuring the tool can detect unsafe practices specifically disallowed by MISRA-C (e.g., disallowed global variable usage, recursion, or unchecked pointer operations).

Lesson/Application: Early identification of coding inconsistencies:

• Schedule periodic (e.g., nightly or weekly) static analysis runs as part of the continuous integration pipeline, allowing the team to identify and resolve issues early.

Key Takeaways

Combining insights from the NASA Lessons Learned database with modern practices allows project managers to ensure coding standards are not just a set of rules, but a valuable tool for improving software quality, reducing costs, and ensuring mission success. Leveraging these insights will create a robust foundation for the continued success of NASA’s software systems across their extended life cycles.

6.2 Other Lessons Learned

The Goddard Space Flight Center (GSFC) Lessons Learned online repository

• Provide template(s) to facilitate developing documentation. Lesson Number 61: The recommendation states: "Use of template(s) and a delivery schedule can help with required documentation."
• Consistent array indexing philosophy and naming conventions. Lesson Number 76: The recommendation states: "Reach an agreement on a consistent array indexing philosophy, and naming conventions, and ensure it is communicated throughout the project teams (FSW, Systems Engineering and Operations teams)."
• Engage early with experts from previous missions. Lesson Number 135: The recommendation states: "Engage early with experts from previous missions to understand their data standards."

7. Software Assurance

7.1 Tasking for Software Assurance

7.2 Software Assurance Products

Static Analysis of the Source Code

• Perform static analysis of the source code against the established coding standard. This helps identify:
  • Violations of coding rules (e.g., non-conformance with naming conventions, unsafe use of memory, or uninitialized variables).
  • Potential bugs or vulnerabilities in the code (e.g., buffer overflows, null pointer dereference, or unchecked return values).
  • Security issues in compliance with a secure coding standard (e.g., CERT C, CWE Top 25 weaknesses).

Independent Evaluation of Source Code

• SA Independent Analysis: The software assurance team should independently assess the software code for compliance with the project’s coding standard, as well as other coding principles, methods, and rules.
  • Evaluate the effectiveness and coverage of static analysis results provided by the development team.
  • Identify risks or concerns related to deviations from coding standards, such as unexpected complexity, security vulnerabilities, or maintainability issues.
  • Provide actionable feedback to project managers and development teams for improvements.

Key Deliverables for SA Verification of Code Against Coding Standards

1. Coding Standard Document Verification:
   • Ensure coding standards (including secure and safety-critical coding standards, if applicable) are clearly defined and documented for the project.
2. Static Code Analysis Results:
   • Verify that static analysis results demonstrate compliance with the coding standard.
     • Use automated tools to validate coding violations (e.g., SonarQube, Coverity, Klocwork).
3. SA Risk Reports:
   • Provide reports detailing risks, issues, and recommendations to address coding violations.

7.3 Metrics

Effective metrics support continuous improvement and provide a quantitative way to track adherence to coding standards and resolution of issues.

Recommended Metrics for Coding Standards

• Total Number of Coding Standard Violations Identified:

  • Open (violations that remain unresolved).
  • Closed (violations resolved during the project phase).
  • Classification by severity level (e.g., critical, major, or minor) and type (e.g., style, security, maintainability, performance-related).
  • Trend tracking across lifecycle phases to identify recurring patterns.

• Total Number of Non-Conformances:

  • Track software process non-conformances by life cycle phase over time, identifying areas where adherence to coding standards is lacking or requires improvement.

• Other Metrics:

  • Percentage of compliance with the coding standard (e.g., % of files/modules that adhere to the rules).
  • Number of identified critical security vulnerabilities and time taken to resolve them.
  • Number of repeated violations (indicating areas needing additional focus or training).

Reference:

For additional metric-related guidance, see Topic 8.18: SA Suggested Metrics.

7.4 Updated Guidance

Task 1: Understand and Familiarize With Project Coding Standards

• Plan Review:

  • Review the project software development or management plan to determine the coding standards, methods, and principles defined for the project (e.g., safe coding practices, secure coding standards, guidelines for reliability).
  • Verify that the standards are comprehensive and well-suited to the project's requirements (flight software, mission-critical software, ground utilities, etc.).
  • Coding standards could include:
    • Secure coding standards (e.g., CERT C, MISRA-C).
    • Guidelines for safe use of constructs, error handling, and reliability principles.
    • Specific principles for high-assurance embedded or flight software.

• Analysis of Development and Selection Processes:

  • During the review of the software plans (SWE-013), ensure that the coding standards align with industry or NASA-specific requirements.
  • Confirm the inclusion of best practices and principles to address project-specific challenges (e.g., mission-critical requirements, safety-critical system requirements).

• Use of Static Analysis Results:

  • Analyze results from static analysis tools provided by the development team. Look for patterns of recurring issues that indicate inconsistent use of coding standards or unsafe practices.
  • Examples of issues:
    • Violations of rules governing the use of global variables.
    • Non-compliance with memory usage rules, such as violations of memory allocation/deallocation.
    • Use of unsafe constructs in multithreaded environments (e.g., race conditions, deadlocks).

• Reporting Issues:

  • Identify risks or issues from static analysis reports and escalate unresolved violations or critically severe problems to project management.
    • Example risks might include unaddressed buffer overflows, inadequate exception handling, or failure to prevent known vulnerabilities like injection attacks.
  • Provide a summary report to assist project management in understanding project risk and deciding on corrective action priorities.

Task 2: Perform Independent Static Code Analysis

• Independent Verification:

  • Software assurance should run independent static analysis tools or use a second configuration to validate the development team’s adherence to coding standards. Ensure that both static analysis use cases are in agreement:
    1. Validation of coding standard compliance.
    2. Detection of potential errors and risks not identified by the development team.

• Well-defined Issue Review Process:

  • Develop a process to review results of static code analysis to:
    • Determine the criticality of each issue.
    • Highlight coding violations requiring immediate correction (e.g., issues affecting mission safety, human safety, or system reliability).
    • Separate false positives for meaningful, actionable outputs.
  • Define criteria for closing issues to ensure consistency in the resolution process.

• Communication and Reporting:

  • Share detailed results of independent static analysis with project management and relevant stakeholders. Include:
    • Types of coding violations detected and proposed resolutions.
    • Recommendations regarding specific code that may require refactoring or closer oversight.
    • Insights on developer responses to violations and opportunities for improvement in coding practices.

• Documentation:

  • Retain all results and verification findings as part of the project record.
  • Document trends and leverage the information to refine coding standards and static analysis rules for future projects.

7.5 Recommendations for Success

1. Select Tools Aligned With the Coding Standard:

   • Ensure static analysis tools support the coding standards used in the project. For example:
     • MISRA: Polyspace, Coverity, Klocwork.
     • CERT C/Secure Coding: Coverity, Flawfinder.
     • For multi-language projects, select tools that support multiple languages (e.g., SonarQube).

2. Perform Continuous Verification:

   • Schedule regular static analysis runs (e.g., nightly or at major development milestones).
   • Independent static analysis by software assurance can be staggered or run in tandem for critical phases.

3. Integrate SA Into Team Practices:

   • Engage software assurance early in the project to ensure coding standards are well-defined and practical for the development team.
   • Use regular communication to resolve potential risks collaboratively.

4. Training and Awareness:

   • Train developers and assurance personnel on the importance of coding standard adherence, secure coding practices, and related tool usage.
   • Share recurring static analysis trends to help improve the team’s response to coding violations.

By rigorously implementing and independently verifying adherence to coding standards, software assurance ensures that the project minimizes risks, improves maintainability, and upholds NASA’s emphasis on delivering high-quality software systems.

7.6 Additional Guidance

Additional guidance related to this requirement may be found in the following materials in this Handbook:

8. Objective Evidence