The Power of Ten: Rules for Developing Safety-Critical Code

Restrict safety-critical C to ten memorable, mechanically enforceable rules that bound control and resource behavior, localize review, expose contracts and errors, reduce indirection, and keep warning-based analysis continuously clean.

Version

v1 · 2026-08-30 · History

Domain-specific #

2955

Origin domain

software engineering

Subdomain

safety critical c programming

Aliases

Power of Ten coding rules, Power of 10 coding rules

Core Idea

The Power of Ten is Gerard J. Holzmann's deliberately small discipline for making safety-critical C code easier to review and subject to strong mechanical analysis. Its ten rules remove or constrain language features and coding practices that obscure control flow, resource bounds, interfaces, or tool results. The objective is not aesthetic uniformity. It is to shape source code so important claims—termination or deliberate nontermination, bounded stack and heap use, explicit error handling, limited aliasing, local reasoning, and warning-free static analysis—become cheaper and more credible to check.

Scope of Application

The home scope is safety- and mission-critical software written in C, especially embedded and flight software for which bounded resource use and strong source analysis matter. The original paper targets C pragmatically because of its mature compiler, debugger, metrics, testing, model-extraction, and source-analysis ecosystem. The rules can also guide other high-consequence C environments—avionics, medical devices, industrial controls, vehicles, and energy systems—when their implementation and assurance constraints fit.

Clarity

A project can make its claim auditable by publishing a compliance profile with five answers:

1. Is the claimed object the original 2006 ten-rule set, the JPL institutional standard, or an explicitly named adaptation? 2. Which code, generated artifacts, libraries, and initialization phases are in scope? 3. How is each rule operationalized—especially loop-bound proof, function-length counting, useful assertion density, exception handling, and pointer restrictions?

Manages Complexity

C gives programmers compact access to pointers, preprocessing, dynamic storage, recursion, and implementation-defined behavior. That flexibility can make high-consequence code difficult to bound or understand. The Power of Ten manages this complexity by reducing the number of execution and representation forms reviewers and tools must consider.

Abstract Reasoning

The signature licenses conditional inferences. If recursion is absent and every terminating loop has a statically established bound, then unbounded iteration cannot arise through those mechanisms; the result still depends on interrupts, external blocking, concurrency, library calls, and the accuracy of the analysis model. If allocation ends after initialization and recursion is absent, static memory and stack bounds become easier to establish; this does not prove absence of buffer overruns or pointer corruption.

Knowledge Transfer

The exact rule set transfers most directly among C projects with bounded embedded execution. Reviewers can reuse compliance queries, coding templates, assertion patterns, loop-bound annotations, and static-analysis gates. The 2009 experience report is especially important here: it operationalizes the original rules and records practical thresholds such as applying a configured number of assertions to functions above a configured size.

Relationships to Other Abstractions

Current abstraction The Power of Ten: Rules for Developing Safety-Critical Code Domain-specific

Parents (1) — more general patterns this builds on

• The Power of Ten: Rules for Developing Safety-Critical Code is a kind of Rule of Least Power (Minimum Sufficient Capability) Prime

  The strict parent is Rule of Least Power (Minimum Sufficient Capability).

Hierarchy path (1) — routes to 1 parentless root

• The Power of Ten: Rules for Developing Safety-Critical Code → Rule of Least Power (Minimum Sufficient Capability) → Constraint

Neighborhood in Abstraction Space

The Power of Ten: Rules for Developing Safety-Critical Code sits in a sparse region of the domain-specific corpus (90^th percentile for distinctiveness): few abstractions share its structure, so a faithful description tends to retrieve it precisely.

Family — Unclustered & Miscellaneous (1565 abstractions)

Nearest neighbors

• Cryptographic Hash Function — 0.80
• Halting Problem — 0.80
• Greenspun's Tenth Rule — 0.79
• Grzegorczyk hierarchy — 0.78
• Turing Machine — 0.78

Computed from structural-signature embeddings · 2026-09-08