CERT C: Rec. CON02-C

R2026b

Do not use volatile as a synchronization primitive

Since R2026b

Description

Do not use volatile as a synchronization primitive¹ .

Polyspace Implementation

Polyspace checks for the issue Synchronization primitive not appropriate.

Examples

Synchronization primitive not appropriate

Issue

The issue occurs when your code uses a shared global volatile variable as a synchronization primitive between threads. Polyspace^® considers a global variable to be an inappropriate synchronization primitive if these conditions are met:

• The variable is a volatile global variable shared between threads.

• The variable is used in conditional expressions.

• The variable is not protected using a mutex.

Risk

Because volatile variables do not provide the atomicity or the ordering guarantees required for thread synchronization, using them as synchronization primitives can cause data races and undefined behavior at run time. Threads can observe stale or inconsistent values of the shared volatile variable, resulting in incorrect program flow.

Fix

Use proper synchronization primitives or atomic types. Polyspace recognizes common multitasking libraries and their synchronization techniques. For more details on multitasking libraries recognized by default, see Auto-Detection of Thread Creation and Critical Section in Polyspace.

If you use a different library, configure the synchronicity manually. See Configuring Polyspace Multitasking Analysis Manually.

Example

In this example, a volatile Boolean variable flag is used as a synchronization primitive between threads. One thread waits on the flag while another sets it. The volatile qualifier does not provide the atomicity or ordering guarantees required for thread-safe synchronization.

#include <threads.h>
#include <stdbool.h>
#include <stddef.h>

int account_balance;
volatile bool flag = false; // Noncompliant

int wait_for_flag(void *arg) {
    int amount = (int)arg;
    while (!flag) {
        sleep(1);
    }
    account_balance -= amount;
    return 0;
}

int set_flag(void *arg) {
    (void)arg;
    flag = true;
    return 0;
}

int main(void) {
    thrd_t t1, t2;
    thrd_create(&t1, wait_for_flag, (void*)100);
    thrd_create(&t2, set_flag, NULL);
    thrd_join(t1, NULL);
    thrd_join(t2, NULL);
    return 0;
}

Correction

Replace the volatile flag with a mutex. The mutex provides the atomicity and ordering guarantees required for safe thread synchronization.

#include <threads.h>
#include <stddef.h>

int account_balance;
mtx_t flag; // Compliant

int debit(void *arg) {
    int amount = (int)arg;
    if (mtx_lock(&flag) == thrd_error) {
        return -1;
    }
    account_balance -= amount;
    if (mtx_unlock(&flag) == thrd_error) {
        return -1;
    }
    return 0;
}

int main(void) {
    thrd_t t1, t2;
    mtx_init(&flag, mtx_plain);
    thrd_create(&t1, debit, (void*)100);
    thrd_create(&t2, debit, (void*)50);
    thrd_join(t1, NULL);
    thrd_join(t2, NULL);
    mtx_destroy(&flag);
    return 0;
}

Check Information

Group: Rec. 14. Concurrency (CON)

PQL Name: std.cert.CON02_C

Version History

Introduced in R2026b