I had a go at this problem, backwards-compatible safe C, back in 2012.[1] It was discussed on the C standards mailing list, and the consensus was that it would work technically, but was politically infeasible. What I proposed was not too far from "Checked C", but the syntax was different.<p>I'd defined a "strict mode" for C. The first step was to add C++ references to C. The second step was to make arrays first-class objects, instead of reducing them to pointers on every function call. When passing arrays around, you'd usually use references to arrays, which wouldn't lose the size information as reduction to a pointer does.<p>Array size information for array function parameters was required, but could be computed from other parameters. For example, UNIX/Linux "read" is usually defined as<p><pre><code> int read(int fd, char buf[], size_t len);
</code></pre>
The safe version would be<p><pre><code> int read(int fd, &char buf[len], size_t len);
</code></pre>
In both cases, all that's passed at run time is a pointer, but the compiler now knows that the size of the array is "len" and has something to check it against. The check can be made at both call and entry, and in many cases, can be optimized out. In general, in all the places in C where you'd describe an array with a pointer with empty brackets, as with "buf[]", you'd now have to put in a size expression.<p>You could do pointer arithmetic, but only if the pointer had been initialized from an array, and was attached to that array for the life of the pointer.<p><pre><code> char s[100];
char* p = s;
...
char ch = *p++;
</code></pre>
Because p is associated only with s, the compiler knows what to check it against.<p>There was more, but that's the general idea. A key point was that the run-time representation didn't change; there were no "fat pointers". Thus, you could intermix strict and non-strict compilation units, and gradually convert a working program to strict mode.<p>This took less new syntax and fewer new keywords than "Checked C". I was trying to keep C style, adding just enough that you could talk about arrays properly in C.<p>[1] <a href="http://www.animats.com/papers/languages/safearraysforc43.pdf" rel="nofollow">http://www.animats.com/papers/languages/safearraysforc43.pdf</a>