but I don't want to move my embedded C projects to C++. If I can use a language extension to get some extra confidence in my programs without changing the language im using then that's a compelling proposition.

The difference between a language extension, and a new language, is one of degree, not kind. Personally, since the semantics of this "extension" go to the core of what one does in C, I consider Checked C a new language.

I agree, in principle. But reading over this document, the changes can be made in an incremental fashion. And with far less impact than switching to using C++ just for these (assuming equivalents exist) features.

switching to c++ can also be done in an incremental fashion.

Yes, but not quite as trivially as:

  Enable extension
  Add `checked` to array declarations. (for the simplest
  case they've implemented).

Converting to C++ also means making sure you have `extern "C"` in your function declarations to get around C++'s name mangling when calling C libraries. Among other, potential, source level changes. Or, similarly, making sure your C (now C++) library can be called correctly by C projects that depended on it.

I'm not sold on this project as we haven't seen any results of course, but the approach is simpler than switching to C++.

There are also some nice C99 syntax features like compound literals that may not be supported by your C++ compiler.

since many C programs will have simple array types like that, this addition is mostly syntactic.

but here in the case of Microsoft Checked C , you still need to modify your actual source code to get safer one.

But you're moving to a safer subset, not a safer superset, so it still shouldn't require significant alterations.

Uhhh moving from set to subset is what requires alterations, set to superset does not, by definition.

The problem here is compiler support and performance.

C++ is an altered and extended form of C, thus I would say it is more accurate to call it a superset, rather than a subset. I'm not using precise definitions here.

And of course, but those will come in time. The point of it is that C++ isn't any safer (And actually, I would say is more risky in some aspects, because of the differences between (For example) the UB in C and C++), while Checked C is guaranteed to be safer, to a certain degree.

OK, I have to admit that Checked C is probably strictly safer while C++ is ... a mixed thing (both safer and more complicated).