I recently learned that the seL4 kernel verification was done using a subset of C which, among other things, did not include support for function pointers. I find that fairly interesting, especially if you compare it to a more modern system such as Chlipala's Bedrock (where one of the taglines is support for higher-order reasoning.)
If we suppose that languages which are easier to verify are better to program in, one might wonder if normal programmers should program in this subset, even if they aren't planning to do any formal verification. (Or, put differently, one can pay part of the cost of verification without going full hog, and hope that the choice of language makes the situation better later if you decide to do verification. Though this is a dubious claim, since it's widely agreed that verified software needs to be designed to be verified from the beginning.) This made me wonder, is there a detailed specification of their C subset anywhere? I did some looking, but I could not find it. Perhaps the question is ill-posed... (I am not precisely sure what I mean by this detailed specification)