5 ms·

Rust is not even designed to for safety-critical use. You need Ada or other languages for that.

by goodpoint 5y ago

rcxdude 5y ago
Neither's C, but it is extremely common in safety-critical software.
- pjmlp 5y ago
  I wouldn't call MISRA C still C, it is more like playing Ada with C compilers.
  - tialaramex 5y ago
    MISRA: Of course the C language provides loads of standard library functions which look ordinary but are actually defined in a way that's hideously dangerous. You can use most of those but please take care to avoid mistakes (MISRA D4.11). Ada: It would be insane to provide a standard library full of dangerous sharp edges so we didn't do that. pjmlp: See? Practically twins.
  - rcxdude 5y ago
    It's not a very good impression: MISRA C is basically a list of guidelines, half of which say "don't invoke undefined behaviour" (duh) and the other half are questionable coding-style rules. None of it really corresponds to any Ada features (not to mention you basically ignore any MISRA rule you like if you just write down that you've done it and attempt some justification).
    - a-priori 5y ago
      The goal of MISRA C mostly isn't to prevent problems in your code. It's to make the code more amenable to static analysis, which _can_ detect problems.
      - woodruffw 5y ago
        Which, notably, is what Rust does by construction: you don't have to do (much) alias or escape analysis against Rust, because it's given to you by the compiler for free. There's also been a decent amount of empirical research on MISRA C's effectiveness, most of which has shown that attempting compliance actually makes programmer-introduced faults more likely[1]. [1]: http://resolver.tudelft.nl/uuid:646de5ba-eee8-4ec8-8bbc-2c188e1847ea http://resolver.tudelft.nl/uuid:646de5ba-eee8-4ec8-8bbc-2c18...
      - rcxdude 5y ago
        It's extremely common to use MISRA without static analysis (I would personally advocate for the opposite way around). Also, if the goal is to make static analysis easier, why not just have the rule be 'the static analyser must be able to say this is OK'? (which will depend greatly on what the capabilities of your static analyser are).
    - pjmlp 5y ago
      That is why there are companies that do MISRA-C certifications.

Rust is not even designed to for safety-critical use. You need Ada or other languages for that.

rcxdude 5y ago

Neither's C, but it is extremely common in safety-critical software.

pjmlp 5y ago
I wouldn't call MISRA C still C, it is more like playing Ada with C compilers.
- tialaramex 5y ago
  MISRA: Of course the C language provides loads of standard library functions which look ordinary but are actually defined in a way that's hideously dangerous. You can use most of those but please take care to avoid mistakes (MISRA D4.11). Ada: It would be insane to provide a standard library full of dangerous sharp edges so we didn't do that. pjmlp: See? Practically twins.
- rcxdude 5y ago
  It's not a very good impression: MISRA C is basically a list of guidelines, half of which say "don't invoke undefined behaviour" (duh) and the other half are questionable coding-style rules. None of it really corresponds to any Ada features (not to mention you basically ignore any MISRA rule you like if you just write down that you've done it and attempt some justification).
  - a-priori 5y ago
    The goal of MISRA C mostly isn't to prevent problems in your code. It's to make the code more amenable to static analysis, which _can_ detect problems.
    - woodruffw 5y ago
      Which, notably, is what Rust does by construction: you don't have to do (much) alias or escape analysis against Rust, because it's given to you by the compiler for free. There's also been a decent amount of empirical research on MISRA C's effectiveness, most of which has shown that attempting compliance actually makes programmer-introduced faults more likely[1]. [1]: http://resolver.tudelft.nl/uuid:646de5ba-eee8-4ec8-8bbc-2c188e1847ea http://resolver.tudelft.nl/uuid:646de5ba-eee8-4ec8-8bbc-2c18...
    - rcxdude 5y ago
      It's extremely common to use MISRA without static analysis (I would personally advocate for the opposite way around). Also, if the goal is to make static analysis easier, why not just have the rule be 'the static analyser must be able to say this is OK'? (which will depend greatly on what the capabilities of your static analyser are).
  - pjmlp 5y ago
    That is why there are companies that do MISRA-C certifications.