5 ms·

Im actually a bit suprised. Getting anything but MISRA C/C++ certified is usually a no-go, but maybe and finally this is an alternative to fucking MISRA.

wallaBBB 4y ago
For ECUs running the car it's MISRA still, Rust is in the pipeline, but still far far away. 5-10 years before it becomes common. Standard is being worked on, but compilers and other tools will take a lot more time. These are generally not your of the shelf MCUs, and for many compilers are quite tailored. But for anything regarding networking and UX (screens), a lot of languages and frameworks are being used right now. Also, if you hate MISRA subset of C so much, you probably won't like Rust, since both impose some similar rules.
- veltas 4y ago
  I don't know much about Rust but the problem with MISRA is significant defects with the specification that force you to write bad/broken code in rare cases, and produce more work without benefit in others. A Rust MISRA standard would be great. Limited but more expressive and concise than C probably.
jeffreygoesto 4y ago
Certification is already in the works afaik. This [0] is also interesting, a check how much MISRA checking can be removed because the rust compiler already does a similar check. Ah. Found it, [1][2] [0] https://github.com/PolySync/misra-rust https://github.com/PolySync/misra-rust [1] https://news.ycombinator.com/item?id=32237780 https://news.ycombinator.com/item?id=32237780 [2] https://news.ycombinator.com/item?id=30174827 https://news.ycombinator.com/item?id=30174827
qznc 4y ago
Rust essentially puts some parts of MISRA into the type checker (e.g. no pointer arithmetic). Why is MISRA bad? I expect something like MISRA for Rust as well. There will probably be rules like "keyword unsafe forbidden". If you really need it, try writing a deviation record. The advantage is that Rust should require fewer rules.
- thrwyoilarticle 4y ago
  Some MISRA rules lead to absurd code, e.g. single return from a function meaning any error checking adds another level of nesting.
  - teknolog 4y ago
    My first job as a SWE was at Ericsson, and they also had this requirement. Solution: gotos everywhere!
    - thrwyoilarticle 4y ago
      I've seen code that solves it using a `retval` variable, a typical case of code that is written to avoid breaking MISRA rules instead reimplementing the problem that the MISRA rule tries to avoid except with less idiomatic code and more bugs.
  - tubs 4y ago
    Without raii this is kinda needed. Though simple param checking should be allowed ideally. But you can always just do a deviation, it's not super hard.
    - veltas 4y ago
      Frankly it makes code worse a lot of the time, that's been my experience anyway. It's probably necessary if you adhere to not using goto and need cleanup code in a function, but otherwise I've seen code trying to adhere to one exit point create bugs. Linux coding standards are the pragmatic choice, use cleanup goto's. They're idiomatic, clear, safe, easy when done right.
  - hxtk 4y ago
    I do web backend stuff. A coworker of mine writes Go according to MISRA C style and this is the main thing that's always annoyed me: it seems like half the codebase is comments justifying deviations, like explicitly commenting when we are using the `if err != nil...` idiom to note any deferred cleanup that takes place and justify why it's safe to early return.
riedel 4y ago
I am pretty sure that SPARK Ada would be an alternative.
pjmlp 4y ago
There is also AUTOSAR, which focused initially in C++14, got recently updated to C++17, and now is collaborating with Ferrocene regarding having Rust as well.
uninstallgentoo 4y ago

wallaBBB 4y ago

For ECUs running the car it's MISRA still, Rust is in the pipeline, but still far far away. 5-10 years before it becomes common. Standard is being worked on, but compilers and other tools will take a lot more time. These are generally not your of the shelf MCUs, and for many compilers are quite tailored. But for anything regarding networking and UX (screens), a lot of languages and frameworks are being used right now. Also, if you hate MISRA subset of C so much, you probably won't like Rust, since both impose some similar rules.

veltas 4y ago
I don't know much about Rust but the problem with MISRA is significant defects with the specification that force you to write bad/broken code in rare cases, and produce more work without benefit in others. A Rust MISRA standard would be great. Limited but more expressive and concise than C probably.

jeffreygoesto 4y ago

Certification is already in the works afaik. This [0] is also interesting, a check how much MISRA checking can be removed because the rust compiler already does a similar check. Ah. Found it, [1][2] [0] https://github.com/PolySync/misra-rust https://github.com/PolySync/misra-rust [1] https://news.ycombinator.com/item?id=32237780 https://news.ycombinator.com/item?id=32237780 [2] https://news.ycombinator.com/item?id=30174827 https://news.ycombinator.com/item?id=30174827

qznc 4y ago

Rust essentially puts some parts of MISRA into the type checker (e.g. no pointer arithmetic). Why is MISRA bad? I expect something like MISRA for Rust as well. There will probably be rules like "keyword unsafe forbidden". If you really need it, try writing a deviation record. The advantage is that Rust should require fewer rules.

thrwyoilarticle 4y ago
Some MISRA rules lead to absurd code, e.g. single return from a function meaning any error checking adds another level of nesting.
- teknolog 4y ago
  My first job as a SWE was at Ericsson, and they also had this requirement. Solution: gotos everywhere!
  - thrwyoilarticle 4y ago
    I've seen code that solves it using a `retval` variable, a typical case of code that is written to avoid breaking MISRA rules instead reimplementing the problem that the MISRA rule tries to avoid except with less idiomatic code and more bugs.
- tubs 4y ago
  Without raii this is kinda needed. Though simple param checking should be allowed ideally. But you can always just do a deviation, it's not super hard.
  - veltas 4y ago
    Frankly it makes code worse a lot of the time, that's been my experience anyway. It's probably necessary if you adhere to not using goto and need cleanup code in a function, but otherwise I've seen code trying to adhere to one exit point create bugs. Linux coding standards are the pragmatic choice, use cleanup goto's. They're idiomatic, clear, safe, easy when done right.
- hxtk 4y ago
  I do web backend stuff. A coworker of mine writes Go according to MISRA C style and this is the main thing that's always annoyed me: it seems like half the codebase is comments justifying deviations, like explicitly commenting when we are using the `if err != nil...` idiom to note any deferred cleanup that takes place and justify why it's safe to early return.

riedel 4y ago

I am pretty sure that SPARK Ada would be an alternative.

pjmlp 4y ago

There is also AUTOSAR, which focused initially in C++14, got recently updated to C++17, and now is collaborating with Ferrocene regarding having Rust as well.

uninstallgentoo 4y ago