4 ms·

I'd like to clarify a little here: There's an ISO certifiation in here - but it's not an ISO standard for the language. Essentially, the ISO 26262 certificatio

I'd like to clarify a little here: There's an ISO certifiation in here - but it's not an ISO standard for the language. Essentially, the ISO 26262 certification mostly verifies that the compiler release process conforms to a certain standard. It does not create an ISO standard for rust, not does it aim to. At part of the certification process we had to write a spec for the rust language, but it is a descriptive spec of how certain aspects of the rust language behave for one specific release of the compiler. The certification builds on this to ensure that tests catch deviations between spec and implementation, known problems are documented etc. So rust as a language is unaffected, as is the rust project. The spec is open source and might be useful to others, you can find it at https://spec.ferrocene.dev/ https://spec.ferrocene.dev/ The target sectors for ISO 26262 and related industrial certification are clearly sectors that require such certification: automotive, medical, etc. Ferrocene itself however, is not only the ISO certified downstream of the rust compiler, it also offers for example long term support and tracking of known issues which the rust project does not provide. This is also important for certain applications that do not strictly require certifications. Disclosure: I'm one of the founders of Ferrous Systems, but I'm only involved in the Ferrocene project on a moderately high level, so forgive minor technical inaccuracies :)

jeddy3 3y ago
> Essentially, the ISO 26262 certification mostly verifies that the compiler release process conforms to a certain standard. It does not create an ISO standard for rust, not does it aim to. Sorry for a stupid question, but what does this mean? Is it only that Rust itself (the language) is no use in a certification, but rather a specific compiler version? I.e. basically leading to the same outcome in the end. Or does this mean to not get the hopes up (right now) for using Rust in a ISO26262 certified project?
- steveklabnik 3y ago
  Not your parent, and haven't worked directly in these areas, but this is my understanding. "certification" is something that is done to a process that produces a software artifact. So yes, in some sense it is "particular compiler version." The result of certification says "this compiler will do this when given this, and here is how we ensure that that is true, and here's the process for when that's not true, etc etc etc." Users can then use that specific compiler. > I.e. basically leading to the same outcome in the end. The difference is pretty important. Getting this certification does not require that the abstract concept of the Rust language is being specified in any specific way. It does require that a specific inputs to the compiler are described, and because compatibility with upstream Rust is desired, those specific inputs happen to map to inputs to rustc that are identical, but it is important to understand that this can happen completely independently of what the Rust Project decides is best for the language; this is a downstream project. In theory, if the Rust project wanted a specification, starting with some of the work Ferrocene has done would be an option. But the qualification process doesn't require that. > Or does this mean to not get the hopes up (right now) for using Rust in a ISO26262 certified project? The opposite, this means you can use Rust in these places. Even though this work does not specify Rust.
  - jeddy3 3y ago
    Thank you for an exhaustive answer! > The difference is pretty important. Getting this certification does not require that the abstract concept of the Rust language is being specified in any specific way. Sorry, I was being vague. I meant the outcome for "us", the users, creating certified software relying on Ferrocene. Totally on board with that there is a huge difference for certifying Ferrocene itself. > The opposite, this means you can use Rust in these places. Even though this work does not specify Rust. Nice, that's what I was hoping for. We are currently in a project creating safety certified software (in C, as are our other code) and are curiously looking at Rust, partly because of this effort.
    - steveklabnik 3y ago
      You're welcome. The main page for Ferrocene says "ISO 26262 and IEC 61508 qualified" with "DO-178C, ISO 21434, and IEC 62278 in the future," so depending on exactly which things you need, Ferrocene may work, but it also may not.

jeddy3 3y ago

> Essentially, the ISO 26262 certification mostly verifies that the compiler release process conforms to a certain standard. It does not create an ISO standard for rust, not does it aim to. Sorry for a stupid question, but what does this mean? Is it only that Rust itself (the language) is no use in a certification, but rather a specific compiler version? I.e. basically leading to the same outcome in the end. Or does this mean to not get the hopes up (right now) for using Rust in a ISO26262 certified project?

steveklabnik 3y ago
Not your parent, and haven't worked directly in these areas, but this is my understanding. "certification" is something that is done to a process that produces a software artifact. So yes, in some sense it is "particular compiler version." The result of certification says "this compiler will do this when given this, and here is how we ensure that that is true, and here's the process for when that's not true, etc etc etc." Users can then use that specific compiler. > I.e. basically leading to the same outcome in the end. The difference is pretty important. Getting this certification does not require that the abstract concept of the Rust language is being specified in any specific way. It does require that a specific inputs to the compiler are described, and because compatibility with upstream Rust is desired, those specific inputs happen to map to inputs to rustc that are identical, but it is important to understand that this can happen completely independently of what the Rust Project decides is best for the language; this is a downstream project. In theory, if the Rust project wanted a specification, starting with some of the work Ferrocene has done would be an option. But the qualification process doesn't require that. > Or does this mean to not get the hopes up (right now) for using Rust in a ISO26262 certified project? The opposite, this means you can use Rust in these places. Even though this work does not specify Rust.
- jeddy3 3y ago
  Thank you for an exhaustive answer! > The difference is pretty important. Getting this certification does not require that the abstract concept of the Rust language is being specified in any specific way. Sorry, I was being vague. I meant the outcome for "us", the users, creating certified software relying on Ferrocene. Totally on board with that there is a huge difference for certifying Ferrocene itself. > The opposite, this means you can use Rust in these places. Even though this work does not specify Rust. Nice, that's what I was hoping for. We are currently in a project creating safety certified software (in C, as are our other code) and are curiously looking at Rust, partly because of this effort.
  - steveklabnik 3y ago
    You're welcome. The main page for Ferrocene says "ISO 26262 and IEC 61508 qualified" with "DO-178C, ISO 21434, and IEC 62278 in the future," so depending on exactly which things you need, Ferrocene may work, but it also may not.