6 ms·

Why Rust is a great fit for embedded software – 2023 update

51 points by kristianpaul 3y ago

b20000 3y ago
security and memory safety are non issues in most embedded devices
- RhodesianHunter 3y ago
  That certainly appears to be what embedded developers think, given how many issues there have been with IoT security.
  - poor_c_dev 3y ago
    Yes, and the salaries are really poor. I make more money writing javascript than I ever did with embedded C.
    - asyx 3y ago
      Because that's where the money is. You don't get paid for your technical abilities but for how much value you bring to an employer. There are probably a good chunk of researchers that still eat instant ramen at the end of the month that were involved with all those AI algorithms that are all the rage right now for Google Bard, ChatGPT and whatever MS calls their Bing stuff. I thought about switching to something more low level but as long as I can stomach my current job I don't really see a good reason why. I don't even earn that much money but I'd probably still take a pay cut going into embedded.
- pjmlp 3y ago
  We all know that S in IoT stands for security.
  - thfuran 3y ago
    And the R for reliability.
- pornel 3y ago
  I need to regularly reboot my smart bulbs and power sockets. There's definitely room for a more reliable firmware on these things.
eggy 3y ago
Still waiting on Rust. I have attempted to use it beyond toy programs, and it wasn't clicking for me. I am using SPARK2014[0], a big subset of Ada, that has a 25-year track record in high-integrity, safety-critical applications in civil and military applications in many fields. It's also very easy to pick up with integrated tooling and a package manager called Alire. I used to despise verbose syntax, and when I first tried learning Ada over 12 years ago, I now see SPARK2014's syntax and methods as much easier and to work with especially with the surrounding and supportive ecosystem. I worked through the book, "Building High Integrity Applications with Spark"[1] that is a very nice summary and intro to SPARK based on its use in the CubeSAT program. Here's a cute little article on how SPARK2014 was used to replace some low-level stabilization routine in a bigger C program for a specific consumer drone: https://blog.adacore.com/how-to-prevent-drone-crashes-using-spark https://blog.adacore.com/how-to-prevent-drone-crashes-using-... [0] https://www.adacore.com/about-spark https://www.adacore.com/about-spark [1] https://a.co/d/fgtRXxt https://a.co/d/fgtRXxt
- anta40 3y ago
  "alr is tailored to userspace, in a similar way to Python’s virtualenv. A project or workspace will contain all its dependencies." So, each time I create a new project with alr, an Ada toolchain will be downloaded into its project directory?
- Georgelemental 3y ago
  > It wasn't clicking for me. Out of curiosity, was the problem with the language itself, the embedded library/tooling ecosystem, or something else?
  - eggy 3y ago
    To be fair, I started programming back in 1978 with Commodore PET 2001 and went into C and assembly (6502) after that. I then picked up Pascal. Then J and APL after that. While trying Rust for the first time, nailing some of the concepts and syntax (borrow checker, etc.) to express those concepts was very confusing or too verbose to me. Then the second time I tried Rust, I was also learning Zig, and Zig came much easier to me and I could program things quicker albeit without the features of SPARK2014 or Rust for that matter, but a nice sweet spot. But when I saw the goals of Rust and I had already tried SPARK2014, it became apparent that the wish list for Rust was a reality in SPARK2014 and its tooling. The safety, integrity, verifiability, clear and simple syntax along with the formally proven language of SPARK2014, and Ada's legacy seemed the obvious choice to get actual software written for safety-critical applications. I am working on Show Control software which demands high integrity and safety. One leading package, Navigator, runs on QNX. When you are flying things over people's heads at high speeds and accelerations or flying people, you need something that is track proven for such applications. I think Rust can get there someday. I have put Rust on shelf until it matures more on this front. As others have mentioned, Adacore is not so much an PL evangelist as might be thought of by its name, but is cooperating with Ferrous Systems and others to bring Ada/SPARK2014 goodness to Rust. Rust just isn't there yet, and I am a bit too far along to devote my next 10 years to growing and learning Rust when I can apply SPARK2014 today. PL syntax is subjective, and I just find myself tripping over the verbosity in a C++/C-like syntax that Rust adds. I know there are strides to improve this, but
Dowwie 3y ago
What does verified C offer that rust doesn't? Is Ferrocene addressing that requirement?
- owenpalmer 3y ago
  what is "verified C"?
  - patrick451 3y ago
    Probably C that has been audited and certified that it follows a standard designed for safety critical systems like MISRA.
petabytes 3y ago
Last time I tried Rust on bare metal it needed a bunch of hacks or C code to glue it all together. It's just too high level for the most bare metal applications.
- fleventynine 3y ago
  This hasn't been true for a long time. Stable rust can do bare metal armv7m or risc-v development without any C code; just a bit of (inline) assembly to call into a rust main() function using the C ABI.
mimd 3y ago
It would be nice to find a good rundown of how much of the memory safety properties are preserved at stages in the microcontroller/linux driver development.

51 points by kristianpaul 3y ago

b20000 3y ago

security and memory safety are non issues in most embedded devices

RhodesianHunter 3y ago
That certainly appears to be what embedded developers think, given how many issues there have been with IoT security.
- poor_c_dev 3y ago
  Yes, and the salaries are really poor. I make more money writing javascript than I ever did with embedded C.
  - asyx 3y ago
    Because that's where the money is. You don't get paid for your technical abilities but for how much value you bring to an employer. There are probably a good chunk of researchers that still eat instant ramen at the end of the month that were involved with all those AI algorithms that are all the rage right now for Google Bard, ChatGPT and whatever MS calls their Bing stuff. I thought about switching to something more low level but as long as I can stomach my current job I don't really see a good reason why. I don't even earn that much money but I'd probably still take a pay cut going into embedded.
pjmlp 3y ago
We all know that S in IoT stands for security.
- thfuran 3y ago
  And the R for reliability.
pornel 3y ago
I need to regularly reboot my smart bulbs and power sockets. There's definitely room for a more reliable firmware on these things.

eggy 3y ago

Still waiting on Rust. I have attempted to use it beyond toy programs, and it wasn't clicking for me. I am using SPARK2014[0], a big subset of Ada, that has a 25-year track record in high-integrity, safety-critical applications in civil and military applications in many fields. It's also very easy to pick up with integrated tooling and a package manager called Alire. I used to despise verbose syntax, and when I first tried learning Ada over 12 years ago, I now see SPARK2014's syntax and methods as much easier and to work with especially with the surrounding and supportive ecosystem. I worked through the book, "Building High Integrity Applications with Spark"[1] that is a very nice summary and intro to SPARK based on its use in the CubeSAT program. Here's a cute little article on how SPARK2014 was used to replace some low-level stabilization routine in a bigger C program for a specific consumer drone: https://blog.adacore.com/how-to-prevent-drone-crashes-using-spark https://blog.adacore.com/how-to-prevent-drone-crashes-using-... [0] https://www.adacore.com/about-spark https://www.adacore.com/about-spark [1] https://a.co/d/fgtRXxt https://a.co/d/fgtRXxt

anta40 3y ago
"alr is tailored to userspace, in a similar way to Python’s virtualenv. A project or workspace will contain all its dependencies." So, each time I create a new project with alr, an Ada toolchain will be downloaded into its project directory?
Georgelemental 3y ago
> It wasn't clicking for me. Out of curiosity, was the problem with the language itself, the embedded library/tooling ecosystem, or something else?
- eggy 3y ago
  To be fair, I started programming back in 1978 with Commodore PET 2001 and went into C and assembly (6502) after that. I then picked up Pascal. Then J and APL after that. While trying Rust for the first time, nailing some of the concepts and syntax (borrow checker, etc.) to express those concepts was very confusing or too verbose to me. Then the second time I tried Rust, I was also learning Zig, and Zig came much easier to me and I could program things quicker albeit without the features of SPARK2014 or Rust for that matter, but a nice sweet spot. But when I saw the goals of Rust and I had already tried SPARK2014, it became apparent that the wish list for Rust was a reality in SPARK2014 and its tooling. The safety, integrity, verifiability, clear and simple syntax along with the formally proven language of SPARK2014, and Ada's legacy seemed the obvious choice to get actual software written for safety-critical applications. I am working on Show Control software which demands high integrity and safety. One leading package, Navigator, runs on QNX. When you are flying things over people's heads at high speeds and accelerations or flying people, you need something that is track proven for such applications. I think Rust can get there someday. I have put Rust on shelf until it matures more on this front. As others have mentioned, Adacore is not so much an PL evangelist as might be thought of by its name, but is cooperating with Ferrous Systems and others to bring Ada/SPARK2014 goodness to Rust. Rust just isn't there yet, and I am a bit too far along to devote my next 10 years to growing and learning Rust when I can apply SPARK2014 today. PL syntax is subjective, and I just find myself tripping over the verbosity in a C++/C-like syntax that Rust adds. I know there are strides to improve this, but

Dowwie 3y ago

What does verified C offer that rust doesn't? Is Ferrocene addressing that requirement?

owenpalmer 3y ago
what is "verified C"?
- patrick451 3y ago
  Probably C that has been audited and certified that it follows a standard designed for safety critical systems like MISRA.

petabytes 3y ago

Last time I tried Rust on bare metal it needed a bunch of hacks or C code to glue it all together. It's just too high level for the most bare metal applications.

fleventynine 3y ago
This hasn't been true for a long time. Stable rust can do bare metal armv7m or risc-v development without any C code; just a bit of (inline) assembly to call into a rust main() function using the C ABI.

mimd 3y ago

It would be nice to find a good rundown of how much of the memory safety properties are preserved at stages in the microcontroller/linux driver development.