6 ms·

This is big news in my opinion. "We’ve qualified Ferrocene for use in systems up to ASIL D" Where D is the highest existing level used for systems that can po

This is big news in my opinion. "We’ve qualified Ferrocene for use in systems up to ASIL D" Where D is the highest existing level used for systems that can potentially cause fatal injuries. From my understanding that means that now Rust can be used for the development of security critical software in automotive. I used to work in automotive and where I worked software development was dominated by ancient and archaic compilers and toolchains. Even if it wasn't for the advantages that Rust brings to the table the possibility to use a modern toolchain would be revolutionary. At the same time this is the biggest risk for adoption because these legacy systems are deeply ingrained and intertwined with existing processes that often span multiple tiers of suppliers and will be hard to change.

pjmlp 3y ago
While it is great that Rust is now also an option, some of those places still stuck in C89 and C++98, are hardly to going upgrade to anything else. Some times not even the tooling is an excuse, as most chip vendors do at least support C11 and C++14 in most cases.
- Xylakant 3y ago
  Disclaimer: I'm one of the founders of Ferrous Systems To some extend I agree, but from our conversations with OEMs, Tier 1 and Tier 2 suppliers we do see a significant interest in moving to rust, much more than moving to a new C/C++ version. The reasoning is that moving to a new C/C++ version is an incremental change, but moving to rust signifies a jump to a different tech level (let's set aside whether that's true on a technical level or not, I'm talking about perception). One of the signifiers is that we were able to qualify the rust language as it exists, with no such restrictions such as Misra C etc. So no "reduce use of pointers" etc. The other things that's helping is regulatory pressure. The CISA, DARPA etc are all advocating strongly in favor of moving to memory safe languages, and for the chunk of the market that used C/C++ before, rust is a pretty good offering there: It binds to C both ways, that means not only can you call C code from rust, but also the other way round - you can build a component in rust and integrate it in your existing firmware. That's a rare capability. Chipset and ecosystem support are IMO the biggest hurdles at the moment, but with Ferrocene as a qualified compiler, at least that one bar is removed. It's still a long way to go and a lot of work ahead of us :).
  - pjmlp 3y ago
    I see human behavior a more problematic issue to overcome than the toolchains, hence why I mentioned the toolings being more modern than what many are willing to adopt. Looking forward to regulatory pressure to help improving the situation, not only regarding the adoption of modern safer languages, but also to "just" adopt modern practices and tools while coding in C and C++. Already changing the mentality from unsafe at any speed, to quality matters, would be a big improvement. A plus from safer languages that aren't copy-paste compatible with C, is that C style programming is already taken out, so we don't need to spend time creating SonarQube rules and forcing them into teams. Good luck with the Ferrocene effort.
    - Xylakant 3y ago
      > I see human behavior a more problematic issue to overcome than the toolchains, hence why I mentioned the toolings being more modern than what many are willing to adopt. I absolutely agree. I agree that this is what's holding back adoption of new tooling the most. However, the impression that I get from our conversations is that a new C/C++ is seen as "more of the old thing" while rust is considered a break with the old thing, something new with substantial risk, but also substantial upsides. This perception helps when it comes to considering an adoption.
      - cryptonector 3y ago
        We need an industry-wide break with the old thing. There have been enough problems caused by crappy unmaintainable spaghetti code full of UB. Now, a new thing (Rust) doesn't mean you'll get better code in every way, but at least in some ways.
    - rdsubhas 3y ago
      To be frank, this seems to be a general comment on rust as a language itself, than ferrocene. One would instead start from an observation that rust has been filling a real need/gap in the market which can't be explained merely by human behavior alone, and looks like it's been quite successful at doing that.
zozbot234 3y ago
> From my understanding that means that now Rust can be used for the development of security critical software in automotive. What about other safety critical domains such as aerospace, medical, railways, machinery, process control etc? It seems like each of these has its own bespoke standards, so Ferrous will need to seek certification for these separately?
- twic 3y ago
  As the article says: > Beyond the automotive, Ferrocene can also be used in electronic programmable systems in the industrial sector. Here the focus is on developing products or applications that carry out safety functions. Like the automotive certification, we’ve also gone for the highest level of risk reduction and qualified it at SIL4. Apparently [1] the SIL standard is used in at least the process control, nuclear, mechanical, and railway industries. Not sure about medical or aerospace. [1] https://en.wikipedia.org/wiki/Safety_integrity_level#Standards https://en.wikipedia.org/wiki/Safety_integrity_level#Standar...
  - Xylakant 3y ago
    Aerospace would be DO-178, which is on the roadmap, but will take some effort (a year or two, give or take). Medical is closer: While there are dedicated certifications for medical, they are relatively close to the IEC 61508 industrial standards and so IEC certifications are often used as a stand-in for the equivalent medical certification.
    - kejaed 3y ago
      Keeping an eye on this in the aero, uh, space. Very interesting progress, keep up the good work.
    - twoWhlsGud 3y ago
      Isn't AdaCore handling the DO-178 side? Or does Ferrocene intend to have an offering here, also?
tialaramex 3y ago
> From my understanding that means that now Rust can be used for the development of security critical software in automotive. It has always been possible to do whatever you wanted in this respect, Ferrocene means that you don't have to go to more trouble than a competitor who does their software development in a similarly qualified C++ software suite. Rather than pay some number of people to explain why it's OK that you didn't do the boring normal thing, you can pay Ferrocene for their paperwork which says actually Rust is just one of the boring normal things. Is "Boring normal thing" good enough? Well, on its own I'd argue it's not even close, but pragmatism rules the day, people writing firmware which is in pretty old cars were knocking it together in C with no rules, and most people didn't die, so, that's our baseline, that was apparently OK, logically a bit of that won't be a disaster... right? It reminds me of GRAS rules. On the one hand, there's no particular reason to just assume parsnips are OK food while this random thing my chemists just invented is not - after all parsnips may be "natural" but so are all nightshades and some of them are straight up poison (and indeed the rest of Apiaceae, the family parsnips are in, are sometimes poisonous) - however on the other hand a lot of people have eaten parsnips already and they seemed fine, so, maybe that's enough reason to require tests for my chemical but not parsnips ? Or at least, lets not require the tests before continuing to eat parsnips.
- weinzierl 3y ago
  "It has always been possible to do whatever you wanted [..]" That is not quite what I meant. You can always do what you want if you are prepared to accept the consequences. German law requires the manufacturer of a technical product to take all measures objectively necessary and reasonable in order to avoid danger and harm. In automotive safety critical systems ISO26262 is a legally well established, necessary (but not necessarily sufficient) prerequisite for that. Car manufacturers spend a ton of money on certified compilers and toolchains for good reasons. One of them is legal compliance. "From my understanding that means that now Rust can be used for the development of security critical software in automotive." What I meant here is that I'm not sure if what exists today (including Ferrocene's certified toolchain) is enough to make Rust happen in safety critical automotive applications. I simply do not know enough to make that claim.
DoingIsLearning 3y ago
> Rust can be used for the development of security critical software in automotive. Perhaps you are native of a latin language? In the context of ISO26262, ASIL levels relate to the criticality of _safety_ not security. My house's security will determine how easily someone can break in. My house's safety will determine how well it will survive a hurricane.
- weinzierl 3y ago
  Oh yes, you are right, in my mother tongue safety and security are the same word. It is still embarrassing, I should have been more careful.
  - lbschenkel 3y ago
    Portuguese doesn't distinguish between those either: both are "segurança".
  - chromatin 3y ago
    Wait -- I find this fascinating. They are also kind-of the same word(s) in German (Sicherheit / Sicherung). Do native German speakers draw much distinction between Sicherheit and Sicherung, and to the same degree that we do in English? If no, I am curious how the differentiation in concepts developed in English developed and whether it is also present in other Germanic languages.
    - Megranium 3y ago
      Hmm in German you could also say "Betriebssicherheit" (safety) vs. "Angriffssicherheit" (security), or at least that always was the translation that made most sense to me personally. I'd say native speakers of German distinguish it but it depends on the context ... talking about computers, it's typically more about security, while when talking about construction sites, it's typically more about safety.
      - M3t0r 3y ago

pjmlp 3y ago

While it is great that Rust is now also an option, some of those places still stuck in C89 and C++98, are hardly to going upgrade to anything else. Some times not even the tooling is an excuse, as most chip vendors do at least support C11 and C++14 in most cases.

Xylakant 3y ago
Disclaimer: I'm one of the founders of Ferrous Systems To some extend I agree, but from our conversations with OEMs, Tier 1 and Tier 2 suppliers we do see a significant interest in moving to rust, much more than moving to a new C/C++ version. The reasoning is that moving to a new C/C++ version is an incremental change, but moving to rust signifies a jump to a different tech level (let's set aside whether that's true on a technical level or not, I'm talking about perception). One of the signifiers is that we were able to qualify the rust language as it exists, with no such restrictions such as Misra C etc. So no "reduce use of pointers" etc. The other things that's helping is regulatory pressure. The CISA, DARPA etc are all advocating strongly in favor of moving to memory safe languages, and for the chunk of the market that used C/C++ before, rust is a pretty good offering there: It binds to C both ways, that means not only can you call C code from rust, but also the other way round - you can build a component in rust and integrate it in your existing firmware. That's a rare capability. Chipset and ecosystem support are IMO the biggest hurdles at the moment, but with Ferrocene as a qualified compiler, at least that one bar is removed. It's still a long way to go and a lot of work ahead of us :).
- pjmlp 3y ago
  I see human behavior a more problematic issue to overcome than the toolchains, hence why I mentioned the toolings being more modern than what many are willing to adopt. Looking forward to regulatory pressure to help improving the situation, not only regarding the adoption of modern safer languages, but also to "just" adopt modern practices and tools while coding in C and C++. Already changing the mentality from unsafe at any speed, to quality matters, would be a big improvement. A plus from safer languages that aren't copy-paste compatible with C, is that C style programming is already taken out, so we don't need to spend time creating SonarQube rules and forcing them into teams. Good luck with the Ferrocene effort.
  - Xylakant 3y ago
    > I see human behavior a more problematic issue to overcome than the toolchains, hence why I mentioned the toolings being more modern than what many are willing to adopt. I absolutely agree. I agree that this is what's holding back adoption of new tooling the most. However, the impression that I get from our conversations is that a new C/C++ is seen as "more of the old thing" while rust is considered a break with the old thing, something new with substantial risk, but also substantial upsides. This perception helps when it comes to considering an adoption.
    - cryptonector 3y ago
      We need an industry-wide break with the old thing. There have been enough problems caused by crappy unmaintainable spaghetti code full of UB. Now, a new thing (Rust) doesn't mean you'll get better code in every way, but at least in some ways.
  - rdsubhas 3y ago
    To be frank, this seems to be a general comment on rust as a language itself, than ferrocene. One would instead start from an observation that rust has been filling a real need/gap in the market which can't be explained merely by human behavior alone, and looks like it's been quite successful at doing that.

zozbot234 3y ago

> From my understanding that means that now Rust can be used for the development of security critical software in automotive. What about other safety critical domains such as aerospace, medical, railways, machinery, process control etc? It seems like each of these has its own bespoke standards, so Ferrous will need to seek certification for these separately?

twic 3y ago
As the article says: > Beyond the automotive, Ferrocene can also be used in electronic programmable systems in the industrial sector. Here the focus is on developing products or applications that carry out safety functions. Like the automotive certification, we’ve also gone for the highest level of risk reduction and qualified it at SIL4. Apparently [1] the SIL standard is used in at least the process control, nuclear, mechanical, and railway industries. Not sure about medical or aerospace. [1] https://en.wikipedia.org/wiki/Safety_integrity_level#Standards https://en.wikipedia.org/wiki/Safety_integrity_level#Standar...
- Xylakant 3y ago
  Aerospace would be DO-178, which is on the roadmap, but will take some effort (a year or two, give or take). Medical is closer: While there are dedicated certifications for medical, they are relatively close to the IEC 61508 industrial standards and so IEC certifications are often used as a stand-in for the equivalent medical certification.
  - kejaed 3y ago
    Keeping an eye on this in the aero, uh, space. Very interesting progress, keep up the good work.
  - twoWhlsGud 3y ago
    Isn't AdaCore handling the DO-178 side? Or does Ferrocene intend to have an offering here, also?

tialaramex 3y ago

> From my understanding that means that now Rust can be used for the development of security critical software in automotive. It has always been possible to do whatever you wanted in this respect, Ferrocene means that you don't have to go to more trouble than a competitor who does their software development in a similarly qualified C++ software suite. Rather than pay some number of people to explain why it's OK that you didn't do the boring normal thing, you can pay Ferrocene for their paperwork which says actually Rust is just one of the boring normal things. Is "Boring normal thing" good enough? Well, on its own I'd argue it's not even close, but pragmatism rules the day, people writing firmware which is in pretty old cars were knocking it together in C with no rules, and most people didn't die, so, that's our baseline, that was apparently OK, logically a bit of that won't be a disaster... right? It reminds me of GRAS rules. On the one hand, there's no particular reason to just assume parsnips are OK food while this random thing my chemists just invented is not - after all parsnips may be "natural" but so are all nightshades and some of them are straight up poison (and indeed the rest of Apiaceae, the family parsnips are in, are sometimes poisonous) - however on the other hand a lot of people have eaten parsnips already and they seemed fine, so, maybe that's enough reason to require tests for my chemical but not parsnips ? Or at least, lets not require the tests before continuing to eat parsnips.

weinzierl 3y ago
"It has always been possible to do whatever you wanted [..]" That is not quite what I meant. You can always do what you want if you are prepared to accept the consequences. German law requires the manufacturer of a technical product to take all measures objectively necessary and reasonable in order to avoid danger and harm. In automotive safety critical systems ISO26262 is a legally well established, necessary (but not necessarily sufficient) prerequisite for that. Car manufacturers spend a ton of money on certified compilers and toolchains for good reasons. One of them is legal compliance. "From my understanding that means that now Rust can be used for the development of security critical software in automotive." What I meant here is that I'm not sure if what exists today (including Ferrocene's certified toolchain) is enough to make Rust happen in safety critical automotive applications. I simply do not know enough to make that claim.

DoingIsLearning 3y ago

> Rust can be used for the development of security critical software in automotive. Perhaps you are native of a latin language? In the context of ISO26262, ASIL levels relate to the criticality of _safety_ not security. My house's security will determine how easily someone can break in. My house's safety will determine how well it will survive a hurricane.

weinzierl 3y ago
Oh yes, you are right, in my mother tongue safety and security are the same word. It is still embarrassing, I should have been more careful.
- lbschenkel 3y ago
  Portuguese doesn't distinguish between those either: both are "segurança".
- chromatin 3y ago
  Wait -- I find this fascinating. They are also kind-of the same word(s) in German (Sicherheit / Sicherung). Do native German speakers draw much distinction between Sicherheit and Sicherung, and to the same degree that we do in English? If no, I am curious how the differentiation in concepts developed in English developed and whether it is also present in other Germanic languages.
  - Megranium 3y ago
    Hmm in German you could also say "Betriebssicherheit" (safety) vs. "Angriffssicherheit" (security), or at least that always was the translation that made most sense to me personally. I'd say native speakers of German distinguish it but it depends on the context ... talking about computers, it's typically more about security, while when talking about construction sites, it's typically more about safety.
    - M3t0r 3y ago