3 ms·

"It has always been possible to do whatever you wanted [..]" That is not quite what I meant. You can always do what you want if you are prepared to accept the

"It has always been possible to do whatever you wanted [..]" That is not quite what I meant. You can always do what you want if you are prepared to accept the consequences. German law requires the manufacturer of a technical product to take all measures objectively necessary and reasonable in order to avoid danger and harm. In automotive safety critical systems ISO26262 is a legally well established, necessary (but not necessarily sufficient) prerequisite for that. Car manufacturers spend a ton of money on certified compilers and toolchains for good reasons. One of them is legal compliance. "From my understanding that means that now Rust can be used for the development of security critical software in automotive." What I meant here is that I'm not sure if what exists today (including Ferrocene's certified toolchain) is enough to make Rust happen in safety critical automotive applications. I simply do not know enough to make that claim.

Xylakant 3y ago
> In automotive safety critical systems ISO 26262 is a legally well established, necessary (but not necessarily sufficient) prerequisite for that. That is true, but an ISO 26262 qualified toolchain is neither sufficient nor required to achieve certification. It certainly helps when the auditor looks at your project, but you can also opt for other measures. So you could build ISO 26262 certified software in rust even before the Ferrocene qualification, and you still can build it using stock rustc, but it's more work. Few people will do that and rather opt for a qualified toolchain. > What I meant here is that I'm not sure if what exists today (including Ferrocene's certified toolchain) is enough to make Rust happen in safety critical automotive applications. It's one of the foundational pieces, but others are qualified libraries and the entire ecosystem. So the adoption will by necessity still take time. We do have a few exciting things in the pipeline there, but that's news for another day (it's christmas soon, not all presents at once)
- weinzierl 3y ago
  Very true. I'm coming from the supplier side and in the world I know the required ASIL level is a box we have to tick, no realistic way around it. That includes using a certified compiler. Probably that is not universally true but in my bubble for all intents and purposes a certified compiler was a hard requirement. This is in no way a contradiction to what you wrote but underlines why I think a Rust compiler that is not in the way for me ticking the ASIL D box is a big thing.

Xylakant 3y ago

> In automotive safety critical systems ISO 26262 is a legally well established, necessary (but not necessarily sufficient) prerequisite for that. That is true, but an ISO 26262 qualified toolchain is neither sufficient nor required to achieve certification. It certainly helps when the auditor looks at your project, but you can also opt for other measures. So you could build ISO 26262 certified software in rust even before the Ferrocene qualification, and you still can build it using stock rustc, but it's more work. Few people will do that and rather opt for a qualified toolchain. > What I meant here is that I'm not sure if what exists today (including Ferrocene's certified toolchain) is enough to make Rust happen in safety critical automotive applications. It's one of the foundational pieces, but others are qualified libraries and the entire ecosystem. So the adoption will by necessity still take time. We do have a few exciting things in the pipeline there, but that's news for another day (it's christmas soon, not all presents at once)

weinzierl 3y ago
Very true. I'm coming from the supplier side and in the world I know the required ASIL level is a box we have to tick, no realistic way around it. That includes using a certified compiler. Probably that is not universally true but in my bubble for all intents and purposes a certified compiler was a hard requirement. This is in no way a contradiction to what you wrote but underlines why I think a Rust compiler that is not in the way for me ticking the ASIL D box is a big thing.