8 ms·
Rust is rolling off the Volvo assembly line
- deleted 2y ago[deleted]
- slicktux 2y agoSo, will RUST ever have standards for safety critical systems like C/C++. Example MISRA for car programs? Or is the migration or certification too expensive and time consuming?
- BD103 2y agoYou may be interested in Ferrocene[0], a version of the Rust toolchain that is vetted for critical systems like automobiles. It's offered by Ferrous Systems, the same people who help maintain Rust Analyzer (the de-facto LSP for Rust). [0]: https://ferrocene.dev/en/ https://ferrocene.dev/en/
- slicktux 2y agoThank you for the reference! Will definitely look into this!
- AlotOfReading 2y agoNote that what Ferrocene is currently offering is a toolchain. Things like core and std are not part of the current certification package. It's an incredibly exciting offering, but it's not quite ready to ship today. The fact that the certified toolchain is just the normal, publicly available one is great too.
- estebank 2y ago> The fact that the certified toolchain is just the normal, publicly available one is great too. And speaks to the standards of quality that the project holds itself to.
- steveklabnik 2y agoYes, Ferrocene is able to be qualified more easily in part by how good upstream development practices are. A lot of qualified compilers need to be written from scratch because the existing compilers do not do testing and other things that are required for qualification, but the upstream Rust project has a development process far closer to a safety qualified compiler than not. It’s something worth celebrating about rust as a project.
- tialaramex 2y ago> Things like core and std are not part of the current certification package As with C++ I'm not sure this makes coherent sense because of the relationship between the language and some elements of the supporting libraries - with respect to `core` specifically, the Rust programming language requires some of core. Suppose you write a for loop. In Rust that's just sugar, and it's de-sugared into a loop that uses IntoIterator::into_iter, Iterator::next, Option::Some and Option::None which are all from the core library.
- AlotOfReading 2y agoHence the warning. They're not separable, but it's what the current state of the offering is. If you ship core anything depending on core or std, the burden is on you to ensure those parts of your code are appropriately qualified until they can get the situation sorted.
- bmitc 2y agoI was recently looking into things along these lines, and my understanding of Ferrocene is that it's just regular Rust with extra tests added. I'd love to know if that's accurate or not. If it is accurate, I've wondered why Rust doesn't just include those tests in the core build.
- steveklabnik 2y agoIn my understanding, no additional tests, but some additional platform support. The issue isn't more tests upstream, it’s more the chain of responsibility for guaranteeing that results are connected to the specification and all of the paperwork that’s required, and ensuring it is accurate.
- monocasa 2y agoThe ferrocene morph of the toplchian is ISO 26262 and ASIL-D, and as this blog post is about rust in the ECU of a production vehicle of a large manufacturer. It seems like it already has support in the relevant safety critical standards, at least in the automotive space.
- RealityVoid 2y agoDifferent kind of standards. MISRA is a coding guidelines standard, ISO 26262 is a functional safety standard, it concerns the whole system, including processes and the tools used (here is where the certification from Ferrocene and HighTec step in). There is overlap, but they mostly do different things.
- howenterprisey 2y agoI looked into MISRA specifically for my previous job and Rust effectively complies with most of it out of the box, and what's left is either inapplicable or not difficult to catch with further tooling.
- nextaccountic 2y ago> further tooling. Just a heads up, Rust does have further tooling. I wish they were more widely used Here are three of them https://github.com/creusot-rs/creusot https://github.com/creusot-rs/creusot https://viperproject.github.io/prusti-dev/user-guide/ https://viperproject.github.io/prusti-dev/user-guide/ https://model-checking.github.io/kani/ https://model-checking.github.io/kani/
- RealityVoid 2y agoSAE has a coding standard in the works for Rust in safety critical systems. https://standardsworks.sae.org/standards-committees/safer-rust-task-force https://standardsworks.sae.org/standards-committees/safer-ru...
- Eplankton 2y agohttps://www.segger.com/news/pr-240927-ozone-support-rust/ https://www.segger.com/news/pr-240927-ozone-support-rust/
- dostick 2y agoAfter reading part of article I realised it’s about Rust the programming language. Not the rust-colored car called Rust as author obviously intended to confuse people with that image and ambiguous title.
- philwelch 2y agoOr, indeed, that Volvo’s manufacturing quality had declined to the point that the cars themselves were shipping with their bodies literally already rusting
- kevinventullo 2y agoThis is absolutely how I initially read it. I’m surprised the title was approved by their comms team!
- wright08 2y agoHuh interesting observation. I wonder if anything in the first two sentences of the article can shed any light. In my job I get to speak to lots of people about Rust. Some are just starting out, some have barely ever heard of it, and then some people are running Rust silently in production at a very large company in a very serious product. Yeah I've definitely heard of people "running (iron oxide) silently in production". Super ambiguous
- aschla 2y agoIt's almost as if it was an intentional artistic choice in phrasing... /s
- pahbloo 2y agoRust (the language) is rolling off the Volvo assembly (not the language) line
- exabrial 2y agoSorry for dumb question, but does rust have an LTS release? Seems like it’s a lot of nightly builds still
- awestroke 2y agoThere's a nightly build every night. There is a stable release every now and then. There are no official LTS releases. The question has been asked every now and then, but I see no real need for an LTS release. Just pick any version and keep using that specific version for as long as you want to. You could pick the same version as some LTS linux distro version.
- GolDDranks 2y agoThe stable release is every 6 weeks, i.e. once in a month and a half. Only the newest version at the time is supported. The qualified Ferrocene toolchain has "2 years of patch releases for select versions", so they have 2-year LTS releases, but that's a paid support plan. Overall, the Rust community hasn't felt much need for official LTS releases.
- daghamm 2y agoSerious question: Can you really call it stable if it is updated every 6 weeks?
- GolDDranks 2y agoEqually serious answer: yes, if it doesn't break backwards compatibilty between the updates. This is what the Rust project means by stable. You can update and your code will continue building. (There's a bunch of documented caveats though.) Rust has been stable in this sense since 1.0, almost ten years. Of course, you might have different semantics for "stable". Some seem to mean "rarely updating" or "each update is small" by that. In the latter sense, too, Rust has becoming stabler over the last few years. In the "rarely updating" sense, Rust is not going to change course. Frequent, time-based releases have demonstrably made the progress smoother, and in a sense, "stabler", as in, more predictable and bug-free.
- _giorgio_ 2y agoYou don't want to see any rust in a brand new car.
- MBCook 2y agoThe article mentions a few times that Rust is a good choice because the code is NOT safety critical. Is that because the safety critical code requires the compiler/libraries/etc. to have some certification Rust currently lacks? If not I don’t understand why it’s phrased that way.
- adrianN 2y agoYes, that's the reason. Certification requirements usually force you to use some ancient niche toolchain.
- MBCook 2y agoThanks. I figured that was the most likely. Is that being worked on? Rust seems like a much better choice than C or C++ to me.
- rhaps0dy 2y agoYes. Adacore is working on it. They announce the first qualified compiler, for some qualification, here: https://www.adacore.com/press/adacore-announces-the-first-qualification-of-a-rust-compiler https://www.adacore.com/press/adacore-announces-the-first-qu...
- yababa_y 2y agoCheck out the requirements in AUTOSAR and MISRA, it’s more than just certifying some golden toolchain. Although Ferrocene is working on that as well :) https://ferrocene.dev/en/ https://ferrocene.dev/en/
- truetraveller 2y agoWhen I see a Rust post, I don't buy into the hype. It's usually compared with raw C, even C++. This is not a good comparison IMHO, since C/C++ has too many footguns/confusions. Instead, compare it to a nicer/stricter "C" equivalent like Zig. Now, Rust doesn't shine as much.
- stackghost 2y agoI actually think embedded is one of the few places where rust makes sense. In 99% of cases outside embedded, a GC'ed language would be better, but a long time ago someone started the meme that GC is slow, or that your users will notice the pauses, etc but those fears are massively overblown. But on embedded where resources are constrained and you can't run e.g. a JVM then Rust makes sense to me, since you can eliminate a whole class of errors from the get go.
- sham1 2y agoI would imagine that the kinds of embedded systems like cars would probably benefit from Ada instead. Not only is there of course SPARK, if one wants to do formal verification, Ada has a proven track record in things like military applications. Of course, passenger cars don't have quite the same level of care needed as military stuff (although a lot of care is still needed since cars are hundreds if not thousands of kilograms and can absolutely kill people), but I could still see Ada being useful even in the automotive industry.
- kstrauser 2y agoI’m not sure if that’s true. I’ve never been around things like airplane flight systems. I have been trained on other military hardware with instructions on how to reset it and under which circumstances. I wouldn’t be utterly shocked if an F-16 pilot learns that which such and such happens, you flip this switch back and forth 3 times and then turn this other knob to reboot the computer. You would never, ever get that to be an acceptable procedure for a car’s anti-lock brakes.
- stackghost 2y ago
- deleted 2y ago[deleted]
- daghamm 2y agoThe fact that they could go from zero to proof of concept in a year and then into production just 2-3 years later is impressive. Given these results I feel the industry will slowly move to Rust once a certified toolchain for safety critical systems exists. At the same time, let's not forget that this is a highly competent team with tons of experience. It's not guaranteed that other developers can have the same success.
- Cu3PO42 2y agoFerrocene [0] exists today! I'm mainly interested in the space from the point of view of a theoretical computer scientist, so I'm not sure if there's additional boxes that need to be checked legally, but it's looking pretty good to me. [0] https://ferrocene.dev/en/ https://ferrocene.dev/en/
- daghamm 2y agoThat looks very interesting. I think these sort of activities must come from outside because the core Rust team has currently no experience in these areas.
- steveklabnik 2y agoIn the sense that there are a variety of requirements that need to be checked, there are. Each industry is different. Ferrocene has mostly been driven by automotive so far because that’s where the customers are, but they’ll get to all of them eventually.
- Cu3PO42 2y agoI really appreciate your reply! > In the sense that there are a variety of requirements that need to be checked Does "requirement" in this context refer to the same thing as a particular ISO/EN/... standard? Or do you mean that there are a multitude of standards, each of which make various demands and some of those might not yet be fulfilled? My wording was much more ambiguous than I intended. What I meant to convey was that I don't know what hurdles there are beyond conforming to the relevant certifications. I.e. in the automotive conetext, Ferrocene is ISO26262 certified, but is that sufficient to be used in a safety-critical automotive context, or are there additional steps that need to be taken before a supplier could use Ferrocene to create a qualified binary?