5 ms·

Yes, that's the reason. Certification requirements usually force you to use some ancient niche toolchain.

MBCook 2y ago
Thanks. I figured that was the most likely. Is that being worked on? Rust seems like a much better choice than C or C++ to me.
- rhaps0dy 2y ago
  Yes. Adacore is working on it. They announce the first qualified compiler, for some qualification, here: https://www.adacore.com/press/adacore-announces-the-first-qualification-of-a-rust-compiler https://www.adacore.com/press/adacore-announces-the-first-qu...
- yababa_y 2y ago
  Check out the requirements in AUTOSAR and MISRA, it’s more than just certifying some golden toolchain. Although Ferrocene is working on that as well :) https://ferrocene.dev/en/ https://ferrocene.dev/en/
  - estebank 2y ago
    You might also want to check out this comparison of MISRA's rules against idiomatic Rust code: https://github.com/PolySync/misra-rust/blob/master/MISRA-Rules.md https://github.com/PolySync/misra-rust/blob/master/MISRA-Rul...
  - carlmr 2y ago
    Vector has AUTOSAR with Rust modules using a certified compiler now: https://www.vector.com/int/en/news/news/safety-applications-with-rust-and-autosar-classic/#:~:text=Vector%20and%20HighTec%20have%20removed%20the%20last%20hurdles%20for%20the https://www.vector.com/int/en/news/news/safety-applications-...
- bschwindHN 2y ago
  See ferrocene: https://ferrocene.dev/en/ https://ferrocene.dev/en/
- jbit 2y ago
  Hightec also have an ISO26262 qualified compiler focused on automotive: https://hightec-rt.com/rust https://hightec-rt.com/rust So there's lots of focus on having a good alternative to C/C++
AlotOfReading 2y ago
And those ancient, niche toolchains are horribly buggy as a rule. For example, a certain Santa Barbara based vendor ships a high integrity compiler that you can crash with entirely normal standards compliant C/C++.
- SilasX 2y ago
  That ... feels like it defeats the purpose of designating a special, certified library for safety-critical code.
  - estebank 2y ago
    Its not so much about ensuring the best tool chain is used, but rather about setting the lowest bound of quality. By being slow moving it avoids the potential for temporary regressions. It is also ass-covering by demonstrating you followed "industry standard procedure". If you do something different, even if it is quantifiably better, it might make for a stressful deposition explaining why the worse but standard approach wasn't used instead.
  - AlotOfReading 2y ago
    Would it make you feel better if I told you that these kinds of offerings usually also don't offer modern validation tools like sanitizers? They expect people to just wing it with whatever the proprietary IDE happens to give them. A big part of the job of safety critical development is knowing the difference between box checking best practices/regulations and building actually safe systems so you can do both.
    - yjftsjthsd-h 2y ago
      I would assume the solution is to run your code through multiple compilers/toolchains - in dev, CI can run the certified compiler to make sure your code stays compatible with it, but also through modern clang/gcc with every linter and static analysis tool you can think of. Then for the "official" prod builds you use the certified compiler. Automated testing should probably use both, and even compare the behavior of binaries from each chain to look out for bugs that only exist in one. That way you get most of the benefits of both worlds (not all, since you can only write code that all compilers can handle).
steveklabnik 2y ago
Ferrocene is breaking several norms in this area, and “ancient toolchains” is one of them. They’re able to certify new ones remarkably quickly.
- yjftsjthsd-h 2y ago
  > They’re able to certify new ones remarkably quickly. Do you know how they do that? Is it something special about rust, or some process improvement they're doing?
  - steveklabnik 2y ago
    I have some knowledge but as an outsider. For example, rustc has a very large test suite that is run on every single commit. There is also a language reference that describes the language in some detail. One of the things Ferrocene brings to the table is the paperwork and auditing that the test suite corresponds to the specification. With other vendors developing their own toolchain, they would have to do all three parts of that work (well, in the case of C or C++, two ish not three, since they have a specification, but there are always extensions and platform specific behavior to document) instead of just one. This isn’t the only thing they do, but it’s one example. It’s not so much something special about Rust in an abstract sense, but in the practical sense that the Rust Project takes robust software engineering seriously, and being downstream of that is useful.
Eplankton 2y ago
And apparently Segger Studio says NO to "old granpa style toolchain" by introduce this several weeks ago: https://www.segger.com/news/pr-240927-ozone-support-rust/ https://www.segger.com/news/pr-240927-ozone-support-rust/

Thanks. I figured that was the most likely. Is that being worked on? Rust seems like a much better choice than C or C++ to me.

rhaps0dy 2y ago
Yes. Adacore is working on it. They announce the first qualified compiler, for some qualification, here: https://www.adacore.com/press/adacore-announces-the-first-qualification-of-a-rust-compiler https://www.adacore.com/press/adacore-announces-the-first-qu...
yababa_y 2y ago
Check out the requirements in AUTOSAR and MISRA, it’s more than just certifying some golden toolchain. Although Ferrocene is working on that as well :) https://ferrocene.dev/en/ https://ferrocene.dev/en/
- estebank 2y ago
  You might also want to check out this comparison of MISRA's rules against idiomatic Rust code: https://github.com/PolySync/misra-rust/blob/master/MISRA-Rules.md https://github.com/PolySync/misra-rust/blob/master/MISRA-Rul...
- carlmr 2y ago
  Vector has AUTOSAR with Rust modules using a certified compiler now: https://www.vector.com/int/en/news/news/safety-applications-with-rust-and-autosar-classic/#:~:text=Vector%20and%20HighTec%20have%20removed%20the%20last%20hurdles%20for%20the https://www.vector.com/int/en/news/news/safety-applications-...
bschwindHN 2y ago
See ferrocene: https://ferrocene.dev/en/ https://ferrocene.dev/en/
jbit 2y ago
Hightec also have an ISO26262 qualified compiler focused on automotive: https://hightec-rt.com/rust https://hightec-rt.com/rust So there's lots of focus on having a good alternative to C/C++

AlotOfReading 2y ago

And those ancient, niche toolchains are horribly buggy as a rule. For example, a certain Santa Barbara based vendor ships a high integrity compiler that you can crash with entirely normal standards compliant C/C++.

SilasX 2y ago
That ... feels like it defeats the purpose of designating a special, certified library for safety-critical code.
- estebank 2y ago
  Its not so much about ensuring the best tool chain is used, but rather about setting the lowest bound of quality. By being slow moving it avoids the potential for temporary regressions. It is also ass-covering by demonstrating you followed "industry standard procedure". If you do something different, even if it is quantifiably better, it might make for a stressful deposition explaining why the worse but standard approach wasn't used instead.
- AlotOfReading 2y ago
  Would it make you feel better if I told you that these kinds of offerings usually also don't offer modern validation tools like sanitizers? They expect people to just wing it with whatever the proprietary IDE happens to give them. A big part of the job of safety critical development is knowing the difference between box checking best practices/regulations and building actually safe systems so you can do both.
  - yjftsjthsd-h 2y ago
    I would assume the solution is to run your code through multiple compilers/toolchains - in dev, CI can run the certified compiler to make sure your code stays compatible with it, but also through modern clang/gcc with every linter and static analysis tool you can think of. Then for the "official" prod builds you use the certified compiler. Automated testing should probably use both, and even compare the behavior of binaries from each chain to look out for bugs that only exist in one. That way you get most of the benefits of both worlds (not all, since you can only write code that all compilers can handle).

steveklabnik 2y ago

Ferrocene is breaking several norms in this area, and “ancient toolchains” is one of them. They’re able to certify new ones remarkably quickly.

yjftsjthsd-h 2y ago
> They’re able to certify new ones remarkably quickly. Do you know how they do that? Is it something special about rust, or some process improvement they're doing?
- steveklabnik 2y ago
  I have some knowledge but as an outsider. For example, rustc has a very large test suite that is run on every single commit. There is also a language reference that describes the language in some detail. One of the things Ferrocene brings to the table is the paperwork and auditing that the test suite corresponds to the specification. With other vendors developing their own toolchain, they would have to do all three parts of that work (well, in the case of C or C++, two ish not three, since they have a specification, but there are always extensions and platform specific behavior to document) instead of just one. This isn’t the only thing they do, but it’s one example. It’s not so much something special about Rust in an abstract sense, but in the practical sense that the Rust Project takes robust software engineering seriously, and being downstream of that is useful.

Eplankton 2y ago

And apparently Segger Studio says NO to "old granpa style toolchain" by introduce this several weeks ago: https://www.segger.com/news/pr-240927-ozone-support-rust/ https://www.segger.com/news/pr-240927-ozone-support-rust/