Hacker News Reader

Comment by tazjin | Hacker News Reader

Makes sense that one of the most safety focused manufacturers would go for it.

I do not see any indication in the article that Rust is used in safety critical components:

"And it happened to run on the architecture that was best supported in the embedded bare metal space of Rust at the time. It was also not safety critical component, so we did not have to worry about safety certifications."

I find the article very low on actual information. I don't think Rust will be used in an ABS soon. The Android/Elixir/Rust examples in the article are for the useless gadgets that no one wants.

The article says that they need approval to use Rust in safety critical components and you get approval by showing Rust is working in other places. They say in the article that one of the reasons they chose Rust was for it's safety-first approach which matches well with Volvo's ideology.

> I thought this would be useful for Volvo Cars because it embodies the same type of Ideology that you want when you’re developing safety-critical software.

So I think "Makes sense that one of the most safety focused manufacturers would go for it." is accurate.

Im actually a bit suprised. Getting anything but MISRA C/C++ certified is usually a no-go, but maybe and finally this is an alternative to fucking MISRA.

For ECUs running the car it's MISRA still, Rust is in the pipeline, but still far far away. 5-10 years before it becomes common. Standard is being worked on, but compilers and other tools will take a lot more time. These are generally not your of the shelf MCUs, and for many compilers are quite tailored.

But for anything regarding networking and UX (screens), a lot of languages and frameworks are being used right now.

Also, if you hate MISRA subset of C so much, you probably won't like Rust, since both impose some similar rules.

I don't know much about Rust but the problem with MISRA is significant defects with the specification that force you to write bad/broken code in rare cases, and produce more work without benefit in others. A Rust MISRA standard would be great. Limited but more expressive and concise than C probably.

Certification is already in the works afaik. This [0] is also interesting, a check how much MISRA checking can be removed because the rust compiler already does a similar check.

Ah. Found it, [1][2]

[0] https://github.com/PolySync/misra-rust

[1] https://news.ycombinator.com/item?id=32237780

[2] https://news.ycombinator.com/item?id=30174827

Rust essentially puts some parts of MISRA into the type checker (e.g. no pointer arithmetic). Why is MISRA bad?

I expect something like MISRA for Rust as well. There will probably be rules like "keyword unsafe forbidden". If you really need it, try writing a deviation record. The advantage is that Rust should require fewer rules.

Some MISRA rules lead to absurd code, e.g. single return from a function meaning any error checking adds another level of nesting.

My first job as a SWE was at Ericsson, and they also had this requirement. Solution: gotos everywhere!

I've seen code that solves it using a `retval` variable, a typical case of code that is written to avoid breaking MISRA rules instead reimplementing the problem that the MISRA rule tries to avoid except with less idiomatic code and more bugs.

Without raii this is kinda needed.

Though simple param checking should be allowed ideally.

But you can always just do a deviation, it's not super hard.

Frankly it makes code worse a lot of the time, that's been my experience anyway. It's probably necessary if you adhere to not using goto and need cleanup code in a function, but otherwise I've seen code trying to adhere to one exit point create bugs. Linux coding standards are the pragmatic choice, use cleanup goto's. They're idiomatic, clear, safe, easy when done right.

I do web backend stuff. A coworker of mine writes Go according to MISRA C style and this is the main thing that's always annoyed me: it seems like half the codebase is comments justifying deviations, like explicitly commenting when we are using the `if err != nil...` idiom to note any deferred cleanup that takes place and justify why it's safe to early return.

MISRAble

To be fair this matches up well with Rust's general error management style. Everything seems to add another level of nesting, and often adding another function isn't worth the pain of the borrow checker for local vars.

I am pretty sure that SPARK Ada would be an alternative.

There is also AUTOSAR, which focused initially in C++14, got recently updated to C++17, and now is collaborating with Ferrocene regarding having Rust as well.

ADA has existed for a loooong time

And the market for available ADA devs is ... <crickets>

Even the USAF and defense contractors like Lockheed Martin switched to C++ from ADA for the F-35.

ADA is basically dead and buried outside of maintenance for 35+ year old planes, but I doubt those are seeing much active SW development done on them.

And the results suck

Products can suck regardless of the programing language used.

They spent trillions of dollars in the project including millions of dollars of rework.

I would rather feed students in school quality food, give them school supplies, and take care of their needs, rather than wasting valuable resources fixing avoidable defects.

> ADA is basically dead and buried

This made me clutch my chest and gasp and I have no idea why

I think that's a good indication that the reason Rust has become relatively popular is more likely to be its status as the new cool thing rather than anyone actually caring about safety and correctness.

I think it being open source from the get go has also made it a lot more viable.

That's made it accessible to amateurs, but cost is less relevant in safety industries than reliability.

It’s relevant in terms of there being a skilled developer pool to hire from. There are exceptions, but the vast majority of software technologies that have been success have done so by being accessible to hobbiests to install locally, even if that’s not their primary use case.

The good news about professional programmers is that they're capable of learning. Ada is not a hard language to learn, if you have some familiarity with procedural programming (which 99.99% of programmers do). Considering the amount of time spent on safety-critical systems, there's enough time to train up a new hire that only knows one language on Ada, assuming they're actually a competent programmer.

Surely the biggest thing has been accessibility from the start?

It’s all good and well to hear about Ada but how did one start using it for free at home to learn and then evangelize it in the work place?

How did one find learning materials about it in the same amount as an openly available language?

How did one contribute back to the language ?

Lots of cool stuff happens in proprietary spaces first. OSS variants tend to gain traction very quickly though

See https://ada-lang.io/ and https://learn.adacore.com/

Hmmm, I work providing the toolchains for a popular embedded realtime OS used in many safety-critical applications including auto and I have seen a rise in demand for Ada. Not ADA of course, which is an American law and does not apply to most international manufacturers.

I've also had queries about Rust, but it's not going to be available in safety-critical systems for many years. Part of the safety argument is toolchain adherence to a published standard, and there is no such thing for the Rusts (any version). In the in-dash infotainment systems anything goes, so they often run Linux (unsafe) and Python (unsafe) or even Perl (unsafe).

for FOSS the reference implementation is co-created by the consumers of the software. the users will only accept a new release if it fits their functional needs and passes their verifications.

the Linux kernel, the toolchain, or libraries like ssl libs are co created by the very organisations that consume the software. FB, Google, Amazon, Microsoft, IBM with red hat, Suse, Oracle, SAP they all concrete the Linux kernel, and for each kernel release they validate, each of them, the technology.

that's how the reference implementation _is_ the standard.

same goes for rust, which brilliantly leverages build automation of the cargo package repository to protect the compiler and toolchain from regressions:

https://brson.github.io/2017/07/10/how-rust-is-tested

the more crates have sound test suites, the better the quality statement of the compiler is.

Self certification is not going to pass muster with third-party safety auditors. Boeing tried it and the nose kept pointing down.

Actually they make enough noise to keep 7 compiler vendors in business for the last 40 years, with regular ISO standard updates.

It is a little more than just maintenance.

https://www.adacore.com/

https://www.ghs.com/products/ada_optimizing_compilers.html

https://www.ptc.com/en/products/developer-tools/apexada

https://www.ddci.com/products_score/

http://www.irvine.com/tech.html

http://www.ocsystems.com/w/index.php/OCS:PowerAda

http://www.rrsoftware.com/html/prodinf/janus95/j-ada95.htm

Reply on news.ycombinator.com