Ferrous Systems Blog

Hey, I saw that links to the Embedded Working Group[0], TockOS[1], and others have been posted already, and those are great places to start! My company, Ferrous Systems[2], is also focused on embedded systems development in Rust, and we are already helping companies both with embedded linux and bare-metal/RTOS projects in Rust. We're also running a conference in Berlin on April 26th-29th called OxidizeConf[3] if you are interested in learning more about what is already going on in the Embedded Rust world :) [0]: https://github.com/rust-embedded/wg [1]: https://www.tockos.org/ [2]: https://ferrous-systems.com [3]: https://oxidizeconf.com

There does seem to be a lot of people who are very excited about the potential for Rust as a replacement for C/C++ in the embedded space. There is "Working Group" dedicated to the domain: https://www.rust-lang.org/what/embedded & https://blog.rust-embedded.org/newsletter-28/ Toward the bottom of the page there's a "Production use" section with some quotes from people @ companies using it. There's also an Embedded Rust "book": https://docs.rust-embedded.org/book/ In addition to the language itself, the surrounding tooling (e.g. for package management) contributes to the potential wins available from to moving to Rust. My impression is that there are still areas where there isn't yet an idiomatic solution as to how _best_ to represent certain embedded SW concepts in a way that allows Rust's guarantees to be maintained. So I think there's some churn around that as people experiment/learn. (Primarily in relation to some of the physical constraints of the hardware.) One of the companies prominent in the Rust embedded space is Ferrous Systems: https://ferrous-systems.com/ While it's still early days, relatively speaking, I think a lot of people see a move to Rust as a "once in a generation" opportunity to finally move on from an embedded ecosystem built on substandard vendor C toolchains & also gain from the robustness/safety that Rust offers. In a lot of ways the embedded domain stands to gain even more from what Rust offers because unlike, say, the desktop/server space…

It's already in use at least it automotive. If you are not working with safety critical systems (ADAS type) Rust and to some extent embassy is already in the wild. Companies like ETAS (https://www.etas.com/ww/en/) or Ferrous (https://ferrous-systems.com) are working to certify Rust and some crates (embassy is there) to be used with safety critical components. It's not question if but when it will be used. Volvo, Renault and some Chinese brands already ship cars with Rust embedded components in non safety critical path.

It depends on what stack you work on. There are thousands of these small shops with 1 to 50 devs, that just take on work from companies to do small outsourced IT projects. From a Google search, these guys do Rust: https://ferrous-systems.com/ These guys do Flutter/Dart: https://flutterbountyhunters.com/ These guys do embedded systems: https://landing.witekio.com/embedded-software-development-services-uk-… These guys do web stuff for corporations: https://pixelplex.io/web-development/

It's one of a few ongoing efforts along these lines -- at least the Ferrocene spec is also worthy of attention: https://ferrous-systems.com/blog/the-ferrocene-language-specification-…

It's still too early for Rust in the embedded space. A lot of that space has various certification requirements that Rust doesn't meet yet, and the rest of the space tends to follow too and is very conservative. Ferrous Systems is making some good progress to make certification of Rust happen, through ferrocene[0] and other initiatives, but it will take time. The only company I know using Rust in a sort-of embedded way is SoloKeys[1], using Rust to write the firmware of a hardware authentication token (similar to a yubikey). [0]: https://ferrous-systems.com/ferrocene/ [1]: https://solokeys.com/

1) Sorry, but if you're talking safety critical, then you're talking Sealed Rust/Ferrocene which is talked about here: https://ferrous-systems.com/blog/sealed-rust-the-plan/ I mean, even with C, there is a very circumscribed subset that you use for "safety critical" applications. 2) People are banging on about Rust not being stable but the Rust Embedded guys DO lag for stability--so you can have stability if you choose. And Rust is by far the best language I have seen about being able to stay on old compiler versions and still use newer libraries. 3) I find crappy libraries to be the biggest threat to Rust's sustainability. There was a big "Gold Rush" mentality and a whole lot of unqualified people built a whole lot of crap libraries with no good way for someone to come along later and to flag "That's a crap library, please remove it from crates.io permanently".

My personal favorite feature of this release: It enables the async/await language feature to work on #[no_std] targets. This means that with an appropriate executor, you can run async/await code on embedded microcontrollers! Ferrous Systems have written a blogpost on what async/await can look like for writing embedded firmware: https://ferrous-systems.com/blog/async-on-embedded/ With Rust 1.44, this now becomes possible on the stable release of the language (previously you needed nightly). Very exciting.

Great! For anyone else who hasn't: https://rust-analyzer.github.io/ and https://ferrous-systems.com/blog/rust-analyzer-2019/

They created a specification for Ferrocene because Rust does not yet have a language standard: https://spec.ferrocene.dev/ >> But does the language need a standard? Yes, Rust needs a standard. >> And if so, then for what purpose? For the same purpose that all standards have--to formally define it in writing. Ferrocene's web site (https://ferrous-systems.com/ferrocene/) shows that it meets the ISO 26262 standard (https://en.wikipedia.org/wiki/ISO_26262). Why does ISO 26262 matter? What purpose does it serve? Couldn't a vehicle manufacturer just say "our vehicles are safe"? Which would you trust more: a vehicle that is verified to meet ISO 26262 standards, or a vehicle whose manufacturer tells you "it's safe" without formally defining what "safe" means? I stated it above, but I will re-state it here: Without a language standard, there are many organizations and industries that will not use Rust. Not because Rust is not a fantastic tool for the job, but because laws, regulations, etc. require standardization and qualification of components. This means that I can use a qualified C compiler and toolchain to write safety-critical code, but I can't use Rust despite the fact that Rust is a better choice and will help to prevent problems. Standards do matter. Rust needs a language standard.

Some thoughts... 1. There is no tech stack in the world you can safely deploy and forget about for months or years. Security updates are needed, OS updates cause changes, browser technology changes, and your users change. Even setting aside security, let's say you build something that becomes popular, you've no IC lock-in, and you don't add features / adapt. Sooner or later someone is going to create a clone that does add features / adapt and you will start to lose business. 2. Adding new features is rarely 'easy', because you have to test it with the other features, do deployment, support older versions of the app (if possible), etc. Still, some stacks make it easier than others. 3. Simple deployment once you've configured your automation is an area where there has been lots of progress. You can look at Puppet, Chef, Docker containerization. 4. Dependencies change. Typically you should view changing dependencies like you would adding a new feature: have a justification for it, do full testing, and only then deploy. 5. Open Source is easy to find, and there are a lot of good quality candidates. 6. One commented recommended to use what you know. Within reason, that's good advice. However, the old adage of 'when all you have is a hammer, everything looks like a nail' applies. Use the right tool for the job. 7. For the front-end, I recommend client side JavaScript, either Lit or React using Vite. Svelte shows promise, but is not fully mature enough yet to be acceptable…

Reflections on trusting trust is a great paper, but it's not the reason to have certified compilers. There are better steps to build a trust-root for your compiler, for example bootstrapping the rust compiler from source, by either starting out from the early versions or by using mrustc. Certification aims to solve a different, but maybe related, problem. Essentially "how do we verify that the compiler does what it's supposed to do." At its very basic level, it could be described as formalized qualitiy management. So certifying the rust compiler first involved deriving a sufficiently complete spec from the existing RFCs, deriving the requirements for the compiler from that and then verifying that the compiler upholds that. It also requires describing the verification process, issue managegment handling, etc. We have another blog post describing the qualification process in a little more detail https://ferrous-systems.com/blog/qualifying-rust-without-forking/ Disclosure: I'm one of the founders and managing directors at Ferrous Systems

>>“No other mainstream languages really have these concepts, and they’re really core to understanding a lot of how you have to write code in Rust,” Nichols says. I tried Rust, but I am using SPARK2014/Ada for my needs. Easier to learn and has the formal methods/software integrity checks and other niceties. I started learning SPARK2014 while reading the book, "Building High Integrity Applications with SPARK". It was used by the CubeSat lab in Vermont [1], which the book ties in nicely. I can see programmers flocking to Rust, but scientists are not typically computer scientists, and mainstream shouldn't be a highly-weighted metric. I find Rust a lot more heavy than SPARK/Ada. I've tried Julia too, but you can write systems level code in SPARK/Ada too. The adacore site has a lot of great projects and articles on embedded software, drone low-level code rewrite in SPARK, etc. The partnership between AdaCore and Ferrous Systems is very exciting [2]. I hope to be able to stay with SPARK and gradually learn Rust with this partnership when Rust has a bit more under its belt with real world embedded, high-integrity software like Ada's legacy. [1] http://cubesatlab.org/ [2] https://ferrous-systems.com/blog/ferrous-systems-adacore-joining-force…

Yes, I am (perhaps a bit sloppily) using "particular contexts" to refer to particular use cases. And while your use case is the C5M problem, since we're bringing up other languages (which optimize for different contexts) I think it's worth emphasizing that these features also lend themselves to other use cases. Here's an example of using Rust's async/await on embedded devices, for reasons other than serving millions of concurrent connections: https://ferrous-systems.com/blog/async-on-embedded/ > Many languages/runtimes want just a single coroutine/continuation construct to cover both concurrency and generators — which is a good idea in principle — but then they, especially low-level languages, optimise for the less useful of the two. Notably Rust appears to be the opposite here, as it is first focusing on providing higher-level async/await support rather than providing general coroutine support, but its async/await is implemented atop a coroutine abstraction which it does hope to expose directly someday. I'm sure you don't need to be told most of this, but I bring all this up to help answer the more general question of why not every language builds in a green thread runtime, and why one approach is not necessarily strictly superior to another.

My very first job out of school was in a local company writing enterprise software and I hated it, lasted only a few months. Then I enlisted in a uni research project to build a Cubesat as a systems engineer, and after a couple of years I moved to the agency. I haven't seen many career hoppers, but I'd say it's doable. I would try to enter through the ground software path: mission control systems or simulators. Those employ more "pure" software people. From there it's a matter of being in touch with the embedded guys and show that you can do it. Simulators are great for that; they're basically a piece of software that emulates the onboard processor and simulates all the other sensors and actuators so operators can train and validate the on-board software. You have to be in touch with the onboard software developers, because there are always lots of kinks to iron out (e.g. I once had to fix a bug that a compiler optimization introduced, making magnetorquers always "max out" on actuation). If you're in trading, I assume you're proficient in C++? If so, that's a great asset already. About Rust: I love Rust and I use it in my embedded work now. I think it would be very beneficial for space applications. That said, there is a long way until it's accepted in the space industry. Ferrous Systems[1] is working on it, but it will take a long time; it's a slow industry. Perhaps it will start being accepted by the end of the decade. Another idea for a side project: amateur…

So you're saying for two of the three arbitrary rules I mentioned you need additional tooling for analysis... sure sounds like my initial point. But that's not even the point. > If anything I'd say the contrary is true, people overestimate what MISRA achieves, big chunks of it could be summarised as "Don't do things that are obviously a terrible idea". This is exactly what I mean. You're missing the point of MISRA if you think that's an overestimation or just to make managers happy... MISRA is often for life or death, and it's not even going as far as the random ISO standards that end up applying on top of it in some domains. It might be "obviously terrible" stuff, but very excellent developers end up doing it anyways sometimes, that's just being human. The ground work to even verify a Rust toolchain doesn't even exist, (the closest I could find is a WIP https://ferrous-systems.com/blog/sealed-rust-the-pitch/) so I'm guessing everyone forcing this is likely rolling their own setup of additional tools? If you don't work on ABS controllers and you work at somewhere like Tesla where the bar for safety is a little lower in the name of using new shiny things, by all means use Rust. But I wouldn't do that in a million years. I simply don't buy that using established MISRA C tooling is less safe than rolling your own lint setup.

I'm working on a memory profiler for Python that is fast enough to run in production (see link below), so I've ended up with some similar problems re performance and importance of testing. A few things the article talks about where one can maybe do even better: 1. likely()/unlikely() not being in stable Rust. This is true, but the hashbrown project has some hacked-up variants it claims work on stable: https://github.com/rust-lang/hashbrown/blob/bbda6e0077bafb75c02d0ace66… 2. Rust not having fast thread locals. Same problem for me, so likewise did it in C with "initial-exec". But! If you use clang, you can get LTO across C and Rust, so you can get fast thread locals _and_ not have function call overhead. Basically need to use same version of Clang as Rust does (12 at the moment) and do a little song and dance in linker and compiler flags. See https://matklad.github.io/2020/10/03/fast-thread-locals-in-rust.html 3. For testing these sort of things, being able to assert "this test touched this code path" is extremely useful. In my case, for example, I have different code paths for sampled and unsampled allocations, but from perspective of code calling malloc() everything should be identical. So how to tell if correct code path was used? Coverage marks are a great solution for this: https://ferrous-systems.com/blog/coverage-marks/ (The Python profiler, if anyone is interested: I've already released an open source memory profiler that tracks…

>StaticQueue: LinearisedIterator Using C++ iterator interface to fix the main problem of a standard ring buffer of non-contiguous regions is a cute idea, but I like to use a "bip buffer"[1] instead which actually always gives you real contiguous regions so you can pass the pointers to things like a dma engine. [1] https://ferrous-systems.com/blog/lock-free-ring-buffer/ The tradeoff is that you have in the worse case only half the buffer available - the ring buffer essentially becomes a kind of double buffer where you periodically switch between writing/reading at the end or the beginning of the storage.

It has a partial spec. https://ferrous-systems.com/blog/ferrocene-25-11-0/ Lets not forget not having a formal spec apparently wasn't an issue for C, which only got standardized in 1989, and even K&R C only specified a subset of its behaviours, which is a reason why there is so much UB, and implementation specific behaviours with YOLO C, as the Fil-C author likes to call it.

With "safety certification for AI-based systems" they are mixing up the 26262 functional safety and 21448 safety of the intended functionality. 26262 is closer to verification (the system does what it is told to), 21448 to validation (what you told it actually solves the problem). For certified Rust the article mentions Ferrocene, they achieved their certification a while ago [0]. If you have the chance to work with them, Florian Gilcher is a highly knowledgeable guy and a super nice person. [0] https://ferrous-systems.com/blog/officially-qualified-ferrocene/

> In contrast, the Rust type system has been mathematically proven to be correct. Is this the case? E.g. the issue "Prove the Rust type system sound" https://github.com/rust-lang/rust/issues/9883 is closed with comment "This will be an open issue forever. Closing." in 2016: https://github.com/rust-lang/rust/issues/9883#issuecomment-242452073 . At least nowadays (since 2022) we do have a language specification for Rust: https://ferrous-systems.com/blog/the-ferrocene-language-specification-…

Yeah, MISRA C [1] is a set of rules for writing C for safety-critical environments, originally targeting the automotive environment. If you're used to vanilla C, it can feel very constraining! In the Rust world, there's the Ferrocene project [2], which aims to provide a similar kind of safety-critical level of functionality. [1] https://en.wikipedia.org/wiki/MISRA_C [2] https://ferrous-systems.com/ferrocene/

For something like curl (which is also used in embedded systems: a legally-verified (compliant with ISO and other standards, for better or worse) Rust compiler that targets common microarchitectures is a definite first step. Fortunately, the first half of it exists (Ferrocene, https://ferrous-systems.com/ferrocene/). The second one is harder: there are architectures even GCC does not target (these architectures rely on other compilers like the Small Device C Compiler (or a verified variant) or even a proprietary compiler), and LLVM only compiles to a subset of GCC. Even if there's a GCC Rust (currently being developed fortunately), you are still leaving a lot of architectures.

Ferrous Systems has a basically bog standard Rust 1.68 compiler that’s been certified for use in the most safety critical environments: https://ferrous-systems.com/blog/officially-qualified-ferrocene/ This happened without a standard.

You might be interested in https://ferrous-systems.com/ferrocene/, which " is a ISO 26262 (ASIL D) and IEC 61508 (SIL 4) qualified version of the existing open-source compiler, rustc, based on Rust 1.68."

Yes, we built bindings for LynxOS 178 a while ago and demonstrated Rust on QNX at embedded world. https://www.lynx.com/press-releases/rust-compiler-support https://ferrous-systems.com/blog/how-we-built-our-embedded-world-demo-… Porting Rust to RTOSes is reasonably easy.

It can eliminate many bugs, but it certainly wouldn’t eliminate all bugs. During implementation they realized they were not implementing sudo’s (undocumented) feature of failing to run if the sudoers file is world-writable: https://ferrous-systems.com/blog/testing-sudo-rs/. Of course they did find and fix the bug, but in general Rust isn’t going to protect you from bugs like this that are essentially logic errors.

So I'm pretty sure they're doing something similar to Ferrous systems, since they worked together with them until very recently, Qualifying Rust without forking: https://ferrous-systems.com/blog/qualifying-rust-without-forking/

It seems they left the Ferrocene project recently https://ferrous-systems.com/blog/ferrocene-update/

I think the governance page for rust will answer some of your questions: https://www.rust-lang.org/governance Ferrous Systems is building a qualified rust (ISO 26262 and IEC 61508 qualified version of the existing open-source compiler) https://ferrous-systems.com/ferrocene/