Officially Qualified – Ferrocene

Original Article ↗ Hacker News Discussion ↗

Rust’s Ferrocene toolchain has been formally qualified for use in safety‑critical systems up to automotive ASIL D and industrial SIL4, putting it on par with certified C/C++ compilers in regulated domains. Commenters highlight that the main value lies not in technical changes to rustc but in rigorous documentation, testing, and process certification that satisfy ISO 26262 and similar standards, potentially unlocking Rust for automotive, industrial, and eventually aerospace and medical applications. There is optimism about improved safety and modern tooling, tempered by concerns over conservative industry culture, ecosystem maturity, and the long road to certified libraries and broader target support.

Significance of Ferrocene’s Certification

  • Ferrocene (a Rust toolchain) is now qualified for ISO 26262 ASIL D and IEC 61508 SIL4, the highest levels for automotive and certain industrial systems.
  • This makes Rust a “normal” option for safety‑critical projects, reducing extra justification work vs. using uncertified tools.
  • Many see this as a major milestone because automotive and embedded sectors are highly conservative and toolchain‑driven.

Domains, Standards, and Roadmap

  • Current qualifications: automotive (ISO 26262) and industrial safety (IEC 61508 / SIL4).
  • Aerospace (DO‑178) is explicitly on the roadmap, expected to take 1–2 years.
  • Medical is said to be close to IEC 61508 processes, so current certs can help there.

What Ferrocene Adds Beyond rustc

  • Technically almost identical to upstream rustc; differences are “tens of lines.”
  • Value comes from: documented language spec, extensive tests mapped to requirements, audited development processes, CI on specific safety targets, signed installers, long‑term support, and issue notifications.
  • Some targets that are only “tier 2” in upstream (e.g., aarch64 bare‑metal) are treated as fully tested “tier 1” within Ferrocene.

Impact on Safety vs. Box‑Ticking

  • Certification does not prove the compiler is “always correct.”
  • It ensures processes for requirements, testing, defect handling, and user notification are in place and audited.
  • Participants report that the extra testing has found real regressions (e.g., code size issues) and improved upstream Rust.
  • Some still view it partly as “cover your ass” paperwork, but others stress that the “boxes” (requirements, traceability) are meaningful.

Adoption Barriers and Human Factors

  • Major barrier is human/organizational inertia: many teams still use C89/C++98 despite tool support for newer standards.
  • Rust is perceived as a bigger technological leap than “newer C/C++,” which paradoxically can help justify change.
  • Regulatory pressure (e.g., toward memory‑safe languages) is seen as a strong driver.
  • C interop (both calling C and being called from C) is highlighted as crucial for incremental adoption in existing firmware and RTOS environments.

Rust Versioning, Specs, and Fragmentation Concerns

  • First qualified version is Rust 1.68 (not far behind 1.73 at the time).
  • Plan is to build and test all releases internally, then certify about two per year; exact cadence and handling of problematic features are still evolving.
  • There is concern in general that safety‑critical vendors might “freeze” old Rust versions or curate feature sets, effectively forking the language.
  • Ferrocene has produced a language specification from Rust RFCs to support certification; it is explicitly not claimed as the official Rust spec.
  • Some worry Rust needs an official standard to avoid fragmentation; others note Rust already has a reference manual but it isn’t directly usable in formal processes.

Ecosystem, Libraries, and OS/RTOS Integration

  • Ferrous has demonstrated Rust bindings for LynxOS‑178 and QNX; porting to RTOSes is described as relatively straightforward.
  • Users express strong interest in certified libraries (async executors, networking, Bluetooth, etc.), but note that certifying such components is costly and usually requires customer funding.
  • There is optimism that this compiler certification may inspire broader efforts to build certified Rust libraries.

Pricing and Business Model

  • Several commenters find Ferrocene’s per‑seat pricing unusually low compared to traditional safety‑critical tool vendors, which often charge 10–100× more for inferior tools.
  • Company representatives say their real competition is free rustc; customers pay for quality management, certification, LTS, and support rather than for a proprietary fork.
  • Most documentation (safety manuals, qualification artifacts, compiler source) is open, which is framed as both a strategic choice and a way to keep the vendor “honest.”

Safety vs. Security Terminology

  • Clarification that ASIL levels concern safety (avoiding harm from malfunctions), not security (protection from attacks).
  • Some languages (e.g., German, Portuguese) use one word for both concepts, which can cause confusion; context or compound words are used to distinguish them.

Skepticism and Critiques

  • A few commenters doubt certification bodies in general, citing unrelated past failures (e.g., dam disaster audits).
  • At least one participant expresses blanket distrust of Rust in cars, independent of certification.
  • Others counter with enthusiasm, viewing this as an important, long‑awaited challenge to the C/C++ status quo in safety‑critical software.