misra-rust

From "The state of Rust trying to catch up with Ada [video]" https://news.ycombinator.com/item?id=43007013 : >> The MISRA guidelines for Rust are expected to be released soon but at the earliest at Embedded World 2025. This guideline will not be a list of Do’s and Don’ts for Rust code but rather a comparison with the C guidelines and if/how they are applicable to Rust /? Misra rust guidelines: - This is a different MISRA C for Rust project: https://github.com/PolySync/misra-rust - "Bringing Rust to Safety-Critical Systems in Space" (2024) https://arxiv.org/abs/2405.18135v1 ... > minimum of two assertions per function. Which guidelines say "you must do runtime type and value checking" of every argument at the top of every function? The SEI CERT C Guidelines are far more comprehensive than the OT 10 rules TBH: "SEI CERT C Coding Standard"

You might also want to check out this comparison of MISRA's rules against idiomatic Rust code: https://github.com/PolySync/misra-rust/blob/master/MISRA-Rul...

See also https://github.com/PolySync/misra-rust/blob/master/MISRA-Rul...

MISRA and Ferrocene are not really related other than both being vaguely in the safety space. MISRA is, as you say, a set of rules for writing C code, that restrict what you can do. Ferrocene is a qualified compiler. You write any normal Rust code you want: it's still the upstream Rust compiler. There are no restrictions. Incidentally, someone has compared what MISRA does to what Rust does: https://github.com/PolySync/misra-rust/blob/master/MISRA-Rul... Given that they can't repeat the MISRA stuff there, it's a bit disjoined, but it sure is interesting!

A fun github repo: "what would MISRA look like applied to Rust" https://github.com/PolySync/misra-rust/blob/master/MISRA-Rul... (They're comparing with the C version, not the C++ version...)

This might be of interest https://github.com/PolySync/misra-rust

Certification is already in the works afaik. This [0] is also interesting, a check how much MISRA checking can be removed because the rust compiler already does a similar check. Ah. Found it, [1][2] [0] https://github.com/PolySync/misra-rust [1] https://news.ycombinator.com/item?id=32237780 [2] https://news.ycombinator.com/item?id=30174827

> There are huge swathes of MISRA which forbid things which not only aren't possible in Rust or SPARK I can't vouch for its accuracy, but https://github.com/PolySync/misra-rust seems to very much agree with you.

When it comes to MISRA C, it is interesting to note how many (a majority) of its rules do not apply or have native enforcement[1]. You might have also seen the AUTOSTAR Rust in Automotive Working Group announcement recently[2]. [1]: https://github.com/PolySync/misra-rust/blob/master/MISRA-Rul... [2]: for some reason the announcement was removed from the "News and events" site, https://webcache.googleusercontent.com/search?q=cache%3Ahttp... but it is still available as a PDF https://www.autosar.org/fileadmin/user_upload/20220308_RustW...

Rust makes quite a few things more rigorous (e.g. pairing allocations with deallocations and reference validity). It basically fulfills the job of a static analyzer baked into the language. It's also a vastly more analyzable language (in that its syntax is reasonably unambiguous and there's no dynamic runtime in play) and it can be integrated well. Toolchain quality (error reporting, built in testing, awareness of primitives like "libraries", etc.) is also a huge strong point. We're reasonably confident that we can use safe Rust as is, with strong guidance on how to do unsafe Rust. For a tangible investigation of that space, PolySync has a project that has a look at MISRA rules from a Rust perspective. https://github.com/PolySync/misra-rust/blob/master/MISRA-Rul... Ada is a good example here: the language has not evolved something like MI