Hacker News Reader

Comment by twic | Hacker News Reader

As the article says:

> Beyond the automotive, Ferrocene can also be used in electronic programmable systems in the industrial sector. Here the focus is on developing products or applications that carry out safety functions. Like the automotive certification, we’ve also gone for the highest level of risk reduction and qualified it at SIL4.

Apparently [1] the SIL standard is used in at least the process control, nuclear, mechanical, and railway industries. Not sure about medical or aerospace.

[1] https://en.wikipedia.org/wiki/Safety_integrity_level#Standar...

View on HN

Aerospace would be DO-178, which is on the roadmap, but will take some effort (a year or two, give or take).

Medical is closer: While there are dedicated certifications for medical, they are relatively close to the IEC 61508 industrial standards and so IEC certifications are often used as a stand-in for the equivalent medical certification.

The medical certifications are mostly about design & risk control, there isn't really (currently) the same set of toolchain certs you see in e.g. aerospace. Some places do use them as a shorthand for "our documentation & testing here is minimal, because we use X certified tools and/or standards" but it isn't required for CFR21 or 13485.

Isn't AdaCore handling the DO-178 side? Or does Ferrocene intend to have an offering here, also?

The joint venture with AdaCore is no longer, so yes, we're doing this seperately.

Please beat them to market... Their notion of advertising "curated language features" as a positive instead of "weird frankencompiler that doesn't match any version, work with any 3rd party crates, and has complete vendor-lock" will sell well to people that already use them, unless they aren't an option.

I didn't think they made any language extensions for rust? Thought it was just for Ada.

Ada does not have any formalized FFI with Rust at this time; just C, COBOL, and Fortran:

http://ada-auth.org/standards/22rm/html/RM-B.html

AdaCore has a Rust toolchain:

https://www.adacore.com/gnatpro-rust

I know, thank you, but I'm asking about the "curated" language features gp is criticizing. AdaCore does make Ada language extensions (who else would push the language forward these days?), but I didn't think they had any for rust, which is why I'm asking.

> GNAT Pro for Rust offers yearly updates that incorporate selected, recent enhancements from the upstream development. We make sure the result is a stable, tested Rust toolchain that’s ready to be used and supported for years to come.

https://www.adacore.com/gnatpro-rust

Edit: not so worried about the extensions, more worried they will keep re-releasing 1.68 forever with features added only as people clamor for them. And security fixes wedged into old code. That is in effect forking the language.

The direct competition between Ferrocene and AdaCore should take care of that.

In any case, the compiler wouldn't be certified if they didn't vet the new features. These companies can't control what gets added to the language, and it might take longer than a year to vet future changes.

Their statement is an upfront, no-bull fyi about how reality works. I highly doubt it's a statement of intent to stagnate. It would kind of defeat the purpose of switching away from a stagnated language and ecosystem.

I can imagine no use case where ripping out features from upstream reduces risk vs adding it. I agree it makes no sense to stagnate, but I am familiar with the certified compiler space, and what I have described is exactly what I have witnessed. Compilers that are based on ancient versions of open source compilers, and have code incorporated from various point releases since then to minimize the amount of recertification necessary.

What happens when a new feature holds up the certification process for some reason? There are only two possible options, and they both suck:

1. Stay on the last certified version until everything is certified.

2. Incorporate the parts that can be certified.

The ferrous option appears to be 3. upstream changes that make certification of the new feature easier and then proceed.

If that's still an option, then they haven't reached the point yet where they have to choose.

They're promising yearly updates. I'm asking what happens when a new upstream feature has already gone uncertified for one full year. Either they blow past the deadline and release nothing for over a year, or they ship what's currently available.

There's no third option. Ferrous doesn't have a time machine, and AdaCore is just explicitly saying that they'll give you what they have at least once a year.

>> That is in effect forking the language.

It feels like the effectiveness and success of Rust could make that happen.

Different industries have different needs and will want the language to meet their needs.

Rust needs more funding, labor, and organization to create an official language standard to prevent it from fragmenting.

Ferrous created a language specification. https://github.com/ferrocene/specification

They do say any differences between it and upstream behavior or documentation is a defect in the spec, not upstream. So it isn't authoritative. Unless we all decide it is.

They have explicitly stated that a Rust language specification is a non-goal for Ferrocene:

https://news.ycombinator.com/threads?id=thesuperbigfrog&next...

There's an ongoing discussion about potential adoption into upstream, though.

The thing here is: it would be harmful if we, Ferrous Systems, claimed or even be confused with a more general Rust spec. That's a) the privilege of the Rust project and b) problematic if consumers were to understand it that way.

Doesn't Rust have a Reference manual already? A "spec" just wouldn't be very meaningful given the lack of independent implementations. But to the extent that the reference manual doesn't suffice for documenting the language, that's a defect which could and should be fixed.

The manual isn't directly consumable by formal processes. The compiler design doesn't have to be influenced by a specification, but it does have to be described by one.

>> AdaCore does make Ada language extensions (who else would push the language forward these days?), but I didn't think they had any for rust, which is why I'm asking.

Correct, AdaCore / GNAT has extensions that are not part of the Ada standard:

https://docs.adacore.com/gnat_rm-docs/html/gnat_rm/gnat_rm/g...

I don't have a close relationship with AdaCore and do not know what they are planning for their Rust toolchain.

That said, I would be surprised if they do not add features to ensure Rust plays nicely with their other products and give their Rust toolchain competitive advantages in the safety critical space. I do not see any documentation or details on their website yet, but it also looks like their Rust toolchain is not released yet.

Keeping an eye on this in the aero, uh, space. Very interesting progress, keep up the good work.

SIL is used in my industry (Industrial manufacturing and Refining). It covers more than software though. Mostly system integration - for example things like interlocks and whether a valve will fail open/closed etc.

In one instance we wanted to use a FLIR camera to measure temperature as part of a control loop - had to provide guarantees about the cameras reliability (i.e. mean time between failure), have redundancy and fallbacks in place etc. In order to satisfy the SIL process.

Reply on news.ycombinator.com