Today we're announcing the release of Ferrocene 26.05.0, the latest update to our qualified Rust toolchain. This release arrives with a new #[warn(ferrocene::unvalidated)] lint, a new qualified RHIVOS2 target, limited -C target-cpu support and certified core::fmt!

It's easy to start integrating Rust into your safety-critical industrial systems. Your team can immediately start shipping certifiable code for multiple architectures using a fully qualified Rust compiler with a significant subset of the core library pre-certified.

What is Ferrocene?

Developed as an open source, downstream Rust distribution, Ferrocene is 100% drop-in compatible with the main Rust compiler, allowing you to work seamlessly with both the toolchain distributed by the Rust project and the safety-critical Ferrocene toolchain.

Installation is a breeze: Use criticalup or download the relevant tarballs and unpack them. Users can even use criticalup link to enable familiar UX like cargo +ferrocene build. Your team won't have to administer a license server, CI integration is a snap, and the toolchain can be used totally offline, such as while travelling or in air-gapped environments.

Ferrocene is TÜV SÜD-qualified for use in safety-related development according to ISO 26262 (ASIL D), IEC 61508 (SIL 3), and IEC 62304 (Class C), and supports customer certification efforts toward assurance levels IEC 61508 SIL 4 and DO-178C DAL C.

A subset of the core library distributed with Ferrocene is certified to IEC 61508 (SIL 2) and ISO 26262 (ASIL B).

We'd love to tackle other qualifications and certifications alongside partners. Let us know if that partner can be you!

What is new in Ferrocene 26.05.0

Ferrocene 26.05.0 includes changes from Rust 1.93.0, 1.93.1, 1.94.0, 1.94.1 and 1.95.0, such as cfg on asm! lines, array_windows, cfg_select!, and if-let guards in matches.

This release also includes a number of Ferrocene specific features (explained in detail below). If your project needs additional functionality certified, new certifications added, additional libraries certified on top of core, or want to work with us to develop other useful safety critical tooling, we encourage you to reach out!

Read the full release notes.

Improved certified subset checking

For this release, we focused on tightening and refining the user experience for using certified core (and future other libraries). We previously provided a separate certified subset package that could be used via a custom --target we provided. This worked, but we wanted a better experience for users, and we didn't think it would scale well as we started to certify alloc, std or parts of the library ecosystem.

Now in safety critical contexts, users are instructed to add #![warn(ferrocene::unvalidated)] to their codebase which will warn about any usage of uncertified code. This means they don't need a separate certified core package, or any special targets.

Users can also mark their own functions as prevalidated with #[ferrocene::prevalidated]. In cases where a user wants to opt-in to arguing the safety of a specific function themselves, they can add the #[allow(ferrocene::unvalidated)] attribute.

Here's a demo of what using it looks like:

#![warn(ferrocene::unvalidated)]
#![no_std]

#[ferrocene::prevalidated]
pub fn just_an_example(a: impl Iterator<Item=u32>) -> Option<char> {
    let sum = a.fold(0, |x, y| x + y);
    match sum {
        // Did we mention `core::fmt` is certified now?
        even if even % 2 == 0 => panic!("Got {sum}"),
        // Note: `from_digit` is not ceritifed.
        odd => core::char::from_digit(odd, 8),
    }
}

With this code, not only will the build report a warning, but developers will see it live, as they type in their IDE just like any other Rust lint, here it is in Zed:

Using upstream Rust as well as Ferrocene? With a little bit of setup, it'll just work. First, add to your Cargo.toml:

[lints.rust.unexpected_cfgs]
level = "allow"
check-cfg = ['cfg(ferrocene)']

Then, update annotations to the following:

#![cfg_attr(ferrocene, warn(ferrocene::unvalidated))]

#[cfg_attr(ferrocene, ferrocene::prevalidated)]
pub fn just_an_example(a: impl Iterator<Item=u32>) -> Option<char> { todo!() }

With those set, it's possible to run RUSTFLAGS="--cfg ferrocene" cargo +ferrocene check to see any potential prevalidated warnings.

We think this is a notably improved experience for certified library users, and plan to build on it in the future.

For more information how this works, please check out the relevant article.

Target CPU support

There are a variety of CPU features which are typically accessible by the -C target-cpu=... flag. In certain use cases, these features matter significantly.

We've started rolling out qualified support for certain options of that flag for specific targets:

• thumbv7em-none-eabihf now supports:
  • -C target-cpu=cortex-m4
• aarch64-unknown-none now supports:
  • -C target-cpu=cortex-a53

Certified core::fmt

In previous versions of the certified core subset, users didn't have access to core::fmt, which was a drag. It also meant that panic!()'s format machinery wasn't available. This made debugging hard.

As part of this release we put in the effort of certifying both core::fmt and the panic!() macro.

This means you can now panic!("At the {place}") in your safety-critical software with the same experience as on your favorite Linux distro.

Speaking of Linux distros…

New aarch64-rhivos2-linux-gnu Target

We're excited to collaborate with Red Hat to support a new aarch64-rhivos2-linux-gnu with Ferrocene.

Red Hat In-Vehicle Operating System is a production-grade, safety-certified, open source Linux platform built for software-defined vehicles (SDVs). Building on the proven reliability and security posture of Red Hat Enterprise Linux, it combines functional safety certification [International Organization for Standardization (ISO) 26262:2018 Automotive Safety Integrity Levels (ASIL-B)] with automotive-grade optimizations. Red Hat In-Vehicle Operating System empowers automakers to adopt SDV architectures that prioritize safety, security, and long-term maintainability while supporting continuous innovation through open source communities. - https://www.redhat.com/en/resources/in-vehicle-operating-system-datasheet

Alongside this target, we're also beginning to roll out a qualified aarch64-unknown-linux-gnu host platform. For 26.05, this architecture is only qualified for use while targeting aarch64-rhivos2-linux-gnu. We expect to expand support for this host platform in future versions of Ferrocene, let us know if you're interested in any target in particular.

Available for purchase today!

With Ferrocene, users can develop high-assurance software from the start, without a massive upfront investment. Ferrocene is available for purchase today for €25/month or €240/year per user, providing access to all supported versions of Ferrocene (current and future), along with basic support.

Go to ferrocene.dev to purchase Ferrocene, or contact sales for more information on custom enterprise subscriptions.

Not sure if Ferrocene has the features you and your team need? You can also schedule a Why Ferrocene? session by reaching out to our sales team.