Why Rust
The automotive industry has solved the problem of scale. What remains are harder problems: system resilience, cybersecurity, and the cost of small defects across large fleets. Most of these defects appear at integration points, and most of them trace back to memory errors that C and C++ cannot prevent by design.
Rust addresses this at the language level. It is not an incremental improvement on C — it is a different model, which is precisely why it is worth the migration effort. An incremental change would not justify rewriting anything.
What Rust Changes
| Property | What it means in practice |
|---|---|
| Memory safety | Rust eliminates memory-safety defects at compile time. Where safety cannot be proven by the compiler (for example MMIO access), it provides explicit, contained mechanisms for unsafe code. Memory safety no longer has to be re-established through repeated manual review. |
| Performance | Rust builds on LLVM and benefits from the same optimisations as modern C and C++. It performs in the same range, and in some workloads faster. |
| Determinism | Rust is deterministic like C. Language features carry no hidden runtime cost, so execution cost remains predictable through conventional analysis. |
| Encapsulation | Rust has a strong visibility system and is the only industrially deployed language that tracks resource ownership and handover across component boundaries. Components cannot silently interfere with each other. |
| Scalability | The same language and toolchain run on small microcontrollers and on server-class systems, which makes code sharing across those classes normal rather than exceptional. |
Why This Matters for Functional Safety
Language choice affects certification cost directly. Three effects matter most:
Whole defect classes are removed rather than tested for. Memory-safety errors are prevented by the compiler, so verification effort shifts from proving their absence to verifying functional behaviour.
Encapsulation supports local reasoning. In large codebases, safety arguments can be made about a component without re-analysing everything it links against. This makes safety and QM partitioning practical to enforce and to defend to an assessor.
Documentation and tests are first-class language features. Doc comments, tests and code are linked by the toolchain itself, which gives a natural basis for requirements traceability. When Ferrous Systems qualified Ferrocene, the Rust core library's own documentation was of sufficient quality to serve as requirements.
There is a further point that is easy to overlook: the Rust compiler's own test suite is of high-assurance grade. During Ferrocene's IEC 61508 and ISO 26262 qualification, comparatively few additional tests had to be written.
Adoption
Rust adoption is no longer speculative in safety-related domains:
Google reports that Rust teams are as productive as Go teams and more than twice as productive as C++ teams, based on internal data from 2022 and 2023.
Volvo Cars and Vector Informatik have both published on large-scale automotive Rust deployment.
Silicon vendors are engaging across the board. Arm is active as an IP vendor. On the OS side, Green Hills, QNX, Red Hat In-Vehicle OS and Kernkonzept L4RE all support Rust. Eclipse S-Core is the main open-source effort.
There is a strong international regulatory push toward secure-by-design software, supported by national security agencies including KISA in Korea.
Adoption tends to be slow at first and then rapid once a segment tips. General systems programming reached that point around 2019; small-scale embedded around 2021; safety-critical embedded around 2022. Starting earlier spreads the investment and avoids a compressed migration later.
Rust Training
Rust is not an incremental change from C, and teams migrating from C or C++ need structured instruction rather than self-study. Ferrous Systems has trained Rust professionally since 2015 and is a founding member of the Rust Foundation Trusted Training programme. Trainers include maintainers of core Rust projects and members of Rust governance teams. All sessions are live, built around hands-on exercises, and the material stays with the team afterwards.
Something to Consider
OxidOS and Veecle as complementary automotive platforms around Ferrocene