Ferrocene
Ferrocene is a qualified distribution of the Rust compiler toolchain for safety-critical development.
The standard open-source Rust compiler carries no safety qualification; Ferrocene supplies the documented evidence, defined validation scope, and traceability artifacts that functional safety standards require.
This means a development team can reference Ferrocene's qualification directly in its safety case rather than building a compiler qualification argument from scratch — an effort that typically runs to well over a year.
| Standard | Qualification status |
|---|---|
| ISO 26262 (automotive) | ASIL-D qualified — the highest risk class. Tested in production programmes. |
| IEC 61508 (industrial) | SIL 3 qualified. Supports customer qualification efforts toward SIL 4. |
| IEC 62304 (medical) | Class C qualified. Ferrocene was the first Rust toolchain to achieve this. |
| DO-178C (avionics) | Supports qualification efforts toward DAL C. |
| Assessment | Qualified by TÜV SÜD. |
| Distribution | Binary and source variants. Source is open under MIT or Apache-2.0, including the safety manual and full qualification documents. |
| Language scope | All Rust language features, including macros and procedural macros, at the tooling level. |
Key Advantages
Production-proven ASIL-D qualification
Ferrocene's compiler qualification is at ASIL-D, the highest integrity level under ISO 26262, and has been accepted in real certification projects rather than existing only as a documented claim. Because the qualification artifacts are reusable, the cost is amortised across subsequent programmes.
Binary and source variants
Qualification evidence is available for both a pre-built binary toolchain and a source-qualified build. This lets customers align with their own procurement, build-reproducibility and audit requirements rather than adapting their process to the toolchain.
Rust core library largely pre-certified
A large subset of the Rust core library is already certified within Ferrocene at ASIL-B. This is significant for scoping: projects that keep their safety-critical path on core alone inherit most of the library certification rather than paying for it. Section 4 covers this in detail.
Full language feature coverage
Macros and procedural macros are widely used in real Rust codebases, and excluding them from qualification scope would make Ferrocene impractical. They are covered at the tooling level, with Ferrous Systems assisting on pre-validation within certification projects. Build script (build.rs) validation follows the same approach. Documentation is being developed so that customer teams can perform this work themselves where that is more efficient.
ASIL-D roadmap
Ferrocene's compiler qualification is already at ASIL-D. The remaining gap for full ASIL-D systems is not the compiler but structural coverage: specifically MC/DC (Modified Condition/Decision Coverage). Timing analysis, stack depth analysis and the other ASIL-D concerns are already addressed by available tooling, some from Ferrous Systems and some from partners.
Platform support
| Category | Targets |
|---|---|
| Bare metal | on Armv8-A and Armv7E-M |
| Safety Linux |
Including Red Hat In-Vehicle OS 2.0. aarch64-unknown-linux-gnu and aarch64-unknown-linux-musl. musl targets require additive qualification. |
| QNX |
QNX 7.1 (from Ferrous Systems) and QNX 8.0 (in collaboration with QNX). aarch64-unknown-nto-qnx710 / qnx800. Forward migration toward QNX 8 is a committed path. |
| Build hosts |
Linux (x86 and Arm) for qualified builds. Development on Windows and macOS is supported, and qualification is available for those environments. |
aarch64-unknown-linux-gnu and aarch64-unknown-linux-musl.
musl targets require additive qualification.
aarch64-unknown-nto-qnx710 / qnx800.
Forward migration toward QNX 8 is a committed path.
Development on Windows and macOS is supported, and qualification is available for those environments.
Ferrocene Case Studies
How certification typically proceeds in each domain. Generalised from completed and ongoing work; not descriptions of any specific customer program.
Automotive
ISO 26262 ASIL-B
A typical programme starts with a Rust codebase that has grown organically and carries a dozen or more third-party crates. Most of the work is scoping rather than certification: dependency and code-flow analysis establishes what is actually reachable from safety-critical entry points, the safety and QM boundary is set, and no_std feasibility is decided. Remaining crates are then eliminated, moved outside the boundary, or replaced with direct platform calls through FFI.
Scope commonly falls to two or three crates, and where a no_std path is achievable the alloc and std line item disappears entirely. Branch coverage, which ASIL-B requires, is native to Rust, so there is no coverage gap to close.
Automotive
ISO 26262 ASIL-D
ASIL-D is normally phase two on the ASIL-B foundation rather than a fresh start. The compiler is already qualified at ASIL-D, and timing and stack depth analysis are covered by Ferrous Systems or partner tooling. MC/DC is the one genuine gap, since dedicated Rust tooling is still some time out.
It is handled by identifying where full MC/DC is genuinely required and where branch coverage can be shown equivalent, on the basis of Ferrous Systems' published work on Rust control flow. Core library certification at ASIL-D is delivered on that basis as a chargeable scope item. Because compiler qualification, library certification and traceability infrastructure carry forward, phase two costs substantially less than phase one.
Industrial and IoT
IEC 61508
Ferrocene is qualified to SIL 3, supports customer efforts toward SIL 4, and offers a certified core subset at SIL 2. Targets here tend to be more constrained than in automotive — bare metal or a small RTOS, no heap — so the safety path is often close to a no_std shape already and library scope is small from the outset.
The recurring question is generated code: procedural macros and build scripts are heavily used in embedded Rust and never appear in the source repository. These are brought into certification scope rather than engineered around. SIL-2 assessments have completed with macros and build scripts included, with no schedule delay attributable to the Rust portion and no findings raised against the Rust components.
Medical Devices
IEC 62304 Class C
Ferrocene was the first Rust toolchain qualified to Class C, the level that applies where a failure could cause death or serious injury, so the toolchain question is settled before a project begins. IEC 62304 weights requirements traceability, risk management and lifecycle documentation more heavily than structural coverage alone, which suits Rust: documentation, tests and code are linked by the language itself, and mantra maintains bidirectional traceability within normal development.
Engagements pair the qualified toolchain with core library certification scoped to the reachable subset and evidence generation wired into CI. Supply chain infrastructure matters more here than in automotive, given Section 524B of the FD&C Act and FDA cybersecurity guidance on software of unknown provenance.
Whether you are evaluating Ferrocene for safety-critical Rust development, planning its integration into an existing platform, preparing for functional safety certification, or looking for Rust and Ferrocene engineering support, talk to us about your requirements.
Considering Ferrocene for Your Product?
Contact us
tQCS Limited.
Unit 01, 82F, International Commerce Centre, 1, Austin Road West Kowloon, Hong Kong
+852 2824 8796
Project.ferrocene@tqcs.io
business registration 68326347
About Ferrous Systems
Ferrous Systems has worked professionally with Rust since 2015. Its founders were part of the Rust core and community teams, co-founded the Rust Foundation, and remain deeply involved in the language's development. The company maintains or contributes to a significant part of the Rust ecosystem, including rust-analyzer, rustls, defmt, probe-rs, mantra, bindgen, and the cortex-m and cortex-ar crates. The original author and maintainer of the heapless crate is on the team.
Ferrous Systems offers three lines of work:
Ferrocene (a safety-qualified toolchain and supporting infrastructure)
Certification and engineering consulting
Rust training
tQCS delivers all three across Asia-Pacific, with local project management and technical support.
“We have never missed a customer deadline, and we prioritise that — which sometimes means pushing a feature to make sure there is ample time.”
Florian Gilcher, Managing Director, Ferrous Systems
A related principle governs how capability is described: Ferrous Systems documents only what has actually been validated. Platform support or tool qualification that has been tested but not yet formally assessed is not claimed. This does not mean coverage cannot be extended quickly — on Arm platforms in particular, common configurations are already tested — but it does mean that published scope is always audit-ready.
tQCS is the representative and delivery partner for Ferrous Systems across Asia-Pacific, including Korea, Japan, China.