2

I recently read an interesting Article that, due to a memory Overflow error Power system of Boeing will collapse and turns the Flight into a Flying Brick.

This is a low level memory Handling bug. Can this bug can be eliminated if use Programming Language like Rust. Since Rust Handles memory by Itself and It is close to hardware like C language.

10

Actually, the bug in the Generator Control Units that you refer to is not the kind of memory handling bug that Rust (or any language with fixed-size integers) can protect against. An internal counter of the unit overflowed, which will happen eventually for any fixed-sized counter that keeps track of time for example, and the programmed safety features of the unit detected that and classified it as abnormal behavior. As abnormal behavior is considered bad, the unit was put in "fail-safe" mode. There is no indication that the bug involved an invalid memory access.

Therefor, switching from C/C++ to Rust would not prevent this class of bugs, because it is in application logic where even the smartest compiler for the safest language can't see that the behavior might be problematic.

The primary reasons why I don't see Rust taking over anytime soon in safety-critical areas are

  • Legacy code. Nowadays, software is rarely written from scratch. Nearly always there is a predecessor product and re-using large amounts of code from that product can reduce the lead-time for creating your new product, thus reducing the time until the new product can start making money. The legacy code is typically still written in C or C++.
  • Lack of a certified compiler. In a regulated industry, you are not allowed to disclaim liability and typically you are required to actively prove that your software can't take harmful actions. That includes a proof that the compiler faithfully translates your source code into machine instructions without introducing bugs that are not present in the source code. There are a few compiler vendors for C/C++ compilers that are willing to stake their business on making such a claim, but none for a Rust compiler. That would put a very heavy burden on a company that wants to switch to Rust.
  • Rust does have a checked_add() builtin that lets you detect overflows, but you're right that no language will inherently prevent all bugs. The lack of a certified compiler is the real reason Rust won't move into regulated spaces for the next decade or so, but outside of that it's already very useful as a safer C++. – amon Jul 26 at 9:00
  • 4
    @amon, my guess is that Rust's checked_add would have had the same end result: checked_add signals overflow -> safety features detect something that was not foreseen -> safety features put device in "safe mode". Only the way the overflow is detected change. – Bart van Ingen Schenau Jul 26 at 12:06
  • @BartvanIngenSchenau The future is a wide term. Certified Rust compilers might some day exist. – Sebastian Redl Jul 26 at 12:33
  • @SebastianRedl: I didn't mean to imply that Rust would be disqualified for all time, just that it currently is not as viable an option as the OP seemed to think. – Bart van Ingen Schenau Jul 26 at 12:48
1

Can memory handling errors be avoided by using only memory-safe languages? In brief, yes. They really do have the potential to eliminate a huge source of critical errors in the world's infrastructure. (There can still be memory handling errors in the implementation of the compilers and runtime systems for these languages, but those are usually written by far fewer, far more qualified people than your average industry programmer, so that the risk is far smaller.)

Can these languages replace C/C++ on the strength of improved security? In brief, no. As it is, the market doesn't reward security: software shops usually aren't liable for damages caused by program error, consumers don't accept higher prices for better software quality, and all too many private and public institutions are interested in easily hackable systems. Also, programmers love the raw power that memory-unsafe languages give them. Therefore, for the foreseeable future we will be stuck with undefined behaviour and the resulting vulnerabilities even though nowadays we could afford the additional cost involved in memory-managed systems.

  • "even though nowadays we could afford the additional cost involved in memory-managed systems." What are these costs? I think Rust software is not running any slower than the same program written in C, or is it? – jusaca Jul 26 at 7:59
  • @jusaca but you don't get the same program written in C, you get a program that is mostly the same, the difference is it falls apart for particular input – Caleth Jul 26 at 9:50

Not the answer you're looking for? Browse other questions tagged or ask your own question.