<commit_before>% Does Ivory Rust?
% <NAME>, Galois Inc.
% October 2014

**XXX DRAFT! (comments welcome) XXX**

Synopsis: We compare and contrast two recently-developed "Safe-C" programming
languages, *Ivory* and *Rust*.

# Introduction

Around 2010, researchers at the University of Washington and the University of
California, San Diego, demonstrated their ability to hack into all the software
systems on a modern automobile, evening doing so remotely (through Bluetooth,
the telemetry system, etc).[^car] While the work was novel, the methods were
not. Most of the vulnerabilities exploited have at their heart some well-known
software vulnerability, such as a memory-safety violation or integer
overflow. The vulnerabilities are particularly found in low-level languages like
C and C++ that mostly rely on the user to write correct programs rather than
enforcing correctness.

Memory safety bugs in C/C++ are mostly obviated in higher-level languages, like
Haskell or Java. High-level languages typically restrict unsafe behaviors as
well as automatically perform some tasks that users might do incorrectly (e.g.,
deallocate memory).

So why are C/C++ still used? There are four reasons:

1. *Legacy concerns*. A lot of code exists already that is C/C++ and a lot of
   developers have specialized in these languages. Furthermore, for some
   embedded systems, compilers for high-level languages do not exist.

2. *Space*. To automate some of unsafe tasks, high-level languages often have a
   runtime system, which can be quite large. For example, the smallest compiled
   Haskell program is on the order of 1MB in size, and requires 1MB of
   random-access memory. So the tiniest program is too large for many
   microcontrollers. In comparison, an entire autopilot written in C/C++ runs on
   a microcontroller containing 8K of RAM and 256K of flash.[^ardupilot]
   Moreover, predicting the space usage of a compiled high-level language is
   difficult and is dependent on the behavior of the runtime system.

3. *Time*. Timing concerns cover both predictability and speed. Well-written C
   is still the golden-standard for speed. For real-time systems, predictability
   is also important; the runtime system may unpredictably pause the user
   program to perform garbage collection, for example, causing jitter in the
   program.

4. *Low-level programming*. Finally, without enforced restrictions on pointer
   use and type-casting, C/C++ can simplify interactions with hardware say, when
   writing device drivers. One might argue that hardware interaction is
   inherently unsafe, so why care about safe languages.

# "Safe C" Languages

A handful of languages have been created that provide many of the benefits of C
while providing better safety. Most approaches have been academic, so while the
ideas live on and are incorporated in other languages and compilers, the
implementations have mostly bit-rotted. Li compares some safe C implementations
(the document is a decade old but useful for historical context.[^li]

Other notable Safe~C languages in production are Go[^go], Swift[^swift], and
SPARK/Ada[^spark].

**Rust**: Rust began as a personal project of a Mozilla employee and was officially
sponsored by the company starting in 2009. The language was influenced by a
large number of languages, notably including many functional programming
languages.

Rust is focused on two primary goals: concurrency and memory-safety, while still
providing the user low-level control of memory and good performance. The
language guarantees memory-safety through static type checking rather than a
runtime system. Therefore, Rust programs are nearly as fast and predictable with
as small memory footprint as C programs.

**Ivory**: Ivory was developed at Galois, Inc. as part of their contribution to
the DARPA HACMS program.[^hacms] Development began in 2012, researching the use
of functional programming techniques for real-time security-critical embedded
systems code. Notably, Ivory is implemented as an *embedded domain-specific
language* (EDSL), meaning that the language is embedded within a host
language. The host language used for Ivory is Haskell[^haskell]. An EDSL
implementation is useful for quickly bootstrapping a compiler, since various
aspects (e.g., a front-end, portions of a type-checker, etc.) can be borrowed
from the host language. Furthermore, the host language acts as a Turing-complete
type-safe macro language.

The main application written in Ivory is a full-featured autopilot called
SMACCMPilot,[^smaccmpilot] which is approximately 50k lines of Ivory code. The
Ivory code implements the most of the software stack including device drivers
and board support, flight controllers, the communications subsystem.

The current backend target for Ivory is C99, to enable linking with C libraries
and to use C-based cross-compilers.

# Comparing Rust and Ivory

In the following we compare Rust and Ivory along a few dimensions that are
important to embedded programming. The comparisons are with respect to the
implementations of the respective languages as of October 2014.

While we strive for fairness, I am an Ivory developer and user and have used
Rust only for small examples. I do not have insight into the direction of Rust
developments. Another bias includes the categories themselves: some may be more
relevant to Ivory's use-cases.

That said we compare Rust and Ivory on the following dimensions: concurrency,
memory manipulation, arithmetic, programming paradigms, macro programming,
contracts/testing/formal verification, compiler implementations, adoption,
maturity, and legacy.

## Concurrency

**Rust**: Rust focuses on providing concurrency (the language was inspired by
writing fast, long-running server applications). The concurrency model is
similar to Erlang's model. Lightweight tasks use message passing over
channels. Channels are statically typed. Tasks are spawned at runtime and
error-handling is provided.
<commit_msg>ivory/rust comparison: why?<commit_after>% Does Ivory Rust?
% Lee Pike, Galois Inc.
% October 2014

**XXX DRAFT! (comments welcome) XXX**

Synopsis: We compare and contrast two recently-developed "Safe-C" programming
languages, *Ivory* and *Rust*.

# Introduction

Around 2010, researchers at the University of Washington and the University of
California, San Diego, demonstrated their ability to hack into all the software
systems on a modern automobile, evening doing so remotely (through Bluetooth,
the telemetry system, etc).[^car] While the work was novel, the methods were
not. Most of the vulnerabilities exploited have at their heart some well-known
software vulnerability, such as a memory-safety violation or integer
overflow. The vulnerabilities are particularly found in low-level languages like
C and C++ that mostly rely on the user to write correct programs rather than
enforcing correctness.

Memory safety bugs in C/C++ are mostly obviated in higher-level languages, like
Haskell or Java. High-level languages typically restrict unsafe behaviors as
well as automatically perform some tasks that users might do incorrectly (e.g.,
deallocate memory).

So why are C/C++ still used? There are four reasons:

1. *Legacy concerns*. A lot of code exists already that is C/C++ and a lot of
   developers have specialized in these languages. Furthermore, for some
   embedded systems, compilers for high-level languages do not exist.

2. *Space*. To automate some of unsafe tasks, high-level languages often have a
   runtime system, which can be quite large. For example, the smallest compiled
   Haskell program is on the order of 1MB in size, and requires 1MB of
   random-access memory. So the tiniest program is too large for many
   microcontrollers. In comparison, an entire autopilot written in C/C++ runs on
   a microcontroller containing 8K of RAM and 256K of flash.[^ardupilot]
   Moreover, predicting the space usage of a compiled high-level language is
   difficult and is dependent on the behavior of the runtime system.

3. *Time*. Timing concerns cover both predictability and speed. Well-written C
   is still the golden-standard for speed. For real-time systems, predictability
   is also important; the runtime system may unpredictably pause the user
   program to perform garbage collection, for example, causing jitter in the
   program.

4. *Low-level programming*. Finally, without enforced restrictions on pointer
   use and type-casting, C/C++ can simplify interactions with hardware say, when
   writing device drivers. One might argue that hardware interaction is
   inherently unsafe, so why care about safe languages.

# "Safe C" Languages

A handful of languages have been created that provide many of the benefits of C
while providing better safety. Most approaches have been academic, so while the
ideas live on and are incorporated in other languages and compilers, the
implementations have mostly bit-rotted. Li compares some safe C implementations
(the document is a decade old but useful for historical context.[^li]

Other notable Safe~C languages in production are Go[^go], Swift[^swift], and
SPARK/Ada[^spark].

**Rust**: Rust began as a personal project of a Mozilla employee and was officially
sponsored by the company starting in 2009. The language was influenced by a
large number of languages, notably including many functional programming
languages.

Rust is focused on two primary goals: concurrency and memory-safety, while still
providing the user low-level control of memory and good performance. The
language guarantees memory-safety through static type checking rather than a
runtime system. Therefore, Rust programs are nearly as fast and predictable with
as small memory footprint as C programs.

**Ivory**: Ivory was developed at Galois, Inc. as part of their contribution to
the DARPA HACMS program.[^hacms] Development began in 2012, researching the use
of functional programming techniques for real-time security-critical embedded
systems code. Notably, Ivory is implemented as an *embedded domain-specific
language* (EDSL), meaning that the language is embedded within a host
language. The host language used for Ivory is Haskell[^haskell]. An EDSL
implementation is useful for quickly bootstrapping a compiler, since various
aspects (e.g., a front-end, portions of a type-checker, etc.) can be borrowed
from the host language. Furthermore, the host language acts as a Turing-complete
type-safe macro language.

The main application written in Ivory is a full-featured autopilot called
SMACCMPilot,[^smaccmpilot] which is approximately 50k lines of Ivory code. The
Ivory code implements the most of the software stack including device drivers
and board support, flight controllers, the communications subsystem.

The current backend target for Ivory is C99, to enable linking with C libraries
and to use C-based cross-compilers.

# Comparing Rust and Ivory

Rust is one of the most advanced, safe C languages being developed, both in
terms of its technology but also in terms of its community and openness. Rust is
a measuring stick against which to compare other safe C languages.

In the following we compare Rust and Ivory along a few dimensions that are
important to embedded programming. The comparisons are with respect to the
implementations of the respective languages as of October 2014.

While we strive for fairness, I am an Ivory developer and user and have used
Rust only for small examples. I do not have insight into the direction of Rust
developments. Another bias includes the categories themselves: some may be more
relevant to Ivory's use-cases.

That said we compare Rust and Ivory on the following dimensions: concurrency,
memory manipulation, arithmetic, programming paradigms, macro programming,
contracts/testing/formal verification, compiler implementations, adoption,
maturity, and legacy.

## Concurrency

**Rust**: Rust focuses on providing concurrency (the language was inspired by
writing fast, long-running server applications). The concurrency model is
similar to Erlang's model. Lightweight tasks use message passing over
channels. Channels are statically typed. Tasks are spawned at runtime and
error-handling is provided.

{'fraction_non_alphanumeric': 0.04562955681166544, 'fraction_numerical': 0.005570574260670107, 'mean_word_length': 4.742238946378175, 'pattern_counts': {'":': 0, '<': 4, '<?xml version=': 0, '>': 4, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2466737', 'n_tokens_mistral': 3071, 'n_tokens_neox': 2841, 'n_words': 1757}