4. Tool Analysis¶

4.1. Potential Errors¶

4.1.1. Installation¶

Error identifier	Use case	Description	Risk	Mitigation	Detectable
Identifier: `RUSTC_ERR_INSTALL_01`¶	`RUSTC_UC0_INST`	Ferrocene was not correctly installed	Undefined behavior	`RUSTC_AVD_CHECK_INSTALL_001`	NO

4.1.2. Rust Driver¶

Error identifier	Use case	Description	Risk	Mitigation	Detectable
Identifier: `RUSTC_ERR_DRIVER_02`¶	`RUSTC_UC1_RLIB`, `RUSTC_UC2_STATICLIB`, `RUSTC_UC3_EXEC`, `RUSTC_UC4_EXEC_RLIB`, `RUSTC_UC5_EXEC_CLIB`, `RUSTC_UC6_PROC_MACRO`	An used environment variable is set to an incorrect value	Undefined behavior	`RUSTC_AVD_CHECK_CLEAN_ENV_002`	YES
Identifier: `RUSTC_ERR_DRIVER_03`¶	`RUSTC_UC1_RLIB`, `RUSTC_UC2_STATICLIB`, `RUSTC_UC3_EXEC`, `RUSTC_UC4_EXEC_RLIB`, `RUSTC_UC5_EXEC_CLIB`, `RUSTC_UC6_PROC_MACRO`	An invalid option is passed	Undefined behavior	`RUSTC_AVD_CHECK_BUILD_SCRIPT_003`	YES
Identifier: `RUSTC_ERR_DRIVER_04`¶	`RUSTC_UC1_RLIB`, `RUSTC_UC2_STATICLIB`, `RUSTC_UC3_EXEC`, `RUSTC_UC4_EXEC_RLIB`, `RUSTC_UC5_EXEC_CLIB`, `RUSTC_UC6_PROC_MACRO`	Error diagnostics are not correctly emited	Undefined behavior	`RUSTC_AVD_CHECK_BUILD_SCRIPT_003` AND `RUSTC_AVD_TEST_007`	NO
Identifier: `RUSTC_ERR_DRIVER_05`¶	`RUSTC_UC1_RLIB`, `RUSTC_UC2_STATICLIB`, `RUSTC_UC3_EXEC`, `RUSTC_UC4_EXEC_RLIB`, `RUSTC_UC5_EXEC_CLIB`, `RUSTC_UC6_PROC_MACRO`	The output is generated with missing part	Wrong code	`RUSTC_AVD_CHECK_BUILD_SCRIPT_003`	NO
Identifier: `RUSTC_ERR_DRIVER_06`¶	`RUSTC_UC1_RLIB`, `RUSTC_UC2_STATICLIB`, `RUSTC_UC3_EXEC`, `RUSTC_UC4_EXEC_RLIB`, `RUSTC_UC5_EXEC_CLIB`, `RUSTC_UC6_PROC_MACRO`	The behavior is incorrect because of concurrent modification	Undefined behavior	`RUSTC_AVD_PARALLEL_BUILD_006`	NO
Identifier: `RUSTC_ERR_DRIVER_07`¶	`RUSTC_UC1_RLIB`, `RUSTC_UC2_STATICLIB`, `RUSTC_UC3_EXEC`, `RUSTC_UC4_EXEC_RLIB`, `RUSTC_UC5_EXEC_CLIB`, `RUSTC_UC6_PROC_MACRO`	A warning is generated instead of an error	Undefined behavior	`RUSTC_AVD_WARNING_AS_ERROR_005`	NO
Identifier: `RUSTC_ERR_DRIVER_08`¶	`RUSTC_UC1_RLIB`, `RUSTC_UC2_STATICLIB`, `RUSTC_UC3_EXEC`, `RUSTC_UC4_EXEC_RLIB`, `RUSTC_UC5_EXEC_CLIB`, `RUSTC_UC6_PROC_MACRO`	The compilation has a wrong behavior	Wrong code	`RUSTC_AVD_TEST_007`	NO
Identifier: `RUSTC_ERR_DRIVER_09`¶	`RUSTC_UC1_RLIB`, `RUSTC_UC2_STATICLIB`, `RUSTC_UC3_EXEC`, `RUSTC_UC4_EXEC_RLIB`, `RUSTC_UC5_EXEC_CLIB`, `RUSTC_UC6_PROC_MACRO`	An incomplete input is accepted leading to an undefined behavior	Undefined behavior	`RUSTC_AVD_TEST_007`	YES
Identifier: `RUSTC_ERR_DRIVER_10`¶	`RUSTC_UC1_RLIB`, `RUSTC_UC2_STATICLIB`, `RUSTC_UC3_EXEC`, `RUSTC_UC4_EXEC_RLIB`, `RUSTC_UC5_EXEC_CLIB`, `RUSTC_UC6_PROC_MACRO`	Some object files are silently not generated	Use an artifact from a previous build	`RUSTC_AVD_CLEAN_004`	NO
Identifier: `RUSTC_ERR_DRIVER_29`¶	`RUSTC_UC6_PROC_MACRO`	An shared object file of a incorrect or outdated `proc-macro` crate is passed to rustc	Wrong code	`RUSTC_AVD_CLEAN_004`	NO
Identifier: `RUSTC_ERR_DRIVER_31`¶	`RUSTC_UC6_PROC_MACRO`	A proc-macro crate uses a dynamic library which is different than the one it was validated with, such as an updated library provided by a system package	Wrong code	`RUSTC_AVD_TEST_007`	NO
Identifier: `RUSTC_ERR_DRIVER_32`¶	`RUSTC_UC6_PROC_MACRO`	A proc-macro contains Undefined Behavior, which corrupts the memory space of the compiler	Wrong code	`RUSTC_AVD_MITIGATE_KPS_009`, `RUSTC_AVD_ENSURE_MEMORY_SAFETY_010`	NO

4.1.3. Rust Front-End¶

Error identifier	Use case	Description	Risk	Mitigation	Detectable
Identifier: `RUSTC_ERR_RUST_FE_11`¶	`RUSTC_UC1_RLIB`, `RUSTC_UC2_STATICLIB`, `RUSTC_UC3_EXEC`, `RUSTC_UC4_EXEC_RLIB`, `RUSTC_UC5_EXEC_CLIB`, `RUSTC_UC6_PROC_MACRO`	Input has invalid contents	Invalid code generated	`RUSTC_AVD_TEST_007`	YES
Identifier: `RUSTC_ERR_RUST_FE_12`¶	`RUSTC_UC1_RLIB`, `RUSTC_UC2_STATICLIB`, `RUSTC_UC3_EXEC`, `RUSTC_UC4_EXEC_RLIB`, `RUSTC_UC5_EXEC_CLIB`, `RUSTC_UC6_PROC_MACRO`	Error diagnostics is invalid	Invalid code generated	`RUSTC_AVD_WARNING_AS_ERROR_005`	NO
Identifier: `RUSTC_ERR_RUST_FE_13`¶	`RUSTC_UC1_RLIB`, `RUSTC_UC2_STATICLIB`, `RUSTC_UC3_EXEC`, `RUSTC_UC4_EXEC_RLIB`, `RUSTC_UC5_EXEC_CLIB`, `RUSTC_UC6_PROC_MACRO`	Invalid output generated from valid input	Invalid code generated	`RUSTC_AVD_TEST_007`	NO
Identifier: `RUSTC_ERR_RUST_FE_14`¶	`RUSTC_UC1_RLIB`, `RUSTC_UC2_STATICLIB`, `RUSTC_UC3_EXEC`, `RUSTC_UC4_EXEC_RLIB`, `RUSTC_UC5_EXEC_CLIB`, `RUSTC_UC6_PROC_MACRO`	The behavior is incorrect because of concurrent modifications	Invalid code generated	`RUSTC_AVD_PARALLEL_BUILD_006`	NO
Identifier: `RUSTC_ERR_RUST_FE_15`¶	`RUSTC_UC1_RLIB`, `RUSTC_UC2_STATICLIB`, `RUSTC_UC3_EXEC`, `RUSTC_UC4_EXEC_RLIB`, `RUSTC_UC5_EXEC_CLIB`, `RUSTC_UC6_PROC_MACRO`	Invalid input is accepted	Undefined behavior	`RUSTC_AVD_TEST_007`	YES
Identifier: `RUSTC_ERR_RUST_FE_16`¶	`RUSTC_UC1_RLIB`, `RUSTC_UC2_STATICLIB`, `RUSTC_UC3_EXEC`, `RUSTC_UC4_EXEC_RLIB`, `RUSTC_UC5_EXEC_CLIB`, `RUSTC_UC6_PROC_MACRO`	Incorrect number of inputs are accepted	Undefined behavior	`RUSTC_AVD_CHECK_BUILD_SCRIPT_003`	YES
Identifier: `RUSTC_ERR_RUST_FE_30`¶	`RUSTC_UC6_PROC_MACRO`	A proc macro implementation function is invoked incorrectly by rustc.	Undefined behavior	`RUSTC_AVD_TEST_007`, `RUSTC_AVD_PROC_MACRO_NO_LINKER_SCRIPTS_011`	YES

4.1.4. LLVM¶

Error identifier	Use case	Description	Risk	Mitigation	Detectable
Identifier: `RUSTC_ERR_LLVM_17`¶	`RUSTC_UC1_RLIB`, `RUSTC_UC2_STATICLIB`, `RUSTC_UC3_EXEC`, `RUSTC_UC4_EXEC_RLIB`, `RUSTC_UC5_EXEC_CLIB`, `RUSTC_UC6_PROC_MACRO`	Input parameter has invalid value	Most likely LLVM will crash. Invalid code could also be generated	`RUSTC_AVD_TEST_007`	NO
Identifier: `RUSTC_ERR_LLVM_18`¶	`RUSTC_UC1_RLIB`, `RUSTC_UC2_STATICLIB`, `RUSTC_UC3_EXEC`, `RUSTC_UC4_EXEC_RLIB`, `RUSTC_UC5_EXEC_CLIB`, `RUSTC_UC6_PROC_MACRO`	An object file is invalid	Invalid code generated	`RUSTC_AVD_CHECK_BUILD_SCRIPT_003`	NO
Identifier: `RUSTC_ERR_LLVM_19`¶	`RUSTC_UC1_RLIB`, `RUSTC_UC2_STATICLIB`, `RUSTC_UC3_EXEC`, `RUSTC_UC4_EXEC_RLIB`, `RUSTC_UC5_EXEC_CLIB`, `RUSTC_UC6_PROC_MACRO`	An object file or static library is not correctly translated to machine code	Undefined behavior	`RUSTC_AVD_TEST_007`	NO
Identifier: `RUSTC_ERR_LLVM_20`¶	`RUSTC_UC1_RLIB`, `RUSTC_UC2_STATICLIB`, `RUSTC_UC3_EXEC`, `RUSTC_UC4_EXEC_RLIB`, `RUSTC_UC5_EXEC_CLIB`, `RUSTC_UC6_PROC_MACRO`	The behavior is incorrect because of concurrent modifications	Invalid code generated	`RUSTC_AVD_PARALLEL_BUILD_006`	NO
Identifier: `RUSTC_ERR_LLVM_21`¶	`RUSTC_UC1_RLIB`, `RUSTC_UC2_STATICLIB`, `RUSTC_UC3_EXEC`, `RUSTC_UC4_EXEC_RLIB`, `RUSTC_UC5_EXEC_CLIB`, `RUSTC_UC6_PROC_MACRO`	An object or static library exposes additional symbols	Internal functionality might become callable from the outside	`RUSTC_AVD_TEST_007`	NO
Identifier: `RUSTC_ERR_LLVM_22`¶	`RUSTC_UC1_RLIB`, `RUSTC_UC2_STATICLIB`, `RUSTC_UC3_EXEC`, `RUSTC_UC4_EXEC_RLIB`, `RUSTC_UC5_EXEC_CLIB`, `RUSTC_UC6_PROC_MACRO`	Output does not contain expected variables or functions	Invalid code generated	`RUSTC_AVD_CHECK_CLEAN_ENV_002` AND `RUSTC_AVD_CLEAN_004` AND `RUSTC_AVD_TEST_007`	NO

4.1.5. Linking¶

Error identifier	Use case	Description	Risk	Mitigation	Detectable
Identifier: `RUSTC_ERR_LINK_23`¶	`RUSTC_UC3_EXEC`, `RUSTC_UC4_EXEC_RLIB`, `RUSTC_UC5_EXEC_CLIB`, `RUSTC_UC6_PROC_MACRO`	Invalid input is accepted	Undefined behavior	`RUSTC_AVD_CHECK_BUILD_SCRIPT_003`	NO
Identifier: `RUSTC_ERR_LINK_24`¶	`RUSTC_UC3_EXEC`, `RUSTC_UC4_EXEC_RLIB`, `RUSTC_UC5_EXEC_CLIB`, `RUSTC_UC6_PROC_MACRO`	Invalid executable or library produced	Undefined behavior	`RUSTC_AVD_TEST_007`	NO
Identifier: `RUSTC_ERR_LINK_25`¶	`RUSTC_UC3_EXEC`, `RUSTC_UC4_EXEC_RLIB`, `RUSTC_UC5_EXEC_CLIB`, `RUSTC_UC6_PROC_MACRO`	The behavior is incorrect because of concurrent modifications	Undefined behavior	`RUSTC_AVD_PARALLEL_BUILD_006`	NO
Identifier: `RUSTC_ERR_LINK_26`¶	`RUSTC_UC3_EXEC`, `RUSTC_UC4_EXEC_RLIB`, `RUSTC_UC5_EXEC_CLIB`, `RUSTC_UC6_PROC_MACRO`	Incorrect number of inputs are accepted	Undefined behavior	`RUSTC_AVD_CHECK_BUILD_SCRIPT_003`	YES
Identifier: `RUSTC_ERR_LINK_27`¶	`RUSTC_UC3_EXEC`, `RUSTC_UC4_EXEC_RLIB`, `RUSTC_UC5_EXEC_CLIB`, `RUSTC_UC6_PROC_MACRO`	An input is missing	Invalid code generated but won’t run	`RUSTC_AVD_CHECK_INSTALL_001`	YES
Identifier: `RUSTC_ERR_LINK_28`¶	`RUSTC_UC3_EXEC`, `RUSTC_UC4_EXEC_RLIB`, `RUSTC_UC5_EXEC_CLIB`, `RUSTC_UC6_PROC_MACRO`	Error diagnostics not emmited	Invalid or missing code not detected by user may be linked against subsequent stage	`RUSTC_AVD_TEST_007`	NO

4.1.6. Core library¶

Error identifier	Use case	Description	Risk	Mitigation	Detectable
Identifier: `CORE_ERR_01`¶	`RUSTC_UC1_RLIB`, `RUSTC_UC2_STATICLIB`, `RUSTC_UC3_EXEC`, `RUSTC_UC4_EXEC_RLIB`, `RUSTC_UC5_EXEC_CLIB`	Source code contains calls to uncertified functions	Uncertified code generated	`CORE_AVD_SUBSET_001`	YES
Identifier: `CORE_ERR_02`¶	`RUSTC_UC1_RLIB`, `RUSTC_UC2_STATICLIB`, `RUSTC_UC3_EXEC`, `RUSTC_UC4_EXEC_RLIB`, `RUSTC_UC5_EXEC_CLIB`	Source code contains macros	Generated code is incorrect	`CORE_AVD_MACROS_002`	YES
Identifier: `CORE_ERR_03`¶	`RUSTC_UC1_RLIB`, `RUSTC_UC2_STATICLIB`, `RUSTC_UC3_EXEC`, `RUSTC_UC4_EXEC_RLIB`, `RUSTC_UC5_EXEC_CLIB`	Source code contains architecture specific functions	Functions are used incorrectly	`CORE_AVD_ARCH_003`	YES

4.2. Detection Measures and Usage Restriction¶

Measure identifier	Description
Identifier: `RUSTC_AVD_CHECK_INSTALL_001`¶	The toolchain Installation shall be checked in order to ensure the validity of the build results.
Identifier: `RUSTC_AVD_CHECK_CLEAN_ENV_002`¶	User must verify that environment variables used by the toolchain are correctly set.
Identifier: `RUSTC_AVD_CHECK_BUILD_SCRIPT_003`¶	User must verify that the list of build actions is correct.
Identifier: `RUSTC_AVD_CLEAN_004`¶	Before building, the user must ensure that the build environment is clean of former compilation artifacts.
Identifier: `RUSTC_AVD_WARNING_AS_ERROR_005`¶	All Warnings should be considered errors, the build should NOT display any warning.
Identifier: `RUSTC_AVD_PARALLEL_BUILD_006`¶	Concurrent file updates during the build operations are prohibited.
Identifier: `RUSTC_AVD_TEST_007`¶	Testing must be performed on the final application or libraries, or on any parts built, using an environment as close as possible to the final build.
Identifier: `RUSTC_AVD_PROC_MACRO_NO_ATTRIBUTE_008`¶	The user shall ensure that no attributes are used on a macro implementation function. The only exceptions are `proc_macro`, `proc_macro_derive` or `proc_macro_attribute`.
Identifier: `RUSTC_AVD_MITIGATE_KPS_009`¶	The user shall implement mitigation strategies for known problems documented in the Known Problems manual.
Identifier: `RUSTC_AVD_ENSURE_MEMORY_SAFETY_010`¶	The user shall identify and evaluate the risks related to all instances of unsafe code as defined in Unsafety, and follow the guidelines outlined in Handling Unsafety.
Identifier: `RUSTC_AVD_PROC_MACRO_NO_LINKER_SCRIPTS_011`¶	The user shall ensure that no linker scripts are used when compiling a proc-macro crate.
Identifier: `CORE_AVD_SUBSET_001`¶	User must verify that only the certified subset of the core library is used.
Identifier: `CORE_AVD_MACROS_002`¶	User must verify that code generated by macros is correct.
Identifier: `CORE_AVD_ARCH_003`¶	User must verify that architecture specific functions are used correctly.

4.3. Potential Errors by Classes Traceability Matrix¶

Potential errors are the result of the HazOp analysis, it should be documented in the HazOp Report documents.

4.4. ISO 26262 Tool Classification¶

During this analysis, we highlighted some of the potential errors concerning Ferrocene that impacts the safety-related software code. Hence, the tool impact is TI2.

Moreover, this analysis shows us that the likelihood of detecting these potential errors is very low. Therefore, the tool error detection class is TD3.

Using clause 11.4.5.4 in part 8 of the [ISO 26262:2018] standard, we can conclude that in the worst case the Tool Classification Level is TCL3 and therefore we choose the following qualification methods:

1b. Evaluation of the tool development process in accordance with 11.4.8
1c. Validation of the software tool in accordance with 11.4.9

According to clause 11.4.2 in part 8 of the [ISO 26262:2018] standard, this choice depends on the user’s software development life-cycle and their validation strategy. The user has the responsibility to determine whether this level, or a better one, is applicable.

4.5. IEC 61508 Tool Classification¶

Ferrocene provides a development environment capable of compiling and linking programs for the target architecture to conform with industrial [IEC 61508:2010] class T3.

4.6. IEC 62304 Tool Classification¶

[IEC 62304:2006 + AMD 1:2015] does not provide an own scheme to classify and qualify tools used in its context, but recommends the application of techniques and tools as defined in [IEC 61508:2010]. Therefore, with the qualification of Ferrocene adhering to an IEC 61508 Tool Classification, Ferrocene can be used for development, release and maintenance of medical device software up to Class C.