Towards Rust for Critical Systems The programming language landscape in software development for aerospace and other safetycritical domains is comprised of lowlevel languages such as C which require a heavy verification effort, and languages such as Ada which have higher safety guarantees but are often seen as unpopular with developers. The industry has struggled to adopt newer languages with more modern features that can increase quality, productivity and enjoyment for developers. Rust is a promising new language, that attempts to combine user friendliness with strong safety support, while also delivering modern convenience features. In this paper we present an analysis of the potential benefits of the adoption of Rust for safety critical systems through an analysis of safety coding guidelines for C that Rust would alleviate. This paper presents an initial understanding of the potential benefits of Rust, to enable clearer evaluation of the value proposition of using Rust in safety critical domains.

Verification of Safety Functions Implemented in Rust  a Symbolic Execution based approach Symbolic execution allows us to observe and assert properties of program code executing under (partially) unknown inputs and state. In this work we present a case study demonstrating that safety functions implemented in the Rust programming language can be verified by an assertion based approach. To this end, we leverage on previous developments adopting LLVMKLEE for symbolic execution of Rust programs.In particular we show that reliability can be ensured by proven absence of undefined behavior and that safety properties (expressed as assertions) can be ensured for all reachable paths of the underlying implementation (under symbolic inputs). Moreover, the verification (besides stating assertions) is fully automatic and can be applied without any changes made to the implementation. While assertions have the advantage of being familiar to the mainstream programmer, they lack the expressiveness of dedicated logic developed for model checking. The paper also discusses complexity issues arising from pathstate explosion inherent to symbolic execution. The feasibility of the approach is demonstrated on a representative use case implementing a safety function (equality) from the PLCopen library. We obtain complete path (466) and state (8) coverage in under 2 seconds for the given example on an i77700 laptop computer.