Remember there's tools that can prove absence of or detect many classes of error in C with no runtime checks. RV-Match and Astree Analyzer come to mind. Plus all kinds of test generators and a verified compiler. Plus lots of open tooling to do same thing. Safety-critical vendors buy that kind of stuff more than most C shops. C subset with such tooling is safer and more correct than Rust.

The advantage of Ada and Rust is they're cheaper and faster to get safe code out of. Businesses will like that. I don't know how compiler qualification plays out these days.

I'll repeat this from another comment. There are a few things a coding standard like Misra can't do for you.

Lacking a strict type system, discriminated unions, if-expressions (they exist in C but are often discouraged because of readability concerns), match expressions, macros that are AST members, procedural macros, guaranteed mutability restrictions with the borrow checker, etc. are things that a coding rule and analyzer can't bring into a language like C. Most importantly no module system to keep yourself somewhat isolated from third party code that you have no control over.

Add to that that you have humans checking each violation whether they think it will cause problems. Humans fixing these. And in a lot of cases humans not fixing these. Then you're actually still left with a lot of code that a stricter compiler like Rust or Ada would have rejected in the first place.

True, but many companies still try the shortcut of MISRA plus cheaper C devs, than paying for Ada compilers plus more skilled developers.

Your other comment is irrelevant in this subthread, because neither RV-Match nor Astree are coding standards.

Furthermore, there's zero proof that e.g. macros, match or variant types have any impact on code quality. Bringing the module system into this is really grasping at straws.

Where did you get this 80%/20% figures from?

Rough numbers from experience of what these analyzers discover and what actually turns out to be a bug, vs. What rust keeps you from doing out of the box. I could have said a lot or a little, but I wanted to convey an idea of how much and how little.

Lacking a strict type system, discriminated unions, if-expressions (they exist in C but are often discouraged because of readability concerns), match expressions, macros that are AST members, procedural macros, guaranteed mutability restrictions with the borrow checker, etc. are things that a coding rule and analyzer can't bring into a language like C. Most importantly no module system to keep yourself somewhat isolated from third party code that you have no control over.

Add to that that you have humans checking each violation whether they think it will cause problems. Humans fixing these. And in a lot of cases humans not fixing these. Then you're actually still left with a lot of code that à stricter compiler like Rust or Ada would have rejected in the first place.