My materials probably took 4-6 hours to write the first draft (I did most of it over two evenings, maybe one more just skimming the questions to figure out what things to talk about for each question), probably 2-3 hours or so to edit, then probably another hours over an evening just skimming it too many times before I hit submit. My materials were 16 pages or so, some of that was the original document (which has been linked in this comment section).
It's a fair bit of writing to ask for, but for a mostly remote and prose-driven company, you do a lot of long-form writing in the day to day work. The public RFDs and github issues/comments/commits give a good flavor for this.
As others have said, lots of my work is open source, and I have public writings and talks, so finding those were much easier for me than it might be for someone with only closed source works.
It's worth noting that the support for ESP32 in Rust is official [0], and there are multiple full time engineers at Espressif working on developing and maintaining it.
It's really not so different! In embassy, DMA transfers and interrupts become things that you can .await on, the process is basically:
* The software starts a transaction, or triggers some event (like putting data in the fifo)
* The software task yields
* When the "fifo empty" interrupt or "dma transfer done interrupt" occurs, it wakes the task to resume
* the software task checks if it is done, and either reloads/restarts if there's more to do, or returns "done"
It's really not different than event driven state machines you would have written before, it's just "in-band" of the language now, and async/await gives you syntax to do it.
Even if you don't know Rust, I'd suggest poking around at some of the examples here:
Speaking as someone familiar with C and Rust (not so much Go!), although there's a parallel here to Rust's Traits, this actually is much closer to dyn Trait in Rust, which uses vtables and runtime polymorphism, rather than "regular" Traits in Rust, which are monomorphized versions of similar interface constraints, much closer to C++'s templates (or concepts, I'm hand waving here).
This isn't necessarily a negative, sometimes you actually prefer vtables and runtime polymorphism for various reasons like flexibility, or code size reasons. Just wanted to add some flavor for folks that aren't as familiar with Rust, that this isn't exactly how things usually work, as "regular" Trait usage is much more common than dyn Trait usage, which you have to explicitly opt-in to.
As others have mentioned, ~all of the embassy HALs support nearly 1:1 parity of blocking interfaces for drivers next to the async ones. You really can avoid async entirely while still using embassy hals. The ecosystem is not tightly integrated/locked in.
Even data structure libraries, like embassy-sync, all have `try_` methods, which would allow for polling usage outside of async.
There's no mandate to use async - and helping folks that DO see value in it (which is a LOT of folks), isn't "splitting the ecosystem" - it's people doing things the way they like to do it. Embassy still works very hard to support folks who DON'T want to use async, to avoid duplicated work. There's nothing stopping you from preferring to write and maintain your own HALs, I know you have been for a while! But it's not something that people necessarily have to do, even if they aren't interested or don't prefer async!
In safety industries, particularly aviation, "alarm fatigue" is a really big deal. You recognize that pilots have limited situational bandwidth, and you REALLY don't want to be bugging them about things you can avoid. I worked in collision avoidance systems (TAS/TCASI/TCASII), and spent nearly a whole year just working on figuring out when and how we could avoid warning pilots in cases where "we're not sure exactly what is going on, so tell the pilot just in case" could potentially annoy pilots in cases like take off and landing (where they have important OTHER things to be doing!)
It's a fun balance between "possibly don't warn the pilot about something they should know about", and "don't warn them if they are busy doing something important".
Nordic's nRF family is the major other vendor I've seen doing this, almost all peripheral can be on any pin. It's definitely a big help for designing boards.
Hey, I'm James! I have my company (OneVariable), and have 7+ years of embedded Rust experience, and 10+ years of embedded experience. I've been helping teams start using Rust, or scale up their use of Rust, through advising, training, and development assistance, as well as "Senior as a service" to help teams that are ramping up but still need help with questions around embedded/rust. Happy to help customers in EU and NA time zones.
Let me know if you need any help getting big computers talking to smaller computers!
Thanks for Sublime Text! It's been my daily driver for over 15 years :). 10 of those developing Rust, and making heavy use of the Rust Analyzer/LSP plugin infra.
I also want to thank you for having such a reasonable licensing model, I'm launching my own desktop app in the next week or so, and I plan to have a very similar model to Sublime (free to use with nags, license is good for any personal usage, inclusive of updates for X period of time).
For each release of Ferrocene, this is kept up to date, and the same as C or C++, what is specified and stable can be relied upon, and implementation details are implementation details, the same as it would be if you switched from LLVM w/ SolidSands' SuperTest suite to IAR or GreenHills' toolchains which may have varying impl details but still maintain conformance with the specification.
The majority of safety critical teams will snapshot a single toolchain for the entire development lifecycle (sometimes updating if necessary, very rarely), but Ferrocene is releasing updates that are approaching the full Rust cadence (IIRC they've discussed going to every other release, so once every 12 weeks vs Rust's 6 week cadence), with all of the verification required to ensure the specification is still complete, and all tests are passing.
There's still work to specify and test more/all of the core/alloc/std library components, as well as third party crates, but from a toolchain perspective, it is much closer than you are giving them credit for. Unlike many proprietary C/C++ toolchains or verification suites, the majority of safety justification artifacts are publicly browseable here: https://public-docs.ferrocene.dev/main/index.html.
(I am a former founder of Ferrous Systems, and one of the people that pushed for the Ferrocene project to happen, but haven't worked there for a couple years and have no monetary stake in them anymore - I think they are just still doing the right thing, and doing it well.)
I bridged my bluesky account, if you're on mastodon and want to talk to me here, you're welcome to. Not sure if you need to opt-in on the mastodon side to be bridged to bluesky.
You don't generally need to license Arm chips unless you are designing your own chips for sale, like STM32 or Raspberry Pi do. This is something very few companies do, relative to those who just build things from existing chips.
If you're just building something with an existing Arm microcontrollers. The vendor (Like STMicro) has already licensed the Arm design and sold it to you.
In general in Rust, lifetimes enforce that references to a thing do not outlive the thing itself.
Even in unsafe code, it is possible to tie the lifetime of the allocations to the lifetime of the thing handing out the allocations, meaning that if you ever attempt to "escape" the scope, e.g. storing a shorter lifetime allocation in a longer lifetime allocation, that outer item can now only live as long as the shorter lifetime (even though it derives from the longer lifetime allocator). Any violation of this becomes a compile time error.
For example, within a function, you can have a Vec of references to local items, and although the Vec is an allocation, and COULD live forever/as long as necessary (allocations have 'static lifetime), that Vec MUST be dropped at or before when the references it contains would become invalid.
Tock-OS, Oxid-OS (the safety version of Tock-OS, like freertos/safertos), and Hubris (from Oxide Computers) are the main three RTOSs, Embassy and RTIC are common frameworks (but not classic RTOSs) used for scheduling and resource management on bare metal systems. There are some more niche or non-public ones as well.
For more classic OSs (not real time), Redox is the main one, as well as a lot of research/experimental/teaching ones, including the Blog OS from this guide/submission.
It's a fair bit of writing to ask for, but for a mostly remote and prose-driven company, you do a lot of long-form writing in the day to day work. The public RFDs and github issues/comments/commits give a good flavor for this.
As others have said, lots of my work is open source, and I have public writings and talks, so finding those were much easier for me than it might be for someone with only closed source works.