We don't use STM chips though. Since the way we do state estimation and fault tolerant control requires a lot of computational power, we settled on 64-bit ARM Cortex A series processors. Since there was nothing available that fit our requirements, we produce the hardware ourselves as well.
When we started a bit more than two years ago, we started in C++, but have been slowly switching to Rust starting less than a year later. Now that everything is in Rust, our productivity went up a lot, together with the reliability of our systems (which is our main selling point).
The thing we miss most from C++ is the Eigen library, but the alternatives in Rust are pretty okay, though less complete. We are adding features and optimizations to some of these libraries, which we'll publish open source in a few months probably.
For all the small vectors and matrices, things like Vector3 and Matrix3x3 from nalgebra work fine. A few generic things we had to change from statically sized to dynamically sized arrays/matrices, but since these were rather big already, the difference in performance was neglegible. The type safety was maintained by directly wrapping those in a generic struct where the template parameter describes the contents of the matrix or vector. Such template parameter is basically a struct where the members describe the meaning of all the columns/rows of the related vector/matrix. A custom derive proc macro generated the conversions to and from this type (which are all optimized away by the compiler). It looks something like this:
struct Foo<T: VectorLike> {
matrix: DynanamicallyAllocatedMatrix<f64>,
}
impl<T: VectorLike> Foo<T> {
fn new() {
Foo { matrix: DynanamicallyAllocatedMatrix::zeros(T::N, T::N) }
}
fn get_diagonal(&self) -> T { ... }
...
}
In the end, keeping track of the meaning of the entire vector/matrix in the type system provides us with even a lot more safety than only keeping the size of them in the type system. And it has the advantage that you don't need const generics, since you're keeping track of whole types, and not just numbers. The downside is that we have to maintain a few procedural macro implementations.
I don’t know how soon ndarray will adopt it. We’ll just have to see.
We'll be changing our company name in a few weeks, followed by the launch of a new website which should have a lot more information than the current one.
we also working on writing drivers and supporting libs as we need them: we've implemented drivers for accelerometers, magnetrometers, pressure sensor, tof sensor, and ported dcmimu algorithm to rust.
Not sure what you mean with this comment. Even in a context like this, Rust has a lot of safety benefits, but yes you don't have access to the stdlib, and are restricted to core.
Allocation and deallocation focuses on small sliver of safety, but yes, That’s not a concern in that context.