Rust Programming Language RustFest Rome 2018, 9 Dec 2018

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: RustFest Rome 2018 - Massimiliano Mantione: Fun with Rusty Robots

Description

Lately as a hobby I am participating to robotic competitions where autonomous robots fight according to various rules (usually speed races or Sumo fights). Lately I am putting Rust into every robot I program, from bare metal (arduino-like AVR and ARM Cortex-M), to Linux on higher level boards (Raspberry PI, Beaglebone), and even on a real time OS running on the Lego Mindstorm ARM-v5 CPU. In this talk I'll show embedded Rust programming in all of these environments, with a focus on getting things done!

https://rome.rustfest.eu/sessions/fun-with-rusty-robots
https://media.ccc.de/v/rustfest-rome-7-fun-with-rusty-robots

A

There you go so everybody, please give a round of applause bus in the honor.

B

Good morning, everyone am I near enough. Yes, okay, so I talked about rust on robots. Now something short about myself things I worked on. I am mostly a compiler engineer. I working on the monitors in time compiler for six years, then in the Unity game engine for one year, the v8 team in Google for one year and a half and now I do virtual reality on the web in hyper, fair and it's fun.

B

But now, let's talk about this talk first, so I start telling stories about how I actually ended up using rust on robots, because the story is important because so you understand the motivations. What actually happened and I'll show a couple of examples and then I'll say something about what's special about rust on robots and it will be pretty simple, because the software is very, very simple and also because in the end me and grassed.

B

Well, it's not like that much so long ago, I, like the concepts that I like a time and I, was feeling the learning curve. You know borrowed checker anyone and so I just was watching rust from a distance. That was it and then about robots and again I like at them in principle, of course, but again I like a time, and then we saw a Lego sumo competition.

B

It was me and my son, while also my wife, he was 12 and it was love at first sight, I mean it was really fun, and so we started building our robot to compete in these competitions and to give some perspective I'm talking about hobby projects, mostly done with Lego, so essentially toys and for competitions, which is fun because then you are forced to do them better. So you are doing something simple, but then you say oh crap I'm losing this match.

B

Why and then you want to do something better, and these competitions that I'm talking about is mostly sumo and line follower. So a sumo match is something like this. You've got two opponents on a small arena and they start and they are autonomous and they try to use a strategy to push the other out.

B

So this is what you should expect, and the line follower is a small thing that follows a line you know, and the goal is to do it fast, so the one that wins is the one that it faster to that time it and now, over the years we actually built a team because there's this guy here, which is the most recent one, he was winning competition all the time, organizing one in Italy we participated to the one he was organizing, then became friends and then there's my wife, my son, another father with his son.

B

This one is his son. Now another family join it and next week we will be in estonia, tallinn for a gigantic event, with hundreds of robots will be, will be bringing 30 ourselves.

B

So we are really having a lot of fun. So back to the story, our first lego robot. We had to program this thing and the Lego kit comes through the visual environment. Now the visual environment is fine for kids, but it's very limiting when you want to do something more complex. My kid understood that so we would intend to switch to a real programming language. Now the Lego thing runs Linux inside.

B

Big like this, it's big like this. This is the mold completely small computer, so it's Lego.

B

So runs Linux and there is an operating system which is easy. Three dad Evie three is the name of the CPU, the the Lego kit and Evie. Three death is a debian part on this, so you have a Debian. You can SSH into it. You can use whatever you want and our first language was no js' javascript, because we wanted to keep it simple.

B

Then that was problem with the libraries to switch to python and then the robot work it we qualified in our competition, but we realized that it was not interacting properly I mean it was slow, so I was blaming the language, but in spite on I mean it's not fast. We all roll, so I didn't want to inflict memory management on to my son, so I said: okay.

B

So my idea was goal and goal and is a very simple as a language it's compiled to native code and it's working, but somebody said let there be latency in the world and there was Latin si and the problem is that doing things takes time and time can be significant and our robots did not react in time. So we built a Latin si tester. Now this latency tester has panels passing in front of a proximity sensors that drives a line that is censored by a sensor.

B

So the time it takes for the signal to propagate from these sensors to the actuator to be imperceivable.

B

And and react so this is a simulator of the latency that the robot is actually experiencing, while working I had to be scientific, because I really wanted to understand what was going on. I mean this is obviously a toy, but it served a purpose. It was a scientific experiment and the problem was we measured, something like 50 millisecond, latency spikes? Is it much? Is it not much? We are talking about hard real-time, but what does it mean well hard? Real-Time is not about performance by its own sake.

B

It's about time, related correctness, which means predictable, latency and to give examples related to robotics think about a self-driving car on a highway a bit more than 100 km/h is 30 meters per second, and at this speed, 100 milliseconds is 3 meters. So if, by any means that software is 100, millimeter milliseconds late, you lose 3 meters of rank, which is not good, probably I said. Ok, this is a car. What about our toys? Ok, take a line.

B

Follower robot, let's say, go doing 2 meters per second, then 10 milliseconds is 20 millimeters and since the line is smaller than 20 millimeters, if you have a blind spot of 10 milliseconds, you just risk to miss a sharp turn and go out of the track. So this is the kind of latency you should aim at generally millisecond or sub millisecond latency. If you want to be serious now, the root of the problem actually was not. The language I was very conscious when I was writing go long. I did essentially never did allocations.

B

The garbage collector wasn't there anyway, so it was just machine code. It was fast. The problem was the OS. So in that operating system it was a Linux kernel, an ancient one without pre entity and there's this arm. V5 chip, which has a cache addressing scheme. I, don't want to dive into the details, but the problem is a Tavi context which the operating system is forced to flash the whole cache, which is painful.

B

So what can we do? I say: okay, let's try a new operating system we found out there. Is this easy three RT, which is a small real-time kernel that has been ported on the Lego brick by a Japanese team and it is there on the internet and it was amazing soup, milliseconds, max latencies and the event loop was running on more than 10 kilohertz, so 10 times per millisecond, you could measure things, I mean we were extra happy.

B

The documentation was entirely in Japanese, just tiny bits of English and the user code must be written in C. There is no other SDK essentially, so my son got sad because of the C language. You know he was already very proficient in golang and said: what's this mess you have to care about pointers the references? What was this thing? And so this is I said: okay, let's look at rust. This was actually a perfect excuse for me for learning rust and it's actually a perfect fit, because there is no GC, the respirator latency.

B

There is high performance and it is perfect C ABI interoperability, which means that it's a perfect drop-in replacement for C in essentially an environment, so I started with baby steps. I entered no STD land, which means that you want to keep it as small. You don't want to have dependencies.

B

I did not want to have memory allocation anyway, because you know I'm your reason, size reasons and everything so I selected, the RFI target, which is actually pretty well supported and the proof of concept was a single rest files, compiled it directly with the compiler as see not even cargo, and it was replacing a single C object file with one single function and link it together and well it working that was very simple.

B

You know a function that adds one to a number it's about his worker, then I did the bulk of the job, which was integrated that with the operating system that were a few small challenges like no simple Cisco ABI, because this is quality. I was this thing that was difficult to emulate in grass, but then the solution is simply to wrap. This is Cole. I need would see, functions and link on to them. It's very simple to do, then.

B

The binary file format for the executable was really tricky because it was an elf format but with a custom layout that they selected and so I just reused. The C SDK linker script I changed nothing, so impact is what I do is to compile my application, create as a static library in rust and then have a C application in this operating system and Link the static library into that application, providing essentially the main entry point.

B

So there is this application in this operating system that cause my main entry point in rust and from that point on is just rust. Land called him back into the library function in C, it's pretty simple and he started working but working then linkit files became too big.

B

So it's something like 1 megabyte of code and I said: why does it did 1 megabyte of code and then I tried various strategies with the linker to limit the scope of the code, throwing away what was not needed, but every time I touched the linking process, as was backing the build. It was very, very hard to produce an executable file that was ok for that operating system to load, then I said: ok, I have no other choice. I'll reckon Polly, beak or stripping things by hand.

B

I was really determinate to have it running, and so I I started with sargo, which is a tool that uses in embedded land.

B

But this is actually mostly a tall cover us in embedded and so robotics is an excuse to say, embedded land and with sargo that were linking issues then I use it another tool which is called a cargo X build, which is a plug into cargo, that recompiles lib core and another couple of basic libraries on the fly for you for your target, and the funny thing was that using this under compiling leap code on the fly solve it, the issue magically, it was half the size.

B

Don't ask me why, so it worked it, which means now. I want to show you something just concretely so that we have fun.

B

So I don't know how much this is visible, but this thing is running rust code. It has a small UI, I can select another function and it is measuring the error of the sensor. If I move it, you maybe see that it is moving.

C

B

Okay, you see that there are numbers moving, it's actually measuring the error on the line moving, so this I cannot make it run because I don't have the track. Then there is this boy.

B

Look at the strategy. I can pick another strategy which is around and go to the center and I say prepare to run now. It will start and it should execute the strategy and then look for an opponent in to one second start.

B

Effect start again, five seconds three, two one go Circle look for opponent here is the opponent. Look for me.

B

Now it actually saw me okay, so you see it reacts, it works and this is fast. So it's a toy, but it's been really fun.

B

B

Now a different story.

A

B

So this one I'll cut it a bit shorter because it is a bit of a sad story. Other.

D

B

Which is another toy? This is preemies for kids, it's a one robot per child platform and it's its main, but it's Arduino side, so an IVR CPU, and we wanted to use this in a competition as well.

B

So I said: okay, let's use rest on that which means rest on AVR and the spoiler eyelid. This does not really have a happy ending. It doesn't fully work and they want just to tell you why. So, let's cut it short about the troublesome things, I had to do to actually make it run. So there were lots of us hardest. You have to build your own wrath, compiler from an unstable fork, with an unstable LLVM fork and the build environment is sometimes critical.

B

I was looking for an environment more stable, using a container then, when I had it running, the main library resumed at work and the dutiful thing that I wanted to use, and so I rebuilt the compiler again and catching up in the end. I had analog world again and when I had an a low word. Working I wanted to actually write code for robot and then I had ecosystem issues, because essentially the basic instruction would work. You had several part.

B

Timers and I could use individual pins on the chip, but the problem is anything else and then I'll talk about robot hardware. So what do you? What are you interacting with and if you just need to do simple, readwrite on pins, then it's simple, so you just use the registers and you write to the pins and that's fine. Now, if you, if you have timers, so you can generate square waves which is PWM to drive the continuous current mode and eventually service.

B

So that thing you can get it working in rust easily because it's just a few register right. You had ooh our doer viewers, so you have serial lines. So eventually you could talk to smart sensors if they had a certain interface. But, however, in this thing it is a real word thing. This hardware it has motors and the button which are okay, PWM and the single analog grid on a pin. It has ultrasound sensors.

B

If I switch it on, then you can see that it senses proximity. This is an ultrasound sensor and it's easy to do because in the end, is just a pin where you have to write a high signal to to push the sound and when you have to read the signal to end time, the time it takes for the sound to come back. So you have to time it, but it's not hard.

B

The problem is anything else because for anything else, you have to do what is called a bit banging anybody know what's been bit banging is, is when you are actually implementing a protocol on a pin. Writing high and low bits on the pin by hand using code and the HB light on the thing works on a single pin for chula for to RGB LEDs, and the protocol has something like 800 nano second perfusion pulses and the mainstream audio library, Arduino library.

B

It essentially is a pile of macros and finely tuned inline assembly, which only works because of the speed of the clock of the CPU and they're reading from the line sensor on the front is similar, and the problem is that back trust writing. This in rust is feasible. You put in line assembly in rust with markers and everything, but what is it's not pleasant?

B

So I decided well, it's tricky I, try to reuse the C code now mixing Russ and Arduino turned out to be incredibly hard. I tried both ways so both taking an Arduino sketch with a rest lighter inside and a last application link. In there we know library, in both cases, I had linking issues. Runtime issues not found symbols to large executable, so I ended up, saying: ok, it's just too hard now I'm, just keeping my totus that Trust does work on AVR in this unstable branch.

B

It's still a bit painful to use the echo system is not there because an Arduino, much of the value is the echo system. You find libraries for everything and it helps a lot now if you want to start a rest project on Arduino, think about it. What do you want to do? Do you want to work on the platform or do you want to get something done? Because if you want to get something done, you will have a lot to do that. That's not the message! It's not bad in itself.

B

You just need to know now see. Integration is probably beautiful, but really tricky, maybe just for timing. Eventually, rust AVR will be merged in mainline. Probably so maybe things will get better, but for now is this. So, let's turn page and let's talk about for now, I have told stories, but what about trust so I use a trust. What does it mean to use rust in these things, and is it helping and well yes, it does and the longer answer is.

B

It depends on how you structure your code and what you're, after so the simplest way to write a logic for this thing is what people call the mega loop. It's essentially a big loop that does read data from sensors. Think something and act on actuators do it again and you'll have to do it fast enough that it looks like real time. This is what I was calling the event loop before this is the simplest possible approach is what actually Arduino encourages, because it works.

B

It's very easy to reason about it's subtle, imperative, imperative, of course, that that's fine, it's a small, simple thing, expand that it looks like this. You know you had read that gives you. Data then think that takes the data, takes probably a state and gives you the new state and commands to execute and then act that uses the commands to do things. This is the main thing now you can write it more see like with the passing things by reference with mutations and, in the end being realistic. It ends up like this mutating things everywhere.

B

B

Because, essentially, when you everything is faithful, because when you are reading data, often you need to do timings, because you need to measure the speed of things, which means you need to remember the past values and the next ones, and sometimes you are doing averages among values to taper off spikes or spools reads, which means that the reading system is not stateless. So it needs to have data in data out anyway and about the command system.

B

Quite often, you don't want to do all the possible activations every time you only want to change what changed for performance reasons, especially on the graphical CV, but sometimes also on physical things, which means that you need to know the state of the thing now and compute. What changes and only actuate will change it, which means essentially every subsystem is stateful. Now you can think objectively nted and writing like this, where we have this reader, this state and this actuator, which are stateful objects and then the data that that works is immutable.

B

Actually so you take just the immutable data out of the reader, pass that to the tinkerer that mutates the state, but gives you an immutable command, and then you give the command to the actuator. This is one way to think about it. All you can think in function observe the code. You see this will not compile, but you get the idea so essentially passing value backs on front every time, and the funny thing is be happy because all these styles are fine is just your choice and the borrowed checker is helping you either way.

B

Now the nice thing I showed you these different styles, but plus gives you a choice. You can either write code. That well is not purely functional but say it's single function is a pure function and it actually probably quite likely, since the compiler will do a lesion of the moves it will perform like C like code, that is, memory sharing, so the code that I was showing before when you pass value in value out, you pass the ownership.

B

The compiler is very likely to optimize the move out to say: okay, this is just this value, so why should I have to copy it in and out so you write very high level code and the resulting machine code is high performance or you can say: okay, I've write it C style, so I passed references all the time, even mutable references, but this C style code.

B

It is C style on the surface and in practice the borrow checker is enforcing that you don't do silly things, so you can only mutate something one, one one piece of code at a time. You cannot share a mutable things and so on. So in the end it doesn't really matter. You pick your style and Trust is helping you now.

B

Realistically, the tinkerer function will become complex and becoming complex. It will need to be materialized, so you need to do some kind of splitting up. There are several strategies to make this sync function. It can be a very big match statement so or it can be a function pointer that changes from time to time.

B

So you actually are calling a different function from time to time all you can have many separated soup loops, so you exhibit once you bloop, to do an activity and another loop to do another activity and another loop to do another activity. I tried, probably all of them, and you can just pick what you feel most sensible. Each one will work. Macros could help in the sub loops but again be happy, because the rest type system is helping a lot.

B

What I found out is that the state can be an enum, so it can have different shapes, which means that, according to what your robot doing to the context, it is perfectly clear what kind of information it has in the state and what it can and cannot do on that. So usually, when you have a data structure in a language like C, it is something like free form and memory representation. So, yes, it is structured, but in practice you can do whatever you want.

B

You have to be very disciplined while in rust, if you design up front to the shape of your state, then it's very hard to do mistake. In the think function because you do pattern matching on the state and it's clear if it's either one thing or the other or the other, it's really really hard to do. Mistakes, as I said exhaustive pattern matching, so it's, in my opinion better than playing C or C++.

B

So are we done and I say? Not really? We still have this single mega loop and it means that the response time the latency is constrained by the loop complexity. So essentially you process things at the speed of the loop. If you wanted to process things at different speeds, the code would be not so good and all the complexity is duty metal inside a single function. It can be the composite hierarchically, but in the end it's a single invocation.

B

Now can we do better and the idea is that we would need a multitasking system. However, this means the scheduler under scheduler normally means overhead, and you don't want overhead, it's the small embedded system so and also it needs to be a real-time scheduler. So it feels not bare metal anymore, but there's this project called RTFM, which would means real time for the masses. I would like to thank her gap.

B

Oratio I, hope I pronounce the name well, I met him in Paris and lustrous fast, and this is a hardware scheduler, so it's a rust library or framework or crate or whatever it's a crate, and it's a hardware schedule that is interact Riven, which means every task actually starts because of an interrupt the physical interrupts on the machine. It runs to completion, but they can overlap, and the nice thing is that it has sub microsecond overhead, because it's hardware level and it has Fearless concurrency, because okay now a complete example.

B

Remember this and bought this this robot with the ultrasound reading the ultrasound takes time. You have to send the pools and wait for the reply. What if you wanted to do something in the middle? Sometimes it takes something like one millisecond and health to wait for this. Echo I wanted to do something else, so the idea would be I should fire an interrupt when I get the reply, but then this means that the interrupt routine will have to mutate, something that maybe I was using.

B

So this can get tricky and ok this this aside with voice and the magic of RTFM, is that it uses the last type system and phantom markers, which is I, mean the values without sides, but with particular types that are inserted in the data structure, so that it can be markand with particular features and then essentially, it will prove at compile time that there are no concurrency problems in the accesses, which means that your interrupts will fire and will modify things, and you will be okay and, in my opinion this is very, very nice magic that should be experimented more as far as I know.

B

Right now, it is only on armed contacts and and aware and Linux, but that doesn't count and I'll explain why- and this brings me to arm cortex-m. This is where the real action is so I showed you toys on difficult platforms, but if you want to do something about that, just go here. Rath support is first-class. It just works right now.

B

You don't even need another linker, so the embedded link ship ad with rust will work for your embedded target and maybe it start with a tool called bobbing, which is a common line to do compilation of projects, but you can even do that without and what, if you wanted to use Linux with your robots with rust? Well then rust support is perfect, I mean it's. The development experience is so easy. It's just you host operating system on the target. The problem is the real-time scheduler, so at that point you will be either used.

B

Priam, 30 and fight with Linux real-time a lot or stick to soft real-time. Another design could be put the hard real-time logic in a small embedded controller programmers with bare metal and if you have something fancy like image, recognition, sort whatever put that on a highlighter arm board like a Raspberry Pi, and when you get data, you feed the commands in real time with a serial line to do the real-time tasks and then probably this is a more sensible design in my opinion.

B

So to sum it up, I say that rust on robots is greed. It even runs on legal bricks right now, which is amazing, and the lag ones performs at least as well as C, and the abstractions help you build better software.

B

That's all thanks a lot.

E

Yeah yeah hold on one at a time, so questions about how rust will kill all humans. Yeah. Thanks for the talk, you didn't love, rich research in how this all works with the compilers and crates and stuff. It's 10 e resource, where you wrote down all this, so others can catch up to it. Ok,.

B

Unfortunately, that's only destroyed because I did the research in a hurry, because my real goal was not just this conference, but the competition in one week.

B

So what I want to do is to publish most of the code that I brought so right now, I work in a let's say: a workspace we'd create all in the same repository. I want to split the crate so that the the generic support platform, support, crates will be published and the robot code well not really because it doesn't make sense and also because the other members of my teams will just not be happy about it. I probably share it, but if anyway, it's just robot specific code.

B

So probably what will happen is that I will do this split and publish the crates like that.

C

Hi great talk were you able to get interrupts to work on a year? We trust.

B

I didn't even try, because the hardware platform that I was using essentially is has been designed for kids, not for so it has the the things on the different on the wrong pins, which means that I could not use this thing for the ultrasound and AVR is very limited. Limited anyway, is that very small CPU. So now.

C

I was thinking if you could, if rust, enables you to use, interrupt service routines.

B

I have seen code that does it. There is one attribute that you need to give to the function so that the function. Actually, you know when you write something excellent, see it's X and something, and then the compiler understands that the ABI is interrupt service routine and then you can actually use it. Okay, thank.

C

E

E

So how does your son feel about rust, concurrency, okay,.

B

So initially he was scared, because I was clear with him upfront I explained him. The issue with memory management and the point that is was not exposed to see like errors, but he had the borrowed checker and initially he was resisting because he said go long is so simple and, in my opinion, he's right by the way. Golang is exceptional as a programming language for the simplicity, but right now, as far as I know, he is at home adapting the code of one robot to another robot in rust.

B

B

There was another question there.

B

E

We have a yeah, we can recover some time for questions.

D

um You said the there was sorry in your second last slide, you're talking about the difficulties with preempt Archie. um Could you elaborate a little bit on that? Okay.

B

So the problem is that Linux is not a real-time operating system, which means that sometimes you enter the kernel and though you have no idea when you will get out of it and as I said, this is not good. Now, over the over time, there has been a patch maintain it over the kernel, which is called the real-time patch that adds real-time features to the kernel, bringing it to almost real-time status.

B

It is not perfect because it's not being designed from the start to do that, but it's almost there I am aware of cases where person. So if you have a raspberry pi, a quad core one I know that people have essentially dedicated one core of the four to a single process. That does nothing else that answering to interrupts from an SPI line, and this, in my opinion, is a very, very interesting concept.

B

So you have a very high level operating system on the other course, you can even run a web server, but on this score is essentially it's real time working on a single serial line. Now, probably on this SPI, you are going to talk to another CPU, which is a real-time one, which does the real thing. But then it's it's sensible, because you can write high-level logic like a webs web interaction server, which is totally soft. Real-Time. You really don't care there, but then you can interface with real things.

B

So that's the route I would take that could.

D

A

Well, thank you very much be done here, give a round of applause, yeah.