PAI-140 · Education

Rust for Physical AI

A language, not a syntax tour. You learn Rust by writing the firmware that drives a 3D rover: every lesson compiles real no_std Rust to WebAssembly and runs it as the live control loop. When the borrow checker rejects a bug, you watch it reject the bug before the robot could ever make it. Ownership and memory safety without a garbage collector, the type system as a modelling tool, zero-cost abstraction, and the one-binary seam from browser sim to bare metal, the substrate (Ferric) that makes the boundary the robot's own, on-device, no cloud: the reasons Physical AI is being written in Rust.

Intermediate → Skilled·5 modules·8 lessons
▶ Start the course ← All courses
THE HORIZON

Where this sits, and what moves it.

Binding constraint · The cost of a guarantee at runtime. A garbage collector buys memory safety with a pause you cannot schedule around; ownership buys the same safety at compile time and charges nothing at run time.

Was impossible

Writing a control loop meant choosing between safety and determinism. C gave you the timing and none of the guarantees; a managed language gave you the guarantees and a collector that could stop the loop at the worst possible moment.

Is probable

Rust removes that trade, and this course makes the removal visible by having the borrow checker reject a bug before a robot could act on it. What is not removed is the human cost: the model has to be learned, and a field that has written embedded C for forty years does not re-tool quickly.

Becomes possible

The direction to watch is one binary spanning simulation and the device with nothing conditional in between -- which this course already does, browser to microcontroller. What would make it decisive is the same source carrying a machine-checkable timing proof, so 'correct' and 'correct on time' stop being separate claims.

Every hard thing was impossible until the constraint that made it impossible was named. How we read a frontier →

Module 1

Ownership: Safety Without a Garbage Collector

Learn ownership, moves, and borrowing as the mechanism that makes a control loop memory-safe at zero runtime cost, and watch the compiler reject an unsafe program before it can run on hardware.

  1. L4Ownership: the Compiler Catches It FirstTwo variables try to own the same heap value in Rust. When is that error caught?Understand ownership and moves by reading a real borrow-checker error and fixing it, so firmware that misuses a peripheral fails to build instead of misbehaving on the robot.→
  2. L4Borrowing: Share Without Giving AwayYou pass the peripherals into a helper function and the build fails with 'expected Peripherals, found &mut Peripherals'. What did the compiler catch?Use shared and mutable references to pass the peripherals into helper functions without moving them, the everyday tool for structuring firmware into readable pieces.→
Module 2

Types That Model the Machine

Use Option and enums with exhaustive matching to make illegal robot states unrepresentable, turning 'what if the sensor has no reading?' and 'what if a state is unhandled?' into questions the compiler answers.

  1. L4Option: No Null, No Silent BugA range finder returns -1.0 to mean ‘path clear.’ If you treat that reading as a plain number in your control law, what goes wrong?Model a sensor's 'no reading' sentinel as Option<f32> and handle it with match, so a missing measurement can never be used as if it were a real distance.→
  2. L4Enums: States You Cannot Get WrongYou model a robot's mode as an enum {Idle, Moving, Fault} and forget to handle Fault in a match. What happens?Model the controller as an enum state machine and let exhaustive matching force every state to be handled, so an unhandled mode is a build error rather than undefined behaviour on the robot.→
Module 3

Abstraction at Zero Cost

Build a reusable controller with a struct, a trait, and a generic function, and understand why Rust's abstractions compile down to the same tight code as hand-written math, the property that lets one policy run on a microcontroller.

  1. L4Traits: Reusable Control, Zero CostYou write drive() generically so it runs ANY Controller (Pursuit now, others later). In Rust, what does that abstraction cost at runtime?Define a Controller trait, implement it on a Pursuit struct, and call it through a generic function, seeing that the abstraction adds no runtime overhead on the metal.→
Module 4

One Binary, Sim to Edge

Understand why the same Rust source compiles unchanged to both this browser (WebAssembly) and a real microcontroller, and where the real boundary between portable logic and hardware sits.

  1. L4One Source, Two TargetsThe same control function compiles to WebAssembly for the browser and to firmware for the board. What sits at that seam?Write the portable control core and understand the seam: the same control() that compiles to WebAssembly here also cross-compiles to a Cortex-M or RISC-V target, with only the HAL changing.→
Module 5

Fast and Deterministic

Make the loop not just correct but correct on time: no garbage collector means a bounded, repeatable control period. Then compose the whole course into one portable, deterministic firmware.

  1. L4Correct, and On TimeTwo control loops run identical math, one in a garbage-collected language, one in Rust (no GC). Which holds a rock-steady loop time?Build an eased proportional loop and understand why no garbage collector means a constant-time tick, the property behind reproducible control that the Institute's determinism work depends on.→
  2. L4Capstone: The Portable, Deterministic ControllerYour firmware composes a Controller trait, a Phase state machine and a non-blocking loop. The rover sits still. Where do you look?Compose the whole course into one firmware, a Controller trait, a Phase state machine, and a non-blocking heartbeat, and land the rover inside a tight 0.12 m pad with the status LED beating, all in no_std Rust.→
See it live

Anatomy demonstrations

The machines behind this course, taken apart three ways, the body, the one rule, and the small learned brain. Guess before you look; an open core proves every number on the page.

DemonstrationAnatomy of DrivingNonholonomic control, live →The whole series →
Foundations

From the interactive textbook

The ideas under this course as live explorables, each runs the real Rust library and re-derives its own result.

Ch. 3 · SafetyThe command it will not obeyOpen the chapter ↗The full textbook →