, ,

Sonair ADAR One: First Safety-Certified Product Written in Rust Ships on Robots

Jessica Nicole
Sonair ADAR One: First Safety-Certified Product Written in Rust Ships on Robots

On September 1, 2026, Oslo-based Sonair published how it certified ADAR One—what the company calls the first safety-certified embedded product written in Rust. This is not a lab demo: the complete system is type-approved by exida against IEC 61496, IEC 61508, and ISO 13849, and the sensor is already in series production on industrial robots.

ADAR is acoustic detection and ranging. The unit sends an omnidirectional ultrasound pulse, listens on multiple transducers, and builds a 3D point cloud. When anything enters a defined protective zone, the sensor tells the robot or machine to slow or stop—classic machine-safety behavior, now running safety functions that are 100% Rust.

Collaborative robot palletizer on a factory floor—the class of industrial cell where certified ultrasonic safety sensing is shipping. Photo: Wikimedia Commons.
Palletizing and robot cells are exactly where a certified 3D ultrasonic safety sensor has to earn trust. Photo: Wikimedia Commons (rights-safe).

Safety firmware runs on a Texas Instruments Sitara AM62x: quad Cortex-A53 plus an isolated M4, both in Rust, built with Ferrocene (Ferrocene 25.11.0 assessed by TÜV SÜD for IEC 61508 SIL2; a certified libcore subset is feature-flagged; core::fmt landed in Ferrocene 26.05.0). Non-safe work such as Ethernet stays on the R5 under FreeRTOS in C—Sonair simply ran out of calendar to port that side.

TI had almost no Rust tooling when they started, so the team generated a ~30 MB peripheral access crate via tixml2svd/svd2rust and went bare metal rather than RTIC or async to keep certification risk down. More than 90 robotics companies evaluated the beta; beRobox has agreed to deploy the certified sensor. For floor teams, that is a MES-adjacent safety input and a QMS-grade evidence trail—not a language fashion statement.

Close-up of a printed circuit board—the embedded surface where safety-certified Rust firmware has to run. Photo: Wikimedia Commons.
Bare-metal Rust on a Sitara with a home-grown PAC is the unglamorous path that made SIL2-class firmware shippable. Photo: Wikimedia Commons (rights-safe).

Separately, Peeriot showed a Myrmic developer preview at RustConf 2026 (September 10)—useful for IoT/edge Rust, but a different maturity class than an exida type-approved safety product. The Sonair journal is the bar: certified toolchain, certified subset of libcore, and a shipping sensor on real cells.

For N23D, one native Rust binary and a local-first industrial stack only matter if that Rust can survive the same rigor the floor already demands of safety PLCs and light curtains. Certification-grade Rust on robots is the standard we are writing toward—not toy demos.

Sources/References