Embedded software is mostly written in C. Rust is changing that, slowly but irreversibly.
Most embedded software is C. Most embedded bugs are memory safety bugs that Rust would have prevented. The math has been clear for years; the ecosystem just had to catch up. By 2026 it has.
The case for Rust on MCUs
The same memory safety guarantees that made Rust the language of choice for systems programming on the desktop apply to MCUs. No buffer overflows. No use-after-free. No data races on RTOS-shared state. For safety-critical or security-sensitive embedded products, this is decisive.
The ecosystem in 2026
- embassy: an async runtime for embedded Rust. Targeting STM32, nRF52, RP2040, ESP32. Production-grade.
- RTIC (Real-Time Interrupt-driven Concurrency): the priority-based concurrency framework. Used in real medical and automotive products.
- defmt: log framework that compiles format strings out of the binary. Tiny on-target footprint.
- probe-rs: replaces OpenOCD for flashing and debugging. Genuinely better.
- Crates for ARM Cortex-M peripherals: SVD-generated PACs and HALs for every major vendor.
What works today
STM32 family: production-grade. nRF52 / nRF53: production-grade. RP2040: production-grade. ESP32: improving fast (the Xtensa toolchain is the wart). Cortex-M0 through M85: all supported.
What does not yet
Some safety-certified contexts (automotive ASIL-D, aviation DO-178C) still require certified compilers. The Ferrocene project is working on this, with traction. Until then, certified Rust is bleeding-edge.
The migration pattern
You do not rewrite the firmware. You write new modules in Rust and link against the existing C codebase. The Rust subset interfaces via FFI, the C subset stays where it is. The percentage of Rust grows over time without a "big rewrite" project.
The hiring problem
There are ten thousand competent embedded C engineers for every embedded Rust engineer. This will improve over the next five years; for now, plan for training time. The Rust learning curve in embedded is steeper than in web because the lifetime story interacts with peripheral access in ways the desktop programmer has not seen.
What we ship
For new firmware projects where the team is willing, we default to Rust on Cortex-M. Existing C codebases stay in C. The transition is incremental, and ten years from now most new embedded code will be Rust.