Review comments

diff --git a/examples/ble_scanning.rs b/examples/ble_scanning.rs
index 8396399..bbbe76a 100644
--- a/examples/ble_scanning.rs
+++ b/examples/ble_scanning.rs

@@ -29,7 +29,12 @@
         ble_parser::find(&my_buffer, simple_ble::gap_data::SERVICE_DATA as u8)
             .and_then(|service_data| ble_parser::extract_for_service([91, 79], service_data))
             .and_then(|payload| corepack::from_bytes::<LedCommand>(&payload).ok())
-            .and_then(|msg| leds_driver.get(msg.nr as usize).map(|led| led.set(msg.st)));
+            .and_then(|msg| {
+                leds_driver
+                    .get(msg.nr as usize)
+                    .map(|led| led.set(msg.st))
+                    .into()
+            });
     });
 
     let _subscription = drivers.ble_scanning.start(&mut callback)?;

diff --git a/examples/blink_random.rs b/examples/blink_random.rs
index 60bac18..93a263d 100644
--- a/examples/blink_random.rs
+++ b/examples/blink_random.rs

@@ -31,7 +31,7 @@
 // Takes the 4 least-significant bits of x, and turn the 4 leds on/off accordingly.
 fn blink_nibble(leds_driver: &LedsDriver, x: u8) -> TockResult<()> {
     for i in 0..4 {
-        let led = leds_driver.get(i).unwrap();
+        let led = leds_driver.get(i)?;
         if (x >> i) & 1 != 0 {
             led.on()?;
         } else {

diff --git a/examples/button_leds.rs b/examples/button_leds.rs
index 794251d..4a48f2f 100644
--- a/examples/button_leds.rs
+++ b/examples/button_leds.rs

@@ -12,7 +12,7 @@
     let leds_driver = drivers.leds.init_driver()?;
 
     let mut callback = |button_num, state| {
-        if let (ButtonState::Pressed, Some(led)) = (state, leds_driver.get(button_num)) {
+        if let (ButtonState::Pressed, Ok(led)) = (state, leds_driver.get(button_num)) {
             led.toggle().ok().unwrap();
         }
     };

diff --git a/src/buttons.rs b/src/buttons.rs
index 5787f83..aac5cb2 100644
--- a/src/buttons.rs
+++ b/src/buttons.rs

@@ -1,6 +1,7 @@
 use crate::callback::CallbackSubscription;
 use crate::callback::Consumer;
 use crate::result::OtherError;
+use crate::result::OutOfRangeError;
 use crate::result::TockResult;
 use crate::syscalls;
 use core::marker::PhantomData;
@@ -41,14 +42,15 @@
         self.num_buttons
     }
 
-    pub fn get(&self, button_num: usize) -> Option<Button> {
+    /// Returns the button at 0-based index `button_num`
+    pub fn get(&self, button_num: usize) -> Result<Button, OutOfRangeError> {
         if button_num < self.num_buttons {
-            Some(Button {
+            Ok(Button {
                 button_num,
                 lifetime: PhantomData,
             })
         } else {
-            None
+            Err(OutOfRangeError)
         }
     }
 

diff --git a/src/callback.rs b/src/callback.rs
index 95d4e04..053806f 100644
--- a/src/callback.rs
+++ b/src/callback.rs

@@ -46,7 +46,7 @@
 }
 
 impl<'a> CallbackSubscription<'a> {
-    pub fn new(driver_number: usize, subscribe_number: usize) -> CallbackSubscription<'a> {
+    pub(crate) fn new(driver_number: usize, subscribe_number: usize) -> CallbackSubscription<'a> {
         CallbackSubscription {
             driver_number,
             subscribe_number,

diff --git a/src/leds.rs b/src/leds.rs
index 8fd9ce6..e0f420c 100644
--- a/src/leds.rs
+++ b/src/leds.rs

@@ -1,3 +1,4 @@
+use crate::result::OutOfRangeError;
 use crate::result::TockResult;
 use crate::syscalls::command;
 use core::marker::PhantomData;
@@ -42,14 +43,15 @@
         }
     }
 
-    pub fn get(&self, led_num: usize) -> Option<Led> {
+    /// Returns the led at 0-based index `led_num`
+    pub fn get(&self, led_num: usize) -> Result<Led, OutOfRangeError> {
         if led_num < self.num_leds {
-            Some(Led {
+            Ok(Led {
                 led_num,
                 lifetime: PhantomData,
             })
         } else {
-            None
+            Err(OutOfRangeError)
         }
     }
 }

diff --git a/src/result.rs b/src/result.rs
index 925dcdc..9dc4f16 100644
--- a/src/result.rs
+++ b/src/result.rs

@@ -72,6 +72,7 @@
     TimerDriverDurationOutOfRange,
     TimerDriverErroneousClockFrequency,
     DriverAlreadyTaken,
+    OutOfRangeError,
 }
 
 impl From<OtherError> for TockError {
@@ -80,6 +81,14 @@
     }
 }
 
+pub struct OutOfRangeError;
+
+impl From<OutOfRangeError> for TockError {
+    fn from(_other: OutOfRangeError) -> Self {
+        TockError::Other(OtherError::OutOfRangeError)
+    }
+}
+
 pub const SUCCESS: isize = 0;
 pub const FAIL: isize = -1;
 pub const EBUSY: isize = -2;