Heterogeneous multiprocessor systems on a chips (MPSoCs) consisting of cores with different performance/power characteristics are widely used in many real-time embedded systems, where both soft-error reliability and lifetime reliability are key concerns. Although existing efforts have investigated related problems, they either focus on one of the two reliability concerns or propose time-consuming scheduling algorithms that cannot adequately address runtime workload and environmental variations. This paper introduces an online framework which is adaptive to runtime variations and maximizes soft-error reliability while satisfying the lifetime reliability constraint for soft real-time systems executing on MPSoCs that are composed of high-performance cores and low-power (LP) cores. Based on each core's executing frequency and utilization, the framework performs workload migration between high-performance cores and LP cores to reduce power consumption and improve soft-error reliability. Experimental results based on different hardware platforms show that the proposed approach reduces the probability of failures due to soft errors by at least 17% and 50% on average compared to a number of representative existing approaches that satisfy the same lifetime reliability constraints.

Multiprocessor systems on a chip consisting of integrated CPUs and GPUs are suitable platforms for real-time embedded applications requiring massively parallel processing. For such applications, lifetime reliability due to permanent faults and soft-error reliability due to transient faults are major concerns. Detailed execution profiling has revealed that a CUDA task's CPU execution time significantly increases if the task executes on a different core than the operating system (OS). Based on this observation, an extended task model is introduced to consider the execution time dependencies among tasks and the OS. A hybrid framework is proposed to improve soft-error reliability while satisfying a lifetime reliability constraint for soft real-time systems executing on integrated CPU and GPU platforms. This framework: 1) reduces the total utilization of cores and improves soft-error reliability via off-line task mapping; 2) achieves a higher lifetime reliability through task migration at run time; and 3) improves soft-error reliability by dynamically scaling frequencies of CPU and GPU cores. The experimental results show that the proposed framework leads to a system that can execute without soft errors for at least 4 days (4 times) and 6 days (6 times) longer, on average, than existing approaches.

GPUs are increasingly being used in real-time systems, such as autonomous vehicles, due to the vast performance benefits that they offer. As more and more applications use GPUs, more than one application may need to run on the same GPU in parallel. However, real-time systems also require predictable performance from each individual applications which GPUs do not fully support in a multi-tasking environment. Nvidia recently added a new feature in their latest GPU architecture that allows limited resource provisioning. This feature is provided in the form of a closed-source kernel module called the Multi-Process Service (MPS). However, MPS only provides the capability to partition the compute resources of GPU and does not provide any mechanism to avoid inter-application conflicts within the shared memory hierarchy. In our experiments, we find that compute resource partitioning alone is not sufficient for performance isolation. In the worst case, due to interference from co-running GPU tasks, read/write transactions can observe a slowdown of more than 10x. In this paper, we present Fractional GPUs (FGPUs), a software-only mechanism to partition both compute and memory resources of a GPU to allow parallel execution of GPU workloads with performance isolation. As many details of GPU memory hierarchy are not publicly available, we first reverse-engineer the information through various micro-benchmarks. We find that the GPU memory hierarchy is different from that of the CPU, making it well-suited for page coloring. Based on our findings, we were able to partition both the L2 cache and DRAM for multiple Nvidia GPUs. Furthermore, we show that a better strategy exists for partitioning compute resources than the one used by MPS. An FGPU combines both this strategy and memory coloring to provide superior isolation. We compare our FGPU implementation with Nvidia MPS. Compared to MPS, FGPU reduces the average variation in application runtime, in a multi-tenancy environment, from 135% to 9%. To allow multiple applications to use FGPUs seamlessly, we ported Caffe, a popular framework used for machine learning, to use our FGPU API.

Vision-based perception systems are crucial for profitable autonomous-driving vehicle products. High accuracy in such perception systems is being enabled by rapidly evolving convolution neural networks (CNNs). To achieve a better understanding of its surrounding environment, a vehicle must be provided with full coverage via multiple cameras. However, when processing multiple video streams, existing CNN frameworks often fail to provide enough inference performance, particularly on embedded hardware constrained by size, weight, and power limits. This paper presents the results of an industrial case study that was conducted to re-think the design of CNN software to better utilize available hardware resources. In this study, techniques such as parallelism, pipelining, and the merging of per-camera images into a single composite image were considered in the context of a Drive PX2 embedded hardware platform. The study identifies a combination of techniques that can be applied to increase throughput (number of simultaneous camera streams) without significantly increasing per-frame latency (camera to CNN output) or reducing per-stream accuracy.

OpenVX is a recently ratified standard that was expressly proposed to facilitate the design of computer-vision (CV) applications used in real-time embedded systems. Despite its real-time focus, OpenVX presents several challenges when validating real-time constraints. Many of these challenges are rooted in the fact that OpenVX only implicitly defines any notion of a schedulable entity. Under OpenVX, CV applications are specified in the form of processing graphs that are inherently considered to execute monolithically end-to-end. This monolithic execution hinders parallelism and can lead to significant processing-capacity loss. Prior work partially addressed this problem by treating graph nodes as schedulable entities, but under OpenVX, these nodes represent rather coarse-grained CV functions, so the available parallelism that can be obtained in this way is quite limited. In this paper, a much more fine-grained approach for scheduling OpenVX graphs is proposed. This approach was designed to enable additional parallelism and to eliminate schedulability-related processing-capacity loss that arises when programs execute on both CPUs and graphics processing units (GPUs). Response-time analysis for this new approach is presented and its efficacy is evaluated via a case study involving an actual CV application.

With an increasing demand for complex and powerful system-on-chips, modern real-time automotive systems face significant challenges in managing on-chip-temperature. We demonstrate, via real experiments, the importance of accounting for dynamic ambient temperature and task-level power dissipation in resource management so as to meet both thermal and timing constraints. To address this problem, we propose RT-TRM, a real-time thermal-aware resource management framework. We first introduce a task-level dynamic power model that can capture different power dissipations with a simple task-level parameter called the activity factor. We then develop two new mechanisms, adaptive parameter assignment and online idle-time scheduling. The former adjusts voltage/frequency levels and task periods according to the varying ambient temperature while preserving feasibility. The latter generates a schedule by allocating idle times efficiently without missing any task/job deadline. By tightly integrating the solutions of these two mechanisms, we can guarantee both thermal and timing constraints in the presence of dynamic ambient temperature variations. We have implemented RT-TRM on an automotive microcontroller to demonstrate its effectiveness, achieving better resource utilization by 18.2% over other runtime approaches while meeting both thermal and timing constraints.

Heterogeneous MPSoCs consisting of cores with different performance/power behaviors are widely used in many power-constrained real-time systems. Both soft-error reliability and lifetime reliability are key concerns in such systems. Although existing work have investigated related problems, they either focus on one of the two reliability concerns or propose complicated scheduling algorithms that cannot adequately address run-time workload and environment variations. This paper introduces an on-line heuristic to maximize soft-error reliability while satisfying a lifetime reliability constraint for soft real-time systems executed on MPSoCs composed of high-performance cores and low-power cores. Based on the run-time cores' frequencies and utilizations, the heuristic performs workload migration between the high-performance cores and low-power cores to achieve improved soft-error reliability. Experimental results from both a hardware platform and a simulator show that the proposed algorithm reduces the probability of faults by at least 30% compared to a number of representative existing approaches while satisfying the same lifetime reliability constraints.

Autonomous vehicles are an exemplar for forward-looking safety-critical real-time systems where significant computing capacity must be provided within strict size, weight, and power (SWaP) limits. A promising way forward in meeting these needs is to leverage multicore platforms augmented with graphics processing units (GPUs) as accelerators. Such an approach is being strongly advocated by NVIDIA, whose Jetson TX1 board is currently a leading multicore+GPU solution marketed for autonomous systems. Unfortunately, no study has ever been published that expressly evaluates the effectiveness of the TX1, or any other comparable platform, in hosting safety-critical real-time workloads. In this paper, such a study is presented. Specifically, the TX1 is evaluated via benchmarking efforts, blackbox evaluations of GPU behavior, and case-study evaluations involving computer-vision workloads inspired by autonomousdriving use cases. Autonomous vehicles are an exemplar for forward-looking safety-critical real-time systems where significant computing capacity must be provided within strict size, weight, and power (SWaP) limits. A promising way forward in meeting these needs is to leverage multicore platforms augmented with graphics processing units (GPUs) as accelerators. Such an approach is being strongly advocated by NVIDIA, whose Jetson TX1 board is currently a leading multicore+GPU solution marketed for autonomous systems. Unfortunately, no study has ever been published that expressly evaluates the effectiveness of the TX1, or any other comparable platform, in hosting safety-critical real-time workloads. In this paper, such a study is presented. Specifically, the TX1 is evaluated via benchmarking efforts, blackbox evaluations of GPU behavior, and case-study evaluations involving computer-vision workloads inspired by autonomous-driving use cases.

We propose a server-based approach to manage a general-purpose graphics processing unit (GPU) in a predictable and efficient manner. Our proposed approach introduces a GPU server task that is dedicated to handling GPU requests from other tasks on their behalf. The GPU server ensures bounded time to access the GPU, and allows other tasks to suspend during their GPU computation to save CPU cycles. By doing so, we address the two major limitations of the existing real-time synchronization-based GPU management approach: busy waiting and long priority inversion. We implemented a prototype of the server-based approach on a real embedded platform. This case study demonstrates the practicality and effectiveness of the server-based approach. Experimental results indicate that the server-based approach yields significant improvements in task schedulability over the existing synchronization-based approach in most practical settings. Although we focus on a GPU in this paper, the server-based approach can also be used for other types of computational accelerators.

The increasing performance of modern processors makes virtualization a viable solution for consolidating real-time systems into a single hardware platform. Although real-time task scheduling in a virtual machine can benefit from hierarchical scheduling, unbounded interrupt handling time and vulnerability to interrupt storms make practitioners hesitant to virtualize interrupt-driven real-time applications. In this paper, we propose vINT, an interrupt handling scheme designed for real-time system virtualization. vINT provides a pseudo-VCPU abstraction dedicated for interrupt handling, which overcomes the limits imposed by the timing parameters of virtual CPUs in an analyzable way. vINT also accounts for and enforces interrupt handling and resulting execution flows within a guest virtual machine. vINT does not require any change to the guest OS code, so it can be used for virtualizing proprietary, closed-source OSs. We analyze interrupt handling time as well as VCPU and task schedulability, with and without vINT. Our experimental results indicate that vINT achieves timely interrupt handling while providing as good task schedulability as when it is not used. Our case study based on a prototype implementation on the KVM hyper visor shows that vINT yields significant benefits in reducing interrupt handling time and in protecting real-time tasks against interrupt storms permeating into the virtual machine.

Motivated by the increasing trend in embedded systems towards platform integration, there has been an increasing research interest in scheduling mixed-criticality systems. However, most existing efforts have concentrated on scheduling sequential tasks and ignored intra-task parallelism. In this paper, we study the scheduling of mixed-criticality parallel jobs on multiprocessor platforms. We propose a synchronous mixed-criticality job model, where each job consists of segments, each segment having an arbitrary number of parallel threads that synchronize at the end of the segment. A novel MinLoad algorithm is developed to decompose mixed-criticality parallel jobs into mixed-criticality sequential jobs. This decomposition enables us to leverage existing mixed-criticality scheduling algorithms and schedulability analysis to the multiprocessor scheduling of mixed-criticality parallel jobs. In addition, our MinLoad job decomposition algorithm is designed to make the decomposed mixed-criticality sequential tasks easier to schedule, and thus requires smaller-sized multiprocessor platforms for the mixed-criticality systems.

The virtualization of real-time systems has received much attention for its many benefits, such as the consolidation of individually developed real-time applications while maintaining their implementations. However, the current state of the art still lacks properties required for resource sharing among real-time application tasks in a multi-core virtualization environment. In this paper, we propose vMPCP, a synchronization framework for the virtualization of multi-core real-time systems. Vmpcp exposes the executions of critical sections of tasks in a guest virtual machine to the hyper visor. Using this approach, vMPCP reduces and bounds blocking time on accessing resources shared within and across virtual CPUs (VCPUs) assigned on different physical CPU cores. Vmpcp supports periodic server and deferrable server policies for the VCPU budget replenish policy, with an optional budget overrun to reduce blocking times. We provide the VCPU and task schedulability analyses under vMPCP, with different VCPU budget supply policies, with and without overrun. Experimental results indicate that, under vMPCP, deferrable server outperforms periodic server when overrun is used, with as much as 80% more task sets being schedulable. The case study using our hyper visor implementation shows that vMPCP yields significant benefits compared to a virtualization-unaware multi-core synchronization protocol, with 29% shorter response time on average.

Multi-core System-on-Chip (SoC) has become a popular execution platform for many embedded real-time systems that require high performance and low power-consumption. High temperature is known to accelerate the failure of deep submicron chips. To prevent such accelerated failures due to chip overheating, various thermal-aware scheduling (TAS) algorithms and dynamic thermal management (DTM) have been proposed and applied to mission/safety-critical applications. To control on-chip temperature more effectively, it is necessary to predict the thermal dynamics of a multi-core chip in real time and trigger appropriate power/temperature management before overheating the chip. However, due to dynamically-changing runtime environments, it is very difficult to estimate the chip temperature on-the-fly. In this paper, we propose models of efficiently estimating multi-core chip temperature while accounting for the system dynamics in real time. Based on these models, we design a proactive peak temperature manager (PTM) which periodically estimates future core temperature and triggers proper DTMs on the estimated-to-be-overheated cores for their cooling without violating applications timing constraints. Our in-depth evaluation based on the HotSpot thermal simulator has shown that the proposed method can predict the occurrence of peak temperature in a core with 90-98% accuracy, and using the estimated thermal model of a multi-core chip, PTM can effectively keep core temperature below a given threshold without violating any timing constraint.

In this paper, we present a feature-oriented requirements modelling language (FORML) for modelling the behavioural requirements of a software product line. FORML aims to support feature modularity and precise requirements modelling, and to ease the task of adding new features to a set of existing requirements. In particular, FORML decomposes a product line's requirements into feature modules, and provides language support for specifying tightly-coupled features as model fragments that extend and override existing feature modules. We discuss how decisions in the design of FORML affect the evolvability of requirements models, and explicate the specification of intended interactions among related features. We applied FORML to the specification of two feature sets, automotive and telephony, and we discuss how well the case studies exercised the language and how the requirements models evolved over the course of the case studies.

System integration is the elephant in the china store of large-scale cyber-physical system (CPS) design. It would be hard to find any other technology that is more undervalued scientifically and at the same time has bigger impact on the presence and future of engineered systems. The unique challenges in CPS integration emerge from the heterogeneity of components and interactions. This heterogeneity drives the need for modeling and analyzing cross-domain interactions among physical and computational/networking domains and demands deep understanding of the effects of heterogeneous abstraction layers in the design flow. To address the challenges of CPS integration, significant progress needs to be made toward a new science and technology foundation that is model based, precise, and predictable. This paper presents a theory of composition for heterogeneous systems focusing on stability. Specifically, the paper presents a passivity-based design approach that decouples stability from timing uncertainties caused by networking and computation. In addition, the paper describes cross-domain abstractions that provide effective solution for model-based fully automated software synthesis and high-fidelity performance analysis. The design objectives demonstrated using the techniques presented in the paper are group coordination for networked unmanned air vehicles (UAVs) and high-confidence embedded control software design for a quadrotor UAV. Open problems in the area are also discussed, including the extension of the theory of compositional design to guarantee properties beyond stability, such as safety and performance.

As robotic software systems become larger and more complex, it is increasingly important to reuse existing software components to control development costs. For a broad class of relatively simple components, ranging from sensor and actuation interfaces to many simple perception and navigation algorithms, this can be a reasonably straightforward process, and many excellent frameworks have been developed in recent years that support reuse of such components in novel systems. However, there is also a class of more advanced software components, such as for modeling and interacting with complex environments, for which reuse can be a much more challenging problem. In particular, many advanced robotic algorithms can be highly sensitive to the perception and actuation capabilities of the specific robots they are deployed on, in turn requiring significant and invasive modifications to accommodate the specific capabilities of a different robotic system. This work examines the nature of this sensitivity and proposes a novel design methodology for isolating a stable, reusable "core" algorithm from any platform-specific enhancements, or "supplemental" effects. Modern software engineering techniques are used to encapsulate these supplemental effects separately from the core algorithm, allowing platform-specific details to be accommodated by modular substitution instead of direct modification of the "core" component. This methodology is experimentally evaluated on existing software for autonomous driving behaviors, yielding useful insights into the creation of highly adaptable robotic software components.

Multi-core System-on-Chip (SoC) has become a popular execution platform for many embedded real-time systems. As CMOS transistors continue to shrink down to the nanoscale regime, it becomes more susceptible to various reliability threats mainly due to thermal hotspots. To improve the reliability of embedded real-time systems, dynamic thermal management (DTM) is required for mission/safety- critical applications running on a multi-core chip to avoid possible thermal hazards while meeting the applications' timing constraints. In this paper, we propose an efficient runtime thermal- aware scheduler (TAS) using job-migration and power-gating techniques to avoid the thermal hotspots on a multi-core chip. Before runtime, the TAS distributes the periodic real-time tasks to cores using the tasks' execution profiles to balance the utilization of functional units on the chip. At runtime, the TAS periodically monitors the core temperatures and triggers one of the following pre-defined thermal management schemes depending on the level of the measured core temperature: (i) migrating jobs running on hot cores to other cooler cores to reduce the workloads on the hot cores, or (ii) turning off hot cores for a certain period of time to cool them down. All tasks' timing constraints are guaranteed during the job migrations and powering cores on/off. Our in-depth evaluation has shown that the proposed TAS can effectively minimize the thermal hotspots on a multi-core chip without violating any application timing constraint.

Model-based methodologies have been widely used to handle the increasing demand for rapid development of high-quality, real-time embedded control software. A key challenge in such model-based design is integration of various “collaborative” analysis methods to support the automation of the design process. Traditional analysis methods developed for analyzing specific system properties, however, are not designed for such integration, and thus cannot ensure that the information for the analysis will be provided at the design stage where the information is needed. Moreover, many traditional analysis methods depend heavily on complete and accurate design models which can only be applied to post-design verification and are unavailable for automation of the design process involving an early design stage, where implementation details are unknown. This challenge can be met by integrating analysis methods with the design process. We have developed such a framework combined with software modeling, execution platform configuration, and run-time monitoring mechanisms to enable accurate assessment of embedded software quality at early design stages. We have implemented and demonstrated the framework with a toolkit, called AIRES, that integrates software models, a virtual execution platform, and timing and schedulability analysis methods.

Allocating software components and messages to computing devices and their interconnecting networks is a great challenge in vehicle control system development. The allocation decisions are usually made at an early development stage without the implementation details of the computing platform. To produce low-cost products with correct vehicle control, the software allocation must facilitate the final system scheduling with better resource utilization and the presence of platform implementation uncertainties. In this paper, we present an allocation method to improve the resource utilization and scheduling while keeping the decisions independent of delayed platform implementation. Our method determines the allocation using a genetic algorithm with an optimization function combining the peak usage request and the usage request density to minimize the potential contentions on shared resources. The preliminary evaluation using the representative synthetic systems has shown the effectiveness and applicability of the method.

A distributed real-time control system is modeled by au- tomatically generating a virtual execution platform and in- tegrating it with an abstract run-time model. This allows us to capture the dynamic effects of non-deterministic behavior of the underlying hardware and real-time operating system (RTOS), which cannot be accurately evaluated by existing static approaches. Our framework has been implemented and integrated with the existing AIRES toolkit. The con- struction of a virtual execution platform for a control appli- cation is observed to take 422ms. The integrated platform and control application consists of 56 software components connected by 1280 links for data exchanges and precedence relations, and the constructed platform executes the appli- cation at a normalized speed--defined as the ratio of simu- lation time to real time -- 10.6. Our preliminary evaluation has demonstrated the virtual execution platform's capabil- ity of providing accurate run-time information at a reason- able time-cost.

Constructing runtime tasks, or operating system-level processes/threads, from the components of software design models is crucial to the model-based development of embedded control software. A better method should explore more design choices and reduce the overheads of the runtime system to meet the timing and resource constraints of embedded control software. This paper presents a novel, two-step method for systematic and automatic construction of runtime tasks from software design models. It uses graph transformation to construct a task set meeting system-level end-to-end (e2e) timing constraints. Its first step decomposes the system-level e2e timing constraints into the components' timing constraints, which form a necessary condition for any valid and feasible schedule. The second step iteratively merges the components into tasks and sequences their executions. A thus-constructed task set is proven to meet both intercomponent precedence and system-level e2e timing constraints and to minimize runtime overheads by minimizing the total number of resultant tasks. Our evaluation results based on randomly generated software models have shown that the proposed method outperforms commonly used methods and is also scalable.

In a large embedded real-time system, priority assignment can greatly affect the timing behavior - which can consequently affect the overall behavior - of the system. Thus, it is crucial for model-based design of a large embedded real-time system to be able to intelligently assign priorities such that tasks can meet their deadlines. In this paper, we propose a priority-refinement method for dependent tasks distributed throughout a heterogeneous multiprocessor environment. In this method, we refine an initial priority assignment iteratively using the simulated annealing technique with tasks' latest completion times (LCT). Our evaluations, based on randomly-generated models, have shown that the refinement method outperforms other priority-assignment schemes and scales well for large, complex, real-time systems. This method has been implemented in the Automatic Integration of Reusable Embedded Software (AIRES) toolkit and has been successfully applied to a vehicle system control application.

Allocating software components while meeting multiple platform resource constraints is crucial for model-based design of large embedded real-time software and automatic design model transformation. In this paper, we propose a new method for component allocation using an informed branch-and-bound and forward checking mechanism subject to a combination of resource constraints. We have implemented this method in the automatic integration of reusable embedded software (AIRES) toolkit - which has been developed under the DARPA MoBIES Program - and applied it to an automotive electronic throttle control (ETC) system. Our evaluation based on randomly-generated design models has shown that the proposed method scales well for large and complex embedded real-time software.

The model-based methodology has proven to be effective for fast and low-cost development of embedded software. In the model-based development process, transforming a software structural model that describes the underlying application, to an implementable runtime model is a critical issue. Since the designed software will finally run on the target platform, non-functional issues like schedulability timing constraints and resource requirements have to be considered during the transformation. In this paper we propose a generic runtime model architecture that can best satisfy the non-functional requirements of the system, and a generic transformation method to convert a structural model to a runtime model in such an architecture. The transformation approach is based on the notion of end-to-end computations performed by the system in response to external stimuli. We demonstrate the advantages and effectiveness of the proposed method by constructing a software runtime model for a combined electronic throttle and air-fuel ratio control system.

We present an end-to-end tool-chain for model-based design and analysis of component-based embedded real-time software, with avionics mission computing as an application domain. The tool-chain covers the entire system development lifecycle including modeling, analysis, code generation, and run-time instrumentation. Emphasis is placed on integration of tools developed by multiple institutions via standardized interface format definitions in XML. By capturing all relevant information explicitly in models at the design level, and performing analysis that provides insight into non-functional aspects of the system, we can raise the level of abstraction for the designer, and facilitate rapid system prototyping.

We propose a software architecture based on a combination of object-oriented models and executable formal specifications. In this architecture, the machine control software is viewed as an integration of a set of reusable software components, each modeled with a set of event-based external interfaces for functional definitions, a control logic driver for execution of behavioral specifications, and a set of service protocols for platform adaptation. The behaviors of the entire software can be viewed as an integration of behaviors of components and their integration. Separation of structural specification from behavioral specification enables the controller software structure to be reconfigured independently of application, and software behavior to be reconfigured independently of controller software structure. When the system needs reconfiguration due to changes in either application requirements or the execution platform, the software with our architecture can then be reconfigured by changing reusable components and their interactions in structure for functional capability, and by changing the Control Plan program for behavior. Both types of reconfiguration can be done at the executable code level after the software is implemented. The proposed architecture also supports reconfigurability to facilitate heterogeneous implementations and vendor-neutral products.

Software is essential in today's machine controllers for reuse, reconfiguration and cost-reduction. Formal models and specifications for such a system are critical to guarantee correctness. In this paper, we present an approach to model manufacturing control systems based on a framework for subsystem composition and a nested finite state machine model for the system behavior. The paper presents the application of model-based methodology for real control systems. Some preliminary results obtained show that development costs were reduced significantly due to the domain-specific knowledge captured in such a model.

We present an architecture that supports reconfigurable software construction. In this architecture, the controller software consists of a set of well-defined components and a set of behavior specifications. Each component is modeled with event-based external interfaces, a control logic driver and service protocols. Behaviors of components and their integration are modeled as finite state machines and nested finite state machines. The behaviors of software can be specified in Control Plan programs and executed by control logic drivers at run-time. Such software supports executable code-level reconfiguration as well as remote behavioral reconfiguration. Reconfiguration with heterogeneous implementations and vendor-neutral products is also supported. Our evaluation of the motion control software for a milling machine controller demonstrated that the software constructed with this architecture has high reconfigurability and low development and maintenance costs.

The state-of-art approaches to embedded real-time software development are very costly. The high development cost can be reduced significantly by using model-based integration of reusable components (models and/or software modules). To this end, we propose an architecture that supports integration of software components and their behaviors, and reconfiguration of component behavior at executable-code-level. In this architecture, components are designed and used as building blocks for integration, each of which is modeled with event-based external interfaces, a control logic driver, and service protocols. The behavior of each component is specified as a Finite State Machine (FSM), and the integrated behavior is modeled as a Nested Finite State Machine (NFSM). These behavior specifications can be packed into a Control Plan program, and loaded to a runtime system for execution or to a verification tool for analysis. With this architecture, embedded software can be constructed by selecting an...

In contemporary machine control systems, the monitoring functions are developed and tested separately, requiring additional time and effort for their integration into a machine control system. Also, the software for most contemporary controllers is fixed and very application-dependent, so the system may not run correctly after such integration since the algorithms are time-sensitive. We show how to modularize machine tool control systems with object-oriented concepts. We define a set of software components and system services for reuse, present some system guidelines based on simulations and test analyses to help users implement controllers that satisfy real-time constraints. We present the integration of broken tool detection functionality into an existing three axis motion controller, and demonstrate that the integration requires minimal effort and skill, and that the hard real-time constraints for broken tool signal processing can be satisfied with our software architecture.