Static Timing Orchestration for Tree-Structured Robot Control Firmware

Static Timing Orchestration for Tree-Structured Robot Control Firmware

arXiv:2608.04600v1 [cs.RO] 5 Aug 2026

Wang Xi, Feiran Wei, Mo Deng, Weiheng Lin, Pangkit Fong and Jianping He Abstract— As robotic systems become increasingly complex, generating control firmware from structural description files has emerged as a promising paradigm for reducing development complexity and improving maintainability. Existing robot description formats naturally represent robotic systems as hierarchical tree structures, where devices are recursively composed into functional subsystems and eventually into the complete robot. However, such tree-structured organization also introduces structured data dependencies that affect perceptionto-decision latency and, consequently, control performance. In this paper, we propose F INE M OTE , a control firmware generation framework with a scheduling mechanism tailored for tree-structured device models. The framework objectifies heterogeneous low-level control logic and exposes unified scheduling units and execution entry points. Based on the resulting object hierarchy, the scheduling mechanism exploits compiletime information to statically determine execution order with minimal runtime overhead. We prove that the proposed mechanism satisfies deadline and precedence constraints, and further derive an upper bound on intra-tree decision latency. We implement the proposed framework and evaluate it on real robotic control platforms. The experimental results show improved timing behavior and runtime responsiveness, demonstrating the practical effectiveness of the proposed design.

I. I NTRODUCTION With the increasing scale of robotic applications, scheduling strategies for robotic systems have attracted growing attention. To interact reliably with the physical world, robots are typically equipped with low-level control firmware that drives sensors, actuators, and other physical devices. Modern robots integrate many heterogeneous devices through multiple communication buses, making such firmware highly complex. Consequently, developing and maintaining control firmware through conventional manual workflows is difficult and error-prone. A common way to manage this complexity is to construct firmware from structural descriptions. Robot description formats such as the Unified Robot Description Format (URDF) [1] and xacro [2] were introduced for robot modeling and analysis, and their XML-like structure naturally describes a tree-structured device hierarchy. For example, leaf devices such as motors form higher-level components such as manipulators, which are further composed into a complete robot system. Such structural information can serve as an input to firmware generation frameworks. For instance, ros2 control [3] uses dedicated URDF fields to specify hardware interfaces and binds them with device libraries to The authors are with the Department of Automation, Shanghai Jiao Tong University, and Key Laboratory of System Control and Information Processing, Ministry of Education of China, Shanghai, China. Corresponding E-mail address: {bddwyx,fpjgaoge,jphe}@sjtu.edu.cn

construct control code. Similarly, AUTOSAR [4] adopts an XML-based paradigm for control software generation in the automotive domain. However, building such a framework is itself nontrivial. A generation framework must bridge high-level structural descriptions and low-level firmware implementation, objectify heterogeneous device logic, bind communication interfaces, and expose schedulable execution units. Moreover, even when the functional structure can be generated, timing orchestration remains insufficiently addressed. A treestructured device hierarchy induces data dependencies among tasks: state information is aggregated from leaves to the root, while decisions are propagated from the root back to leaves. Improper scheduling may therefore accumulate latency along this bidirectional propagation process, leading to longer perception-to-decision delay and degraded control performance. Reducing this latency is difficult because timing orchestration must satisfy both precedence and deadline constraints. To expose useful scheduling points, control firmware often decomposes each device task into two stages: one stage provides state information for upper-level decision generation, and the other generates local actions according to upperlevel commands. These two stages must execute sequentially within the same device period, introducing intra-task precedence constraints. As analyzed later, such constraints make even single-core scheduling nontrivial. Furthermore, execution times of user-defined device logic are usually unavailable at the framework level, so aggressive task switching or preemption may lead to deadline violations. We observe that robot control firmware has a largely static structure. Robot components do not appear or disappear during firmware execution, and their mechanical structure and hardware configuration are available at compile time. This motivates a static timing orchestration strategy: scheduling policies can be constructed before runtime by leveraging framework-level design mechanisms and compile-time structural information. Such a strategy matches embedded control platforms, where low runtime overhead and deterministic behavior are essential. Based on these observations, we design a control firmware generation framework with static timing orchestration. The framework targets complex robotic mechatronic systems and aims to simplify firmware development while providing predictable timing behavior. The main contributions of this paper are summarized as follows: • We propose an object-oriented control firmware generation framework for tree-structured robotic devices.

Based on this framework, we formulate the corresponding scheduling problem and explicitly capture the impact of tree-structured device dependencies on intratree decision latency. • We design a static scheduling strategy that satisfies both schedulability and intra-device precedence constraints. We further derive an upper bound on the intra-tree decision latency under the proposed scheduling strategy. • We provide an open-source implementation of the proposed framework and evaluate its feasibility and scheduling behavior on a real robotic platform. The results demonstrate that the framework can support practical firmware development while maintaining predictable timing behavior. II. F RAMEWORK D ESIGN This section presents the framework design from the perspective of scheduling and formulates the corresponding scheduling problem. This abstraction allows readers to follow the technical development without requiring detailed understanding of the underlying framework implementation. To avoid tedious implementation details and conserve space, implementation mechanisms are described using design pattern names. Comprehensive definitions of design patterns can be found in [5], [6]. We first provide an overview of the framework. The proposed firmware generation framework adopts a devicecentric scheduling model. Each device object corresponds to a physical robot component and aligns with the structural description file. Developers define device-specific functionality following the framework interface, while scheduling and timing behaviors are enforced at the framework level without user intervention. A. Device-Centric Task Model The first key idea is to decompose complex robotic workloads into schedulable units. In conventional robotic control firmware, two types of execution activities usually coexist: time-triggered control computation and event-triggered communication processing through physical peripherals. However, scheduling such hybrid-triggered workloads is difficult, since periodic control tasks and peripheral events follow different activation mechanisms. Therefore, we first simplify the scheduling model by separating communication processing from control computation. This separation is based on the following observation. Within one control period, each device object exchanges only a bounded amount of data through physical interfaces, and the cost of moving such data is relatively small. Thus, we assign higher priority to communication peripherals, while restricting their responsibility to data movement. In particular, communication paths do not perform protocol parsing or execute control logic. This design keeps peripheral responses timely and, meanwhile, avoids blocking periodic control computation with complex event-triggered processing. Furthermore, this separation can be directly realized in the framework implementation. Each device object registers its

communication requirements to the corresponding bus object through the Observer pattern. Meanwhile, each bus object is implemented as a Singleton, which handles transmission requests and dispatches received data through interrupts or DMA. As a result, event-triggered peripheral processing is confined to asynchronous data transfer, whereas device-level control logic is executed in the time-triggered part of the firmware. Under this implementation, the scheduling problem of the control firmware is largely reduced to time-triggered scheduling. Therefore, the remaining scheduling analysis can focus on periodic device tasks. Let δ denote the system scheduling tick. Consider a robotic application with N device objects dn , n = 1, . . . , N . Let D = {d1 , . . . , dN } denote the set of device objects instantiated in the robotic application. Then we define the basic scheduling abstraction used in this paper. Definition 1 (Device Task Model) Each device dn ∈ D periodically releases a task τn , characterized by (Cn , Tn , Dn ), where Cn is the worst-case execution time (WCET), Tn is the period, and Dn is the relative deadline. Tn is assumed to be an integer multiple of the scheduling tick δ. We assume that scheduling starts at t = 0, when all device objects release their first tasks simultaneously. Considering the characteristics of embedded control firmware platforms, the remainder of this paper focuses on preemptive singlecore scheduling. Furthermore, to simplify the analysis, we assume implicit deadlines for device tasks: Tn = Dn ,

∀n.

At the implementation level, all device objects are additionally required to be globally instantiated. This requirement follows from the robotic control setting, where the set of physical devices is fixed at system startup. Moreover, global instantiation enables deterministic startup orchestration, which will be used later to reason about device ordering. B. Tree-Structured Dependency The device task model defined above abstracts each device object as a periodic scheduling unit. However, these units are not independent. In structure-driven robot firmware, device objects are organized according to the robot hierarchy described by the structural specification. Therefore, the next step is to model the dependency relation induced by this hierarchy.

Fig. 1. Tree-structured device dependencies and an example low-latency scheduling order.

Although structural descriptions provide a natural basis for firmware generation, directly generating complete device logic from them is often impractical. The main difficulty comes from the diversity of leaf devices. Consider a manipulator as an example. The internal motioncontrol logic of the manipulator is largely independent of the specific motor model, since the controller only needs to issue commands such as position, velocity, or torque to motor objects. However, replacing the motor hardware may still change implementation-level details, including data types, variables, and configuration parameters. This mismatch between functional abstraction and hardware-specific implementation prevents structural descriptions from directly specifying complete device functions. To address this issue, the framework represents hierarchical composition through dependency injection. Leaf device objects are first declared or instantiated, and are then passed as construction arguments to upper-level device objects. Meanwhile, upper-level classes access lower-level devices through abstract interfaces, which allows the same composite logic to be reused across different hardware implementations. Consequently, defining device objects from leaves to roots reconstructs the robot functionality while preserving hardware abstraction. Based on this implementation mechanism, we define the tree-structured dependency among device objects. Definition 2 (Tree-structured dependency) For two devices dn1 , dn2 ∈ D, the ordered pair (dn1 , dn2 ) denotes that dn2 depends on dn1 in the structural description. All such dependency pairs form the edge set E. Due to the structural constraints of the description files, the directed graph (D, E) is assumed to be a forest. Let M denote the number of trees. We denote the m-th tree by (Dm , Em ), where m = 1, . . . , M . For subsequent latency analysis, we also define leaf-toroot paths in each tree. Consider a sequence of device indices (np )P p=1 in the m-th tree such that dnp ∈ Dm ,

∀p = 1, . . . , P,

and (dnp , dnp+1 ) ∈ Em ,

∀p = 1, . . . , P − 1.

If dn1 is a leaf node and dnP is the root node of the m-th tree, then (np )P p=1 is called a leaf-to-root path. The set of all leaf-to-root paths in the m-th tree is denoted by Pm . This notation will be used later to define decision latency. C. Intra-Tree Latency Model The tree-structured dependency defined above introduces nontrivial timing interactions among device tasks. In the upward direction, an upper-level device depends on state information produced by lower-level devices. In the downward direction, decisions generated by upper-level devices are propagated back toward leaf devices and are eventually

delivered to cyber-physical interfaces. Therefore, even if each device task meets its own deadline, scheduling gaps between dependent devices may accumulate along a tree and increase the overall decision delay. In this paper, we focus on the intra-tree decision latency, defined as the elapsed time from a leaf-side state update to the generation of the corresponding leaf-side actuator command. This latency includes both computation time and scheduling-induced waiting time. Moreover, because data must traverse multiple hierarchy levels, scheduling-induced waiting time may accumulate along a leaf-to-root-to-leaf propagation path. As a result, the execution order of device tasks becomes critical to the timing behavior of the control firmware. To expose schedulable points inside each device task, the framework decomposes the task of every device into two stages. The Update stage, denoted by τn+ and ■ , updates the internal state of device dn using data provided by lower-level devices. It terminates when the state information required by upper-level devices becomes available. The Handle stage, denoted by τn− and ● , generates actions for the current cycle based on the updated device state and propagates decision information to lower-level devices. This two-stage decomposition makes the bidirectional data propagation explicit. After a lower-level ■ stage finishes, the scheduler may execute the ■ stage of an upper-level device without waiting for the lower-level ● stage. Similarly, after an upper-level decision is generated, the scheduler may propagate it downward through subsequent ● stages. Thus, the decomposition provides the scheduling flexibility needed to reduce latency accumulation inside a device tree. Based on this decomposition, the set of schedulable stages is defined as T(D) = {τn+ , τn− | dn ∈ D}. To reason about instance-level data propagation, we next introduce release indices and timing functions. For each device dn , let Kn ≜ {k ∈ N | ∃α ∈ N, kδ = αTn } be the set of valid release indices; namely, k ∈ Kn iff dn releases a task at time kδ. We model the scheduler by two timing functions S, F : T(D) × N → R. For a stage type ◦ ∈ {+, −}, S(τn◦ , k) and F (τn◦ , k) denote the start time and finish time of the stage instance (τn◦ , k), respectively. Here, (τn◦ , k) denotes the instance of stage τn◦ released by device dn at time kδ. With the start-time and finish-time mappings defined, we now specify when data produced by one stage becomes visible to another stage. Combining the tree dependency with scheduling behavior, we define the data transfer relation ≺. Definition 3 (Data transfer relation) Let ◦ ∈ {+, −} denote the stage type. For two stage instances (τn◦1 , k1 ) and (τn◦2 , k2 ), we write (τn◦1 , k1 ) ≺ (τn◦2 , k2 )

(a) UML Graph

(b) Structural Diagram

Fig. 2. Core mechanisms of the framework. These mechanisms periodically interact with the physical layer to establish basic control. Due to space and scope limitations, this paper focuses on the modeling and scheduling of device objects.

if the following conditions hold: 1) The two devices are adjacent in the corresponding propagation direction: ( (dn1 , dn2 ) ∈ E, ◦ = +, (dn2 , dn1 ) ∈ E, ◦ = −. 2) The instance (τn◦1 , k1 ) is the latest released producer instance whose output is visible to (τn◦2 , k2 ), i.e.,  k1 = max k ∈ Kn1 F (τn◦1 , k) ≤ S(τn◦2 , k2 ) . The relation ≺ captures the data instance actually consumed by a stage instance. For the ■ stage, data propagates from a child device to its parent. For the ● stage, decision information propagates from a parent device to its child. With this relation, we can define the latency along a leafto-root path. Consider the i-th leaf-to-root path in the m-th tree, denoted by i (np )P p=1 ∈ Pm , where Pi is the length of this path, dn1 is the leaf, and dnPi is the root. Given a terminal release index k(2Pi −1) ∈ Kn1 , corresponding to the terminal leaf-side ● stage, the datatransfer relation determines a backward release-index sequence i −1 (kj )2P j=1 . Specifically, the downward decision propagation is first determined backward by (τn−P , kPi ) ≺ (τn−(P −1) , k(Pi +1) ) ≺ · · · ≺ (τn−1 , k(2Pi −1) ), i

i

where n(Pi +v) = n(Pi −v) . Then, the upward state propagation is determined backward by (τn+1 , k1 ) ≺ (τn+2 , k2 ) ≺ · · · ≺ (τn+P , kPi ). i

The decision latency of this path ending at release index k(2Pi −1) is defined as F (τn−1 , k(2Pi −1) ) − S(τn+1 , k1 ). That is, latency is measured from the start of the leaf-side ■ stage that produced the state eventually used by the terminal leaf-side ● stage, to the completion of that terminal ● stage.

We now lift this path-level metric to the tree level. Definition 4 (Intra-tree decision latency) For the m-th tree, the intra-tree decision latency is defined as
Lm = max max F (τn−1 , k2Pi −1 ) − S(τn+1 , k1 ) , Pi i: (np )p=1 ∈Pm k(2Pi −1)

where the release indices k1 , . . . , k(2Pi −2) are determined by the data transfer relation ≺. D. The Scheduling Problem Given a scheduling policy S, the finish-time function F is induced by the resulting execution trace. Therefore, designing the scheduling policy S is sufficient to determine both the start-time and finish-time behavior of all stage instances. We now formulate the scheduling problem for treestructured device dependencies. Given the timing functions defined above, the objective is to find a scheduling policy S that minimizes the worst intra-tree decision latency: min

max Lm m=1,...,M F (τn− , k) ≤ kδ + Dn , F (τn+ , k) ≤ S(τn− , k),

(1a)

S

s.t.

∀n, ∀k ∈ Kn ,

(1b)

∀n, ∀k ∈ Kn .

(1c)

Here, (1b) requires each device task to finish before its relative deadline, while (1c) enforces the intra-device precedence from the ■ stage to the ● stage. Solving (1) is challenging for several reasons. First, the scheduler has limited information at the framework level. The execution time Cn is generally difficult to obtain, and the framework has limited prior knowledge of the userdefined device set D before compilation. Consequently, using fine-grained priority assignment to resolve intra-tree data dependencies is difficult and may compromise schedulability. Second, the optimization problem is computationally difficult. Without preemption, the problem is consistent with the ST-SR-IA problem with in-schedule dependencies defined in [7]. The precedence constraint in (1c) turns the assignment problem from a tractable combinatorial optimization problem into an NP-hard one. Although we do not claim a direct complexity proof for the preemptive variant considered in this paper, it is reasonable to regard it as computationally hard as well, given its close relation to the non-preemptive case and the additional scheduling choices introduced by preemption.

Therefore, even verifying whether a given scheduling policy is optimal can be difficult. For these reasons, we do not seek an exact optimum. Instead, we design a simple and practically implementable scheduling strategy that satisfies the schedulability and precedence constraints while reducing intra-tree decision latency. III. A S TATIC S CHEDULING S TRATEGY A. Device Registration Static scheduling requires an ordering of device objects that is consistent with both the device hierarchy and datapropagation directions. However, the firmware does not directly observe the complete device forest; it only observes construction and registration events. Maintaining an explicit dependency map is possible but fragile, especially when device objects are distributed across multiple translation units, while dynamically storing the full graph would conflict with the deterministic and low-overhead requirements of embedded firmware. We therefore exploit the temporal implication of dependency injection. If a parent device is constructed from references to its child devices, then the child devices must already be available before the parent is constructed. This construction order induces a partial dependency order that can be captured by registration. The remaining issue is translation-unit-level initialization: non-local objects are constructed before entering main, but their relative order across different translation units is generally not controlled, leading to the well-known Static Initialization Order Fiasco [8]. We first formalize how device objects appear at the translationunit level. Definition 5 (Devices in Translation Units) The declarations and definitions of device objects in D are distributed over Q translation units. For each translation unit q, let D(q) ⊆ D denote the set of device objects declared or defined in it. We denote their source-level appearance order by  |D(q) | Uq ≜ d(q) , r r=1

(q)

where dr is the r-th device object declared or defined in translation unit q. According to § 6.6.3 of C++17 [9] and mainstream compiler implementations, non-local objects are constructed before entering the main function. We denote the resulting device initialization order by N

O ≜ (dns )s=1 , where (ns )N s=1 is a permutation of {1, . . . , N }, and s denotes the initialization rank. Accordingly, we define the initialization-rank mapping I(dns ) = s. We now state the ordering property used by the proposed registration mechanism.

Theorem 1 (Initialization Order Preservation ) Assume that the program is well-formed under C++17 [9] and follows the dependency-injection discipline described above. Then the following properties hold: 1) For every translation unit q, the source-level device sequence Uq is a subsequence of the global initialization order O. 2) The initialization order O is consistent with the device forest. That is, for any two devices dn1 , dn2 ∈ D, if (dn1 , dn2 ) ∈ E, then I(dn1 ) < I(dn2 ). Proof: This result strongly depends on the framework mechanism and the partially-ordered initialization feature introduced in C++17. Appendix A provides a feasible implementation path that satisfies this requirement. Theorem 1 provides a useful perspective. The framework does not need to explicitly reconstruct the complete dependency forest or require developers to manually specify a traversal order. Instead, under the proposed construction discipline, the initialization order already provides a deterministic child-to-parent order. We next use this order to design the static scheduling algorithm. B. Static Device Scheduling The registration order provides a deterministic order for device objects. Before scheduling starts, the framework constructs all scheduling sequences statically from this order, without maintaining the device forest at runtime. Devices are first partitioned by their periods. Let W be the number of distinct device periods T . For each w = 1, . . . , W , let Qw denote the subsequence of the initialization order O containing all devices with the same period T (w) :   Qw ≜ dns ∈ O | Tns = T (w) , where T (w) is the common period of devices in Qw . The periods are ordered as T (1) < T (2) < · · · < T (W ) . The framework assigns static priorities to these sequences according to Rate-Monotonic Scheduling (RMS). Thus, a sequence with a shorter period has a higher priority, and a higher-priority sequence may preempt the execution of a lower-priority sequence. Within each sequence, the execution order is fixed. For Qw = (dn1 , dn2 , . . . , dn|Qw | ), the scheduler executes τn+1 , τn+2 , . . . , τn+|Qw | , τn−|Qw | , . . . , τn−2 , τn−1 .

(2)

Since each period bucket Qw preserves the initialization order, same-period dependencies follow the desired child-toparent order for ■ and parent-to-child order for ● . Overall, the scheduling policy is fully determined before runtime: period buckets, their priorities, and their internal execution orders are all fixed before scheduling begins.

C. Schedulability Analysis

is

We now analyze the schedulability of the proposed static scheduling policy. The analysis first abstracts event-triggered bus responses as conservative periodic workloads, and then combines them with the period buckets defined above. Let NB denote the number of bus objects used in the firmware. For each bus object bβ , where β = 1, . . . , NB , let Rβ be its baud rate and ℓβ be the minimum frame length in bits. The minimum response interval is TβB =

ℓβ . Rβ

The corresponding service routine performs only data movement, with WCET CβB . Lemma 1 (Periodic Abstraction of Bus Responses) For schedulability analysis, each bus object bβ can be conservatively modeled as a periodic workload
CβB , PβB , TβB , where PβB = min{TβB , δ}, and δ is the system scheduling tick. Proof: Bus responses are separated by at least TβB , and therefore form a sporadic workload. Replacing this workload with a periodic workload of period PβB = min{TβB , δ} is conservative since PβB ≤ TβB . For any interval of length L, the processor demand of the original workload satisfies ' & ' & L L B Cβ ≤ CβB . TβB PβB Thus, the periodic abstraction safely upper-bounds the processor demand of bus responses. Next, we abstract each period bucket as one periodic workload. For a bucket Qw , let X Q Cw ≜ Cn dn ∈Qw

denote its aggregate execution time, where Cn includes both the ■ and ● stages of device dn . Since all devices in Qw share the same period T (w) , the bucket can be modeled as a periodic workload   Q τwQ = Cw , T (w) , T (w) . Since every device period is an integer multiple of the scheduling tick δ, and PβB ≤ δ, bus workloads have priorities no lower than device buckets under Rate-Monotonic Scheduling (RMS). This is consistent with the implementation, where bus service routines are assigned higher priority than periodic control execution. Theorem 2 (Schedulability Bound) Consider NB bus objects and W period buckets scheduled according to the proposed static policy. A sufficient condition for schedulability

NB X CβB

+ B

β=1

Pβ

W   Q X Cw ≤ (NB + W ) 21/(NB +W ) − 1 . (w) T w=1

Proof: By Lemma 1, each bus object bβ is conservatively modeled as a periodic workload with execution time CβB and period PβB . Meanwhile, each period bucket Qw is Q modeled as a periodic workload with execution time Cw , (w) period T , and implicit deadline. Thus, the firmware is abstracted as NB + W periodic workloads scheduled under RMS. Applying the Liu–Layland utilization bound [10] yields the stated sufficient condition. D. Summary of the Static Policy Using the ordering property in Theorem 1, we design a fully static scheduling policy. The period buckets Qw , their RMS priorities, and their internal execution orders are all determined before scheduling starts. The execution order in (2) enforces the intra-device precedence constraint in (1c), since each ● stage is executed only after the corresponding ■ stage. Meanwhile, Theorem 2 provides a sufficient condition under which the deadline constraint in (1b) is satisfied. Therefore, the remaining question is the latency cost of this static policy. In the next section, we derive an upper bound on the intra-tree decision latency Lm of the proposed scheduling strategy. IV. L ATENCY A NALYSIS A. Response-Time Bounds Before deriving latency bounds, we first analyze the response-time bounds of ■ and ● . For device dn and phase τn◦ , where ◦ ∈ {+, −}, define its response time at release index k ∈ Kn as R◦n (k) ≜ F (τn◦ , k) − kδ. This response time depends on the specific release index k, and is therefore inconvenient for deriving releaseindependent latency bounds. Instead, we seek two uniform b− b+ upper bounds R n and Rn such that b+ R+ n (k) ≤ Rn ,

b− R− n (k) ≤ Rn ,

∀k ∈ Kn .

Lemma 2 (Response-Time Bounds) Under the proposed b+ static scheduling policy, feasible response-time bounds R n − b and Rn are given by the least fixed points of & ' & ' NB + X X b+ b R R n n Q b + = B+ + R CβB + Cw , n n B (w) T P β (w) β=1 w:T

<Tn

and − b− R n = Bn +

' & NB X b− R n CβB + B P β β=1

& X w:T (w) <Tn

where Bn+ ≜ Cn+ +

X u:Tu =Tn I(du )<I(dn )

Cu+

' b− R n Q Cw , T (w)

and Bn− ≜

X

Cu+ +

u:Tu =Tn

X

Cu− + Cn− .

u:Tu =Tn I(du )>I(dn )

Here, Cu+ and Cu− denote the WCETs of ■ and ● of device du , respectively. Proof: See Appendix B. Lemma 2 gives release-independent completion bounds for ■ and ● phases. The registry order is already used in this local analysis to tighten the deterministic sameperiod workload. Specifically, Bn+ only includes the ■ prefix before dn in the forward traversal, while Bn− includes all same-period ■ phases and only the reverse-● prefix before dn . Thus, compared with charging all same-period phases b+ uniformly, the ordering information gives tighter bounds R n − b and Rn . The subsequent latency analysis can therefore ignore the b+ b− exact release-dependent interference and use R n and Rn as safe local completion bounds. We next propagate these bounds through the data-transfer relation along a leaf-to-root path to derive an upper bound on the intra-tree decision latency. B. Intra-tree Latency Bound For clarity, we use producer and consumer to refer to the data-transfer direction of the current phase. During ■ propagation, the child device is the producer and the parent device is the consumer. During ● propagation, this relation is reversed. For two adjacent devices on a path, the consumer can observe the producer output only at its own release instants. At a common release instant, if the proposed scheduling order ensures that the producer output is already available when the consumer reads its input, then the consumer may use the producer instance released at the same tick. Otherwise, we conservatively require the consumed producer instance to have completed before the consumer release, using the response-time bound in Lemma 2. i For the i-th path (np )P p=1 , we define two predicates to distinguish these cases. For upward ■ propagation, let Ui,u , u = 2, . . . , Pi , indicate whether the output of τn+(u−1) is visible to τn+u at a common release instant:  Ui,u ≜ Tn(u−1) < Tnu
 ∨ Tn(u−1) = Tnu ∧ I(dn(u−1) ) < I(dnu ) . For downward ● propagation, let Hi,v , v = 1, . . . , Pi − 1, indicate whether the output of τn−(P −v+1) is visible to τn−(P −v) i i at a common release instant: h Hi,v ≜ Tn(Pi −v+1) < Tn(Pi −v)  ∨ Tn(Pi −v+1) = Tn(Pi −v) i ∧ I(dn(Pi −v+1) ) > I(dn(Pi −v) ) . When the corresponding predicate holds, the consumer release is aligned with the producer release. Otherwise, it is

aligned with the producer completion bound. The following theorem constructs a release sequence that safely upperbounds the sequence selected by the data-transfer relation. Theorem 3 (Intra-tree Latency Bound) Consider the i-th i leaf-to-root path (np )P p=1 ∈ Pm and a final leaf ● release i −1 index k(2Pi −1) ∈ Kn(2Pi −1) . Let (kj )2P be recursively j=1 defined backward as follows. For downward ● propagation, for v = Pi − 1, . . . , 1, % $ k(Pi +v) δ Tn(Pi −v+1)    , Hi,v ,   Tn(P −v+1) δ   i       k δ  k(Pi +v−1) =  (Pi +v)    b−  −R  Tn(Pi −v+1)   n (Pi −v+1)     , otherwise.     T δ  n (P −v+1)    i   For upward ■ propagation, for u = Pi , . . . , 2, % $ Tn(u−1)  ku δ   , Ui,u ,   δ  Tn(u−1) k(u−1) = $ %  b+  k δ − R Tn(u−1) u  n (u−1)   , otherwise.  Tn(u−1) δ Then the intra-tree latency of the m-th tree is upperbounded by   b− Lm ≤ max max k(2Pi −1) δ + R − k δ , 1 n1 k ∈Kn1 i ∈P (np )p=1 m (2Pi −1) P

where k1 is the first release index obtained by the backward recurrence for the corresponding path and final release. Proof: Inspired by the latency-analysis methodology for data chains of real-time periodic tasks [11], we prove Theorem 3 in Appendix C. The key insight is that the predicates Ui,u and Hi,v identify when adjacent producer– consumer phases have same-tick visibility; otherwise, the b+ b− proof falls back to the response-time bounds R n and Rn to conservatively account for release-level waiting. C. Latency under Special Cases Since no period relation is imposed on devices within a tree, the general form of Theorem 3 is necessarily complex and provides limited intuition. We therefore derive a simpler bound for a common case in robotic control firmware. 1) Harmonic Device Periods: We first consider treestructured harmonic periods. For every dependency edge (dn1 , dn2 ) ∈ E, where dn1 is the child and dn2 is the parent, assume that Tn2 = λn1 ,n2 Tn1 ,

λn1 ,n2 ∈ N+ .

Thus, the parent period is an integer multiple of the child period. Under this assumption, upward ■ propagation always has same-tick visibility. If the child has a shorter period, it has higher RMS priority and completes before the parent

activation. If the two devices have the same period, the forward registry order executes the child ■ before the parent ■ . Therefore, the corresponding predicate Ui,u always holds. For downward ● propagation, same-tick visibility holds only when the parent and child have the same period. If the parent period is larger, the child has higher RMS priority, and the parent ● is not guaranteed to complete before the child ● at the same tick. In this case, the consumed parent instance must be selected using the parent ● completion bound.

2) Same-Period Device Trees: The harmonic bound still permits period-level deferral when adjacent devices have different periods. We now consider the special case where all devices have the same period and aligned releases. In this case, every adjacent producer-consumer pair on any leafto-root path is released at the same tick. Since the forward traversal follows the child-to-parent direction for ■ and the reverse traversal follows the parent-to-child direction for ● , intra-tree propagation introduces no release-level waiting.

Corollary 1 (Harmonic Intra-Tree Latency Bound) Under the harmonic period assumption above, the backward release sequence in Theorem 3 can be simplified as follows: For downward ● propagation, for v = Pi − 1, . . . , 1,   k(Pi +v) ,      Tn(Pi −v+1) = Tn(Pi −v) ;    % k(Pi +v−1) = $ k b− Tn(Pi −v+1) (Pi +v) δ − Rn(P −v+1)  i   ,   Tn(Pi −v+1) δ     Tn(Pi −v+1) > Tn(Pi −v) .

Corollary 2 (Same-Period Intra-Tree Latency) Suppose that all devices in D have the same period T and aligned releases. Then, for every tree (Dm , Em ), the intra-tree latency satisfies

For upward ■ propagation, for u = Pi , . . . , 2, k(u−1) = ku . Consequently, the intra-tree latency of the m-th tree satisfies   b− Lm ≤ max max k(2Pi −1) δ + R n1 − k 1 δ , k ∈Kn1 i ∈P (np )p=1 m (2Pi −1) P

i Proof: Consider any path (np )P p=1 ∈ Pm . For upward ■ propagation, the harmonic assumption gives

Tn(u−1) ≤ Tnu ,

u = 2, . . . , Pi .

If the inequality is strict, the child has higher RMS priority; if the periods are equal, the forward registry traversal executes the child before the parent. Hence Ui,u holds for every upward edge. Since releases are aligned, the upward recurrence in Theorem 3 reduces to k(u−1) = ku . For downward ● propagation, the producer is the parent and the consumer is the child, so the harmonic assumption gives Tn(Pi −v+1) ≥ Tn(Pi −v) . If the periods are equal, reverse registry traversal executes the parent before the child, so Hi,v holds and the recurrence gives k(Pi +v−1) = k(Pi +v) . If the parent period is larger, same-tick visibility is not guaranteed, and Theorem 3 uses the completion-bound branch, giving the stated second case. Therefore, the recurrence in Theorem 3 simplifies exactly as stated. Applying the tree-level bound of Theorem 3 with this simplified recurrence proves the corollary.

Lm ≤

max P

i ∈P (np )p=1 m

b− R n1 .

Moreover, since there is no shorter-period device group in b− this case, R n1 is given by the least fixed point ' & NB b− X R n − − 1 b n = Bn + CβB , R 1 1 B P β β=1 where Bn−1 =

X

X

Cu+ +

du ∈D

Cu− + Cn−1 .

du ∈D I(du )>I(dn1 )

i Proof: Consider any path (np )P p=1 ∈ Pm . Since all devices have the same period T and aligned releases, every adjacent producer-consumer pair on the path is released at the same tick. The forward traversal executes each child ■ before its parent ■ , and the reverse traversal executes each parent ● before its child ● . Hence all predicates Ui,u and Hi,v hold. Therefore, Theorem 3 gives

k1 = k2 = · · · = k(2Pi −1) . Substituting this equality into Theorem 3 yields Lm ≤

max P

i ∈P (np )p=1 m

b− R n1 .

b − . Since all devices have the same It remains to simplify R n1 period, the shorter-period device-group term in Lemma 2 is empty. Thus, & ' NB b− X R n − − 1 b n = Bn + R CβB . 1 1 B P β β=1 Since all devices belong to the same period group, Bn−1 takes the stated form. This proves the corollary. Remark 1 The proofs of Corollary 1 and Corollary 2 show that Theorem 1, enabled by the framework design, reduces latency at multiple propagation steps. Since harmonic and same-period device structures are common in robotic systems, the proposed scheduling policy is effective in reducing intra-tree decision latency in practical scenarios.

V. E XPERIMENTS A. Setup 1) Scenario: Evaluating a control firmware framework is difficult because a fair comparison requires a real project with an existing implementation and development history. Moreover, changing the baseline to match all functions of the proposed framework may itself affect fairness. Therefore, we use a case study: we adapt F INE M OTE to an existing opensource robotic platform and compare firmware-level timing metrics. We choose the underwater robot FINS-ROV as the evaluation platform. Its mechanical and electrical design is opensource [12], and its control firmware is also available [13]. The platform uses the ROBO M ASTER T YPE C board, which is supported by F INE M OTE . FINS-ROV has eight thrusters and performs closed-loop attitude and motion control using an IMU and four pressure sensors. The IMU is connected through UART, while the pressure sensors are connected through an I2 C expansion board. Due to limited peripheral interfaces, the thruster ESCs are driven by an I2 C-to-8-channel PWM module. From the perspective of F INE M OTE , the system contains 14 device objects: 13 leaf devices and one top-level FINS-ROV object. These devices form the two-level tree shown in Fig. 3. The IMU period is 5 ms, while all other devices have a period of 10 ms.

Fig. 4. Execution interval between the farthest sensor event and motor output event.

Fig. 5.

Actuator jitter measured from the last initialized motor.

the internal response delay of the firmware. As shown in Fig. 4, F INE M OTE achieves an average interval of 53.64 µs with a standard deviation of 4.29 µs, while the baseline reaches 1610.00 µs with a standard deviation of 10.68 µs. The second metric is actuator jitter, measured as the standard deviation of the execution interval of the last initialized motor’s ● . As shown in Fig. 5, F INE M OTE reduces this jitter to 5.34 µs, compared with 18.87 µs in the baseline. These results show that the proposed framework and scheduling policy provide lower firmware-level response delay and more stable actuator timing in the FINS-ROV case study. VI. R ELATED W ORKS

Fig. 3.

Device tree structure of the FINS-ROV case study.

2) Measurement Method: To reduce measurement interference, we use a debugger and RTT Viewer to collect timestamps. RTT transfers data through the debug channel, avoiding extra bus communication in the control path. We insert lightweight probe functions at the beginning of ■ and the end of ● . Based on the sequential execution semantics of C++ statements [9], the recorded timestamps preserve the order of measured events. In our setup, the method provides approximately 10 µs-level precision, which is sufficient for the timing analysis in this experiment. B. Results The baseline firmware uses interrupt-set flags and polling in the main loop, making its latency difficult to define using our formal metric. We therefore evaluate the firmware using two practical timing metrics. The first metric is the execution interval between the farthest sensor event and motor output event, which reflects

Structure-driven generation has been widely explored in robotics and automotive software. In robotics, ros2 control [3] uses structural information in URDF to describe hardware interfaces and bind them with device-specific implementations. In the automotive domain, AUTOSAR [4] adopts an XML-based paradigm to configure and generate control software. These approaches reduce the engineering effort of firmware or middleware development. However, they mainly focus on functional integration and code generation, while timing orchestration and scheduling guarantees are not treated as first-class design objectives. Several studies have addressed real-time scheduling for robotic middleware. ROS-lite [14], [15] provides a lightweight ROS-compatible framework for embedded manycore platforms. ROSCH [16] improves real-time execution in ROS through synchronization support and fixed-priority DAG scheduling. These systems demonstrate the importance of real-time scheduling in robotic software stacks. However, they do not target structure-driven firmware generation, nor do they exploit tree-structured device dependencies induced by robot descriptions. In contrast, this work jointly considers firmware generation and timing orchestration. The proposed framework exposes

schedulable units from tree-structured device objects, statically derives execution order from the construction and registration mechanism, and provides schedulability and latency analysis for the resulting firmware. Thus, our approach complements existing generation frameworks by making timing behavior an explicit part of the generated control firmware. VII. C ONCLUSION This paper presented a control firmware generation framework with static timing orchestration for tree-structured robotic device models. The proposed framework objectifies heterogeneous low-level device logic, decouples eventtriggered communication from periodic control execution, and exposes device-level scheduling units for timing analysis. By exploiting dependency injection and C++ initialization behavior, the framework derives a deterministic device registration order without explicitly maintaining the complete device forest at runtime. Based on this registration order, we proposed a static scheduling policy that groups devices by period, assigns Rate-Monotonic Scheduling priorities across period buckets, and executes device phases in an order consistent with tree-structured data propagation. We formulated the corresponding scheduling problem, established schedulability conditions, and derived intra-tree decision-latency bounds under the proposed policy. These results show that the framework can satisfy deadline and precedence constraints while reducing latency accumulation within device trees. We implemented the proposed design and evaluated it on robotic control platforms. The results demonstrate that static timing orchestration can provide predictable timing behavior with low runtime overhead, while preserving the development benefits of structure-driven firmware generation. Future work will focus on tighter latency analysis, broader support for heterogeneous communication patterns, and automated extraction of timing parameters from generated firmware. A PPENDIX A. Proof of Theorem 1 The proof is closely tied to the implementation discipline of the framework. We first establish the ordering property and then discuss the implementation requirements. Consider a dependency edge (q) (d(q) r1 , dr2 ) ∈ E (q)

within a translation unit Uq , where dr1 is the child device (q) and dr2 is the parent device. Under dependency injection, the parent device is constructed using the child device as a construction argument. Therefore, by the name lookup rules in § 6.4 of C++17 [9], the child device must be declared or defined before it is used in the parent construction. Hence, r1 < r2 . Furthermore, by § 6.6.3 of C++17 [9], under the requirements of partially-ordered initialization, this source-level

order is preserved in the global initialization order. Thus, (q) I(d(q) r1 ) < I(dr2 ).

This shows that each translation-unit sequence Uq is preserved as a subsequence of the global initialization order O. It remains to show that all device dependencies are covered. By § 6.2 of C++17 [9], every device object that appears in the firmware must be defined at least once. Therefore, Q [

{ d | d ∈ Uq } = D.

q=1

Consequently, every dependency edge in E appears in at least one translation-unit sequence whose order is preserved by partially-ordered initialization. Combining this with the previous argument yields (dn1 , dn2 ) ∈ E ⇒ I(dn1 ) < I(dn2 ). Therefore, the global initialization order O is consistent with the child-to-parent order of the device forest. The proof uses partially-ordered initialization, which can be realized in two ways: i) All objects in the same device tree can be defined in one translation unit. ii) If a developer intends to expose a defined device object to other translation units, the object should be declared with the inline specifier. In either case, § 6.6.3 ensures that if all primitive devices appear before the composite device in every relevant translation unit, their construction order is preserved. This property is naturally respected under dependency injection. B. Proof of Lemma 2 Consider an arbitrary release index k ∈ Kn . We first consider the ■ phase τn+ . Under the proposed scheduling policy, all devices with the same period as dn are released at the same tick and are executed according to the registry traversal order. Therefore, before τn+ completes, the deterministic same-period workload consists of τn+ itself and the ■ phases of all same-period devices that appear before dn in the registry. This gives the term Bn+ . During the response interval of length R+ n (k), each bus response stream β contributes at most ' & R+ n (k) CβB PβB units of interference. Similarly, each higher-priority device period group w with T (w) < Tn contributes at most  +  Rn (k) Q Cw . T (w) Hence + R+ n (k) ≤ Bn +

& ' NB X R+ n (k) CβB + B P β β=1

X w:T (w) <Tn



 R+ n (k) Q Cw . T (w)

By the standard fixed-priority response-time argument, the least fixed point of the corresponding monotone recurrence is a safe release-independent upper bound. Therefore, b+ R+ n (k) ≤ Rn .

Since k ∈ Kn was arbitrary, both bounds hold for every release of device dn . C. Proof of Theorem 3 i −1 Let (κj )2P be the exact release sequence selected by j=1 the backward data-transfer relation for the path ending at

κ(2Pi −1) = k(2Pi −1) . We prove by structural induction that j = 1, . . . , 2Pi − 1.

The base case holds since κ(2Pi −1) = k(2Pi −1) . Assume that the claim holds for the current consumer release in a backward propagation step. Consider a downward ● propagation step from dn(Pi −v+1) to dn(Pi −v) , where v = Pi − 1, . . . , 1. By the backward datatransfer relation, n κ(Pi +v−1) = max q ∈ Kn(Pi −v+1) | o F (τn−(P −v+1) , q) ≤ S(τn−(P −v) , κ(Pi +v) ) . i

b− F (τn−(P −v+1) , q) ≤ qδ + R n(P −v+1) ≤ κ(Pi +v) δ. i

i

Since a task cannot start before its release instant,

The proof for ● is identical except for the deterministic same-period workload. Before τn− completes, all same-period ■ phases must have completed, and the reverse registry traversal executes the ● phases of same-period devices appearing after dn before executing τn− . Therefore, the deterministic same-period workload is Bn− . The bus-interference and higher-priority device-group interference terms are unchanged. Hence the same fixed-priority response-time argument gives b− R− n (k) ≤ Rn .

κj ≥ kj ,

By Lemma 2,

i

If Hi,v holds, the scheduler guarantees that the producer output is visible to the consumer for the latest producer release no later than the consumer release. Hence $ % κ(Pi +v) δ Tn(Pi −v+1) . κ(Pi +v−1) ≥ Tn(Pi −v+1) δ By the induction hypothesis κ(Pi +v) ≥ k(Pi +v) and the monotonicity of the floor alignment, $ % κ(Pi +v) δ Tn(Pi −v+1) Tn(Pi −v+1) δ $ % k(Pi +v) δ Tn(Pi −v+1) ≥ = k(Pi +v−1) . Tn(Pi −v+1) δ Thus κ(Pi +v−1) ≥ k(Pi +v−1) . If Hi,v does not hold, visibility from the latest producer release no later than the consumer release is not guaranteed. Let % $ b− κ(Pi +v) δ − R Tn(Pi −v+1) n(Pi −v+1) q= . Tn(Pi −v+1) δ

κ(Pi +v) δ ≤ S(τn−(P −v) , κ(Pi +v) ). i

Therefore, F (τn−(P −v+1) , q) ≤ S(τn−(P −v) , κ(Pi +v) ). i

i

Hence q is an observable producer release. Since κ(Pi +v−1) is the latest observable release selected by the backward datatransfer relation, we obtain κ(Pi +v−1) ≥ q. By the induction hypothesis and the monotonicity of the floor alignment, $ % b− k(Pi +v) δ − R Tn(Pi −v+1) n(Pi −v+1) q≥ = k(Pi +v−1) . Tn(Pi −v+1) δ Thus κ(Pi +v−1) ≥ k(Pi +v−1) . The upward ■ propagation is analogous. For the transfer from dn(u−1) to dnu , where u = Pi , . . . , 2, the same + b+ argument applies with Ui,u , R n(u−1) , τ , n(u−1) , and nu − b− replacing Hi,v , R n(Pi −v+1) , τ , n(Pi −v+1) , and n(Pi −v) , respectively. Thus, for every upward step, κ(u−1) ≥ k(u−1) . Therefore, by backward induction over the downward and upward propagation steps, κ1 ≥ k1 . The exact decision latency of this path under the final release k(2Pi −1) is F (τn−1 , κ(2Pi −1) ) − S(τn+1 , κ1 ). Using Lemma 2 and κ(2Pi −1) = k(2Pi −1) , we have + b− F (τn−1 , κ(2Pi −1) )−S(τn+1 , κ1 ) ≤ k(2Pi −1) δ+R n1 −S(τn1 , κ1 ).

Since a task cannot start before its release instant and κ1 ≥ k1 , S(τn+1 , κ1 ) ≥ κ1 δ ≥ k1 δ. Therefore, b− F (τn−1 , κ(2Pi −1) ) − S(τn+1 , κ1 ) ≤ k(2Pi −1) δ + R n1 − k1 δ. Thus, the intra-tree latency is bounded by   b − − k1 δ , Lm ≤ max max k(2Pi −1) δ + R n1 k ∈Kn1 i ∈P (np )p=1 m (2Pi −1) P

R EFERENCES [1] ROS Wiki, “XML Robot Description Format (URDF),” https://wiki. ros.org/urdf, accessed: 2026-05-26. [2] ——, “xacro,” https://wiki.ros.org/xacro, accessed: 2026-05-26. [3] Open Robotics, “ros2 control: Robot control framework for ROS 2,” https://control.ros.org/, 2021, accessed: 2025-08-03. [4] AUTOSAR, “AUTOSAR,” https://www.autosar.org, accessed: 202605-26. [5] E. Gamma, R. Helm, R. Johnson, and J. Vlissides, Design patterns: elements of reusable object-oriented software. Pearson Deutschland GmbH, 1995. [6] S. McConnell, Code complete. Pearson Education, 2004. [7] G. A. Korsah, A. Stentz, and M. B. Dias, “A comprehensive taxonomy for multi-robot task allocation,” The International Journal of Robotics Research, vol. 32, no. 12, pp. 1495–1512, 2013. [8] cppreference.com contributors, “Static Initialization Order Fiasco,” https://en.cppreference.com/cpp/language/siof, accessed: 2026-05-26. [9] Programming Languages — C++, International Organization for Standardization ISO/IEC 14 882:2017, 2017. [10] C. L. Liu and J. W. Layland, “Scheduling algorithms for multiprogramming in a hard-real-time environment,” Journal of the ACM, vol. 20, no. 1, pp. 46–61, 1973.

[11] T. Kloda, A. Bertout, and Y. Sorel, “Latency analysis for data chains of real-time periodic tasks,” in International Conference on Emerging Technologies and Factory Automation (ETFA). IEEE, 2018. [12] J. Xu, D. Lin, P. Fong, C. Fang, X. Duan, and J. He, “Aucamp: An underwater camera-based multi-robot platform with low-cost, distributed, and robust localization,” arXiv preprint arXiv:2506.09876, 2025. [13] IWIN-FINS Lab, “Finsrov: an underwater camera-based multi-robot platform,” https://github.com/FPJ-GAOGE/ FinsROV-An-Underwater-Camera-Based-Multi-Robot-Platform, 2022, accessed: 2026-05-26. [14] T. Azumi, Y. Maruyama, and S. Kato, “Ros-lite: Ros framework for noc-based embedded many-core platform,” in IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS). IEEE, 2020. [15] Y. Tajima, S. Tsunoda, and T. Azumi, “Ros-lite2: Autonomous-driving software platform for clustered many-core processor,” in IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS). IEEE, 2024. [16] Y. Saito, F. Sato, T. Azumi, S. Kato, and N. Nishio, “Rosch: realtime scheduling framework for ros,” in International Conference on Embedded and Real-Time Computing Systems and Applications (RTCSA). IEEE, 2018.

Related documents

• Toward scalable intuitive telecommand of robots for space deployment with METERON SUPVIS Justin#464040
• Expert-Play Contouring Control: Faster-than-Demonstration Planning from Slow Expert and Fast Play#1037481
• A self-orchestrating physics-discovering neural architecture for adaptive and fault-resilient robotic motion control via RPA and digital twins.#923697
• AI-Native Orchestration in the 6G Continuum: Evolving Operator Platforms with Agentic AI#667937
• Open-source benchmarking for learned reaching motion generation in robotics#633067