This chapter describes a case study for a railroad crossing control embedded system. This software design is for a safety-critical system, in which the raising and lowering of railroad barriers must be done safely and in a timely manner. As is typical of embedded systems, the system interfaces with the external environment by means of several sensors and actuators. It also must send status messages to a Rail Operations Service. Control of the railroad crossing is state dependent, which necessitates the design of a state machine to provide overall control of the software system. As the Railroad Crossing Control System (RXCS) is an embedded system, the design approach benefits from starting with a systems engineering perspective of the total hardware/software system, the Railroad Crossing Embedded System.

The problem is described in Section 20.1. Section 20.2 describes the structural modeling of the system, consisting of the structural model of the problem domain, followed by the system and software system context models, and the hardware/software boundary model. Section 20.3 describes the use case model from a software engineering perspective, describing both the functional and nonfunctional requirements of the safety-critical system. Section 20.4 describes the dynamic state machine modeling, which is particularly important to model the state dependent intricacies of this embedded system. Section 20.5 describes how the object and class structuring criteria are applied to this system. Section 20.6 describes how dynamic interaction modeling is used to develop sequence diagrams from the use cases. Section 20.7 describes the design model for the software system, which is designed as a concurrent software architecture that is based on software architectural patterns. Section 20.8 describes the performance analysis of the real-time design executing on single and multiprocessor systems. Section 20.9 describes the design of the RXCS component-based software architecture that is part of the distributed Light Rail System described in Chapter 21. Section 20.10 describes system configuration and deployment.

PROBLEM DESCRIPTION

A railroad crossing consists of two barriers, each with a flashing warning light and an audio warning signal. The barriers are normally raised. When a train approaches, the barriers are lowered, the warning lights start flashing, and the audio warnings are sounded. When the train departs, the barriers are raised, the warning lights stop flashing, and the audio warnings are stopped.