Embedded hardware development boards

Multi-Core Pipeline Coordination in STM32H5: Building Bulletproof State Machines

By Vaishak C

Modern embedded systems need sophisticated coordination between multiple processing cores, sensors, and communication protocols. When building real-time edge computing platforms that integrate camera capture, thermal imaging, and network transmission, single-threaded approaches quickly become bottlenecks. The challenge is orchestrating complex multi-sensor pipelines while keeping deterministic timing and bulletproof reliability.

The challenge: coordinating complex multi-sensor pipelines

Our edge computing platform faces a demanding coordination problem: simultaneously managing camera capture, thermal sensor acquisition, flash storage, and network transmission across multiple cores while ensuring zero data loss and real-time constraints.

The architecture centers on dual-core coordination between a high-performance Cortex-M7 core handling sensor data acquisition and a Cortex-M4 core managing communication protocols. Each capture session has to coordinate camera frame capture (640x400 pixels, 530KB per frame), thermal sensor data (768 temperature points, 3KB per sample), flash storage operations (multi-MB writes to external storage), network transmission via CAN-FD and high-speed serial, all under sub-100ms latency requirements.

State machine workflow diagram

State machine architecture

The solution implements a hierarchical state machine coordinating resource access across concurrent operations, ensuring mutual exclusion between resource-intensive operations while allowing safe concurrent access to independent subsystems. Critical state transitions use atomic operations with bulletproof error recovery:

bool pipeline_coordinator_request_state(pipeline_state_t requested_state, bool force) {
    if (xSemaphoreTake(pipeline_mutex, pdMS_TO_TICKS(100)) != pdTRUE) {
        return false; // Timeout - system under stress
    }
  
    pipeline_state_t current_state = current_pipeline_state;
  
    if (!is_valid_transition(current_state, requested_state) && !force) {
        xSemaphoreGive(pipeline_mutex);
        return false;
    }
  
    current_pipeline_state = requested_state;
    state_transition_time = xTaskGetTickCount();
  
    if (requested_state == PIPELINE_STATE_OFFLOADING) {
        LOG_INFO_TAG("PIPELINE", "FLASH OFFLOAD STARTED - blocking capture operations");
    }
  
    xSemaphoreGive(pipeline_mutex);
    return true;
}

This prevents race conditions during high-load scenarios where multiple subsystems compete for shared resources.

Inter-core communication via VBUS

The system implements a custom VBUS protocol over CAN-FD for deterministic inter-core communication, with priority levels ranging from emergency alerts down to diagnostic messages:

typedef enum {
    VBUS_PRIORITY_EMERGENCY = 0,    // Critical system alerts
    VBUS_PRIORITY_VERY_HIGH = 1,    // Real-time sensor data
    VBUS_PRIORITY_HIGH = 2,         // Capture coordination
    VBUS_PRIORITY_MEDIUM = 4,       // Status updates
    VBUS_PRIORITY_LOW = 6           // Diagnostic messages
} vbus_priority_t;

Message priority handling ensures critical coordination messages preempt lower-priority data transfers, keeping real-time responsiveness even during high-bandwidth image transmission. The VBUS message processor implements zero-copy routing with predictable latency, decoding priority and type from the CAN ID and dispatching accordingly, with time-sync commands processed immediately in ISR context while large image transfers get deferred to task context.

Capture session coordination

The system coordinates simultaneous thermal and camera capture with precise timing, using a session struct that tracks thermal and camera buffers, timestamps, and capture status independently before validating synchronization:

bool trigger_synchronized_capture(void) {
    if (!pipeline_coordinator_request_state(PIPELINE_STATE_THERMAL_PENDING, false)) {
        return false; // Pipeline busy - reject capture request
    }
  
    currentSession.sequence_id = ++captureSequenceCounter;
    currentSession.state = CAPTURE_STATE_THERMAL_PENDING;
    currentSession.thermal_captured = false;
    currentSession.camera_captured = false;
  
    // Start thermal capture first (lower latency sensor)
    thermal_start_tick = xTaskGetTickCount();
    if (ir_imager_capture_async(thermal_data_callback) != IR_IMAGER_OK) {
        pipeline_coordinator_release_state(PIPELINE_STATE_THERMAL_PENDING);
        return false;
    }
  
    HAL_Delay(CAPTURE_PREPARATION_TIME_MS);
    if (Camera_StartCapture(frame_callback) != HAL_OK) {
        ir_imager_stop_capture();
        pipeline_coordinator_release_state(PIPELINE_STATE_THERMAL_PENDING);
        return false;
    }
  
    return true;
}

Timing validation confirms captured data pairs stay synchronized within an acceptable window, flagging a sync violation and marking the session as errored if the gap exceeds it.

Resource management and critical sections

Large-scale flash storage operations need exclusive system access to prevent memory contention. The offload trigger checks PSRAM buffer utilization and requests exclusive pipeline access before starting, then suspends capture operations for the duration of the offload, processing a batch of entries with per-entry error recovery so one failure doesn't stall the rest, then releases exclusive access once done.

Memory consistency across cores uses hardware coherency mechanisms plus software barriers:

// Cross-core data sharing with cache coherency
void ensure_cache_coherency_for_shared_data(void *data, size_t size) {
    SCB_CleanInvalidateDCache_by_Addr(data, size);
    __DSB(); // Data Synchronization Barrier
    __ISB(); // Instruction Synchronization Barrier
}

// Atomic updates for cross-core coordination
void update_shared_pipeline_state(pipeline_state_t new_state) {
    __disable_irq();
    current_pipeline_state = new_state;
    ensure_cache_coherency_for_shared_data(&current_pipeline_state, sizeof(current_pipeline_state));
    __enable_irq();
}

Performance results

Production deployment shows the coordination system doing real work. Storage coordination time dropped from roughly 6.18 seconds down to about 131ms, a reduction of nearly 98%, purely by overlapping I/O operations with capture processing instead of serializing them. Total pipeline time dropped from around 12.8 seconds to around 6.8 seconds, roughly a 47% improvement, even though the camera capture, thermal capture, and flash-offload durations themselves stayed the same, since they're bound by sensor and I/O physics rather than coordination overhead.

Error recovery is built into the state machine as a first-class concern: on failure, active capture operations get force-stopped, the coordination state resets to idle, pending timers get cleared, and communication protocols restart, restoring the system to an operational state automatically.

Production reliability metrics reflect that design: a very high capture success rate over more than 100,000 capture cycles, zero deadlock occurrences during six months of continuous operation, an extremely low rate of state corruption events (all with automatic recovery), and a mean recovery time in the range of 150ms from error detection back to operational state. The coordination system also scales cleanly as sensor complexity grows, supporting dynamic registration of new sensors into a priority-sorted coordination list.

Key implementation insights

Bulletproof systems need explicit state validation at every transition, invalid transitions indicate serious errors that need immediate attention, not silent tolerance. Hardware-accelerated priority inheritance in RTOS schedulers prevents priority inversion during critical coordination. Multi-core systems need explicit cache management for shared data structures, hardware coherency protocols help but can't replace careful software design. Production systems need automatic error recovery restoring operational state within hundreds of milliseconds without manual intervention. And zero-copy message passing with priority-based routing minimizes inter-core latency while keeping behavior deterministic.

Why it matters at Hoomanely

This coordination system enables the sensor fusion our precision pet healthcare monitoring depends on. Coordinating camera, thermal, and proximity sensors with millisecond-level timing accuracy is what lets us capture the detailed physiological data needed for early health issue detection, with the bulletproof state machine design supporting reliable 24/7 operation in real homes where pets depend on continuous monitoring.

Read more