Dual Synthesis of Petri Net Based Dependable Logic Controllers for Safety Critical Systems

Transcription

1 Dual Synthesis of Petri Net Based Dependable Logic Controllers for Safety Critical Systems Arkadiusz Bukowiec, Jacek Tkacz, Marian Adamski, and Remigiusz Wiśniewski Institute of Computer Engineering and Electronics, University of Zielona Góra ul. Licealna 9, Zielona Góra, Poland s: Abstract In the paper, implementation of application specific logic controller for safety critical systems by means of Petri nets is described. The solution is based on duplicated main control unit and results comparison from both units. The design process of algorithm with use of Petri net is common for both unit. The hardware duplication is obtained during dual synthesis process. This process uses two different logic synthesis methods to obtain two different architectures for both control units. Such design flow simplify the process of realization of safety critical logic controllers. X Logic Controller for Safety Critical System CU A CU B Y A Y B COMP Y ERR I. INTRODUCTION Digital controllers for safety critical applications are an important research field. Very often they are implemented into FPGA devices [1]. Logic control unit of digital systems can be described in several forms. However, for safety critical systems only very well verified methods can be applied. Petri nets are one of such models. In presented solution, Petri nets are used for design entry, formal verification and logic synthesis and then HDL models are used for simulation, synthesis and hardware implementation. The novel methodology of logic synthesis of concurrent digital controllers for safety critical systems is based on dual synthesis of the same Petri net model with use of differen synthesis methods. First synthesis method is based on rule-based specification and hierarchical encoding obtained from Petri net model [2]. The second one is based on architectural decomposition of logic circuit and decomposition of Petri net into state machine (SM) subnets [3], [4]. As a results the two different HDL models are obtained. They are used for redundant implementation to increase the safety of logic controller. It leads to usage of the architecture with duplicated control units [5], [6]. Typically, reliability is increased if models of control unit are designed by different teams and on another method. It required creation of two specifications and independent verification of it. But the goal is to obtain two different hardware structure not two different models. The proposed solution simplify this process by application of two different logic synthesis methods. There is created one specification by one team and it is verified. Then it is passed to dual synthesis process. This approach also reduce the costs of design process because only one design team is required. II. ARCHITECTURE OF LOGIC CONTROLLERS FOR SAFETY CRITICAL SYSTEMS In definition [5], the outputs of controller for safety critical applications should be set in known state in case of accident. Fig. 1. Architecture of Logic Controllers for Safety Critical Systems Secondly, the device should work properly in normal conditions. This means that logic controller should be designed without any errors and should be able to detect any selfaccident. The condition of controller safety state should be secured by properly designed hardware. The known safety state should be achieved automatically after self-accident detection, irrespective of algorithm realization by logic controller. Presented architecture of logic controller for safety critical systems is based on duplicated control units (Fig. 1). The duplication of control units is applied in order to detect hardware failure. The similar approach was introduced in [5], [6] for design of PLC. Both control units, A and B, are obtained during dual synthesis processes from the same Petri net model. For each control unit there is applied different synthesis method, which are described in following sections. It means that both control units (CU A and CU B) realized the same algorithm. They are also connected to the same input signals X. The output signals Y A and Y B are compared in the comparator (COMP). If the comparison detect a failure then the ERR status signal is generated and output signals Y are reset it represent the safety state of controllers outputs. In normal conditions, output signals Y are set to the correct values, the same as value of signals Y A and Y B, and the ERR status signal not set. III. DESIGN FLOW FOR LOGIC CONTROLLER FOR SAFETY CRITICAL SYSTEMS There is proposed new design flow (Fig. 2) for logic controller for safety critical systems. The entry to the process is control algorithm designed as a well formed control interpreted Petri net [7], [8], [9]. In proposed approach it should be described in extended PNML format [10]. The applied allowed /14/$ IEEE 243

2 HDL NetList MODEL A SYNTHESIS CU A VENDOR LIBRARY PNML NetList BitStream PETRI NET DUAL SYNTHESIS VENDOR LIBRARY TOP-LEVEL & COMP IMPLEMENTATION Logic Controller HDL NetList MODEL B SYNTHESIS CU B Fig. 2. Design Flow for Logic Controllers for Safety Critical Systems extension defines interpretation of the Petri net. It is necessary to describe communication of the controller with environment. The Petri net should be initially colored. There are many coloring and SM extraction algorithms [11], [12], [13], [14], [15], [16] and one of them can be chosen. First, the dual synthesis is performed. In this process there are used independently two different synthesis methods. Each method generates logic description of the control algorithm in hardware description language (HDL). This description is platform independent. The first one is based on rule-based specification and hierarchical encoding [2]. It is obtained as a single module. The second one is based on architectural and parallel decomposition [3], [4]. The logic description is divided into several modules. Additionally, to increase reliability, generated models are described in different HDLs VHDL and Verilog. Then, both models are passed into third party synthesis tools. At this stage, the device has to be chosen and suitable vendor library is used. Both modules are synthesized separately as black boxes and separate net list files for each model are obtained. The top level module and comparator modules should be also created. The top level instantiates comparator and black boxes of both modules. The top level with comparator should be synthesized separately for the same device to obtain its net list. All three net lists are passed into implementation process. After that the bitstream is generated. IV. ALGORITHMS OF PETRI NET SYNTHESIS The automated design flow starts with dual synthesis of designed and initially colored Petri net. There is proposed to use two different synthesis methods in order to receive two different logic description of the same algorithm. Outputs of both control units are compared there is required that they produce their outputs at the same time. To satisfy this condition the HDL models have to be prepared in proper way: The state registers of both control units have to be trigged by the same edge of the same clock signal. In proposed solution the rising edge is chosen. The outputs have to be registered to avoid mismatch in comparison. The output register use the same clock that the state register but it is trigged by opposite edge than registers. It allows to be generated outputs in one Fig. 3. X MTC T RG Q Modular logic circuit of Petri net Q clock cycle [17]. In proposed solution the falling edge have to be used. The both control units have to be reset in the same way. Because the state registers are topically built from standard D-type flip-flops the asynchronous reset is used. For the output register the synchronous reset should be used in order to generate outputs always in the same period of time. A. Modular Logic Synthesis First synthesis method allows to implement control algorithm described by Petri net as a modular logic circuit (Fig. 3). The modular transition coder (MTC) is responsible for generation of events that corresponds to the firing of Petri net transitions. The register RG Q holds encoded global and local states. The Q signal represents encoded global states and the Y P signal represents encoded local states. To encode the local states output signals are used. The register holds values of output signals and it is used for synchronization purpose. It is trigged by opposite edge than the register RG Q. The logic description describes the changes of Petri net markings separately for each place. The autonomous place p n is considered together with its input {t i t j } and output transitions {t k t l } as a basic component of the Petri net Fig. 4. a) t i t k Pn t j t l b) guard ti Pm Symbolic representation of Petri net parts Pi t i c) guard tl MPn Pi Pm Y t l t j 244

3 (Fig. 4). The precondition for firing transition t i is: t i p m and p l and guard ti. The place gets its token if one of its input transition fires. The next marking for a place p n (Fig. 4a) is defined as n p n ( p m p m ) (1) The precondition of local transitions t i (Fig. 4b) is defined as follows: t i p m p i guard ti (2) Macroplace mp n from the figure 4c contains sequential places p i and p m. The boundary transition t l can be described as follows: t l mp n p m guard tl (3) To make the specification close with HDL syntax and semantics, the sequents with empty left side are used: Φ; where Φ is formula in propositional logic. defines next operator from propositional temporal logic and it is usually omitted. It should be noted, that the macroplaces which are colored with disjoint set of colors are evidently concurrent to each other. The macroplaces sharing the same color are sequentially related to each other. The special implicit configuration (coordination) places mp n detect all the Petri net subnets, which they dominate. During the hierarchical state encoding only a proper subset of them is necessary to detect the groups of places [18]. In proposed synthesis method, macroplaces, that represents global states, are encoded by means of variables Q = {q 0,, q N 1 } with on-hot code, where N is a number of macroplaces in conducted Petri net. To encode places, that represents local states, also additional variables Q = {q N,, q N+M 1 } are used, where M is a number of bits required for encoding of local states. The one-hot encoding can be also applied but for reducing the number of variables the binary encoding is proposed. The encoding of local states is realized for each global state undependable. Typically, global states do not have a lot of local states and codes do not include big number of variables in case of binary encoding. Here M is defined as follow: I M = log 2 P i, (4) where: i=1 I is number of global places, P i is a set of local places inside global place mp i. which hold a current state of each subnet. The memories RG i Y are responsible for decoding and generation of outputs. At the beginning the Petri net is decomposed into state machines subnets. All places colored by first color create the first SM-subnet. Next subnets are created in a similar way. All sequences of places, which have been previously selected by already created SM-subnets are replaced by macroplaces. The doubles of these macroplaces appear in a new SM-subnet and they do not have any output signals assigned. The doubles are treated as normal place in the further parts of the synthesis process. The encoding of places is done on minimal number of required bits represented by variables from the set Q = {q 0,, q R 1 }. Where I R = log 2 P i (5) i=1 and P i is a set of places of i-th SM-subnet. Places are encoded separately in each SM-subnet. Conjunctions describe places, preconditions of transitions and place hold-conditions. The conjunction describing the place p consists only of affirmation or negation of variables q r that are used to store the code of this place: p m = R(P i) 1 r=0 q l r. (6) If the r-th bit of the code equals 0 then negation (l = 0) is used and if it equals 1 then affirmation (l = 1) is used. The characteristic functions describing the precondition of transition t consists of place conjunctions of input places to this transition (from all subnets) and a guard condition assigned to this transition: t s = t s guard s. (7) The hold-conjunction of place p consists of negation of the sum of transition conjunctions of all its output transitions (from all subnets) and its place conjunction: hp m = p m p m. (8) Logic equations describe functions of combinational circuits CC i. They are created based on the D flip-flop equation. They are built from conjunctions describing preconditions of transitions and place hold-conjunctions: M D r = ( p m hp m K(p m )[r]). (9) X m=1 D 1 CC 1 RG Q 1 Q 1 Q 1 1 Y 1 B. Architectural Synthesis The idea of proposed synthesis method is based on parallel decomposition of Petri net colored by I colors with the minimal binary place encoding. Places are encoded separately in every colored subset. Output variables assigned to places are placed in memory blocks. It leads to realization of a logic circuit in double-level distributed architecture (Fig. 5), where the combinational circuits (CC i ) of first level are responsible for generation of the excitation functions. The memory of the circuit is built from concurrent colored D-type registers RG i Q Fig. 5. CC 2 RG Q 2 CC I D 2 Q 2 D I I Q RG I Q Distributed logic circuit of Petri net Q 2 Q Q I 2 I Y 2 Y I Y 245

4 The above equation can be explained as follow: If the variable q r is set to 1 in the code K(p m ) of the place p then the sum of corresponding variable D r consists of transition conjunctions of all its input transitions and the place p hold-conjunctions. The content of memory RG i Y can be described as a table. The table has two columns. First column is an address. It is described by selected variables q r Q. The second columns is an operation. The operation is represented by output variables that are under control of the considered SM-subnet. V. IMPLEMENTATION OF LOGIC CONTROLLER FOR SAFETY CRITICAL SYSTEMS The HDL description of control units A and B were obtained during the logic synthesis process. It is required to create additional comparator and top-level modules. The toplevel module is constructed based on architecture presented in figure 1. The comparator can be described in any HDL as a universal synchronous circuit with parameter N [19]. This parameter define the number of outputs of the controller. The comparator have to be synchronous because both control units could have different delays in setup of output signals. If comparator detect any differences on compared signals then it set value of status signal ERR to true and set all outputs of the controller to safety state (defined as low values of all outputs). Additionally it hold this output state until reset of control system. YT1 P1 [1] t1 XN1 [1] [2] [1] P2 MP1 MP2 t2 YV1 P4 [1, 2] t3 XF1 [1 2] YT2 MP3 P5 [1, 2] t4 XN2 YV1 P6 [1, 2] [3] t5 XF1 t9 MP5 [2] MP4 P7 [2] t6 YM P10 [2, 3] [2, 3] t7 XF4 MP6 YV3 P11 [2, 3] t8 XF3 P3 P9 P8 [2] [3] YV2 XF2 [3] VI. EXAMPLE OF APPLICATION The method of Logic Controller for Safety Critical Systems synthesis, described in the previous sections, is illustrated by its application on control algorithm described by Petri net PN 1 (Fig. 6). This Petri net describes control process of industrial mixer of aggregate content and water [20]. The Petri net PN 1 is initially colored using three colors and it has introduced macro places. Such Petri net can be an entry point to the both synthesis methods of dual synthesis. A. Application of Modular Logic Synthesis This synthesis method deals with macro Petri net. Firstly, boundary transitions are denoted based on definition (3): t 2 mp 1 and mp 2 and p 2 ; t 8 mp 6 and p 11 and XF 3 ; Precondition of local transitions which are located inside of macroplaces are denoted based on definition (2): t 1 mp 1 and p 1 and XN 1 ; t 3 mp 3 and p 4 and XF 1 ; t 9 mp 5 and p 9 and XF 2 ; Marking of global states (macroplaces) are denoted based on definition 1 mp 1 xor (t 5 xor t 2 2 mp 2 xor (t 8 xor t 2 6 mp 6 xor (t 6 xor t 8 ); Fig. 6. Example of colored interpreted Petri net PN 1 And marking of local places are denoted based on the same definition 1 (p 1 and mp 1 ) xor (t 5 xor t 1 2 (p 2 and mp 1 ) xor (t 1 xor t 2 11 (p 11 and mp 6 ) xor (t 7 xor t 8 ); Because places are encoded inside macroplaces there is required to check the current local and global states together to obtain full state of controller. After that the places can be encoded. One-Hot encoding is applied for macroplaces: mp 1 q 1 ; mp 2 q 2 ; mp 3 q 3 ; mp 4 q 4 ; mp 5 q 5 ; mp 6 q 6 ; And binary encoding is applied for local places: p 1 not q 7 ; p 2 q 7 ; p 3 q 8 ; p 4 not q 9 and not q 10 ; p 5 not q 9 and q 10 ; p 6 q 9 and not q 10 ; p 7 q 11 ; p 8 q 12 ; p 9 not q 12 ; p 10 not q 13 ; p 11 q 13 ; After that kind of encoding the preconditions of global transitions are as: t 2 q 1 and q 2 and q 7 and q 8 ; t 8 q 6 and q 13 and XF 3 ; 246

5 and local transitions are as: t 1 q 1 and not q 7 and XN 1 ; t 3 q 3 and not q 9 and not q 10 and XF 1 ; t 9 q 5 and not q 12 and XF 2 ; As a result of global state encoding, the changes of global places are described as 1 q 1 xor (t 5 xor t 2 2 q 2 xor (t 8 xor t 2 6 q 6 xor (t 6 xor t 8 ); As a result of local state encoding, the changes of local places are described as 7 (q 7 and q 1 ) xor (t 1 xor t 2 8 (q 8 and q 2 ) xor (t 8 xor t 2 13 (q 13 and q 6 ) xor (t 7 xor t 8 ); The description of all variables q is obtained based on D flipflop equation and only positive literals of the code are used on the left side of backward implication. The outputs are encoded only by local T 1 not q 7 T 2 not q 9 and q 10 M not q 13 ; The preferable way of controller rapid prototyping is hierarchical design from a formal assertion-based [21] behavioral description, using professional HDL syntax. One of the possible version of general template [22]. For pragmatic reasons the controller is realized as synchronous digital system with distributed state register q 1 q 13 and distributed output register Y T 1 Y M. All concurrently enabled transitions can fire independently, in any order. It is considered that after animation and classical analysis, the implemented interpreted Petri net is checked as safe, live, reversible and without conflicts, which are not solved [13], [12]. Anyway if some transitions of net would be in conflicts or net is not safe (1- bounded), the detected partial state of the net is frozen (state changes stop). B. Application of Architectural Synthesis This synthesis method deals with colored Petri net. Firstly, subnets have to be formatted. The first subnet consists of all places colored by color C 1. The second one has one double of macroplace mp 1. This double of macroplace replaces places p 4, p 5, and p 6 because these places have been already used in the first subnet. There is also created one double of macroplace mp 2 in the third subnet and it replaces places p 10, and p 11. It has to be mentioned that replication of sequential places by double of macroplace has also removed some transitions from received SM-subnet. Also output signals are now only under control of one SM-subnet. Then, the places could be encoded. As, M 0 = {p 1, p 3, p 9 }, places p 1, p 3, and p 9 receive codes equal to 0. The place TABLE I. OPERATION MEMORIES TABLES OF PETRI NET PN 1 Memory Y 1 Memory Y 2 Memory Y 3 Address Operation Address Operation Address Operation q 2q 1q 0 Y T 1Y T 2Y V 1 q 5q 4q 3 Y V 3Y M q 7q 6 Y V conjunctions represent the place codes and they are denoted as: p 1 = q 2 q 1 q 0, p 2 = q 2 q 1 q 0,, mp 2 = q 7 q 6. Each precondition of the transition is created as conjunction based on (7) and they are denoted as: t 1 = p 1 xn 1, t 2 = p 2 p 3,, t 9 = p 9 xf 2. Each place hold-conjunction is created as conjunction based on (8) and they are denoted as: hp 1 = t 1 p 1, hp 2 = t 2 p 2,, hmp 2 = t 8 mp 2. Next, logic equation describing combinational circuits can be formed. There have to be created equations for each D r variable based on (9). For example, the equation for D 0 is denoted as: D 0 = t 1 hp 2 t 3 hp 5. As the variable q 0 is equal to 1 in the code of places p 2, and p 5 the sum of equation D 0 consists of all input transition conjunctions of these places. In this case they are: t 1, and t 3. Additionally, there has to be added hold-condition for all places if the place code has to be stored in register for longer period than one clock cycle. Then, contents of operation memories can be formed. There is required to create separate table for each subnet. There are presented three such tables in table I. Finally, the logic circuit can be built. It can be also described with the use of any HDL in trivial way. C. Synthesis & Implementation Firstly, both obtained control unit model and top-level model with comparator have to be synthesized into specific FPGA device. This step have to be run three times, one for each control unit and one for top-level with comparator. During synthesis of top-level the control unit instances are treated as black boxes. As a result there will be obtained three netlists. These netlists are passed into implementation process. 247

6 Powered by TCPDF ( Resource TABLE II. SYNTHESIS OF PETRI NET PN 1 Utilization Model A Model B top-level Controller and comparator Slices Registers LUTs Block RAMs 3 3 Our example design was implemented into Xilnix Spartan 3E 100 device. The results of synthesis of each module and implementation of whole controller are presented in II VII. CONCLUSION Security and reliability are the most significant facts for the dependable controllers design [23]. In the presented approach two different models are obtained from the same specification. To ensure that two different synthesis methods are used: modular synthesis and architectural synthesis but other known can also considered [9], [24], [25]. In addition, different description styles are applied: assertion based [21], [26], [18] and structural RTL description [27], [28]. The advantages of this solution is possibility to obtain two different models from the same specification. The dual synthesis process is fully automated and it do not required any interaction from designer side. It allows to create whole architecture with redundant hardware of logic controllers for safety critical systems by one team of designers. In addition both control units utilizes different kind of resources of FPGA device. REFERENCES [1] E. Monmasson, L. Idkhajine, M. Cirstea, I. Bahri, A. Tisan, and M. Naouar, FPGAs in industrial control applications, IEEE Transactions on Industrial Informatics, vol. 7, no. 2, pp , [2] J. Tkacz and M. Adamski, Logic design of structured configurable controllers, in Proceedings of IEEE 3rd International Conference on Networked Embedded Systems for Every Application NESEA 12, Liverpool, United Kingdom, 2012, p. [6]. [3] A. Bukowiec and M. Adamski, Synthesis of Petri nets into FPGA with operation flexible memories, in Proceedings of the IEEE 15th International Symposium on Design and Diagnostics of Electronic Circuits and Systems DDECS 12, Tallinn, Estonia, 2012, pp [4], Synthesis of macro Petri nets into FPGA with distributed memories, International Journal of Electronics and Telecommunications, vol. 58, no. 4, pp , [5] W. A. Halang, M. Śnieżek, and S.-K. Jung, A real-time computing architecture for applications with high safety and predictability requirements, in 1st IEEE International Workshop on Real-Time Computing System and Applications RTCSA 94, Seoul, South Korea, 1994, pp [6] A. Bukowiec and M. Wȩgrzyn, Design of logic controllers for safety critical systems using FPGAs with embedded microprocessors, in Real-Time Programming A Proceedings volume from the 28th IFAC/IFIP Workshop WRTP 04, M. Colnaric, W. A. Halang, and M. Wȩgrzyn, Eds. Oxford: Elsevier, 2005, pp [7] T. Kozłowski, E. Dagless, J. Saul, M. Adamski, and J. Szajna, Parallel controller synthesis using Petri nets, IEE Proceedings Computers and Digital Techniques, vol. 142, no. 4, pp , [8] L. A. Cortés, P. Eles, and Z. Peng, Modeling and formal verification of embedded systems based on a Petri net representation, Journal of Systems Architecture, vol. 49, no , pp , [9] L. Gomes, A. Costa, J. Barros, and P. Lima, From Petri net models to VHDL implementation of digital controllers, in 33rd Annual Conference of the IEEE Industrial Electronics Society IECON 07. Taipei, Taiwan: IEEE, 2007, pp [10] M. Weber and E. Kindler, The Petri net markup language, in Petri Net Technology for Communication-Based Systems, ser. Lecture Notes in Computer Science, H. Ehrig, W. Reisig, G. Rozenberg, and H. Weber, Eds. Berlin/Heidelberg: Springer-Verlag, 2003, vol. 2472, pp [11] A. Wȩgrzyn, On decomposition of Petri net by means of coloring, in Proceedings of IEEE East-West Design & Test Workshop EWDTW 06, Sochi, Russia, 2006, pp [12] K. Jensen, K. Kristensen, and L. Wells, Coloured Petri nets and CPN tools for modelling and validation of concurrent systems, International Journal on Software Tools for Technology Transfer (STTT), vol. 9, no. 3, pp , [13] A. Karatkevich, Dynamic Analysis of Petri Net-Based Discrete Systems, ser. Lecture Notes in Control and Information Sciences. Berlin: Springer-Verlag, 2007, vol [14] J. Tkacz, State machine type colouring of Petri net by means of using a symbolic deduction method, Measurement Automation and Monitoring, vol. 53, no. 5, pp , [15] A. Karatkevich and R. Wiśniewski, Computation of Petri nets covering by SM-components based on the graph theory, Przegla d Elektrotechniczny, vol. 88, no. 8, pp , [16] Ł. Stefanowicz, M. Adamski, R. Wiśniewski, and J. Lipiński, Application of hypergraphs to SMCs selection, in Technological Innovation for Collective Awareness Systems, ser. IFIP Advances in Information and Communication Technology, L. Camarinha-Matos, N. Barrento, and R. Mendonça, Eds. Berlin/Heidelberg: Springer-Verlag, 2014, vol. 423, pp [17] A. Bukowiec, Synthesis of FSMs based on architectural decomposition with joined multiple encoding, International Journal of Electronics and Telecommunications, vol. 58, no. 1, pp , [18] M. Adamski and J. Tkacz, Formal reasoning in logic design of reconfigurable controllers, in Proceedings of 11th IFAC/IEEE International Conference on Programmable Devices and Embedded Systems PDeS 12, Brno, Czech Republic, 2012, pp [19] M. Zwoliński, Digital System Design with VHDL, 2nd ed. New Jersy: Prentice Hall, [20] L. Gniewek and J. Kluska, Hardware implementation of fuzzy Petri net as a controller, IEEE Transactions on Systems, Man, and Cybernetics Part B: Cybernetics, vol. 34, no. 3, pp , [21] H. Foster, A. Krolnik, and D. Lacey, Assertion-Based Design, 2nd ed. Norwell: Kluwer Academic Publishers, [22] M. Adamski and M. Wȩgrzyn, Petri nets mapping into reconfigurable logic controllers, Electronics and Telecommunications Quarterly, vol. 55, no. 2, pp , [23] M. Wȩgrzyn, Implementation of safety critical logic controller by means of FPGA, Annual Reviews in Control, vol. 27, no. 1, pp , [24] R. Wiśniewski, A. Barkalov, L. Titarenko, and W. Halang, Design of microprogrammed controllers to be implemented in fpgas, International Journal of Applied Mathematics and Computer Science, vol. 21, no. 2, pp , [25] M. Doligalski and M. Adamski, UML state machine implementation in FPGA devices by means of dual model and Verilog, in 11th IEEE International Conference on Industrial Informatics INDIN Bochum, Germany: IEEE, 2013, pp [26] M. Adamski, Formal logic design of reprogrammable controllers, in Design of Embedded Control Systems, M. Adamski, A. Karatkevich, and M. Wȩgrzyn, Eds. New York: Springer, 2005, pp [27] A. Bukowiec and M. Wȩgrzyn, Design of safety critical logic controller using devices integrated microprocessor with FPGA, in Photonics Applications in Astronomy, Communications, Industry, and High-Energy Physics Experiments III, ser. Proceedings of SPIE, R. S. Romaniuk, Ed. Bellingham, WA: SPIE, 2005, vol. 5775, pp [28] H. Kubátová, Finite state machine implementation in FPGAs, in Design of Embedded Control Systems, M. Adamski, A. Karatkevich, and M. Wȩgrzyn, Eds. New York: Springer, 2005, pp