Best Practices for Developing Real-time Embedded Systems
Development teams are always under pressure to deliver faster and at lower costs, but this is becoming more challenging as system complexity has risen exponentially with features for IoT and Machine Learning. The increased complexity can easily handcuff a development team and lead to not just longer development cycles with higher costs but also lower quality products.
In this session, we will explore best practices for developing real-time embedded systems that will help the modern developer stay on track and produce a quality product within their development cycle. We will explore best practices ranging from how to properly architect a system for scalability, how to manage a development cycle, secure and test a system. We will also discuss best practices for using frameworks and open source software.
The Bottom Line
Problem: Modern real-time embedded projects are growing in feature scope (IoT, ML, richer UIs) while budgets and schedules shrink, producing fragile, tightly coupled, hard-to-test systems that miss deadlines and carry high lifecycle costs.
Solution: Apply a disciplined, metrics-driven SDLC with architecture-first design (clear abstractions, SOLID-like principles), selective use and careful auditing of frameworks/open-source, and automated testing/CI pipelines that include on-target hardware tests. The talk gives pragmatic patterns and checklists to make this repeatable.
Technical Prerequisites
- Comfort programming in C and/or C++ (basic API design, modularity); familiarity with higher-level languages (Python) is helpful but not required.
- Understanding of RTOS concepts: tasks/threads, interrupts, synchronization primitives, and common RTOS trade-offs.
- Familiarity with version control workflows (Git/Bitbucket/GitLab/GitHub) and basic build systems/toolchains (cross-compilers, linker, flash tools).
- Basic software-engineering concepts: requirements → design → implementation → test → maintenance (SDLC), unit testing, and integration testing.
- Introductory knowledge of embedded security concepts (keys/certificates, threat modeling) and hardware isolation primitives (MPU, TrustZone) is useful for the security sections.
- Comfort reading architecture diagrams (component, layered, and data-flow diagrams) and simple UML is helpful for following the design advice.
Key Concepts
- Metrics-driven SDLC: Define simple, automated metrics (burndown, function size, cyclomatic complexity, test coverage, defect removal efficiency) and periodically audit the SDLC to tune process cost vs. value.
- Architecture-first & Abstraction: Design layered, modular architectures before coding. Use hardware and OS abstraction layers to minimize coupling and enable portability and reuse.
- Frameworks & OSS Selection: Use unbiased decision tools (K-T matrix) to choose frameworks; statically analyze and audit any third-party code you adopt and build exception documentation for non-compliant libraries.
- Automated Testing & CI/CD: Automate builds, static analysis, unit tests (TDD if possible), and include hardware-in-the-loop/on-target tests in CI. Don’t rely only on server-side tests—verify on real hardware.
Keywords
- SDLC — Software Development Life Cycle: requirements, design, construction, testing, maintenance; choose a model (waterfall, V-model, agile) appropriate to domain and regulation.
- SOLID — Set of design principles (Single responsibility, Open/Closed, Liskov substitution, Interface segregation, Dependency inversion) to improve modularity and extensibility.
- HAL — Hardware Abstraction Layer: an API layer isolating application code from vendor-specific registers and peripherals to ease porting.
- PSA — Platform Security Architecture: ARM’s framework for threat analysis, secure architecture, implementation, and certification for device security.
- K-T matrix — Kepner-Tregoe style weighted decision matrix used to evaluate and rank framework/RTOS options objectively.
- CI/CD — Continuous Integration/Continuous Deployment: automated build, test, and (optionally) release pipelines for rapid, repeatable verification.
- TDD — Test-Driven Development: write failing tests first, then implement code to pass them; helps build and maintain regression suites.
Toolbox
- Version control: Bitbucket, GitLab, GitHub (any Git hosting).
- Project management / planning: Jira, Wrike, Trac; time tracking: Harvest.
- CI / build servers: Jenkins (example used), or hosted CI providers.
- Unit test frameworks: CppUTest (example); other embedded test frameworks are applicable.
- Static analysis / complexity metrics: your compiler toolchain warnings, static analyzers (MISRA checks, cyclomatic complexity tools).
- UML / architecture tools: Enterprise Architect, Visual Paradigm.
- RTOS / middleware examples: FatFs (file system), ThreadX/FileX (middleware examples); evaluate via K-T matrix before selection.
- Hardware primitives: TrustZone, MPUs for hardware isolation and security layering.
Takeaway
After watching, you will be able to start (or improve) an auditable, metrics-driven SDLC that emphasizes architecture-first design with clear abstraction layers and an automated CI pipeline that includes on-target testing—reducing coupling, lowering cost of change, and improving time-to-market.
Final Note
Jacob Beningo’s talk is practical, well-paced, and grounded in years of embedded consulting across industries. He balances broad coverage with concrete, repeatable actions (metrics, SOLID-like design, K-T selection, CI with hardware tests) and emphasizes the discipline required to make best practices work in real teams. If you want actionable ways to make your next embedded project more predictable and maintainable, this session is worth your focused attention.
According to Jacob Beningo, what are the three levels where discipline is essential to make best practices effective?
Thanks!
Hi, Jacob. I've watched both of your presentations, and it's clear why your presentations are popular. Thanks for sharing knowledge and in an applicable manner :)
Other than that, hope it's not too late to put questions here: there is something I've been hearing since 2018 which is Secure Software Development Life Cycle (SSDLC). Basically, as developers we tend to be sloppy on leaving excessive or unwanted information in our source code. As an example, credentials like admin:admin hard-coded, or similar in test scripts... that may eventually hit production without noticing. Do you have any Best Practices for this/check-lists/follow-ups?
Thanks again for the good quality talk!
Hello Cesar,
Definitely no time limit on questions.
I haven't really put together a checklist on this aspect of SDLC yet. A few items that immediately come to mind though include:
- Change default passwords
- Disable JTAG/SWD
- Disable debug output and printf statements
- encrypt log data (don't store as plain text)
I hope that helps for now. I'll give it some more thought and post something to my website blog in the future. Great question!
Thank you Jacob for sharing this valuable informations.
Thanks Jacob,very useful information.
You're welcome! I'm glad that you found it helpful.
Really Big Thankful for you Jacob , it's awesome as usual
Thanks! I'm glad that you found it helpful!
Check out Jacob's Zoom meeting to discuss this presentation:
https://www.embeddedonlineconference.com/meeting/Live_Discussion_Best_Practices_for_Developing_Real-time_Embedded_Systems
I'm currently online to answer questions through the forum here and will be answering questions live on Zoom at 3 P.M. EDT using the login on the left.
We had a great Q&A session! Thank-you everyone who came and participated! It was a pleasure speaking with you!
Very informative as usual. Lot of new things to learn on. Thank you!
You're welcome!
Thank you for an excellent presentation! It was really fun and inspiring!
Regarding a primer of the packet parser, I'd say that its main problem is relying on a static state. And if you make it instantiable, then decoupling it from a CBUF is just natural: no one could attach a few parsers to a single UART :)
Yes the example is not meant to be a final solution but just to give ideas. The one I use in development is completely abstracted and can easily work across multiple devices.
Hi Jacob,
Thank you so much for sharing such valuable and informative information. I will surely try to follow your guidelines while designing embedded system.
You're welcome! Glad to you enjoyed it!
This methodology also applies to FPGA development.
Agreed. My only fault with this talk is that the name doesn't quite fit how broad it was in scope. Really great tips for embedded software developers in general!
Thanks! That’s good to know. I don’t do much with FPGAs so it’s always interesting to hear about differences and similarities. Thanks for the comment!
Thank you for sharing such valuable knowledge.
Very nice talk about SDLC. I really enjoyed the presentation and could ensure that we are doing most of the best practices you presented. Thank you very much!
Thanks! I'm glad to hear that you are following them .... you'd be surprised how many teams through-out the embedded space aren't following these ...
A really good talk, thanks. I enjoy your newsletter and blog posts too - always informative and well written.
Thanks! I'm glad to hear that you enjoy them and find the helpful!
Very interesting talk! I found the use of software metrics very interesting, where can I find more details on some of these? I'm particularly interested in defect removal efficiency.
A good source for these software metrics and software quality studies in general is Capers Jones such as "The Economics of Software Quality". Others you can learn just by getting a static analysis tool that will provide code quality reports. You read through and understand each one and what you want to measure and go from there. (Be warned, there are probably hundreds but measuring just a dozen or less can go a long ways).
Thanks Jacob! Great workshop. Every firmware developer should take your workshops.
Thanks!
Good speaker. Good refresh !
Thanks! I hope that you have some great take-a-ways to go back to the "office" with.
I am so blown away. I have never invested into going to these conferences in the past due to the perceived opportunity cost of travel and time off from work but I have spent 10X $ on 1/10 amount of education. Amazing job to everyone who put this together and presented today so far.
Thanks! We greatly appreciate it! Enjoy the rest of the conference!
SOLID Principles -- Bob Martin @ Object Mentor
This was actually developed by Michael Feathers but Bob Martin has spoken about it quite a bit. Michael was who I could not remember.
At 47:11, we are much better at processing visual data than a list of numbers. Plotting the numbers in a radar chart can really help everyone understand the data.
Thanks. This is there to show what the process looks like not show the results for the process. Attendees can duplicate a table similar to that in order to evaluate and arrive at a decision. The radar chart in this instance doesn't help with the data generation process across multiple developers and weighting their results. It would be useful for a single developer trying to rate each category in general.
Uncle Bob (Robert Martin) - "Clean Code" book and other articles uses the S.O.L.I.D ordering among others. Really appreciate his focus on each of the programming paradigms is removing (restricting) freedom to avoid bad coding habits.
I have not read that one but there are lots of articles out there around SOLID principles.
clickable link: https://www.surveymonkey.com/r/D6ZH87G
Thanks! Brilliant!
I'm looking forward to answering any questions you might have! Due to the time limit, there obviously were only so many best practices I could discuss. If you have questions around specific areas, please feel free to ask about them.










I really enjoyed this talk. Thanks for sharing!