Multi-task scheduling method and system of safety controller

Abstract

The invention provides a multi-task scheduling method and system of a safety controller. Belongs to the technical field of industrial automation control. According to the method, aiming at a multiple redundancy safety controller, under the environment of not depending on a universal operating system, an external hardware synchronous clock is introduced to send a unified interrupt signal to each system of CPU, so that microsecond-level redundancy synchronous operation is realized; dividing a CPU control period into a basic function task and a plurality of user control tasks by adopting a static time slice rotation strategy; a counter in an interrupt service program is used for directly controlling task switching, and a complex scheduling algorithm is not needed; and meanwhile, through a data processing mechanism of memory partitioning and'centralized carrying-independent execution ', the inter-task data consistency without mutual exclusion locks is realized. According to the method, the problems of dependence on an expensive and safe operating system, difficulty in multi-system synchronization, deadlock risk and the like in the prior art are solved, and the minimum 5ms control period is realized while the cost is greatly reduced.

Description

Technical Field

[0001] This invention relates to the field of industrial automation control technology, and in particular to a multi-task scheduling method and system for a safety controller. Background Technology

[0002] Safety controllers are core devices in industrial automation systems, widely used in petrochemical, rail transportation, and emergency stop (ESD) systems. Their core requirements are high reliability and fail-safety. They are typically designed according to the IEC 61508 standard and feature redundant architectures such as 1oo2 (one of two options) or 2oo3 (two of three options).

[0003] Existing safety controllers face the following main challenges when implementing multitasking (i.e., running control logic in different cycles simultaneously): 1. Reliance on expensive operating systems: Traditional solutions typically rely on real-time operating systems (RTOS) for multitasking. Since security controllers require SIL (Security Integrity Level) certification, the operating system used must also undergo rigorous certification (such as VxWorks RTOS). This not only results in extremely high costs, but also means that if domestically produced or niche operating systems are used, their reliability often lacks long-term verification.

[0004] 2. Performance bottleneck caused by pseudo-multitasking: Another common "bare-metal" solution is to use a single-task large loop. That is, the controller sets a minimum cycle (e.g., 50ms), and all logic must be completed within this cycle. This causes the controller's response speed to be limited by the slowest task, making it unable to support fast control loops such as 5ms or even faster, and resulting in low CPU resource utilization.

[0005] 3. Redundancy Synchronization Difficulty: In multi-CPU redundant architectures, relying on internal CPU timers for task switching can lead to drift. Due to crystal oscillator temperature drift and accumulated errors, it is difficult for CPUs in different systems to maintain microsecond-level synchronization, resulting in redundancy voting failure.

[0006] Therefore, there is an urgent need for a security controller multi-task scheduling scheme that is not dependent on commercial operating systems, has low cost, high real-time performance, and can guarantee strict synchronization among multiple systems. Summary of the Invention

[0007] The present invention aims to solve the above-mentioned technical problems and provides a multi-task scheduling method and system for a security controller. In an environment without an operating system, it achieves highly deterministic and highly secure multi-task processing by combining hardware assistance with static time slice scheduling.

[0008] The first aspect of this invention discloses a multi-task scheduling method for a security controller, applied to a multi-redundant security controller, wherein the controller does not depend on a general-purpose operating system, characterized in that the method includes the following steps: Synchronous operation steps: Periodic hardware interrupt signals are sent simultaneously to each CPU of the redundant safety controller through an external hardware synchronization clock as the reference clock for synchronous operation of each CPU. Task allocation steps: Divide a complete CPU control cycle into multiple time slices, and define basic function tasks and at least one user control task. The basic function tasks and user control tasks each occupy a preset number of time slices. Task switching steps: In the interrupt service routine triggered by the hardware interrupt signal, maintain an interrupt counter and determine whether the task switching time point has been reached based on the current interrupt count value; if it has been reached, save the current task context and switch to the next task. Data consistency processing steps: An independent data storage area is divided between the basic functional tasks and the user control tasks. The basic functional tasks perform centralized copying and mapping of data before and after the execution of each task to achieve data isolation between tasks without mutual exclusion locks.

[0009] Preferably, the task allocation step specifically includes: If the total duration of the CPU control cycle is set to T, and the period of the hardware interrupt signal is t, then one CPU control cycle contains N = T / t time slices. The basic functional task is configured to be executed at the beginning of each CPU control cycle, occupying M time slices; Allocate the remaining NM time slices to one or more user-controlled tasks; The basic functional tasks are used to perform I / O scanning, redundant inter-system data exchange and voting, fault diagnosis and communication functions.

[0010] Preferably, the task switching step specifically includes: When the basic function task begins execution, the interrupt counter is reset to its initial value; The interrupt counter increments for each hardware interrupt signal received. When the interrupt count equals the number of time slices allocated to the current task, a task switch operation is triggered, jumping to the entry address of the next task, resetting the interrupt counter, and starting the time slice statistics for the next task.

[0011] Preferably, the method further includes a time window security check step, specifically including: Interrupt interval check: Record the current interrupt time in the interrupt service routine, calculate the difference between it and the previous interrupt time, and determine whether the difference is within the first preset tolerance range; Task duration check: When a task switch occurs, calculate the actual execution time of the current task and determine whether the actual execution time is within the second preset tolerance range; If any of the above checks fail, the watchdog feeding operation will stop, triggering a hardware watchdog reset and putting the controller into a safe state.

[0012] Preferably, in the data consistency processing step, the data storage area is divided as follows: Basic function data area: Stores all physical input variables, physical output variables, and global mapping variables; Each user task has its own independent input variable area, output variable area, and internal calculation variable area; The physical addresses of the data areas of each user task do not overlap, and the user-controlled task can only access its own corresponding data area.

[0013] Preferably, the specific execution logic of the data consistency processing step is as follows: Before executing any user control task, the basic function task copies the relevant input data from the basic function data area to the input variable area of ​​the user control task, and updates the source variable values ​​in the variable mapping relationship to the destination variable. After any user control task is completed, the basic function task reads back the data from the output variable area and internal calculation variable area of ​​the user control task to the basic function data area. During the execution of user-controlled tasks, each task uses an independent copy of the data for computation and does not perform direct data access across regions.

[0014] Preferably, the variable mapping relationship is predefined by the user and used for data transfer between different user control tasks; When the variables of the first user control task need to be passed to the second user control task, the basic function task performs unidirectional assignment between the execution of the two tasks. This ensures that even if the variables of the first user control task change during the execution of the second user control task, the copy of the variables held by the second user control task remains unchanged until the next CPU control cycle.

[0015] Preferably, the multi-redundant safety controller is a dual (1oo2), triple (2oo3) architecture or an N-fold (N≥2) redundancy architecture; the external hardware synchronization clock is independent of each CPU system, and each CPU system performs handshake synchronization at a fixed time in each CPU control cycle.

[0016] Preferably, the control cycle of the user control task is configured to be an integer multiple of the CPU control cycle; when the actual execution time of the user control task is less than the allocated time slice, the CPU performs idle operation or background diagnostic task in the remaining time slice.

[0017] A second aspect of this invention discloses a multi-task scheduling system for a security controller; the system includes: An external hardware synchronization clock is used to generate interrupt signals at a fixed frequency; The redundant processing unit includes at least two independent CPUs, each of which receives the interrupt signal. A memory storing executable instructions that, when executed by a CPU, implement the multitasking scheduling method as described in any one of claims 1 to 9; The partitioned storage module is used to divide the physical memory into mutually isolated basic functional data areas and multiple user task data areas.

[0018] The beneficial effects of this invention are as follows: 1. Low cost and high degree of autonomy and controllability: No need to purchase expensive security-certified operating systems, reducing BOM costs, and complete control over the core scheduling code, making it easy to pass security certification.

[0019] 2. High real-time performance and determinism: Supports control cycles as short as 5ms or even shorter. Static scheduling eliminates the uncertainty and jitter of the OS scheduler, meeting hard real-time requirements.

[0020] 3. Strict redundancy synchronization: Based on external hardware clock and interrupt count, it ensures that multiple CPUs maintain consistent pace at the microsecond level, ensuring the accuracy of redundant voting.

[0021] 4. High security: The lockless design avoids race conditions and deadlocks; time window monitoring ensures that timing faults can be captured in real time. Attached Figure Description

[0022] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0023] Figure 1 This is a flowchart of a multi-task scheduling method for a security controller according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the hardware synchronization architecture of the multi-redundant safety controller in an embodiment of the present invention; Figure 3 This is a schematic diagram of task time slice allocation within the CPU control cycle in an embodiment of the present invention; Figure 4 This is a flowchart of task switching based on interruption counting in an embodiment of the present invention; Figure 5 This is a schematic diagram of data partitioning and data flow in an embodiment of the present invention; Figure 6 This is a timing diagram of task execution and data copying in an embodiment of the present invention; Figure 7 A schematic diagram of the structure of a multi-task scheduling system for a security controller according to an embodiment of the present invention. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0025] The first aspect of this invention discloses a multi-task scheduling method for a security controller.

[0026] Example 1: Figure 1 This is a flowchart of a multi-task scheduling method for a security controller according to an embodiment of the present invention, such as... Figure 1 As shown, The method is applied to a multi-redundant safety controller that does not depend on a general-purpose operating system, and the method includes the following steps: Step S1 Synchronization Operation Step: Periodic hardware interrupt signals are sent simultaneously to each CPU of the redundant safety controller through an external hardware synchronization clock as the reference clock for the synchronous operation of each CPU. Conventional multitasking scheduling typically relies on tick interrupts generated by internal CPU timers. However, in a multi-redundant controller, multiple CPUs operate independently. If the scheduling still relies on the internal timer interrupts of each CPU, the following problems arise: with independent hardware, it is difficult for the internal timers of each CPU to generate tick interrupts simultaneously; even if a CPU synchronizes its internal timer with other running CPUs upon power-up, temperature drift or accumulated time errors will still lead to inconsistencies in the ticks among the CPUs, thus failing to meet the synchronous scheduling requirements of the multi-redundant controller.

[0027] Therefore, this solution adds an external hardware synchronization clock as an external unified "beat," and each CPU of the redundant controller can obtain the same count from this hardware clock; at the same time, this hardware clock provides interrupts to each CPU of the redundant controller at a fixed frequency.

[0028] The firmware of each CPU is agreed to be at a fixed time (e.g.) Figure 2 A new CPU cycle begins at T1+nT, ultimately ensuring that the two systems execute CPU user control logic synchronously.

[0029] Step S2 Task Allocation Step: Divide a complete CPU control cycle into multiple time slices, and define basic function tasks and at least one user control task. The basic function tasks and user control tasks each occupy a preset number of time slices. In step S2, the task allocation step specifically includes: If the total duration of the CPU control cycle is set to T, and the period of the hardware interrupt signal is t, then one CPU control cycle contains N = T / t time slices. The basic functional task is configured to be executed at the beginning of each CPU control cycle, occupying M time slices; Allocate the remaining NM time slices to one or more user-controlled tasks; The basic functional tasks are used to perform I / O scanning, redundant inter-system data exchange and voting, fault diagnosis and communication functions.

[0030] In some specific embodiments, the system supports the execution of multiple user control logics. Taking support for two user control logics as an example, the CPU firmware is divided into three tasks: a basic task (RTS); UP1 is a task used to execute user control logic 1; and UP2 is a task used to execute user logic 2. These three tasks run sequentially in a cycle, in the following order: RTS task 1, UP11, UP21, RTS task 2, UP12, UP22, RTS task 3, and so on. Each cycle (referred to as a CPU cycle) includes one RTS task, one UP1 task, and one UP2 task.

[0031] The total CPU cycle duration is 5ms, of which 3ms is allocated to the RTS task, and 1.5ms (UP1) and 0.5ms (UP2) are allocated to the UP1 and UP2 tasks, respectively. This time slice allocation ratio is not fixed and can be adjusted during controller design based on actual needs. For example, if the execution time of user control logic in a certain controller is long, the RTS time slice can be shortened, while the UP (UP1, UP2) time slices can be extended. The duration of these tasks is guaranteed by the time slice allocation. Since the external hardware clock provides interrupts to each CPU of the redundant controller simultaneously at a fixed frequency, under the above time slice allocation requirements, this frequency can be designed to be once every 0.5ms, meaning the interval between two interrupts represents one time slice. The RTS task occupies 6 time slices, the UP1 task occupies 3 time slices, and the UP2 task occupies 1 time slice.

[0032] The specific details of each task are as follows: The RTS task is used to implement the controller's basic functions, including I / O scanning, data exchange and voting between systems, fault diagnosis, and communication with the host computer. To ensure the integrity of these basic functions, they must be completed within a single RTS task time slice (i.e., executed once per CPU cycle). The controller also has an internal program flow monitoring system; if a task is not completed within its time slice, a system alarm will be generated.

[0033] Tasks UP1 and UP2 are used to execute user control logic. This user control logic does not need to be completed within a single UP task time slice and can be split across multiple CPU cycles. The control cycles for UP1 and UP2 are multiples of 5ms. For a single UP, the minimum control cycle (considering only execution time) can be obtained based on the estimated execution time and the allocated time slice size. If the user-configured control cycle is longer than the minimum control cycle, the excess time is idle. An example is shown below. Figure 3 As shown: (The control cycle of user task 1 is 10ms, and the execution time is 2ms; the control cycle of user task 2 is 20ms, and the execution time is 1.5ms.) Step S3 Task Switching Step: In the interrupt service routine triggered by the hardware interrupt signal, maintain an interrupt counter and determine whether the task switching time node has been reached based on the current interrupt count value; if it has been reached, save the current task context and switch to the next task. In step S3, the task switching step specifically includes: When the basic function task begins execution, the interrupt counter is reset to its initial value; The interrupt counter increments for each hardware interrupt signal received. When the interrupt count equals the number of time slices allocated to the current task, a task switch operation is triggered, jumping to the entry address of the next task, resetting the interrupt counter, and starting the time slice statistics for the next task.

[0034] The method also includes a time window security check step, specifically including: Interrupt interval check: Record the current interrupt time in the interrupt service routine, calculate the difference between it and the previous interrupt time, and determine whether the difference is within the first preset tolerance range; Task duration check: When a task switch occurs, calculate the actual execution time of the current task and determine whether the actual execution time is within the second preset tolerance range; If any of the above checks fail, the watchdog feeding operation will stop, triggering a hardware watchdog reset and putting the controller into a safe state.

[0035] In some specific embodiments, task switching is mainly implemented in the interrupt handler. As mentioned earlier, the hardware synchronization clock simultaneously sends interrupts to both CPUs of the security controller, and the interval between interrupts, which is the size of the CPU time slice, is 0.5ms.

[0036] The interrupt handler determines whether a task switch is needed based on the interrupt count and the synchronization clock. An example of an interrupt handler switching from the RTS to the UP1 task is as follows: Step 31: After the interrupt handler switches to the RTS task for the first time, it sets the interrupt count to 0; Step 32: The interrupt handler increments the interrupt count by 1 for each interrupt received; Step 33: Since the time slice allocated to RTS is 3ms, when the interrupt handler receives 6 interrupts, that is, when the interrupt count is 6, it determines that the switch from RTS task to UP1 task should be completed in this interrupt. Step 34: The interrupt handler switches to task UP1 according to the task switching process, such as saving the context and jumping the program counter. Step 35: The interrupt handler resets the interrupt count to 0 and repeats the above steps; Typically, multitasking scheduling does not prioritize interrupt timeliness. However, in multi-redundant safety controllers, interrupt timeliness directly impacts the timeliness of task switching across CPUs and the synchronous execution of user control logic, thus affecting functional safety requirements. Therefore, during task switching, a time window check is performed to detect interrupt loss or duplication errors.

[0037] The time window check includes two aspects: On one hand, the interrupt handler checks whether the time interval between two interrupts is within the range of 0.5ms ± 25us. The checking process is as follows: 1. The interrupt handler will read the current time at the very beginning.

[0038] 2. Determine whether the difference between the current time and the previous time (the time recorded when the previous interrupt handler started) is within the range of 0.5ms ± 25us.

[0039] 3. If the difference meets the requirements, the current time will be recorded as the previous time.

[0040] 4. If the difference does not meet the requirements, it will enter an infinite loop, that is, stop feeding the hardware watchdog and reset the system by the hardware watchdog.

[0041] On the other hand, the interrupt handler checks whether the time difference between the start and end of the current task meets the time slice length of that task during task switching. The checking process is as follows: 1. For example, as shown in step 3 above, the interrupt handler finds that the interrupt count is 6, and determines that the switch from the RTS task to the UP1 task should be completed in this interrupt.

[0042] 2. Determine whether the difference between the current time and the previous time (the time recorded during the previous switch) is within the range of 3ms ± 25us.

[0043] 3. If the difference meets the requirements, the current time will be recorded as the previous time.

[0044] 4. If the difference does not meet the requirements, it will enter an infinite loop, that is, stop feeding the hardware watchdog and reset the system by the hardware watchdog.

[0045] If each CPU of the redundant controller detects an error in the time window, the entire system is guided to a safe state, thus meeting the functional safety requirements.

[0046] The process of task switching and time window checking is as follows: Figure 4 As shown.

[0047] Step S4: Data consistency processing step: An independent data storage area is divided between the basic function task and the user control task. The basic function task performs centralized copying and mapping of data before and after the execution of each task to achieve data isolation between tasks without mutual exclusion locks.

[0048] In step S4, during the data consistency processing step, the data storage area is divided as follows: Basic function data area: Stores all physical input variables, physical output variables, and global mapping variables; Each user task has its own independent input variable area, output variable area, and internal calculation variable area; The physical addresses of the data areas of each user task do not overlap, and the user-controlled task can only access its own corresponding data area.

[0049] In step S4, the specific execution logic of the data consistency processing step is as follows: Before executing any user control task, the basic function task copies the relevant input data from the basic function data area to the input variable area of ​​the user control task, and updates the source variable values ​​in the variable mapping relationship to the destination variable. After any user control task is completed, the basic function task reads back the data from the output variable area and internal calculation variable area of ​​the user control task to the basic function data area. During the execution of user-controlled tasks, each task uses an independent copy of the data for computation and does not perform direct data access across regions.

[0050] In step S4, the variable mapping relationship is predefined by the user and used for data transfer between different user control tasks; When the variables of the first user control task need to be passed to the second user control task, the basic function task performs unidirectional assignment between the execution of the two tasks. This ensures that even if the variables of the first user control task change during the execution of the second user control task, the copy of the variables held by the second user control task remains unchanged until the next CPU control cycle.

[0051] In multi-task industrial controllers, data consistency typically refers to the non-interference of variables among multiple user control logics. This solution incorporates the following technical requirements to ensure data consistency.

[0052] 1. Users can define custom variables for User Control Logic 1 and User Control Logic 2, and there are no shared variables between them. Each task has its own variable area, and the two variable areas are independent and do not overlap. Variables for each task can only be accessed within that task. That is, the variables used when UP1 is executed are completely different from the variables used when UP2 is executed.

[0053] 2. If users expect shared variables across different user control logics, variable mapping can be used instead. The mapping relationship is specified by the user in the programming tool. For example, if UP1 has variable A, and UP2 wants to use this variable, it can define variable B and specify it as A->B; similarly, if UP2 has variable C, and UP1 wants to use this variable, it can define variable D and specify it as C->D. In the following description, A and C are source variables, and B and D are destination variables.

[0054] 3. For UP1 and UP2, which define the above mapping relationship A->B, even if the variable A in UP1 changes during the execution of UP2, the variable B in UP2 will not change accordingly.

[0055] Based on the above technical requirements, the CPU data area is divided into three independent areas: UP1 data area (including UP1 input variables, output variables, and UP1 operation variables), UP2 data area (including UP2 input variables, output variables, and UP1 operation variables), and RTS data area (including all input variables, all output variables, UP1 operation variables, and UP2 operation variables). UP1 tasks use the UP1 data area, UP2 tasks use the UP2 data area, and RTS tasks use the RTS data area.

[0056] Before the UP1 task executes, the RTS task copies the input data from area I of the RTS data area to area I of the UP1 data area. At the same time, it assigns the source variables of the variable mapping to the destination variables of the variable mapping (as shown by the yellow arrow on the left side of the figure below, that is, assigning the value of variable D to variable C). On the other hand, after the UP1 task completes the execution of the user control logic, the RTS task copies the Q area (output variables) and UP1 area (UP1 variables) of the UP1 data area to the corresponding data area of ​​the RTS data area. This process does not require saving the source variables of the variable mapping separately, because the UP1 area (UP1 variables) already contains all the source variables of the variable mapping, that is, it contains variable A.

[0057] Similarly, before the UP2 task executes, the RTS task copies the input data from the I area of ​​the RTS data area to the I area of ​​the UP2 data area, and at the same time assigns the source variable of the variable mapping to the destination variable of the variable mapping (as shown by the yellow arrow on the right side of the figure below, that is, assigning the value of variable A to variable B). On the other hand, after the UP2 task completes the execution of the user control logic, the RTS task copies the Q area (output variable) and the UP2 area (UP2 variable) of the UP2 data area to the corresponding data area of ​​the RTS data area. The UP2 area (UP2 variable) also contains the source variable of the variable mapping, that is, it contains the source variable D.

[0058] The data area allocation and mapping process is as follows: Figure 5 As shown.

[0059] The timing relationship between data area copying and UP task execution is as follows: Figure 6 As shown: In the above technical solution, UP1 and UP2 use independent copies during execution, while the RTS task is responsible for the unified data transfer. This ensures that UP1 and UP2 do not need to worry about inconsistencies in critical data during execution. Therefore, there is no need to design additional "mutex" or "semaphore" to protect shared data, avoiding complex deadlock problems in an OS-less environment and improving security and determinism.

[0060] Furthermore, the multi-redundant safety controller is a dual (1oo2), triple (2oo3), or N-redundant (N≥2) architecture; the external hardware synchronization clock is independent of each CPU system, and each CPU system performs handshake synchronization at a fixed time in each CPU control cycle. The control cycle of the user control task is configured to be an integer multiple of the CPU control cycle; when the actual execution time of the user control task is less than the allocated time slice, the CPU performs idle operations or background diagnostic tasks in the remaining time slice.

[0061] Example 2: System Architecture and Synchronization Mechanism like Figure 2 As shown, this embodiment employs a dual (1002) redundant safety controller architecture, comprising CPUA and CPUB. To address the issue of clock inconsistency between the two CPU systems, an independent external hardware synchronization clock source (such as one based on an FPGA or a high-precision crystal oscillator circuit) is introduced. This clock source simultaneously sends signals to the external interrupt pins of both CPUA and CPUB at a fixed frequency (set to 2kHz in this embodiment, i.e., period t=0.5ms). The firmware of both CPU systems is configured to simultaneously initiate a new control cycle upon receiving the Nth interrupt, thereby eliminating accumulated errors and ensuring strict synchronous operation of the two systems.

[0062] Example 3: Task Allocation Strategy like Figure 3 As shown, the system defines a minimum control cycle (CPU cycle) of 5ms. The external interrupt cycle is 0.5ms, therefore one CPU cycle contains 10 time slices (Ticks).

[0063] The tasks are divided into: 1. RTS Task (Basic Functions): Responsible for IO refresh, inter-system communication, voting, etc. Allocates the first 6 time slices (3ms). 2. UP1 task (user logic 1): Allocate the next 3 time slices (1.5ms).

[0064] 3. UP2 task (user logic 2): Allocate the last time slice (0.5ms).

[0065] If user logic UP1 actually only requires 1ms to execute, the CPU will execute an idle loop or background self-test during the remaining 0.5ms time slice until the interrupt counter is forcibly switched to UP2. This static allocation ensures the predictability of CPU load.

[0066] Example 4: Task Switching and Time Window Check like Figure 4 As shown, task switching is entirely completed in the interrupt service routine (ISR), without the need for a complex task scheduler.

[0067] The ISR logic is as follows: 1. Time window check (watchdog mechanism): Read the current hardware timer time Tnow.

[0068] Calculate ΔT=Tnow Tlast_int.

[0069] Determine whether ΔT is within the range of 0.5ms ± 25μs.

[0070] If the error exceeds the specified range, it indicates a hardware clock malfunction or CPU malfunction. Stop feeding the watchdog and reset the controller if the hardware watchdog times out (Fail-Safe).

[0071] If everything is normal, update Tlast_int=Tnow.

[0072] 2. Task scheduling logic: Interrupt counter Counter++.

[0073] If the current task is an RTS task and Counter==6: save the RTS context, restore the UP1 context, clear Counter, and set the current state to UP1.

[0074] If the current task is UP1 and Counter==3: save the UP1 context, restore the UP2 context, clear Counter, and set the current state to UP2.

[0075] If the current task is UP2 and Counter == 1: Save the UP2 context, restore the RTS context, clear Counter, set the current state to RTS, and enter the next 5ms cycle.

[0076] At the switching point, the total task duration is also checked (e.g., check if RTS has actually run for 3ms). If the deviation is too large, a safety reset is triggered.

[0077] Example 5: Data Consistency and Lock-Free Design like Figure 5 and Figure 6 As shown, in order to avoid data inconsistency caused by multi-task contention and to avoid using mutexes that may lead to deadlock, this invention adopts a strategy of "three-zone isolation + centralized transfer".

[0078] The memory is physically divided into: RTS data area (global), UP1 data area (private), and UP2 data area (private).

[0079] Data flow process: 1. RTS Phase: The RTS task reads physical input from the IO module and writes it to the I-image area of ​​the RTS data area.

[0080] 2. UP1 preparation phase: Before starting the UP1 task (or at the end of RTS), the RTS task copies the relevant inputs from the RTS area to the I area of ​​the UP1 area; at the same time, it processes variable mapping (such as mapping the output variables of UP2 to the inputs of UP1).

[0081] 3. UP1 execution phase: The UP1 task only reads and writes the UP1 data area and is completely unaware of the existence of RTS or UP2.

[0082] 4. UP1 End Phase: The RTS task reads back the Q area (output) and intermediate variables of the UP1 area to the RTS data area.

[0083] 5. UP2 phase: Similarly, use a separate copy.

[0084] For example, a user defines a mapping A→B (variable A belongs to UP1, variable B belongs to UP2). During the execution of UP2, even if the logic of UP1 causes a sudden change in A, the variable B in UP2 will not change accordingly. This is because UP2 uses a copy of B prepared in the previous RTS phase, and the value of B in UP2 remains unchanged. B will only be updated in the RTS phase of the next CPU cycle. This mechanism ensures the atomicity and consistency of data within a single cycle.

[0085] The scope of protection of this invention is not limited to the above embodiments. Any technical solution based on the core idea of ​​this invention, which utilizes external interrupt counting for static time-slice scheduling and employs a data isolation copy mechanism, should fall within the scope of protection of this invention.

[0086] In summary, compared to operating system solutions employing complex preemptive scheduling strategies, this invention utilizes static time-slice round-robin scheduling and deterministic interrupt counting scheduling, resulting in a highly linear and predictable execution flow. This deterministic architecture significantly simplifies the analysis of worst-case execution time and eliminates the risks of random failures such as priority inversion and resource starvation. When undergoing functional safety standard certifications such as IEC 61508, this concise and fully traversable logical structure is more likely to pass static code analysis and coverage testing, thereby shortening product development cycles and reducing certification costs.

[0087] The second aspect of the present invention discloses a multi-task scheduling system for a security controller. Figure 7 This is a structural diagram of a multi-task scheduling system for a security controller according to an embodiment of the present invention; as shown below. Figure 7 As shown, the system 100 includes: An external hardware synchronization clock 101 is used to generate an interrupt signal at a fixed frequency. The redundant processing unit 102 includes at least two independent CPUs, each of which receives the interrupt signal. The memory 103 stores executable instructions, which, when executed by the CPU, implement the multitasking scheduling method described in any of the first aspects; The partitioned storage module 104 is used to divide the physical memory into mutually isolated basic functional data areas and multiple user task data areas.

[0088] Please note that the technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments have been described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification. The above embodiments only illustrate several implementation methods of this application, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the invention patent. It should be pointed out that for those skilled in the art, several modifications and improvements can be made without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A multi-task scheduling method for a safety controller, applied to a multi-redundant safety controller, wherein the controller does not depend on a general-purpose operating system, characterized in that, The method includes the following steps: Synchronous operation steps: Periodic hardware interrupt signals are sent simultaneously to each CPU of the redundant safety controller through an external hardware synchronization clock as the reference clock for synchronous operation of each CPU. Task allocation steps: Divide a complete CPU control cycle into multiple time slices, and define basic function tasks and at least one user control task. The basic function tasks and user control tasks each occupy a preset number of time slices. Task switching steps: In the interrupt service routine triggered by the hardware interrupt signal, maintain an interrupt counter and determine whether the task switching time point has been reached based on the current interrupt count value; if it has been reached, save the current task context and switch to the next task. Data consistency processing steps: An independent data storage area is divided between the basic functional tasks and the user control tasks. The basic functional tasks perform centralized copying and mapping of data before and after the execution of each task to achieve data isolation between tasks without mutual exclusion locks.

2. The multi-task scheduling method for a security controller according to claim 1, characterized in that, The task allocation steps specifically include: If the total duration of the CPU control cycle is set to T, and the period of the hardware interrupt signal is t, then one CPU control cycle contains N = T / t time slices. The basic functional task is configured to be executed at the beginning of each CPU control cycle, occupying M time slices; Allocate the remaining NM time slices to one or more user-controlled tasks; The basic functional tasks are used to perform I / O scanning, redundant inter-system data exchange and voting, fault diagnosis and communication functions.

3. The multi-task scheduling method for a security controller according to claim 1, characterized in that, The task switching steps specifically include: When the basic function task begins execution, the interrupt counter is reset to its initial value; The interrupt counter increments for each hardware interrupt signal received. When the interrupt count equals the number of time slices allocated to the current task, a task switch operation is triggered, jumping to the entry address of the next task, resetting the interrupt counter, and starting the time slice statistics for the next task.

4. The multi-task scheduling method for a security controller according to claim 1, characterized in that, The method also includes a time window security check step, specifically including: Interrupt interval check: Record the current interrupt time in the interrupt service routine, calculate the difference between it and the previous interrupt time, and determine whether the difference is within the first preset tolerance range; Task duration check: When a task switch occurs, calculate the actual execution time of the current task and determine whether the actual execution time is within the second preset tolerance range; If any of the above checks fail, the watchdog feeding operation will stop, triggering a hardware watchdog reset and putting the controller into a safe state.

5. The multi-task scheduling method for a security controller according to claim 1, characterized in that, In the data consistency processing step, the data storage area is divided as follows: Basic function data area: Stores all physical input variables, physical output variables, and global mapping variables; Each user task has its own independent input variable area, output variable area, and internal calculation variable area; The physical addresses of the data areas of each user task do not overlap, and the user-controlled task can only access its own corresponding data area.

6. The multi-task scheduling method for a security controller according to claim 5, characterized in that, The specific execution logic of the data consistency processing step is as follows: Before executing any user control task, the basic function task copies the relevant input data from the basic function data area to the input variable area of ​​the user control task, and updates the source variable values ​​in the variable mapping relationship to the destination variable. After any user control task is completed, the basic function task reads back the data from the output variable area and internal calculation variable area of ​​the user control task to the basic function data area. During the execution of user-controlled tasks, each task uses an independent copy of the data for computation and does not perform direct data access across regions.

7. The multi-task scheduling method for a security controller according to claim 6, characterized in that, The variable mapping relationship is predefined by the user and is used for data transfer between different user control tasks; When the variables of the first user control task need to be passed to the second user control task, the basic function task performs unidirectional assignment between the execution of the two tasks. This ensures that even if the variables of the first user control task change during the execution of the second user control task, the copy of the variables held by the second user control task remains unchanged until the next CPU control cycle.

8. The multi-task scheduling method for a security controller according to claim 1, characterized in that, The multi-redundant safety controller is a dual, triple, or N-fold redundancy architecture; the external hardware synchronization clock is independent of each CPU system, and each CPU system performs handshake synchronization at a fixed time in each CPU control cycle.

9. The multi-task scheduling method for a security controller according to claim 2, characterized in that, The control cycle of the user control task is configured to be an integer multiple of the CPU control cycle; when the actual execution time of the user control task is less than the allocated time slice, the CPU performs idle operation or background diagnostic task in the remaining time slice.

10. A multi-task scheduling system for a safety controller, characterized in that, include: An external hardware synchronization clock is used to generate interrupt signals at a fixed frequency; The redundant processing unit includes at least two independent CPUs, each of which receives the interrupt signal. A memory storing executable instructions that, when executed by a CPU, implement the multitasking scheduling method as described in any one of claims 1 to 9; The partitioned storage module is used to divide the physical memory into mutually isolated basic functional data areas and multiple user task data areas.

Images