Task scheduling method for industrial real-time operating system and related device

Abstract

This application relates to the field of industrial automation control technology and provides a task scheduling method and related apparatus for an industrial real-time operating system. The method includes: during the compilation stage, creating a real-time domain task time parameter table for each hard real-time task in the microkernel real-time domain and statically allocating and setting access permissions for shared memory; in a dual-domain isolated operation environment, the microkernel real-time domain writes the real-time control data collected in each control cycle into a unidirectional circular buffer in shared memory and executes AI inference tasks to obtain detection results; preemptively scheduling the AI ​​inference tasks according to the idle window of the control cycle and performing priority inheritance on the AI ​​inference task holding the lock when a lock conflict occurs in the motion control task, and outputting motion control instructions. This invention solves the problem of determinism deficiency faced by industrial real-time operating systems when simultaneously carrying hard real-time control tasks and AI inference tasks on the same hardware platform.

Description

Technical Field

[0001] This invention relates to the field of industrial automation control technology, and in particular to a task scheduling method and related apparatus for an industrial real-time operating system. Background Technology

[0002] Currently, the computing tasks carried by PLCs have evolved from traditional logic control to AI inference, visual inspection, digital twin synchronization, and other directions. The underlying operating system must simultaneously meet the dual requirements of microsecond-level hard real-time determinism and a rich general-purpose software ecosystem.

[0003] Existing technologies fall into two categories: traditional monolithic RTOS kernels, while guaranteeing determinism for hard real-time tasks, lack sufficient support for modern software ecosystems such as AI inference frameworks and containerized applications; Linux with rich real-time preemption patching features suffers from uncertain response latency for hard real-time tasks, making it difficult to meet the microsecond-level jitter requirements of high-end motion control scenarios. None of these existing technologies fundamentally solve the scheduling determinism problem when hard real-time tasks and AI inference tasks coexist: when the two types of tasks compete for shared resources, the priority inversion problem across scheduling domains cannot be handled by existing single-domain priority inheritance protocols, the blocking duration of hard real-time tasks degenerates into unboundedness, and existing technologies lack a static proof mechanism for satisfying the deadlines of all hard real-time tasks before system startup, making it difficult to meet the access requirements of industrial safety scenarios. Summary of the Invention

[0004] This invention provides a task scheduling method and related apparatus for an industrial real-time operating system. This invention solves the problem of determinism deficiency faced by an industrial real-time operating system when it simultaneously carries hard real-time control tasks and AI inference tasks on the same hardware platform.

[0005] In a first aspect, embodiments of this application provide a task scheduling method for an industrial real-time operating system, including: During the compilation phase, a real-time domain task time parameter table is created for each hard real-time task in the microkernel real-time domain, and shared memory is statically allocated and access permissions are set to form a dual-domain isolated running environment. The real-time domain task time parameter table includes a control cycle idle window. In the dual-domain isolated operation environment, the microkernel real-time domain writes the real-time control data collected in each control cycle into the unidirectional circular buffer of the shared memory, and the general operating system non-real-time domain executes the AI ​​inference task to obtain the detection result, and writes the detection result into the target cache; The AI ​​inference task is preemptively scheduled according to the control cycle idle window, and when a lock conflict occurs when the motion control task reads the detection result, priority inheritance is performed on the AI ​​inference task holding the target cache lock, and motion control instructions are output.

[0006] Optionally, in a first implementation of the first aspect of the present invention, during the compilation phase, a real-time domain task time parameter table is created for each hard real-time task in the microkernel real-time domain, and shared memory is statically allocated and access permissions are set to form a dual-domain isolated running environment. The real-time domain task time parameter table includes a control cycle idle window, comprising: During the compilation phase, the maximum number of iterations and the maximum nesting level of each hard real-time task in the microkernel real-time domain are obtained, and each basic block in the first control flow graph of each hard real-time task is marked to obtain the second control flow graph. The hard real-time tasks include motion control tasks, input / output refresh tasks and security monitoring tasks. The number of executions of each basic block in the second control flow graph is set as an integer variable. With the control flow graph flow conservation relationship and the maximum number of iterations as constraints, the maximum value obtained by solving is added to the interruption interference item corresponding to the maximum nesting level to obtain a real-time domain task time parameter table containing the control cycle idle window. Based on the real-time domain task time parameter table, shared memory is statically allocated and access permissions are set to form a dual-domain isolated operating environment.

[0007] Optionally, in a second implementation of the first aspect of the present invention, the step of statically allocating and setting access permissions for shared memory according to the real-time domain task time parameter table to form a dual-domain isolated operating environment includes: Based on the real-time domain task time parameter table, the industrial Ethernet media access controller and servo bus are exclusively mapped to the address space of the microkernel real-time domain. The interrupt controller is configured according to the interrupt nesting level and the critical peripheral interrupts are routed to the physical core where the microkernel real-time domain is located. A unidirectional circular buffer of shared memory is statically allocated based on the amount of data produced by each hard real-time task in each control cycle, and the target cache and its lock control field are statically allocated based on the upper bound of the worst-case execution time of the critical section. The hardware memory protection unit sets the read pointer and completion flag to be writable by the non-real-time domain of the general operating system, and sets the private memory space of the microkernel real-time domain to be inaccessible by the non-real-time domain of the general operating system, thus forming a dual-domain isolated operating environment.

[0008] Optionally, in a third implementation of the first aspect of the present invention, in the dual-domain isolated operating environment, the microkernel real-time domain writes the real-time control data collected in each control cycle into the unidirectional circular buffer of the shared memory, and the general-purpose operating system non-real-time domain executes the AI ​​inference task to obtain the detection result, and writes the detection result into the target cache, including: In the dual-domain isolated operation environment, the position command of the motion control task, the input image data of the input-output refresh task, and the safety status data of the safety monitoring task are combined into real-time control data; The next slot number is calculated based on the write pointer and the total number of slots, and the target slot is determined based on the next slot number and the read pointer. The real-time control data is then written to the target slot. The general-purpose operating system's non-real-time domain reads the current periodic data payload in the target slot based on the completion flag of the target slot, executes an AI inference task based on the current periodic data payload, obtains the detection result, and writes the detection result into the target cache.

[0009] Optionally, in a fourth implementation of the first aspect of the present invention, the step of preemptively scheduling the AI ​​inference task according to the control cycle idle window, and performing priority inheritance on the AI ​​inference task holding the target cache lock when a lock conflict occurs during the motion control task reading the detection result, and outputting motion control instructions, includes: According to the control cycle idle window, a preemption checkpoint is inserted at the operator boundary of the AI ​​inference task and the real-time domain ready flag is read. When the real-time domain ready flag is set, the current time slice number and intermediate tensor pointer are written into the inference intermediate state memory pool of the pre-locked physical page and the processor is yielded. The lock control field of the detection result is read according to the motion control task, and the priority proxy service promotes the scheduling priority of the AI ​​inference task to the priority mapped by the inherited priority field. The critical section is written and the lock status bit of the lock control field is cleared according to the improved inference task priority. The priority proxy service restores the priority according to the original priority of the lock control field holder. The motion control task reads the detection result and outputs motion control instructions.

[0010] Optionally, in a fifth implementation of the first aspect of the present invention, the step of reading the lock control field of the detection result according to the motion control task, and having the priority proxy service raise the scheduling priority of the AI ​​inference task to the priority mapped by the inherited priority field, includes: The motion control task reads the lock control field of the detection result, and after detecting that the lock control field is occupied, it writes it to the inheritance priority field with an atomic write operation to generate a lock conflict record; Based on the lock conflict record, the microkernel real-time domain writes the inter-domain interrupt trigger register to the physical core where the general operating system non-real-time domain is located, and the priority proxy service locates the lock-holding thread in the thread table of the general operating system non-real-time domain according to the holder thread identifier, thus obtaining the lock-holding thread location result. Based on the lock-holding thread location result, the priority of the inherited priority field is mapped to the corresponding level of the general operating system non-real-time domain real-time scheduling class and the scheduling parameters are updated to obtain the improved inference task priority.

[0011] Secondly, embodiments of this application provide an industrial real-time operating system task scheduling device, comprising: The dual-domain isolation unit is used during the compilation phase to create a real-time domain task time parameter table for each hard real-time task in the microkernel real-time domain and to statically allocate and set access permissions for shared memory, forming a dual-domain isolation runtime environment. The real-time domain task time parameter table includes a control cycle idle window. The detection unit is used in the dual-domain isolated operation environment, where the microkernel real-time domain writes the real-time control data collected in each control cycle into the unidirectional circular buffer of the shared memory, and the general operating system non-real-time domain executes the AI ​​inference task to obtain the detection result, and writes the detection result into the target cache. The output unit is used to perform time-slice preemptive scheduling of the AI ​​inference task according to the control cycle idle window, and to perform priority inheritance of the AI ​​inference task holding the target cache lock when the motion control task reads the detection result and a lock conflict occurs, and output motion control instructions.

[0012] Thirdly, embodiments of this application provide a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-described industrial real-time operating system task scheduling method.

[0013] Fourthly, embodiments of this application provide a readable storage medium storing a computer program that, when executed by a processor, implements the steps of the above-described industrial real-time operating system task scheduling method.

[0014] Fifthly, embodiments of this application provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the above-described industrial real-time operating system task scheduling method.

[0015] In one of the solutions provided by the aforementioned industrial real-time operating system task scheduling method and related apparatus, this invention addresses the deterministic deficiency problem faced by industrial real-time operating systems when simultaneously carrying hard real-time control tasks and AI inference tasks on the same hardware platform. This invention solidifies the output of the WCET static analysis toolchain into a structured real-time domain task time parameter table. The control cycle idle window, the upper bound of the worst-case execution time of the critical section, and the maximum nesting level of interrupts in the real-time domain task time parameter table are used item by item in three stages, directly transforming the static analysis conclusions at compile time into runtime scheduling parameters. This allows for the formal proof of the deadline satisfaction of all hard real-time tasks before the industrial real-time operating system starts, unlike the offline evaluation mode in existing technologies where the WCET analysis tool and the operating system scheduler are independent and only available for manual interpretation. This invention exclusively maps the industrial Ethernet media access controller and servo bus to the microkernel real-time domain via a pass-through method. Interrupt routing, shared memory layout, and memory protection permissions are all statically determined once during system startup based on the real-time domain task timing parameter table. There is no dynamic memory allocation or reconfiguration during runtime, eliminating the interference of non-real-time side interrupt load and memory management actions on real-time task response time in existing Linux-based real-time preemption patch schemes. This invention designs the real-time domain write path as a lock-free long path, overwriting the oldest slot when it is full without performing spin wait. This makes the write execution time for inter-domain communication a statically solvable constant and incorporated into the WCET upper bound. This differs from existing inter-domain communication schemes where writes require locking, copying, and system call traps, and the execution time fluctuates with non-real-time domain load, making it unbounded. Therefore, the inter-domain communication overhead becomes a normal sequence of basic blocks that can be accepted by compile-time analysis tools, rather than a real-time performance disruptor. This invention uses a shared memory lock control field, inter-domain interrupts, and a resident agent service to form a cross-scheduling domain inheritance path, enabling the priority inheritance protocol to be established between two mutually unaware scheduling domains: the microkernel real-time domain scheduler and the general operating system scheduler. It excludes preemption checkpoints within the critical section and uses the worst-case execution time upper bound of the critical section and the worst-case processing time of the cross-scheduling domain priority inheritance link as the blocking time upper bound for the motion control task. The corresponding blocking time upper bound is then used to determine offline schedulability. This differs from existing technologies where the single-domain priority inheritance protocol cannot cross two independent schedulers, and the cross-domain blocking time degenerates into an unbounded state. Attached Figure Description

[0016] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a schematic diagram of the structure of an industrial real-time operating system according to one embodiment of the present invention; Figure 2 This is a flowchart illustrating an industrial real-time operating system task scheduling method according to an embodiment of the present invention; Figure 3 yes Figure 2 A schematic diagram of the implementation process of step S100; Figure 4 yes Figure 3 A schematic diagram of the implementation process of step S103; Figure 5 yes Figure 2 A schematic diagram of the implementation process of step S200; Figure 6 yes Figure 2 A schematic diagram of the implementation process of step S300; Figure 7 This is a schematic diagram of a hybrid kernel architecture dual-domain boot process in one embodiment of the present invention; Figure 8 This is a schematic diagram of the priority inheritance process across scheduling domains for AI inference tasks in one embodiment of the present invention; Figure 9 This is a schematic diagram of the structure of an industrial real-time operating system task scheduling device according to an embodiment of the present invention; Figure 10 This is a schematic diagram of the structure of a computer device according to an embodiment of the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] It should be understood that, when used in this specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components, and / or collections thereof. It should also be understood that, as used in this specification and the appended claims, the term "and / or" refers to any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0020] Furthermore, in the description of this invention and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0021] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of the invention include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0022] It should be understood that the sequence number of each step in the following embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0023] To illustrate the technical solution of the present invention, specific embodiments are described below.

[0024] To address the problems mentioned above in the background art, this application proposes a task scheduling method and related apparatus for an industrial real-time operating system. The task scheduling method for an industrial real-time operating system provided by this invention can be applied to applications such as... Figure 1 The industrial real-time operating system shown includes a microkernel real-time domain 1, a general-purpose operating system non-real-time domain 2, and a shared memory ring buffer 3 located between the two. The microkernel real-time domain 1 includes motion control tasks, I / O refresh tasks, and safety monitoring tasks, used to execute hard real-time tasks with deterministic latency requirements. The general-purpose operating system non-real-time domain 2 includes AI inference tasks, data logging tasks, and communication service tasks, used to execute non-real-time computing and general service tasks. The microkernel real-time domain 1 writes data generated by real-time tasks to the shared memory ring buffer 3, and the general-purpose operating system non-real-time domain 2 reads data from the shared memory ring buffer 3, thus enabling data interaction while the two domains are isolated from each other.

[0025] In one embodiment, such as Figure 2 As shown, a task scheduling method for an industrial real-time operating system is provided, which is applied to... Figure 1 Taking the industrial real-time operating system in China as an example, the following steps are included: S100: During the compilation phase, the real-time domain task time parameter table of each hard real-time task in the microkernel real-time domain is created, and the shared memory is statically allocated and access permissions are set to form a dual-domain isolated running environment. The real-time domain task time parameter table includes the control cycle idle window. S200: In a dual-domain isolated operating environment, the microkernel real-time domain writes the real-time control data collected in each control cycle into a unidirectional circular buffer in shared memory, and the general operating system non-real-time domain executes AI inference tasks to obtain detection results, which are then written into the target cache. S300: Performs time-slice preemptive scheduling of AI inference tasks according to the idle window of the control cycle, and when a lock conflict occurs when the motion control task reads the detection result, it inherits the priority of the AI ​​inference task holding the target cache lock and outputs motion control instructions.

[0026] This embodiment addresses the deterministic deficiency problem faced by industrial real-time operating systems when simultaneously undertaking hard real-time control tasks and AI inference tasks on the same hardware platform. The invention solidifies the output of the WCET static analysis toolchain into a structured real-time domain task time parameter table. The control cycle idle window, the upper bound of the worst-case execution time of the critical section, and the maximum nesting level of interrupts in the real-time domain task time parameter table are used item by item in three stages, directly transforming the static analysis conclusions at compile time into runtime scheduling parameters. This allows for the formal proof of the deadline satisfaction of all hard real-time tasks before the industrial real-time operating system starts, unlike the offline evaluation mode in existing technologies where the WCET analysis tool and the operating system scheduler are independent and only available for manual interpretation. This embodiment exclusively maps the industrial Ethernet media access controller and servo bus to the microkernel real-time domain via peripheral pass-through. Interrupt routing, shared memory layout, and memory protection permissions are all statically determined once and for all based on the real-time domain task time parameter table during the industrial real-time operating system startup phase. There is no dynamic memory allocation or dynamic reconfiguration during runtime, eliminating the interference of non-real-time side interrupt load and memory management actions on the real-time task response time in existing Linux with real-time preemption patch schemes. This invention designs the write path of the real-time domain as a lock-free long path. When the slot is full, the oldest slot is overwritten without performing a spin wait. This makes the write execution time of inter-domain communication a statically solvable constant and incorporated into the upper bound of WCET. This embodiment differs from the defects of existing inter-domain communication schemes, which require locking, copying, and system call traps for writing, and whose execution time is unbounded due to fluctuations in non-real-time domain load. Therefore, the inter-domain communication overhead becomes a normal sequence of basic blocks that can be accepted by compile-time analysis tools rather than a real-time performance disruptor. This invention uses a shared memory lock control field, inter-domain interrupts, and a resident agent service to form a cross-scheduling domain inheritance path, enabling the priority inheritance protocol to be established between two mutually unaware scheduling domains: the microkernel real-time domain scheduler and the general operating system scheduler. It excludes preemption checkpoints within the critical section and uses the worst-case execution time upper bound of the critical section and the worst-case processing time of the cross-scheduling domain priority inheritance link as the upper bound of the blocking time for the motion control task. The corresponding upper bound of the blocking time is then used to determine offline schedulability. This embodiment differs from the existing technology where the single-domain priority inheritance protocol cannot cross two independent schedulers, and the cross-domain blocking time degenerates into an unbounded state.

[0027] In one embodiment, such as Figure 3 As shown, step S100 specifically includes the following steps: S101: During the compilation phase, the maximum number of iterations and the maximum nesting level of each hard real-time task in the microkernel real-time domain are obtained, and each basic block in the first control flow graph of each hard real-time task is marked to obtain the second control flow graph. Hard real-time tasks include motion control tasks, input / output refresh tasks and security monitoring tasks. S102: Set the execution count of each basic block in the second control flow graph to an integer variable. With the control flow graph flow conservation relationship and the maximum number of iterations as constraints, sum the maximum value obtained by solving and the interruption interference item corresponding to the maximum nesting level to obtain a real-time domain task time parameter table containing the control cycle idle window. S103: Based on the real-time domain task time parameter table, statically allocate and set access permissions for shared memory to form a dual-domain isolated operating environment.

[0028] In this embodiment, during the compilation stage, the compiler toolchain frontend reads the source code of the control programs corresponding to the motion control task, input / output refresh task, and safety monitoring task in the microkernel real-time domain, and parses the ST, LD, SFC, and other control programs conforming to preset standards into intermediate representations. For ST programs, basic blocks can be divided based on conditional jumps, unconditional jumps, function calls, and return positions. For LD programs, logical branches in the network can be converted into equivalent conditional branch structures. For SFC programs, they are expanded into equivalent branch structures according to steps, transition conditions, and their reachability relationships, thereby establishing the first control flow graph for each hard real-time task. Loop boundary analysis is performed on the loop structures in the first control flow graph. For counting loops controlled by inductive variables, the maximum number of iterations is determined based on the initial value, update step size, and termination condition of the inductive variable. In this embodiment, the counting variable starts from 0, increases by 1 each time, and exits when it reaches 100, thus the maximum number of iterations for the corresponding loop is determined to be 100. For loops whose boundaries cannot be directly parsed through program semantics, a pre-bound loop upper limit comment is read. In this embodiment, The maximum number of iterations for the corresponding loop is preset to 1000. For program segments that cannot be statically analyzed and have no loop upper limit configured, an execution time unbounded warning is output and the corresponding task is prohibited from entering the microkernel real-time domain, thereby preventing code that cannot be analyzed by WCET from entering the hard real-time execution path. At the same time, the function call relationships in each hard real-time task are analyzed and a call graph is established. Function block instances are expanded separately. For small-scale functions, this embodiment sets 32 instructions as the inline processing threshold. For recursive calls, the maximum expansion level is preset to 4 levels, so that the recursive structure is converted into a finite call structure with a clear upper bound, and the maximum function call depth and the corresponding upper bound of the stack space are determined accordingly. Based on this, the interrupt priority mapping relationship of the real-time domain is read, and the control cycle timer, industrial Ethernet media access controller, servo bus and other real-time interrupt sources are sorted according to priority. The high-priority interrupt preemption relationship that may be continuously received during the execution of a certain hard real-time task is analyzed, thereby obtaining the maximum interrupt nesting level L, and the interrupt interference range to be included is determined according to the corresponding nesting relationship. After completing the analysis of loop, call, and interrupt structures, time cost annotations are performed on each basic block in the first control flow graph based on the instruction cost model of the target processor. The instruction type, instruction cycle number, maximum iteration number of the loop to which it belongs, and possible interrupt interference information of each basic block are written into the corresponding basic block. The impact of pipeline and cache on execution cycle is considered so that each basic block has a definite time cost that can be used for worst-case path analysis, thereby obtaining the second control flow graph.

[0029] In this embodiment, the execution count of each basic block in the second control flow graph is set as an integer variable, and the flow conservation relationship between the number of entry and exit of each basic block in the control flow graph is used as the basic constraint. At the same time, the maximum number of iterations of the loop is used as the upper limit constraint of the execution count of the corresponding loop back edge, thereby eliminating invalid execution combinations that do not conform to the actual control path of the program. On the basis of satisfying the above constraints, the weighted result formed by the execution count of each basic block and its corresponding execution cycle number is used as the solution object of implicit path enumeration. The legal control path that can make the total execution cycle reach the maximum value is searched. Then, the interrupt interference item determined according to the maximum interrupt nesting level L is added to the maximum value to obtain the upper bound of the worst-case execution time C of the corresponding hard real-time task. For the critical section code segment involving access to shared resources, the worst-case path is solved separately for the corresponding basic block sequence to obtain the upper bound of the worst-case execution time B of the critical section. The upper bound of the worst-case execution time B of the critical section is used to characterize the upper bound of the critical section execution time when the AI ​​inference task writes to the target cache, so that when the motion control task accesses the target cache occupied by the AI ​​inference task, its maximum blocking time can have a definite upper bound that can be statically analyzed. After performing the above calculations for motion control, input / output refresh, and safety monitoring tasks, the worst-case execution time upper bound C, task period T, task priority, worst-case execution time upper bound B of the critical section, maximum interrupt nesting level L, and stack space upper bound for each task are uniformly written into the real-time domain task time parameter table. Based on the execution occupancy of each ready hard real-time task within a control cycle, the control cycle idle window W is determined, which is the remaining available time from the completion of all hard real-time tasks in the current control cycle to the start of the next control cycle. Simultaneously, offline schedulability analysis is performed, accumulating the ratio of the upper bound C of WCET for each hard real-time task to its corresponding period T, and incorporating the proportional relationship between the maximum critical section blocking term B and its corresponding minimum period. The results are compared with preset schedulability boundaries. If the results do not exceed the preset schedulability boundary... If the offline schedulability criterion is not met, the current task set is considered to satisfy the adopted offline schedulability criterion, and a real-time domain task time parameter table is output. If the preset boundary is exceeded, the basic block sequence that contributes the most to the total execution time is backtracked according to the worst-case path solution result. The corresponding source code position is returned for optimization and S101 and S102 are re-executed until the current task set satisfies the offline schedulability criterion. The real-time domain task time parameter table obtained in this way is used to record the static analysis results. The maximum interrupt nesting level L can also be used for interrupt controller configuration. The upper bound of the worst-case execution time of the critical section B can be used as a component of the upper bound of the blocking time for cross-scheduling domain priority inheritance. The control cycle idle window W can be used as the basis for dividing the time slice of AI inference tasks, so that the static time parameters obtained in the compilation stage can continue to participate in the resource configuration and scheduling control in the runtime stage.The static configuration process of entering the dual-domain isolated operating environment based on the real-time domain task time parameter table involves pre-configuring the shared memory region, unidirectional circular buffer, target cache, and their access permissions before the industrial real-time operating system officially runs. Simultaneously, the peripheral, interrupt, and memory resources required by the microkernel real-time domain are configured by combining the task cycle, maximum interrupt nesting level, upper bound of the worst-case execution time of the critical section, and the idle window of the control cycle. Furthermore, the access of the non-real-time domain of the general operating system to the private memory space of the microkernel real-time domain is restricted through the hardware memory protection unit, so that dynamic memory allocation or temporary resource reconfiguration is no longer required during the running phase. This forms a dual-domain isolated operating environment that can support unidirectional lock-free publishing of real-time control data, execution of AI inference tasks, and cross-domain reading of detection results.

[0030] In one embodiment, such as Figure 4 As shown, step S103 specifically includes the following steps: S1031: Based on the real-time domain task time parameter table, the industrial Ethernet media access controller and servo bus are exclusively mapped to the address space of the microkernel real-time domain. The interrupt controller is configured according to the interrupt nesting level and the critical peripheral interrupts are routed to the physical core where the microkernel real-time domain is located. S1032: Statically allocate a unidirectional circular buffer of shared memory according to the amount of data produced by each hard real-time task in each control cycle, and statically allocate the target cache and its lock control field according to the upper bound of the worst-case execution time of the critical section. S1033: By using a hardware memory protection unit, the read pointer and completion flag are set to be writable by the non-real-time domain of the general operating system, and the private memory space of the microkernel real-time domain is set to be inaccessible by the non-real-time domain of the general operating system, thus forming a dual-domain isolated operating environment.

[0031] In this embodiment, the task cycle, priority, and maximum interrupt nesting level L of each hard real-time task are read from the real-time domain task time parameter table. The Hypervisor establishes an independent address space for the microkernel real-time domain during the startup phase of the industrial real-time operating system. The register address area, DMA descriptor area, and servo bus controller register address area of ​​the industrial Ethernet media access controller are mapped to the microkernel real-time domain. At the same time, no corresponding mapping is established in the page table or two-stage address translation table of the non-real-time domain of the general operating system, so that the industrial Ethernet media access controller and servo bus can only be accessed by the microkernel real-time domain. For peripherals that support DMA, the DMA descriptor ring and buffer physical address can be pre-configured so that peripheral data can directly enter the pre-allocated memory area of ​​the real-time domain, avoiding cross-domain copying during operation. The interrupt controller is configured according to the interrupt priority relationship recorded in the real-time domain task time parameter table and the maximum interrupt nesting level L. In this embodiment, the maximum allowed nesting level is preset to 4 levels, and the control cycle timer, servo bus and industrial Ethernet media access controller are configured to the corresponding real-time interrupt priority levels in sequence. At the same time, the interrupts of the above-mentioned key peripherals are fixedly routed to the physical core where the microkernel real-time domain is located through the target processor core field of the interrupt controller. Ordinary network, storage and background service interrupts generated by the general operating system in the non-real-time domain are routed to other physical cores or delivered in the form of virtual interrupts, thereby reducing the impact of non-real-time domain interrupt load on the real-time domain interrupt response time.

[0032] In this embodiment, the maximum amount of real-time control data that a single slot can accommodate is calculated based on the data length generated by the motion control task, input / output refresh task, and safety monitoring task in each control cycle. Before the industrial real-time operating system starts, the control structure area and data storage area in the shared memory are divided once. The control structure area stores at least the write pointer, read pointer, and the total number of slots. The data storage area has multiple slots arranged continuously at a fixed length. Each slot contains a data payload, a sequence number, and a completion flag. In this embodiment, when the maximum length of data generated by the three hard real-time tasks in each cycle is 256 bytes, the single slot payload area can be preset to 256 bytes. A corresponding number of slots are reserved based on the maximum number of consecutive unconsumed cycles allowed in the non-real-time domain. In this embodiment, 64 slots are preset to avoid dynamic expansion during runtime. For the detection results generated by the AI ​​inference task, a separate static target cache is allocated. The target cache capacity is reserved according to the maximum data length of the detection results. The upper bound B of the worst-case execution time of the critical section in the real-time domain task time parameter table is mainly used to limit the maximum blocking time that the motion control task may endure when the target cache is updated by the AI ​​inference task. At the same time, a lock control field is configured next to the target cache. The lock control field includes a lock status bit, a holder thread identifier, a holder original priority field, and an inherited priority field. In this embodiment, the lock status bit can use 1 bit or the least bit of a 32-bit atomic word to represent the occupancy status. The thread identifier and priority field are stored as fixed-length integers. No preemption checkpoints are set in the critical section to ensure that the lock holding time does not exceed the upper bound B of the worst-case execution time of the critical section obtained from the static analysis.

[0033] In this embodiment, a hardware memory protection unit is used to perform fine-grained permission division on the address space. The code area, task stack, real-time control data area, and key peripheral mapping area of ​​the microkernel real-time domain are set to be accessible only to the microkernel real-time domain, so that the general operating system non-real-time domain has neither write nor read permissions to these areas. For the unidirectional circular buffer, access permissions are set according to the responsibilities of the producer and consumer. The data payload, sequence number, and write pointer are updated by the microkernel real-time domain, so they are set to be read-only for the general operating system non-real-time domain. The read pointer and completion flag need to be advanced or cleared by the non-real-time domain after consuming data, so they are set to be writable. This allows the non-real-time domain to complete normal consumption while preventing it from modifying the key control fields on the producer side. If unauthorized access occurs in the non-real-time domain of the general operating system, the hardware memory protection unit triggers a protection exception and hands it over to the Hypervisor for handling. This exception is not allowed to change the execution state of the microkernel's real-time domain. Thus, after peripheral exclusive access, interrupt partitioning, static layout of shared memory, and fixed access permissions are completed, a dual-domain isolated running environment is formed, so that dynamic memory allocation, dynamic mapping, or temporary permission adjustment are no longer performed during the running phase, thereby ensuring that the resource access path of the real-time domain is deterministic.

[0034] In one embodiment, such as Figure 5 As shown, step S200 specifically includes the following steps: S201: In a dual-domain isolated operating environment, the position commands of the motion control task, the input image data of the input / output refresh task, and the safety status data of the safety monitoring task are combined into real-time control data. S202: Calculate the next slot number based on the write pointer and the total number of slots, determine the target slot based on the next slot number and the read pointer, and write the real-time control data to the target slot; S203: The general operating system's non-real-time domain reads the current periodic data payload in the target slot based on the completion flag of the target slot, executes the AI ​​inference task based on the current periodic data payload, obtains the detection result, and writes the detection result into the target cache.

[0035] In this embodiment, the microkernel real-time domain uses the control cycle start point generated by the hardware timer as the unified time reference for the real-time control data of the current cycle. Motion control tasks, input / output refresh tasks, and safety monitoring tasks are scheduled sequentially according to the priority of the hard real-time tasks. The motion control task collects the position commands corresponding to the current control cycle and position feedback data reflecting the execution status. The input / output refresh task acquires the input image data formed by the field input channels. The safety monitoring task acquires safety status data such as emergency stop status, driver fault status, communication anomaly status, and safety interlock status. Then, according to a statically determined slot data structure, the data from these different sources are combined in a fixed field order to form the real-time control data for the current cycle. In this embodiment, the control data is written sequentially into a predetermined data payload area in the order of cycle number, position command, position feedback, input image data, and safety status data. The combined data length does not exceed the data payload length reserved for a single slot, thus generating a data payload with a consistent structure and fixed length for each control cycle, avoiding dynamic memory allocation or variable-length data splicing during operation. Since the length of a single slot and the position of each field are statically determined during the establishment of the dual-domain isolated operating environment, the motion control task, input / output refresh task, and safety monitoring task only need to write the corresponding data to the predetermined offset position to form real-time control data for use in the non-real-time domain of a general operating system.

[0036] In this embodiment, the microkernel real-time domain, acting as the sole producer of the unidirectional circular buffer, reads the current write pointer and determines the next slot number based on the write pointer and the total number of slots. Specifically, it advances cyclically by incrementing the write pointer by one and taking the modulo of the total number of slots, ensuring that the write pointer can wrap around to the first slot after reaching the last slot. Then, it compares the next slot number with the current read pointer. If they are not equal, it indicates that the next slot can be used as the target slot, and the microkernel real-time domain directly writes the real-time control data to the target slot. If they are equal, it indicates that the circular buffer is full. In this case, to avoid uncertain blocking caused by the hard real-time task waiting for non-real-time domain to consume data, it does not perform spin waiting. Instead, it takes the oldest data pointed to by the read pointer as the data that can be overwritten and advances the read pointer synchronously, while incrementing the overflow count. This allows the general operating system's non-real-time domain to identify data overwriting that occurs during the process based on the sequence number or overflow count, thereby ensuring that the execution steps of the real-time domain write path do not extend indefinitely with the current processing load of the non-real-time domain. After determining the target slot, real-time control data is written to the data payload field of the target slot, followed by a monotonically increasing sequence number. A write memory barrier is executed after the data payload and sequence number are written. Then, the completion flag of the target slot is set to valid, and the write memory barrier is executed again. Finally, the write pointer is updated to the current target slot sequence number. The first write memory barrier ensures that when the completion flag is valid, the corresponding data payload and sequence number are fully visible in the non-real-time domain of the general operating system. The second write memory barrier ensures that when the write pointer is updated, the completion flag of the slot has been updated, thus maintaining the correct data visibility order between the two isolated domains without using mutexes. Since the write pointer is updated only by the microkernel real-time domain and the read pointer is mainly advanced by the non-real-time domain of the general operating system, this data path maintains a single producer, single consumer model. The real-time domain side does not need to perform mutex contention, dynamic memory allocation, or wait for consumer responses.

[0037] In this embodiment, the consumer in the non-real-time domain of the general operating system, acting as a circular buffer, reads the completion flag of the slot pointed to by the read pointer. When the completion flag is not yet set, it indicates that there is no complete currently consumable data in the corresponding slot. At this time, the current read ends without accessing the incomplete data payload. When the completion flag is set, the data payload and sequence number of the corresponding slot are read, and the sequence number read this time is compared with the previous valid sequence number. If the sequence numbers are consecutive, it is determined that the data is data normally released according to the control cycle. If the sequence numbers are not consecutive, it is determined that old data has been overwritten during the non-real-time domain's failure to consume data in a timely manner based on the sequence number interval or overflow count. Then, the completion flag of the consumed slot is cleared, and the read pointer is updated according to the same modulo advance method as the write pointer, so that the next read points to the slot. The current cycle data payload obtained thus includes position commands and position feedback for motion control tasks, input image data for input / output refresh tasks, and safety status data for safety monitoring tasks. The AI ​​inference task extracts the input data required by the model from the current cycle data payload according to the preset field offset, and performs data processing and inference calculation according to the input tensor structure of the AI ​​model. In this embodiment, the position status, input image, and safety status are converted into corresponding input tensors and then sent to the inference network that has been deployed in the non-real-time domain of the general operating system to obtain detection results used to characterize the device status, target position, anomaly category, or other industrial control judgment results. After the AI ​​inference task completes the inference, it does not write the detection results back to the aforementioned unidirectional circular buffer, but writes them to the target cache that has been independently and statically allocated in S1032. When writing to the target cache, the lock control field corresponding to the target cache is used to complete the concurrency protection, so that the detection result reverse path from the non-real-time domain to the real-time domain and the lockless circular buffer path from the real-time domain to the non-real-time domain are independent of each other. The former needs to handle the resource competition between the AI ​​inference task writing the detection results and the motion control task reading the detection results, while the latter maintains the lockless data publishing mechanism of a single producer and a single consumer, thereby avoiding mixing the two different data paths.

[0038] In one embodiment, such as Figure 6 As shown, step S300 specifically includes the following steps: S301: Based on the control cycle idle window, insert a preemption checkpoint at the operator boundary of the AI ​​inference task and read the real-time domain ready flag. When the real-time domain ready flag is set, write the current time slice number and intermediate tensor pointer into the inference intermediate state memory pool of the pre-locked physical page and yield the processor. S302: Read the lock control field of the detection result according to the motion control task, and the priority proxy service will promote the scheduling priority of the AI ​​inference task to the priority mapped by the inherited priority field; S303: Based on the improved inference task priority, the critical section is written and the lock status bit of the lock control field is cleared. The priority proxy service restores the priority according to the original priority of the lock control field holder, and the motion control task reads the detection result and outputs the motion control command.

[0039] In this embodiment, the control cycle idle window W in the real-time domain task time parameter table is read, and combined with the context saving and recovery overhead O required by the AI ​​inference task during a pause and resumption process, the upper limit q of the time slice length that the AI ​​inference task can continuously occupy the processor under the current running configuration is determined, where the upper limit of the time slice length is q=W. O, instead of directly dividing the AI ​​inference task according to the fixed scheduling rhythm of the general operating system, divides the complete AI inference process into multiple execution segments that can be terminated independently according to the actual execution boundaries of each layer and operator of the inference network. This ensures that the worst execution time of each execution segment does not exceed the upper limit of the time slice length q. Furthermore, preemptive checkpoints are inserted at the boundaries of convolution operators, matrix operation operators, activation operators, or other operators that can maintain the consistency of intermediate tensor states, thereby avoiding the direct interruption of the inference process before a single operator is completed. After the AI ​​inference task begins execution, it proceeds sequentially according to the order of execution segments. Upon completion of each execution segment, it reaches the corresponding preemption checkpoint and reads the real-time domain ready flag in the shared state region. This real-time domain ready flag is set by the microkernel real-time domain when the motion control task, input / output refresh task, or security monitoring task enters the ready state. If the real-time domain ready flag is not set, it means that there is no hard real-time task waiting to obtain the processor, and the AI ​​inference task continues to execute the next execution segment. If the real-time domain ready flag is already set, it stops proceeding to the next operator, writes the current time slice number, the position of the completed execution segment, and the intermediate tensor pointers required for the next stage of inference into the pre-allocated inference intermediate state memory pool, and immediately yields the processor, so that the microkernel real-time domain can prioritize scheduling the already ready hard real-time tasks. Because the intermediate state memory pool for inference has been statically allocated according to the maximum occupancy of intermediate tensors at each layer of the AI ​​inference network during the dual-domain isolated runtime environment establishment phase, and the corresponding physical pages have been pre-locked, saving the current time slice sequence number and intermediate tensor pointer will not result in dynamic memory allocation, page swapping, or page faults. When rescheduling the AI ​​inference task after the completion of the hard real-time task, it can also directly locate the previous stopping position and continue executing the operator based on the saved time slice sequence number and intermediate tensor pointer. This keeps the pause and resumption overhead of the AI ​​inference task within an analyzable range and ensures that the processor occupancy time of the non-real-time AI inference task matches the idle window in the control cycle, rather than passively yielding the processor after continuously executing the complete inference process. After the AI ​​inference task gradually completes all inference segments and generates detection results through the above time slice mechanism, it enters the stage of writing the detection results to the target cache. The target cache is a reverse shared resource that provides detection results from the non-real-time domain of the general operating system to the real-time domain of the microkernel. It is independent of the unidirectional lock-free circular buffer used by the real-time domain to publish real-time control data to the non-real-time domain. Therefore, the target cache uses a lock control field for concurrent protection.Before the AI ​​inference task begins writing the detection results, it atomically sets the lock status in the lock control field corresponding to the target cache to occupied, and simultaneously writes its own thread identifier and current scheduling priority to the holder thread identifier and the holder's original priority field, respectively. Then, it enters the critical section for writing the detection results. No preemption checkpoints are set inside this critical section to avoid the AI ​​inference task being paused due to the end of a normal time slice while holding the target cache lock. This allows the maximum duration of the critical section to be limited by the upper bound B of the worst-case execution time of the critical section obtained from the aforementioned static analysis.

[0040] In this embodiment, when the motion control task needs to read the detection result, it reads the lock status bit of the lock control field corresponding to the target cache. If the lock status bit is idle, the motion control task can read the target cache according to the normal path. If the lock status bit is occupied, it means that the AI ​​inference task is still in the critical section of writing the detection result. The motion control task writes its own priority into the inherited priority field of the lock control field and forms a lock conflict state. Then, the microkernel real-time domain notifies the priority proxy service in the non-real-time domain of the general operating system through inter-domain interrupt. The proxy service finds the AI ​​inference thread that is currently holding the lock according to the holder thread identifier in the lock control field, and then maps the inherited priority field to the corresponding priority level in the real-time scheduling class of the general operating system and adjusts the scheduling parameters of the AI ​​inference task, so that the AI ​​inference task holding the lock can complete the remaining critical section operation first and release the target cache as soon as possible. The AI ​​inference task continues to execute the previously incomplete target cache critical section according to the upgraded inference task priority. It writes the detection results completely into the pre-statically allocated target cache and clears the lock status bit in the lock control field after the detection results are written, thus indicating that the target cache has changed from an occupied state to an idle state. At the same time, the priority proxy service reads the original priority of the holder that is pre-saved in the lock control field and restores the scheduling parameters of the AI ​​inference thread to the original priority before the priority inheritance occurred. This prevents the temporarily inherited high priority from continuing to affect the normal scheduling of other tasks in the non-real-time domain after the shared resources are released. After the microkernel real-time domain detects that the lock status bit has been cleared, it wakes up the motion control task that was previously blocked due to the target cache being occupied. The motion control task reads the detection results in the target cache and executes the control logic in combination with the position instructions, position feedback and corresponding control states of the current control cycle, thereby generating and outputting motion control instructions. Since the critical section held by the AI ​​inference task during the target cache lock is not allowed to be preempted by time slice checkpoints, the blocking time caused by the motion control task waiting for the target cache to be released has a definite upper bound. The worst-case scenario of inter-domain interrupt triggering, priority proxy service response, priority promotion of the AI ​​inference task holding the lock, and the time required to complete the writing of the remaining target cache to the critical section is included in the upper bound of the blocking time in the offline schedulability analysis.

[0041] In one embodiment, step S302 specifically includes the following steps: The motion control task reads the lock control field of the detection result. After detecting that the lock control field is occupied, it is written to the inheritance priority field by atomic write operation to generate a lock conflict record. Based on the lock conflict record, the microkernel real-time domain writes the inter-domain interrupt trigger register to the physical core where the non-real-time domain of the general operating system is located. The priority proxy service then locates the lock-holding thread in the thread table of the non-real-time domain of the general operating system according to the holder thread identifier, thus obtaining the lock-holding thread location result. Based on the lock-holding thread location results, the priority of the inherited priority field is mapped to the corresponding level of the non-real-time domain real-time scheduling class of the general operating system, and the scheduling parameters are updated to obtain the improved inference task priority.

[0042] In this embodiment, when the motion control task needs to read the detection results written to the target cache by the AI ​​inference task, the microkernel real-time domain accesses the lock control field corresponding to the target cache and reads the lock status bit. The lock control field includes the lock status bit, the holder thread identifier, the holder's original priority, and the inherited priority field. If the lock status bit indicates that it is idle, the motion control task directly enters the detection result reading process. When the lock status bit indicates that it is occupied, it is determined that the current target cache is being written to by the AI ​​inference task in a critical section. At this time, the motion control task does not directly access the detection results that have not yet been updated. Instead, it writes its current scheduling priority to the inherited priority field through an atomic write operation, so that the lock status judgment and the inherited priority writing process will not be disrupted by other concurrent accesses. The motion control task generates a lock conflict record by combining the current target cache identifier, the holder thread identifier, and the write status of the inherited priority field. Then, the motion control task enters a blocked waiting state, thereby solidifying the information of "which hard real-time task is blocked, which non-real-time thread holds the lock, and what priority needs to be inherited" into the lock control field and the lock conflict record.

[0043] In this embodiment, the microkernel real-time domain triggers a cross-scheduling domain notification based on the lock conflict record. Since the microkernel real-time domain itself cannot directly modify the thread scheduling parameters in the non-real-time domain of the general operating system, the microkernel performs a write operation to the inter-domain interrupt trigger register corresponding to the physical core where the non-real-time domain of the general operating system is located, causing the physical core to generate a pre-bound inter-domain interrupt. After responding to the interrupt, the resident priority proxy service in the non-real-time domain of the general operating system reads the lock control field and matches it against the thread table of the general operating system based on the holder thread identifier recorded therein, locating the AI ​​inference thread currently holding the target cache lock. At the same time, it reads the current scheduling category, current priority, and the original priority of the holder stored in the lock control field of the thread, thereby forming the lock-holding thread location result. The priority proxy service has been configured as a higher priority of the real-time scheduling class of the general operating system and bound to the corresponding inter-domain interrupt during the dual-domain initialization phase, so that it can be executed in time after the lock conflict occurs without waiting for the ordinary non-real-time task to complete.

[0044] In this embodiment, the priority in the inherited priority field is read according to the lock-holding thread location result, and the hard real-time task priority used by the microkernel real-time domain is converted into a priority level that can be recognized by the general operating system's non-real-time domain real-time scheduling class. In this embodiment, a fixed priority mapping table is established during the initialization phase, and the priority levels of the microkernel real-time domain are mapped to different levels of the general operating system's real-time scheduling class in descending order, thereby avoiding direct comparison of the different priority value systems used by the two schedulers. After determining the mapping result, the priority proxy service updates the scheduling parameters of the located AI inference thread, temporarily promoting it from the original non-real-time scheduling priority to the real-time scheduling level corresponding to the inherited priority field, thus obtaining the promoted inference task priority. The general operating system scheduler prioritizes the AI ​​inference thread to continue executing the remaining critical section of the target cache according to the updated scheduling parameters, so that it can complete the detection result writing and release the lock as soon as possible. Meanwhile, the original priority of the holder in the lock control field remains unchanged, so that the original scheduling priority can be restored after the AI ​​inference task releases the target cache. If a higher-priority hard real-time task is blocked in the same target cache during the inheritance period, the new higher priority can be used to update the inheritance priority field, and the proxy service will be triggered again to update the scheduling parameters of the AI ​​inference thread. This achieves dynamic cross-scheduling domain priority inheritance and avoids the low-priority AI inference thread being unable to release shared resources for a long time due to preemption by other ordinary non-real-time tasks when holding the target cache.

[0045] like Figure 7 As shown, Figure 7 This is a schematic diagram of the dual-domain boot process of the hybrid kernel architecture of this invention. Figure 7As shown, after the hardware platform powers on, it triggers the isolation layer to allocate real-time resources to the real-time domain. After the real-time domain completes initialization, it feeds back to the isolation layer, and the isolation layer starts the general operating system corresponding to the non-real-time domain. During runtime, the real-time domain writes real-time data to the shared memory area, and the non-real-time domain reads shared data from the shared memory area. This reflects the startup sequence and runtime data flow relationship of the real-time domain starting first, the non-real-time domain starting later, and inter-domain communication being carried out unidirectionally through shared memory.

[0046] like Figure 8 As shown, Figure 8 This is a flowchart illustrating the process of priority inheritance across scheduling domains for AI inference tasks. Figure 8 As shown, after the AI ​​inference task occupies the shared resource, the motion control task requests access to the shared resource. The shared resource detects a lock conflict and notifies the microkernel scheduler. The microkernel scheduler triggers priority inheritance, temporarily elevating the AI ​​inference task to the priority of the motion control task. The AI ​​inference task completes its current time slice and releases the resource. The microkernel scheduler then restores its priority to its original value, and the motion control task acquires the resource and executes control. In addition, at the end of each time slice, the AI ​​inference task checks with the microkernel scheduler to see if any real-time tasks are ready. If so, the real-time task immediately preempts the processor, demonstrating the collaborative working process of priority inheritance and time slice preemption mechanisms in cross-scheduling domain scenarios.

[0047] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0048] In one embodiment, an industrial real-time operating system task scheduling device is provided, which corresponds one-to-one with the industrial real-time operating system task scheduling method described in the above embodiments. For example... Figure 9 As shown, the task scheduling device of the industrial real-time operating system includes: The dual-domain isolation unit is used during the compilation phase to create real-time domain task time parameter tables for each hard real-time task in the microkernel real-time domain and to statically allocate and set access permissions for shared memory, forming a dual-domain isolation runtime environment. The real-time domain task time parameter table includes the control cycle idle window. The detection unit is used in a dual-domain isolated operating environment. The microkernel real-time domain writes the real-time control data collected in each control cycle into a unidirectional circular buffer in shared memory, and the general operating system non-real-time domain executes AI inference tasks to obtain the detection results, which are then written into the target cache. The output unit is used for time-slice preemption scheduling of AI inference tasks according to the control cycle idle window, and when a lock conflict occurs when the motion control task reads the detection result, it inherits the priority of the AI ​​inference task holding the target cache lock and outputs motion control instructions.

[0049] It should be noted that the information interaction and execution process between the above-mentioned devices / units are based on the same concept as the method embodiments of this application. For details on their specific functions and technical effects, please refer to the method embodiments section, and they will not be repeated here.

[0050] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0051] This application also provides a computer device, such as... Figure 10 As shown, the computer device includes: at least one processor, a memory, and a computer program stored in the memory and executable on the at least one processor. When the processor executes the computer program, it implements the steps in any of the above method embodiments, or when the processor executes the computer program, it implements the functions of each module / unit in the above device embodiments.

[0052] For example, the computer program may be divided into one or more modules / units, which are stored in the memory and executed by the processor to complete this application. The one or more modules / units may be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the computer program in the computer device.

[0053] Those skilled in the art will understand that Figure 10The computer device described is merely an example and does not constitute a limitation on the computer device. It may include more or fewer components than shown, or combine certain components, or different components. For example, the computer device may also include input / output devices, network access devices, buses, etc.

[0054] The aforementioned processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), or field-programmable gate arrays (FPGAs). Programmable Gate Array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.

[0055] The memory can be an internal storage unit of the computer device, such as a hard drive or RAM. The memory can also be an external storage device of the computer device, such as a plug-in hard drive, Smart Media Card (SMC), Secure Digital (SD) card, or Flash Card. Furthermore, the memory can include both internal and external storage units of the computer device.

[0056] This application also provides a readable storage medium storing a computer program, which, when executed by a processor, can implement the steps in the above-described method embodiments.

[0057] This application provides a computer program product that, when run on an electronic device, enables the electronic device to implement the steps described in the various method embodiments above.

[0058] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments of this application can be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include at least: any entity or device capable of carrying computer program code to a photographing device / terminal device, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium. Examples include USB flash drives, portable hard drives, magnetic disks, or optical disks. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electrical carrier signals or telecommunication signals.

[0059] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0060] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0061] In the embodiments provided in this application, it should be understood that the disclosed apparatus / devices and methods can be implemented in other ways. For example, the apparatus / device embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0062] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0063] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A task scheduling method for an industrial real-time operating system, characterized in that, include: During the compilation phase, the maximum number of iterations and the maximum nesting level of each hard real-time task in the microkernel real-time domain are obtained, and each basic block in the first control flow graph of each hard real-time task is labeled to obtain a second control flow graph. The hard real-time tasks include motion control tasks, input / output refresh tasks, and security monitoring tasks. The execution count of each basic block in the second control flow graph is set as an integer variable. With the control flow graph flow conservation relationship and the maximum number of iterations as constraints, the maximum value obtained by solving is accumulated with the interrupt interference item corresponding to the maximum nesting level to obtain a real-time domain task time parameter table containing the control cycle idle window. Based on the real-time domain task time parameter table, shared memory is statically allocated and access permissions are set to form a dual-domain isolated running environment. In the dual-domain isolated operation environment, the microkernel real-time domain writes the real-time control data collected in each control cycle into the unidirectional circular buffer of the shared memory, and the general operating system non-real-time domain executes the AI ​​inference task to obtain the detection result, and writes the detection result into the target cache; The AI ​​inference task is preemptively scheduled according to the control cycle idle window, and when a lock conflict occurs when the motion control task reads the detection result, priority inheritance is performed on the AI ​​inference task holding the target cache lock, and motion control instructions are output.

2. The task scheduling method for an industrial real-time operating system as described in claim 1, characterized in that, The step of statically allocating and setting access permissions for shared memory according to the real-time domain task time parameter table to form a dual-domain isolated operating environment includes: Based on the real-time domain task time parameter table, the industrial Ethernet media access controller and servo bus are exclusively mapped to the address space of the microkernel real-time domain. The interrupt controller is configured according to the interrupt nesting level and the critical peripheral interrupts are routed to the physical core where the microkernel real-time domain is located. A unidirectional circular buffer of shared memory is statically allocated based on the amount of data produced by each hard real-time task in each control cycle, and the target cache and its lock control field are statically allocated based on the upper bound of the worst-case execution time of the critical section. The hardware memory protection unit sets the read pointer and completion flag to be writable by the non-real-time domain of the general operating system, and sets the private memory space of the microkernel real-time domain to be inaccessible by the non-real-time domain of the general operating system, thus forming a dual-domain isolated operating environment.

3. The task scheduling method for an industrial real-time operating system as described in claim 2, characterized in that, In the dual-domain isolated operating environment, the microkernel real-time domain writes the real-time control data collected in each control cycle into the unidirectional circular buffer of the shared memory, and the general-purpose operating system non-real-time domain executes the AI ​​inference task to obtain the detection result, which is then written into the target cache, including: In the dual-domain isolated operation environment, the position command of the motion control task, the input image data of the input-output refresh task, and the safety status data of the safety monitoring task are combined into real-time control data; The next slot number is calculated based on the write pointer and the total number of slots, and the target slot is determined based on the next slot number and the read pointer. The real-time control data is then written to the target slot. The general-purpose operating system's non-real-time domain reads the current periodic data payload in the target slot based on the completion flag of the target slot, executes an AI inference task based on the current periodic data payload, obtains the detection result, and writes the detection result into the target cache.

4. The task scheduling method for an industrial real-time operating system as described in claim 3, characterized in that, The time-slice preemptive scheduling of the AI ​​inference task is performed according to the control cycle idle window, and when a lock conflict occurs when the motion control task reads the detection result, priority inheritance is performed on the AI ​​inference task holding the target cache lock, and motion control instructions are output, including: According to the control cycle idle window, a preemption checkpoint is inserted at the operator boundary of the AI ​​inference task and the real-time domain ready flag is read. When the real-time domain ready flag is set, the current time slice number and intermediate tensor pointer are written into the inference intermediate state memory pool of the pre-locked physical page and the processor is yielded. The lock control field of the detection result is read according to the motion control task, and the priority proxy service promotes the scheduling priority of the AI ​​inference task to the priority mapped by the inherited priority field. The critical section is written and the lock status bit of the lock control field is cleared according to the improved inference task priority. The priority proxy service restores the priority according to the original priority of the lock control field holder. The motion control task reads the detection result and outputs motion control instructions.

5. The task scheduling method for an industrial real-time operating system as described in claim 4, characterized in that, The step of reading the lock control field of the detection result according to the motion control task, and having the priority proxy service raise the scheduling priority of the AI ​​inference task to the priority mapped by the inherited priority field, includes: The motion control task reads the lock control field of the detection result, and after detecting that the lock control field is occupied, it writes it to the inheritance priority field with an atomic write operation to generate a lock conflict record; Based on the lock conflict record, the microkernel real-time domain writes the inter-domain interrupt trigger register to the physical core where the general operating system non-real-time domain is located, and the priority proxy service locates the lock-holding thread in the thread table of the general operating system non-real-time domain according to the holder thread identifier, thus obtaining the lock-holding thread location result. Based on the lock-holding thread location result, the priority of the inherited priority field is mapped to the corresponding level of the general operating system non-real-time domain real-time scheduling class and the scheduling parameters are updated to obtain the improved inference task priority.

6. A task scheduling device for an industrial real-time operating system, characterized in that, The steps for implementing the industrial real-time operating system task scheduling method as described in any one of claims 1 to 5 include: The dual-domain isolation unit is used during the compilation phase to obtain the maximum number of iterations and the maximum nesting level of each hard real-time task in the microkernel real-time domain, and to annotate each basic block in the first control flow graph of each hard real-time task to obtain a second control flow graph. The hard real-time tasks include motion control tasks, input / output refresh tasks, and security monitoring tasks. The execution count of each basic block in the second control flow graph is set as an integer variable. With the control flow graph flow conservation relationship and the maximum number of iterations as constraints, the maximum value obtained is accumulated with the interrupt interference item corresponding to the maximum nesting level to obtain a real-time domain task time parameter table containing the control cycle idle window. Based on the real-time domain task time parameter table, shared memory is statically allocated and access permissions are set to form a dual-domain isolated running environment. The detection unit is used in the dual-domain isolated operation environment, where the microkernel real-time domain writes the real-time control data collected in each control cycle into the unidirectional circular buffer of the shared memory, and the general operating system non-real-time domain executes the AI ​​inference task to obtain the detection result, and writes the detection result into the target cache. The output unit is used to perform time-slice preemptive scheduling of the AI ​​inference task according to the control cycle idle window, and to perform priority inheritance of the AI ​​inference task holding the target cache lock when the motion control task reads the detection result and a lock conflict occurs, and output motion control instructions.

7. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the task scheduling method of the industrial real-time operating system as described in any one of claims 1 to 5.

8. A readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the industrial real-time operating system task scheduling method as described in any one of claims 1 to 5.

9. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the steps of the industrial real-time operating system task scheduling method as described in any one of claims 1 to 5.

Images