Morris Dovey said:
(2) schd() accepts a date/time number and a pointer to the code that I
want to run at that time, and stores these away in a linked list that's
ordered so that the soonest-to-run request is always at the top of the
list.
(3) dispatch() compares the current time to the requested run time for the
top/first element on the list. If it's ripe, the element is moved from the
'pending' list to the 'idle' list for recycling, and the code at the
pointer is called....
My Arduino setup() routine does the usual pin assignments, etc. and then
makes a call to the reactor monitoring routine, which captures and logs
data, schedules itself to run again in 1000 milliseconds, and returns. If
it finds a condition that needs action, it calls other code (which may
start other threads, ad nausea)....
The busiest this thing will ever be is during an emergency shutdown, when
all of the motors, valves, etc. will be operating
concurrently/asynchronously - and not even all that will result in
noticable CPU loading....
Morris Dovey
It sounds to me like you would detect an error condition by polling rather
than interrupts from switches, and then schedule a service routine. If mild
and major faults occur simultaneously, like overtemp and pressure, would it
service both alternately or only the one tested last and thus scheduled
soonest?
I ask because the standard cell IC I designed was a dynamic memory
controller for a flat-bed color scanner that prioritized asynchronous memory
access requests from the CCD array, CPU, GPIB output and refresh controller,
in that order. It absolutely had to accept CCD input before the next word
arrived, but couldn't allow the lower priority requests to pile up too long.
That startup company folded before I had a chance to test the completed
machine and see how well my chip worked.
As a hardware guy I always expect a sensor failure or wiring problem. On one
safety-critical machine the sensor switches were biased by resistor networks
and sensed by the A/D converter, so the windows were say zero to 1V = sensor
or wiring shorted, 1V to 2V = valid low, 2V to 3V = fault???, 3V to 4V =
valid high, >4V = sensor or wire open. Thermocouples were biased to indicate
the lowest negative temperature if open. The A/D converter itself was a
single-point failure node, but was easily tested by checking supply and
reference voltages, and there were two processors and sets of redundant
switches. In addition it had a dead-man shutdown that killed power, leaving
everything in a power-off condition chosen to be the safest, such as landing
gear down. That's why I asked you about solenoid valves. I'd have
normally-closed on the hydrogen input and normally-open on the dump line.
jsw
)
