KR20010007066A - A method and apparatus for downloading software into an embedded system - Google Patents

Abstract

PURPOSE: A method for downloading new software and a boot version to the memory of an embedded system is provided by using a fail-safe procedure by discriminatingly using a write-protected area and an unprotected area. CONSTITUTION: A controller (11) performs system operation by operating software stored on a flash memory (12). A RAM (13) is a volatile memory for temporarily storing an initializing and a downloading program and in download mode, a controller (11) is made to operate the system (10). At this time, the software of the latest version copied from the flash memory (12) to the RAM (13) is used each time the system is initialized. To allow complete operation in downloading operation, all operating programs can be copied to the RAM 13.

Description

A METHOD AND APPARATUS FOR DOWNLOADING SOFTWARE INTO AN EMBEDDED SYSTEM}

The present invention relates to the field of embedded systems. More specifically, the present invention provides an effective method for upgrading a software version used to control the operation of an embedded system by downloading a new software version to a single non-volatile memory of the embedded system using failsafe procedures on a substrate. Relates to a device.

Embedded systems are widely used in industry and in office and consumer products. In practice, embedded systems include virtually any device that uses a microprocessor and / or microcontroller and is not only involved in multipurpose calculations. The control system is “built in” the device and is an integral part of the device. Such devices are used to control, monitor or support the operation of many types of machinery and equipment. For example, telephones and many other electronic devices are operated and controlled by firmware, which is a piece of software stored in (or "burned" to) the memory of the electronic device and typically operating the device. It is always called by the controller and / or processing device.

In many devices, the firmware is connected to a database, stored in the same or different memory, and contains the information necessary for proper operation of the device. The device typically includes a specific printed circuit board (PCB) on which the controller or processing device and the required connection memory are assembled (usually soldered). This printed circuit board structure is widely used because it saves space in mass production and is cost effective. The original version of the firmware and the contents of the database are first downloaded into the device's memory by the manufacturer before delivery to the consumer, and serve as the operating system of the device along with the processor or controller.

In many cases, due to consumer demand, improvements in device characteristics are required over time, and new features are provided by manufacturers who continue research and development activities to improve device performance. Such improvements are sometimes realized by upgrading the device's firmware and / or database contents to a new version. This upgrade requires downloading a new version and overwriting (programming) the memory cell containing the previous firmware and database version. Upgrading in the art can be accomplished by a technician or by a data source such as a personal computer (PC) via a data communication link connected to the device, eliminating the need to return the device to the manufacturer for upgrade. In addition, there is an urgent need for enabling on-board upgrades, i.e. eliminating the need to disassemble upgradeable components (e.g. memory devices) from printed circuit boards.

Most embedded systems use an initialization process known as "boot" operation, in which the boot software (sector represents a unit of storage space) until the underlying software or specific instructions go into normal operation. ) Is loaded. Boot performance should be maintained to enable another download and programming process even if the download process fails or the downloaded firmware version is compromised for some reason. Therefore, the boot instruction must be safely saved and restored whenever the downloading or programming process is not working. A typical known solution is to store boot instructions in read-only memory (ROM), which is non-destructive (i.e. retains stored data without the need for power up) and is write protected. However, although the ROM is relatively dense, it cannot be upgraded and must be operated with additional non-volatile memory that is reprogrammable to enable redundancy in stored firmware versions. Thus, this solution is not adaptive and cost effective because one or more non-destructive memory is required and also consumes expensive printed circuit board areas and the boot sector cannot be upgraded. In addition, the initial programming of ROM is relatively time consuming and is usually cost effective in mass production.

U. S. Patent No. 5,666, 293 discloses a method of upgrading the operating system software of a terminal device by downloading a new version over a broadcast channel. The upgrade is accomplished by cyclic broadcast of the packetized data file, which contains the operating system and is captured and stored by the terminal device. However, operating system upgrade routines are stored in ROM, either alone or in conjunction with write-protected sectors of Non-Volatile Random Access Memory (NVRAM). In addition, booting the operating system stored in non-destructive RAM is performed by a loader program stored in ROM and not upgraded.

U. S. Patent No. 5,647, 986 discloses an automatic wastewater treatment apparatus controlled by a controller. The controller is a combination of flash and boot memory and features remote programming capabilities. Flash memory stores the operating program of the device, and boot memory contains boot code, which is required to handle basic communication and reprogramming of flash memory. The controller establishes a connection with the central computer from which new operating programs are downloaded and is instructed to delete the contents of the flash memory. After the contents of the flash memory have been deleted, the controller starts to reprogram the flash memory with the data transferred from the central computer. After programming is complete, the controller reboots the device's processing unit and the device begins to operate according to the updated operating program. However, the device has no backup or reboot capability if it goes down during the download and / or programming process and requires a separate non-upgraded boot memory.

Prior art in the art does not provide a satisfactory solution to the problem of plate downloading new software and boot versions into a single non-volatile memory of the embedded system, which also allows for the upgrade of the download control program, using failsafe procedures. have.

It is an object of the present invention to provide a method and apparatus for downloading new software and boot versions into the memory of an embedded system using failsafe procedures.

It is another object of the present invention to provide a method and apparatus for downloading new software and boot versions into the memory of an embedded system, carried out on board and in the field.

It is yet another object of the present invention to provide a method and apparatus for downloading new software and boot versions into the memory of an embedded system, using a single non-volatile memory component.

Other objects and advantages of the invention will be apparent from the following detailed description.

The present invention relates to a method for upgrading the operating software and / or initialization program versions of an embedded system. A single non-volatile memory element, such as flash memory, is divided into a write-protected area and an unprotected area. Unprotected zones are used to store downloaded software versions. The hardware write protected area of the flash memory is used to store the original version of the initialization and download program and can only be programmed at relatively high voltages not used in the field. The original protected initialization and download program functions as a backup program and is used to run a new download program whenever the current download process stops working. Write-protected zones eliminate the need for additional non-volatile memory, such as ROM.

Preferably, the last valid version of the initialization and download program stored in flash memory is copied to a destructive memory, such as RAM, and the embedded system is operated from RAM. This enables the download process of new initialization programs and operating software versions during the normal operation of the embedded system. Preferably, at the time of the initialization process, the initialization and download programs are copied to RAM and the embedded system is operated from RAM to perform initialization and download functions, if necessary. Optionally, all or part of the system functionality can be duplicated and operated from RAM to allow additional functionality during the upgrade process.

Downloading is performed via a data receiving input in the embedded system. The downloaded data is verified and, if determined to be valid, is programmed into the unprotected area of the flash memory. Optionally, to upgrade, the flash memory can be erased first, and the data is stored directly into the unprotected area of the flash memory. If the download process is interrupted due to an unrecoverable error, it can be completed after activating the initial initialization process from the write protected area of the flash memory or after activating the updated initialization process of the unprotected area of the flash memory. The download and programming process starts over from the beginning, or optionally continues from the point where a data error is detected. After programming, the system is rebooted, the updated initialization process stored in the unprotected area of flash memory is activated, copied to RAM and the embedded system is operated by the new operating software version. Optionally, all or part of the operating software can be copied to RAM and run continuously.

Preferably, the download of the new version is performed by a data source such as a PC connected to the data receiving input of the embedded system or via a data link a group of data from a remote source to the data receiving input of the embedded system. By transmitting from a remote data source.

The invention also relates to an embedded system, in the field and on the board, that has the capability of upgrading operating software and / or initializer versions without affecting regular operation. The embedded system consists of:

A single non-volatile memory element comprising a write protected area for storing the original initialization and download program of the embedded system and an unprotected area for storing the finally updated version of the initialization and download program;

-A destructive memory for storing the initialization program and / or operating software version of the embedded system, which enables simultaneous operation and reprogramming of new versions;

Control circuitry for controlling the initialization process and operation of the embedded system, copying the contents of the non-volatile memory to the volatile memory, and downloading, verifying and programming a new version of the operating software and / or the initialization program; And

A data receiving input for downloading software and / or said initiator version.

1 is a block diagram of a software upgradeable embedded system having a single non-volatile memory, in accordance with a preferred embodiment of the present invention;

2 is a schematic diagram of a memory arrangement of the embedded system of FIG. 1, in accordance with a preferred embodiment of the present invention;

3 is a flow chart of status words of a non-destructive memory system, in accordance with a preferred embodiment of the present invention; And

4 is a flow chart of an embedded system operation, in accordance with a preferred embodiment of the present invention.

The above and other features and advantages of the present invention will be better understood from the following illustrative, non-limiting detailed description of the preferred embodiments of the present invention with reference to the accompanying drawings.

1 is a block diagram of a software upgradeable embedded system having a single non-volatile memory element, in accordance with a preferred embodiment of the present invention. The embedded system 10 is controlled by the controller 11, which is connected to the flash memory 12 and random access memory (RAM) 13 and according to the operating software stored in the flash memory 12 Activate the function. Flash memory 12 is the only non-volatile memory required to store operating software and / or other required instructions. RAM 13 is a destructive memory used for temporary storage of initialization and download programs, using the latest software version copied from flash memory 12 to RAM 13 each time the system is initialized. Allows controller 11 to operate system 10 in mode. In another embodiment, some or all of the operating program may be copied to RAM 13 to allow additional functionality during the download process. For example, in a smart telephone, a portion of the telephone operating control program that allows dialing, the dial tone type of the telephone for incoming calls, and other basic functions may be copied to the RAM 13 so that it can be downloaded. While this function is enabled. It is also possible to copy the entire operating program to RAM 13 to allow full operation during download, in which case all software is run in RAM. The main advantage of flash memory is that its contents are non-destructive, high density devices that can be easily changed "within the system," without having to disassemble.

System 10 is connected to a data source via communication link 14 through which a new program version can be downloaded to flash memory 12 and / or RAM 13. The controller 11 controls the data flow. Thus, downloading and programming new software and firmware versions to system 10 is accomplished via link 14, typically by connecting a programming device (eg, a computer) to link 14. So the upgrade is made in the field and can be distributed on CD-ROMs or the Internet. For example, the system 10 may be a smart phone, which, via a serial connection (eg RS-232), obtains a new software version from an attached PC that acts as a data communication link 14. It can be programmed by downloading. While system 10 is operating normally, each time system 10 is turned on, a boot process is initiated according to instructions stored in flash memory 12 and copied to RAM 13. After the boot process, the system 10 enters a normal operating mode, and the controller 11 controls system functions in accordance with a program stored in the RAM 13 and / or the flash memory 12. Typically, the original (first) software version is programmed into the flash memory 12 by the manufacturer, and in the field a new (and improved) version that enhances the functionality of the system 10 or provides new features to the user. It is sometimes updated by updating. However, for some reason, sometimes the download process is interrupted, or part of the new software version is corrupted (eg due to an unrecoverable error that occurs during data transfer over communication link 14). Since downloading and programming involves the deletion of data from previous software versions in memory, there should be no situation where the flash memory contains only corrupted or incomplete software versions. Therefore, it is very important to continue to protect the boot procedure and maintain availability for reuse to enable new boot processes and subsequent download and programming operations. In another preferred embodiment, it is desirable to provide a memory arrangement for operating the system 10 at some level of functionality according to the current software version, and at the same time programming the new software version on the system 10. (Ie the operation of system 10 is not completely interrupted while programming a new software version). RAM 13 is used to store part or all of the current software version required for operationa, and flash memory 12 is programmed. At a minimum, RAM 13 is used to store and operate the download program. In addition, it is desirable to have the boot and download procedures upgraded. Current flash memory technology does not allow flash memory elements to be accessed simultaneously while being programmed in any sector.

2 schematically illustrates a memory arrangement of the embedded system of FIG. 1, in accordance with a preferred embodiment of the present invention. The storage space of the flash memory 12 is divided into a number of sectors (at least three sectors), also known as segments. Two sectors are used to store the boot program and the remaining sectors are used to store the current version of the operating software, which can be upgraded by the download operation. One boot sector 20 of the flash memory contains the original boot program as programmed by the manufacturer and is hardware protected. Hardware protection can be achieved, for example, by requiring a relatively high voltage that is not available in the field to enable the write function. As a result, system 10 has a protected boot sector that cannot be upgraded in the field. The other boot sector 21 that is not write protected is first programmed with the one boot program and can be upgraded to a new version. An appended flag at the end of the sector is used as the status flag for each of the accessible sectors 21 and 22 of the flash memory 12. Referring to Fig. 3, there is a state diagram of the state flag. The flag is programmed to a "valid state" at the factory. The first step of the update process involves resetting this flag to the "deletion process". Once set, the update process can be started, which involves deleting the current program. After the deletion procedure is completed, the flag is reset to the "deleted" state. After the sector has been programmed and verified, the flag is restored back to the "valid" state.

During the download process, a cyclic redundancy code (CRC) is added to each block of data transmitted via link 14 to system 10 by a remote data source (of a new software / boot version). The controller 11 applies the same CRC calculation to the received data and compares it with the result that was added to the data block before transmission. If the results match, it indicates that the data block was received successfully, ie without data errors, and is an exact copy. If the results do not match, a request to resend the data block is sent over the communication link 14, after which the block is sent again by the remote data source. Such procedures are well known to those skilled in the art. If the logical sector has been properly received, the sector is programmed by the running upgrade program, as indicated by the valid CRC code. The data is then read from the stored sector and reconfirmed, with the status flag at the end of the sector set to "valid".

According to a preferred embodiment of the invention, this dual boot sector arrangement (of write-protected and accessible sectors) of flash memory 12 is stored in write-protected boot sector 20 whenever the download process is interrupted. Using the original boot program, or as indicated by the status flag, the reboot operation is enabled by using an updated boot program with the contents of the accessible boot sector 21 if an exact copy is present. If the flag is valid, the updated boot program is copied to the memory segment 23 (boot segment) of the RAM 13, and every time the system is restarted, such as after the download and programming of the flash memory 12, the system 10 Used to boot. If the flag of the boot sector 21 is not valid, the original, hardware protected version of the boot program is copied to the memory segment 23. RAM 13 includes an additional segment 24 and, if necessary, the data block downloaded to it can be copied for temporary storage. The system 10 is operated and controlled by the controller 11 using the (copyed) boot program stored in the RAM 13 and the software stored in the flash memory 12. Thus, each time the system starts to operate, one of the two boot sectors 20 or 21 is copied to the segment 23 of the RAM 13. Therefore, the program always runs from the same address space, regardless of which code version is used.

4 is a flow chart of an embedded system operation, in accordance with a preferred embodiment of the present invention. The program starts from sector 20 of flash memory. In the first step 401, the validity of the software stored in the sector 21 is checked by checking the status flag stored at the end of the same sector. If known to be valid, in the next step 402, the contents of the sector 21 are copied to the segment 23 of the RAM 13. If not known, in the next step 403, the contents of the segment 20 are copied to the sector 23 of the RAM 13. In a next step 404, the operational address of the controller 11 is sent to the sector 23 (to be operated from the sector). The program copied to sector 23 causes at least controller 11 to operate downlink 14 and update flash memory 12.

According to another preferred embodiment of the invention, one or more sectors 22 of flash memory 12 are also copied to RAM 13. In this case, the controller 11 operates the corresponding portion of the program from the RAM 13 rather than from the flash memory 12. This enables additional functionality during the download because the program can not be run from the same address as it is updated. Currently in practice, during the update, the software can never be executed from the flash memory 12, so only the software copied to the RAM 13 can function.

Along with the boot sector 23 of the RAM 13, the sector 22 of the flash memory 12 is used to generate a software version. The original software version is programmed in the sector 22 of the flash memory by the manufacturer. In operation, if the final version of the boot program (the original boot program at the first run) is known to be valid, it is copied from the unprotected boot sector 21 to the boot segment 23, and the final software version (the original at run time). Software version) is used from sector 22 to cause controller 11 to operate system 10 from RAM 13 and flash memory 12.

The boot program can also be updated by sending a new boot data block and programming the unprotected boot sector 21 into the received boot data block. The protected boot sector 20 includes the original boot program as a backup. When the system 10 is initialized, the controller 11 selects the boot program used for initialization by first checking the validity of the last boot program stored in the boot sector 21. If the status code of the received (new) boot data block is known to be valid, the final boot program is copied from sector 21 to boot segment 23 of RAM 13, and the initialization process is finalized in RAM 13 ( Depending on the version of the boot program (which has been updated). If the status code of sector 21 indicates that the received (new) boot data block is invalid, the original boot program is copied from sector 20 to boot segment 23 of RAM 13, and the initialization process is In accordance with the original boot program version at 13, a new download and programming process is possible. Thus, by using the dual boot sector of flash memory 12, the download and programming process is fail-safe. According to a preferred embodiment of the present invention, if the status code of sector 21 indicates that the received (new) boot data block is not valid, then the original boot program is transferred from sector 20 to boot sector 23 of RAM 13. In addition to copying), additional logical segments in sector 22 are copied to RAM 24 to enable additional functionality. Each sector is only loaded if it indicates that the status word is valid. The operating program must be designed to enable functionality independent of each logical segment, so that some additional valid segments will work when no other segment is invalid.

According to a preferred embodiment of the present invention, the download and programming operations performed by transmitting the updated data block from the remote source, via the communication link, described above, also provide a data source, such as a PC, in the field and on the board. Can be similarly performed by a technician or user connecting to a suitable input or data link input (e.g., a serial RS-232 port).

The above examples and description are given for illustrative purposes only and do not limit the invention in any way. As will be appreciated by those skilled in the art, the present invention can be implemented in a wide variety of ways, which utilize a micro-controller or microprocessor to control the operation of the embedded system, and wirelessly download the upgraded software version. Using more than the techniques described above, such as using data communication links, implementing embedded systems on monolithic circuitry using flash memory and / or RAM and other types of destructive and non-destructive memory, and the like. It can be practiced as, all of which do not depart from the scope of the invention.

With the method and apparatus according to the invention, it is possible to download new software and boot versions into a single non-volatile memory of the embedded system, using failsafe procedures, on the board and in the field.

Claims (23)

a) providing a programmable, non-destructive first memory having at least one write protected area comprising an original initialization and download operating program version and at least one unprotected area containing at least an upgradeable initialization and download operating program version; ; b) upon initialization, copying at least the upgradeable, or original, version of the initialization and download operating program version to a second memory and / or memory location; c) operating said embedded system from said second memory and / or said memory location; And d) downloading a new operating software and / or initiator version and enabling programming the unprotected zone with the downloaded version. The method of claim 1, wherein the second memory is physically separated from the first memory. The method of claim 1, wherein the download of the new version is by using a portable data source connected to a data receiving input of an embedded system. The method of claim 1, wherein the new version of the download is made from the remote data source by sending a group of data from the remote data source via a data link to a data receiving input of an embedded system. 5. The method of claim 4, wherein the data link is a wireless link. The method of claim 1 wherein the non-volatile memory is a flash memory. The method of claim 2, wherein the second memory is a destructive memory. The method of claim 1, wherein the arrival of the aborted downloaded data is detected by checking a data status code. The method of claim 1, wherein upon initialization, performing the following steps: a) check the status code of the unprotected zone; b) if the status code indicates that the initialization and download operating program version is valid, copy the program version to a second memory and / or memory location; And c) If the status code does not indicate that the initialization and download operating program version is valid, copy the original initialization and download operating program version to the second memory and / or memory location. 3. The method of claim 2, wherein the write protected area and the unprotected area are sectors of a single flash memory. The method of claim 1 wherein the embedded system is a telephone. The method of claim 1 wherein the embedded system is a telecommunication system. a) a single non-volatile memory having at least one write protected area for storing the original initialization and download program version of the embedded system and at least one unprotected area for storing the upgradeable initialization and download program version of the embedded system ; b) at least a second memory and / or memory location for storing an initialization and download program version of said embedded system; c) copying at least the original initialization and download program or the upgradeable initialization and download program version to the second memory and / or memory location and downloading and programming at least a new initialization and / or download program version. Control circuitry for controlling the initialization process and operation of the system; And d) a data receiving input for downloading software and / or said initiator version. Embedded system with upgrade capability for operating software and / or initiator versions, including. 14. The embedded system of claim 13 wherein the second memory is physically separate from the first memory. 14. The embedded system of claim 13 wherein the new version is downloaded by using a data source connected to a data receiving input. 15. The embedded system of claim 13, having a data communication link for receiving and downloading a new version of data sent by the data source. The embedded system of claim 13, wherein the data communication link is a wireless link. The system of claim 13, wherein the non-volatile memory is a flash memory. The system of claim 13, wherein the second memory is a destructive memory. The system of claim 13, wherein the control circuit is operated according to at least the following steps: a) upon initialization, check the status word of the unprotected zone; b) if the status word indicates that the initialization and download operating program version is valid, copy the program version to a second memory and / or memory location; And c) if the status word does not indicate that the initialization and download operating program version is valid, copy the original initialization and download operating program version to a second memory and / or memory location. 14. The embedded system of claim 13, wherein the original initialization program is used whenever the data status word does not indicate that an upgradeable initialization and download program version is valid. The system of claim 13, wherein the system is a telephone. 18. The embedded system of claim 13, wherein the embedded system is a telecommunications system.