JP4879124B2 - Fault tolerance architecture for in-circuit programming - Google Patents

Description

  The present invention relates to a computer system having a non-volatile memory for storing a series of instructions to be executed by a processor in the computer system, and more particularly to an in-circuit for updating and changing a series of instructions stored in the non-volatile memory. -It relates to fault tolerance technology for programming.

  Integrated circuit microcontrollers have been developed that include an array of non-volatile memory in an integrated circuit for storing a sequence of instructions to be executed by the microcontroller. The sequence of instructions must be programmed during the device manufacturing process and is stored in a read only memory (ROM) that cannot be updated. A series of instructions is also stored in the EPROM array. However, this approach requires special hardware to program the EPROM array before the device is placed in the circuit. In other systems, EEPROM memory is used to store instructions. EEPROM has the advantage that it can be programmed much faster than EPROM and can be changed quickly. In another approach, flash memory is used to store instructions. This allows for higher density and faster reprogramming of non-volatile memory. When a device combines a reprogrammable non-volatile memory, such as EEPROM or flash memory, with a microcontroller, the device is reprogrammed for as long as it is in the circuit and performs in-circuit programming based on an interaction algorithm. enable.

  The ability to mutually download instructions and data to distant devices is very useful in a network environment. For example, a company can service a customer's device without requiring the customer to transport the device to a service center. Rather, the company can perform diagnostic functions using the in-circuit programming capabilities of the customer's equipment over communication channels such as the Internet and telephone lines. In this way, software modifications are downloaded to the customer's device, and the device is modified and re-enabled with the updated code.

Reliability is an issue during in-circuit programming. The in-circuit programming process takes 10 minutes, during which time there may be data transmission errors or recording errors. These errors are particularly problematic if the code that communicates with the outside world (handshaking code) itself changes during in-circuit programming. If this code is broken, the in-circuit programming module can be left without resetting itself or communicating with the outside world.
What is needed is a way to provide fault tolerance during in-circuit programming, even if the code used by the in-circuit programming process is not correctly programmed to communicate with the outside world.

  The present invention provides a method and apparatus for providing fault tolerance during in-circuit programming. The present invention operates by ensuring that a portion of the computer system boot code is protected from in-circuit programming. As a result, the boot code of the computer system is not corrupted during in-circuit programming. The present invention maintains an in-circuit programming state that is set to an incomplete value when the in-circuit programming process is in progress and is set to a complete value after the in-circuit programming process is completed. . If the system is reset during in-circuit programming, the system will boot from the protected part of the boot code. Otherwise, the system will boot regular boot code that is programmable by the in-circuit programming process. The present invention operates with a watchdog timer that resets itself if the in-circuit programming process fails to complete successfully.

  Accordingly, the present invention indicates that an in-system programming process is in progress and sets the in-circuit programming state to an incomplete value; initiating the in-circuit programming process; When the programming process is finished, indicating that the in-circuit programming process is complete and setting the in-circuit programming state to a full value; and during system initialization, if If the programming state has a complete value, execute the first boot code sequence that is programmable by the in-circuit programming process and if the in-circuit program During in-circuit programming of a computer system having a step that executes a second boot code sequence where the second boot code sequence is protected from the in-circuit programming process if the timing state has an incomplete value Can be characterized as a way to give error recovery.

  According to one aspect of the invention, the in-circuit programming process includes testing a portion of code programmed by the in-circuit programming process.

  According to another aspect of the invention, the in-circuit programming process is monitored to detect delays in the transmission of in-circuit programming instructions. If the delay exceeds a specific timeout value, the in-circuit programming process is restarted. In one embodiment, the monitoring is performed by a remote host from which in-circuit programming code is downloaded. In other embodiments, the monitoring is performed using a watchdog timer coupled to an in-circuit programming system.

  According to another aspect of the invention, the method described above includes storing a remote host address from which in-circuit programming code is downloaded.

  The present invention includes: a processor; a first boot code sequence coupled to the processor; a second boot code sequence coupled to the processor; an in-circuit programming status indicator coupled to the processor; Set to an incomplete value during in-circuit programming; set to a complete value after in-circuit programming is complete; and coupled to the first and second boot code sequences; A selector mechanism for selecting a boot code sequence for system initialization, wherein the selector mechanism includes a first boot if an in-circuit programming status indicator is set to a full value; Select a chord sequence and if Characterized as a device for providing error recovery during in-circuit programming of a computer system that selects a second boot code sequence if the in-circuit programming status indicator is set to an incomplete value Can do.

The present invention includes a step of monitoring an in-circuit program in progress to detect a delay in the transmission of an in-circuit programming command from a remote host, and an in-circuit programming program if the delay exceeds a timeout value. It can be characterized as a method for providing error recovery during in-circuit programming of a computer system having the step of restarting the process.

  The following description is presented to enable a person with ordinary knowledge in the field to make and use the present invention and is given in the context of a particular application and its requirements. Various modifications to the preferred embodiment will be apparent to those skilled in the art. Also, the general principles defined herein may be applied to other embodiments and applications without departing from the spirit and scope of the invention. Accordingly, the present invention is not intended to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and features disclosed herein.

  FIG. 1 illustrates some elements of the main functions of a fault tolerance system for in-circuit programming according to features of the present invention. The in-circuit programming system includes non-volatile memory 100, RAM 108, CPU 112, and peripheral device 114. The in-circuit programming system also includes elements that implement fault tolerance, including jump boot vector 116, multiplexer (MUX) 110, ICP status register 118, remote host address register 120, and ICP watchdog 122.

  In particular, the CPU 112 is any type of processing system including a microcontroller, microprocessor, or mainframe computing system. The CPU 112 is connected to a RAM 108 that is a random access memory including codes and data executed by the CPU 112. Further, the CPU 112 is connected to the nonvolatile memory 100 via the MUX 110.

  Non-volatile memory 100 is any type of memory that persists when power is removed from the system, including flash memory, EPROM, EEPROM, and ROM memory. The nonvolatile memory 100 includes a boot program 102, a utility program 104, an ICP handler 106, and a mini boot code 107. The boot program 102 includes a set of programs that are executed during system initialization to initialize system hardware and software resources. The boot program 102 is stored in a programmable memory that can be modified during the in-circuit programming process.

  The nonvolatile memory 100 also includes a utility program 104 that includes a program executed by the CPU 112 during system operation. Utility program 104 is also included in a memory that can be programmed by an in-circuit programming process. The non-volatile memory 100 also includes an ICP handler 106 included in the memory that performs the in-circuit programming function of the system and can be programmed by the in-circuit programming process.

  In addition, the non-volatile memory 100 has miniboot code 107 contained within protected memory that cannot be changed during the same in-circuit programming process of a regular boot program. The miniboot code 107 is an alternative set of system initialization instructions that perform many of the same functions of the boot program 102. However, only the miniboot code 107 works when there is an error during the in-circuit programming process that makes the boot program 102 potentially corrupted and unusable. Thus, the miniboot code 107 must be stored in memory that cannot be changed during the same in-circuit programming process of a regular boot program. In one embodiment of the invention, the miniboot code 107 is stored in a mask ROM memory, while the boot program 102, utility program 104, and ICP handler 106 are stored in a programmable flash memory.

  The CPU 112 is further connected to hardware elements that facilitate fault tolerance during the in-circuit programming process. The CPU 112 is connected not only to the control input from the ICP status register 118 but also to the MUX 110 that takes the nonvolatile memory 100 and the jump boot vector 116 as inputs. The MUX 110 selectively switches the CPU 112 between the jump boot vector 116 and the non-volatile memory 100 depending on the state of the ICP state register 118. If the ICP status register 118 is dirty, this indicates that the previous in-circuit programming operation has not completed, and the CPU 112 will jump to the miniboot code 107 during system initialization. An instruction is input to the boot vector 116 as an input.

  On the other hand, if the ICP status register 118 is clean, this indicates that an in-circuit programming operation is not in progress, and the CPU 112 takes the first location of the non-volatile memory 100 as input during system initialization. In addition, the CPU 112 is connected to a remote host address register 120 that contains a backup copy of the remote host address when the system is reset during in-circuit programming. The CPU 112 is also connected to the ICP watchdog 122 via a read / write path 130 and a reset line 132.

  ICP watchdog 122 includes a timeout period register 126 and a timer 124 as well as matching logic 128. The timeout period register 126 and the timer 124 can be initialized by the CPU 112 via the read / write path 130. When the value of timer 124 matches the timeout period 126, the matching logic 128 causes a reset signal to be sent through the reset line 123 that supplies the CPU 112. In one embodiment, the hardware elements described above that provide fault tolerance include programmable memory elements that are protected from the in-circuit programming process.

  Further, the CPU 112 is connected to a peripheral device 114 that includes an input / output device used to communicate with the system user indicated by the double arrow on the left side of the peripheral device 114. Peripheral device 114 also has an interface through which the peripheral device is coupled to the Internet 134. Internet 134 is itself connected to remote hosts 136, 138 and 140. The remote host 138 is connected to a disk containing new versions of boot and utility programs to be downloaded to the in-circuit programming system via the Internet.

  In general, the in-circuit programming process operates as follows. The CPU 112 communicates with the user 144 via the peripheral device 114. User 144 causes CPU 112 to begin executing ICP handler 106 which begins the in-circuit programming process. The ICP handler 106 is connected to the Internet 134 via the peripheral device 114 and to the remote host 138 via the Internet 134. Thereafter, the remote host 138 starts downloading data from the disk 142 to the nonvolatile memory 100 via the Internet 134. At the same time, data transfer is started, the timeout period is set to the value evaluated in the ICP watchdog 122, and the timer 124 is started.

  If the in-circuit programming process proceeds smoothly, the fault tolerance feature of the present invention is not activated. On the other hand, if there is an excessive delay in the in-circuit programming process, the timer 124 eventually matches the timeout period 126 and causes the reset signal to flow to the CPU 112 via the reset line 132. Thereby, the CPU 112 starts a boot sequence. If the system is rebooted during the in-circuit programming process, ICP status register 118 is set to a dirty value. This causes the MUX 110 to direct the jump boot vector 116 to the CPU 112 that causes the CPU 112 to boot from the miniboot code 107 instead of the boot program 102. If ICP state 118 is set to a clean value, this means that the in-circuit programming process was complete and MUX 110 causes CPU 112 to boot from boot program 102.

  The miniboot code 107 causes the CPU to start the in-circuit programming process again by first reading the value from the remote host address register 120, and therefore determines which remote host to connect to. Thereafter, the in-circuit programming process begins again.

  2A, 2B, and 2C are flowcharts detailing the sequence of operations involved in providing fault tolerance for an in-circuit programming system in accordance with features of the present invention. This flowchart has five columns: user 144, boot program 102, utility program 104, ICP handler 106, and remote host 138. The boxes under the headings in these columns indicate the operation of the user 144, boot program 102, utility program 104, ICP handler 106, and remote host 138, respectively.

  The system begins at step 210 where the system is powered on or reset by the user, or the system begins at step 212 where the system is self-reset by a watchdog timer. The system then proceeds to step 214 where the system determines whether the ICP status register is set to a dirty value. If it is set to a dirty value, the system proceeds to step 218. If not, the system continues to step 216.

  In step 216, the ICP status register is clean. Thus, the system fetches the first instruction from the default location in program memory. The system then proceeds to step 220. In step 220, the system initializes the hardware and software resources of the system by executing the boot program 102. The system then proceeds to step 228. In step 228, the system allocates the necessary hardware and software for the requested utility program.

  The system then proceeds to step 230. In step 230, the system determines whether in-circuit programming should occur. If not, the system proceeds to step 232. If so, the system proceeds to step 240. In step 232, in-circuit programming is not currently required and the system determines whether to stop. If so, the system proceeds to step 234, which is an end state. If not, the system proceeds to step 222. In step 222, the system runs the requested utility program.

  The system then returns to step 228 to allocate hardware and software for the requested utility program. It should be noted that in step 228, the system can interact with user 144 to determine the correct hardware and software to allocate.

  In step 218, the ICP status register was determined to be dirty with respect to system bootup. Because the boot up code of the regular system can be corrupted, the system fetches the first instruction from the default allocation of protected memory that can be changed by the in-circuit programming process. The system then proceeds to step 224. In step 224, the system executes a jump instruction to the boot vector that specifies a particular entry in the protected memory. The system then proceeds to step 226. In step 226, the system executes the miniboot code 107 that initializes the minimum system resources for in-circuit programming. The system then proceeds to step 236. In step 236, the system restores the remote host address from the remote host address register 120. The system then proceeds to step 240.

  In step 240, the system initiates a link with the remote host and in-circuit programming code is downloaded from the remote host. Thus, in step 242, remote host 138 links with the in-circuit programming system. The system then proceeds to step 244. In step 244, the system stores the remote host address in the remote host address buffer 120. The system then proceeds to step 246. In step 246, the system loads the estimated timeout value into the timeout period register 126.

  The system then proceeds to step 248. In step 248, the system sets the boot vector register 116 to specify the starting address of the miniboot code 107. The system then proceeds to step 250. In step 250, the system sets the ICP status register to an incomplete state indicating that in-circuit programming is currently active. The system then proceeds to step 252. In step 252, the system sets the number of bytes transferred to zero. The system then proceeds to step 254. In step 254, the system continues to download a new boot and / or utility program to the non-volatile memory 100.

  Thus, at step 255, remote host 138 provides a new version of the boot and / or utility program. The system then proceeds to step 256. In step 256, the system determines whether the ICP process is complete. If not, the system proceeds to step 258. If so, the system proceeds to step 264. In step 258, the ICP process does not stop and the system asks whether the number of bytes transferred is equal to the transfer block size. If not, the system returns to step 254 to download more code. If equal, the system proceeds to step 260. In step 260, the system recalculates the timeout value based on performance during the transfer of in-circuit programming code for the ongoing block. Thereafter, the system proceeds to step 262 where the timer 124 is reset. The system then returns to step 252 where the number of bytes transferred is reset to zero.

  In step 264, the data transfer for in-circuit programming is complete and the timer 124 is stopped. The system then proceeds to step 266. In step 266, the system sets the ICP state to a complete value, indicating that in-circuit programming is complete. The system then proceeds to step 270. In step 270, the in-circuit programming process is complete and the system is reset.

According to one feature of the invention, the in-circuit programming process is governed by a timeout period. During this timeout period, a certain amount of data must be transferred from the remote host to the in-circuit programming system. In one embodiment, this timeout period is downloaded twice from the remote host to the processor, the two downloaded values are compared to each other, and the value is correctly downloaded before it is used as the timeout period. Guarantee that. In other embodiments, the timeout period is stored permanently in the in-circuit programming system, the downloaded value is compared with the permanently stored value, and the downloaded value is at least equal to the permanently stored value. Guarantee. If the downloaded value is not at least equal to the permanently stored value, the permanently stored value is used.

The above description of preferred embodiments of the present invention has been made for the purpose of illustration only. They are not intended to limit the invention to the precise shape disclosed.
Obviously, many variations and modifications will become apparent to those skilled in the art. The scope of the present invention is defined by the claims, and is intended to cover their equivalents.

Figure 2 illustrates some elements of the main function of a fault tolerance system for in-circuit programming according to features of the present invention. 6 is a flowchart illustrating a sequence of operations for providing fault tolerance for an in-circuit programming system in accordance with aspects of the present invention. 6 is a flowchart illustrating a sequence of operations for providing fault tolerance for an in-circuit programming system in accordance with aspects of the present invention. 6 is a flowchart illustrating a sequence of operations for providing fault tolerance for an in-circuit programming system in accordance with aspects of the present invention.

Claims (12)

A method for performing error recovery during in-circuit programming of a computer system including a processor coupled to a reprogrammable non-volatile memory comprising:
Providing a boot program to the reprogrammable non-volatile memory, wherein the reprogrammable non-volatile memory is programmable by an in-circuit programming process, and the boot program is a system a step of initializing the target hardware or software is intended to have a resource for initializing,
Providing a miniboot code to a memory protected from the in-circuit programming process, wherein the miniboot code is a resource for initializing software to be initialized of the system in the boot program; are those containing a resource that supports in-circuit programming process for loading subset data or instructions from a remote source to said reprogrammable non-volatile memory, and providing in said memory,
Performing the in-circuit programming process by the processor to load data or instructions into the reprogrammable non-volatile memory;
The in-circuit programming process is in progress with an in-circuit programming state stored and managed by the processor in the in-circuit programming state register when the in-circuit programming process is started. Setting it to the incomplete value shown,
When the in-circuit programming process has completed the step of loading data or instructions, the processor sets the in-circuit programming state to a full value indicating that the in-circuit programming process is complete. Steps,
Connect to a processor simultaneously with the start of the in-circuit programming process using one of the data or instruction sources or the processor to detect delays in downloading blocks of data in the in-circuit programming process Starting a programmed watchdog timer and starting monitoring the in-circuit programming process;
If the delay exceeds a timeout value of the watchdog timer, in response to the monitor, reinitializing the computer system by the processor;
During the re-initializing the computer system, if, if the in-circuit programming state have a full value, by the processor, the boot program selected by the multiplexer, execute, if the in-circuit programming If the state has incomplete value, by the processor, wherein the mini-boot code selected by the multiplexer, execute, and, and a step of re-starting the in-circuit programming process,
A method characterized by that.   The in-circuit programming process loads the section of code into the reprogrammable non-volatile memory and verifies that the section of code has been loaded. The method of claim 1, comprising testing a section of code loaded by the process. The timeout value is downloaded twice from the remote host, and the two timeout values are compared with each other to verify that they match to ensure that the timeout value was downloaded correctly. The method of claim 1. A first timeout value is downloaded from a remote host and compared to a second timeout value permanently stored in the computer system to ensure that the first timeout value is equal to a second timeout value; The method of claim 1, wherein the second timeout value is used as a timeout value if the first timeout value is not equal to a second timeout value . The method of claim 1, wherein executing the miniboot code comprises jumping to an address indicating a boot vector that indicates the start of the miniboot code. Storing the address of the remote host from which the in-circuit programming process downloads data from the remote host, such that the address is protected from the in-circuit programming process;
The method of claim 1, wherein a resource supporting in-circuit programming in the miniboot code initiates a link with a remote host using the stored address. An apparatus for performing error recovery during in-circuit programming of a computer system,
A processor coupled with memory including reprogrammable non-volatile memory;
The memory stores a boot program to be executed by the processor, and the boot program includes a resource for initializing hardware or software to be initialized in the system,
The memory stores miniboot code for execution by the processor, and the miniboot code includes at least some of the resources for initializing software to be initialized of the system in the boot program . Including an alternative set that performs a function , and a resource that supports restarting an in-circuit programming process to load data or instructions into the programmable non-volatile memory;
The memory stores an in-circuit programming sequence for execution by the processor, the in-circuit programming sequence for in-circuit programming to load data or instructions into the programmable non-volatile memory. Executed by the processor for a programming process;
An in-circuit programming status indicator connected to the processor, which is set to an incomplete value by the processor before or during execution of the in-circuit program sequence, and the in-circuit program sequence An in-circuit programming status indicator that is set to a complete value by the processor to indicate completion of execution;
A multiplexer for selecting a boot code sequence for initialization of a computer system, connected to a memory for storing the boot program and storing a mini boot code, wherein the in-circuit programming status indicator is fully A multiplexer for selecting the boot program if it is set to a value, and if the in-circuit programming status indicator is set to an incomplete value;
A device characterized by comprising: 8. The apparatus of claim 7, wherein the boot program and miniboot code are contained in the same memory module. The apparatus of claim 7 , wherein the boot program is programmable through the in-circuit programming process, and the mini-boot code is protected from the in-circuit programming process. 8. The apparatus of claim 7 , wherein the boot program is in flash memory and the miniboot code is in read-only memory. A memory for storing a remote host address connected to the processor, the remote host address having a network address of the remote host, and the in-circuit programming sequence downloading data or instructions from the remote host; 8. The apparatus of claim 7 , wherein the miniboot code has resources to establish a link with the remote host. 8. The apparatus of claim 7 , further comprising a watchdog timer connected to the processor, the watchdog timer monitoring the in-circuit programming process.

Images