Comprehensive task computer and backup upgrading method thereof

Abstract

The invention belongs to the technical field of avionics system design, and particularly relates to an integrated task computer and a backup upgrading method thereof. The comprehensive task computer comprises a core processor and a FLASH memory, the FLASH memory is provided with a starting mirror image file and an application mirror image file from low to high according to addresses, the starting mirror image file is internally provided with a first boot loader, a first PL end bit stream and a system configuration program from low to high according to the addresses, and the application mirror image file is internally provided with a second boot loader, a second PL end bit stream and a system configuration program from low to high according to the addresses. The system configuration program is internally provided with a bootstrap program of the application mirror image file and an identification module for identifying whether the application software is upgraded or not; and the application mirror image file is provided with a second boot loader, a second PL end bit stream and an application software program from low address to high address. According to the invention, the online upgrading function of the equipment master control software and the underlying firmware thereof is realized, and the stability and convenience of the system are enhanced.

Description

Technical Field

[0001] This application belongs to the field of avionics system design technology, specifically relating to an integrated mission computer and its backup and upgrade method. Background Technology

[0002] With the rapid development of informatization and intelligentization, avionics systems are also evolving towards intelligent empowerment, placing higher demands on versatility, stability, and convenience. Regarding software upgrades, traditional integrated mission computers typically only upgrade application software, failing to upgrade the underlying firmware of the hardware. In terms of software storage, traditional integrated mission computers generally have only one partition storing software programs. Therefore, existing integrated mission computers suffer from long upgrade cycles, poor flexibility, insufficient software storage redundancy, and a lack of backup mechanisms. Summary of the Invention

[0003] To address the aforementioned issues, this application provides an integrated mission computer and its backup and upgrade method, which effectively enhances the integrated mission computer's software management capabilities and security adaptability.

[0004] The first aspect of this application provides a comprehensive task computer, including a core processor and a FLASH memory. The FLASH memory contains a boot image file and an application image file arranged from low to high address. The boot image file contains a first bootloader, a first PL bitstream, and a system configuration program arranged from low to high address. The system configuration program includes a module for identifying whether the application image file's bootloader and application software need to be upgraded. The application image file contains a second bootloader, a second PL bitstream, and application software programs arranged from low to high address.

[0005] Preferably, the core processor and FLASH memory are connected via a QSPI bus, and the integrated task computer is selectively connected to the upgrade device via a GJB289A bus.

[0006] Preferably, the first bootloader, the first PL bitstream, and the system configuration program of the startup image file are packaged into a first bin file and burned into the first address space of the FLASH memory; the second bootloader and the second PL bitstream of the application image file are packaged into a second bin file and burned into the second address space of the FLASH memory; and the application software program of the application image file is packaged into a third bin file and burned into the third address space of the FLASH memory.

[0007] Preferably, the first address space is the 0-4M address space of the FLASH memory, the second address space is the 4M-6M address space of the FLASH memory, and the third address space is the address space of the FLASH memory after 6M.

[0008] Preferably, both the second and third address spaces of the FLASH memory are provided with a check code storage area to store the CRC32 check value of the corresponding partition.

[0009] A second aspect of this application provides a method for backing up and upgrading an integrated task computer, which upgrades the boot program and application software of the application image file within the integrated task computer as described above. The method includes:

[0010] Step S1: Locate the boot image file at address 0 of the FLASH memory and load the system configuration program;

[0011] Step S2: Listen for upgrade commands from the upgrade device within the set time period;

[0012] Step S3: When a first upgrade instruction is received to upgrade the bootloader of the application image file, the upgrade file is burned into the address space of the second bootloader and the second PL bitstream stored in the application image file; when a second upgrade instruction is received to upgrade the application software of the application image file, the upgrade file is burned into the address space of the application software program stored in the application image file; when no upgrade instruction is received, the load address of the FLASH memory is configured to offset towards the address of the application image file, the Multiboot function is enabled, and the system is reset so that the application image file can be directly loaded after restarting.

[0013] Preferably, before burning the upgrade file, the process further includes:

[0014] The host computer has entered the upgrade phase.

[0015] The packet handshake receives the bitstream file that needs to be upgraded from the host computer and temporarily stores it in memory.

[0016] Preferably, after temporarily storing the upgrade file in memory, the integrity of the upgrade file is verified; if the verification fails, an error feedback signal is sent to the upgrade device, and the original application image file remains unchanged; if the verification succeeds, the partition data of the corresponding FLASH memory is erased according to the target address of the upgrade instruction, and then the temporary data is written back to the FLASH memory.

[0017] Preferably, a rollback mechanism is triggered when the programming process is interrupted or fails:

[0018] Reload the original backup image into memory and burn it to the corresponding partition of the FLASH memory; record the upgrade failure log and report it to the upgrade device via the GJB289A bus.

[0019] Preferably, the upgrade instruction includes dynamic partitioning parameters to indicate the address offset and length of the target partition.

[0020] This application realizes the online upgrade function of the main control software and its underlying firmware of the equipment, which enhances the stability and convenience of the system; this application uses a dual-image method to carry out backup and upgrade strategy design, which effectively improves the software stability, security and reliability of the integrated mission computer. Attached Figure Description

[0021] Figure 1 This is a schematic diagram of the system composition of a preferred embodiment of the integrated task computer of this application.

[0022] Figure 2 This application Figure 1 A schematic diagram of the file layout within the FLASH memory of the embodiment shown.

[0023] Figure 3 This is a flowchart of a preferred embodiment of the integrated task computer backup and upgrade method of this application. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions in the embodiments of this application will be described in more detail below with reference to the accompanying drawings. In the drawings, the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The described embodiments are only some, not all, of the embodiments of this application. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this application, and should not be construed as limiting this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application. The embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0025] This application provides a comprehensive task computer, such as Figures 1-2As shown, it mainly includes a core processor and a FLASH memory. The FLASH memory contains a boot image file and an application image file arranged from low to high address. The boot image file contains a first bootloader, a first PL bitstream, and a system configuration program arranged from low to high address. The system configuration program contains a bootloader for the application image file and a module for identifying whether the application software needs to be upgraded. The application image file contains a second bootloader, a second PL bitstream, and an application software program arranged from low to high address.

[0026] The integrated task computer of this application stores two software programs in its FLASH memory, which correspond to two image files respectively. One is a startup image file and the other is an application image file, forming a program backup mode. The startup image is responsible for online upgrading of the firmware and application of the application image and starting the application image. The application image is responsible for completing the task scheduling and execution of the application software.

[0027] This application enables online firmware upgrades for the equipment by setting up a boot image file to associate with application image files. In particular, it allows for the upgrading of the second bootloader and second PL bitstream in the application image file based on the boot image file, thereby achieving the function of online firmware upgrades for the underlying equipment. In addition, the application programs in the application image file can be upgraded based on the boot image file, and the application programs can also be upgraded based on the second bootloader and second PL bitstream in the application image file, thus improving the software reliability of the integrated mission computer.

[0028] In some alternative implementations, the core processor and FLASH memory are connected via a QSPI bus, and the integrated mission computer is selectively connected to the upgrade device via a GJB289A bus.

[0029] In this embodiment, the upgrade device provides power to the integrated task computer and also acts as the host computer for the upgrade, providing upgrade commands and monitoring. The two interact via the GJB289A bus. The core processor of the integrated task computer interacts with the FLASH memory via the QSPI bus. QSPI is an enhanced version of the SPI protocol, achieving full-duplex communication through four-wire data transmission (IO0-IO3), with a theoretical bandwidth exceeding 50MB / s. It transmits 4 bits of data per clock cycle, improving efficiency by 4 times compared to traditional SPI. Furthermore, it has a built-in FIFO buffer, supporting pipelined operation of instructions, addresses, and data, reducing CPU intervention.

[0030] In some optional implementations, the first bootloader, the first PL bitstream, and the system configuration program of the startup image file are packaged into a first bin file and burned into the first address space of the FLASH memory; the second bootloader and the second PL bitstream of the application image file are packaged into a second bin file and burned into the second address space of the FLASH memory; and the application software program of the application image file is packaged into a third bin file and burned into the third address space of the FLASH memory.

[0031] In this embodiment, such as Figure 2 As shown, the two images are designed as two different projects: one project is used to generate the boot image, and the other project is used to generate the application image. The FSBL, PL-side bitstream files, and application files of the boot image project can be packaged into a single bin file, which is used as the loading file for the boot image. The application image packages the FSBL and PL-side bitstream files into a single bin file as the application image bootloader loading file, and packages the application files into a single bin file as the application image application loading file.

[0032] In some alternative implementations, the first address space is the 0-4M address space of the FLASH memory, the second address space is the 4M-6M address space of the FLASH memory, and the third address space is the address space of the FLASH memory after 6M.

[0033] In this embodiment, the boot image loading file is burned into the FLASH address space from address 0 to 4M (the capacity range can be changed according to the size of the first PL end bitstream file); the application image bootloader loading file is burned into the FLASH address space from address 4M to 6M (the capacity range can be changed according to the size of the second PL end bitstream file); and the application image application loading file is burned into the FLASH address space from address 6M to the subsequent maximum space.

[0034] In some optional implementations, both the second and third address spaces of the FLASH memory are provided with a check code storage area for storing the CRC32 check value of the corresponding partition.

[0035] Based on this embodiment, upgrade functions such as verification, rollback, and logging can be implemented, improving upgrade fault tolerance. For example, the system configuration program automatically verifies the verification code each time the system starts. If the verification fails, the application image is prohibited from starting and an alarm signal is sent through the GJB289A bus.

[0036] A second aspect of this application provides a method for backing up and upgrading an integrated task computer, which upgrades the boot program and application software of the application image file within the integrated task computer as described above. The method includes:

[0037] Step S1: Locate the boot image file at address 0 of the FLASH memory and load the system configuration program;

[0038] Step S2: Listen for upgrade commands from the upgrade device within the set time period;

[0039] Step S3: When a first upgrade instruction is received to upgrade the bootloader of the application image file, the upgrade file is burned into the address space of the second bootloader and the second PL bitstream stored in the application image file; when a second upgrade instruction is received to upgrade the application software of the application image file, the upgrade file is burned into the address space of the application software program stored in the application image file; when no upgrade instruction is received, the load address of the FLASH memory is configured to offset towards the address of the application image file, the Multiboot function is enabled, and the system is reset so that the application image file can be directly loaded after restarting.

[0040] In step S1, the system is powered on, the BOOTROM searches for the boot image file at address 0 of the FLASH memory, obtains the valid image header of the boot image file, moves its first boot loader FSBL to the axisram, and executes the first boot loader FSBL; the first boot loader FSBL is started, the first PL end bitstream file of the boot image file is configured, the application program of the boot image, that is, the system configuration program, is moved, and the execution of the system configuration program is jumped.

[0041] In step S2, the system configuration program of the image file is started to initialize the PS and PL peripherals required for online upgrade, including GJB289A bus, serial port, QSPI, FLASH, etc., and then receives upgrade commands by listening.

[0042] In step S3, if an application image PL end program upgrade handshake signal is received, the application image PL end program upgrade process is entered; if an application image application upgrade handshake signal is received, the application image application upgrade process is entered, thereby realizing the hardware and software upgrade of the application; if no upgrade handshake signal is received within 50ms, the upgrade process is skipped, the application image is entered, and the application image software program is started.

[0043] In some alternative implementations, prior to burning the upgrade file, the process further includes:

[0044] The host computer has entered the upgrade phase.

[0045] The packet handshake receives the bitstream file that needs to be upgraded from the host computer and temporarily stores it in memory.

[0046] This application adopts a command-response approach to design the handshake upgrade process, the specific process is as follows: Figure 3 As shown, if the application image's PL-side program upgrade process is entered, a three-stage handshake will occur. First, the host computer will be notified that the upgrade state has been entered. Then, a packet-based handshake will be performed to receive the bitstream file to be upgraded from the host computer and temporarily store it in DDR3 memory. Finally, according to the burning command, the FLASH memory burning stage will be entered, writing the received data into the 4-6MB space of the FLASH memory to complete the bitstream file burning. If the application image's application upgrade process is entered, a three-stage handshake will also occur. First, the host computer will be notified that the upgrade state has been entered. Then, a packet-based handshake will be performed to receive the application file to be upgraded from the host computer and temporarily store it in DDR3 memory. Finally, according to the burning command, the FLASH memory burning stage will be entered, writing the received data into the space beyond 6MB of the FLASH memory to complete the application file burning. If the application image boot process is initiated, the BOOTROM load address will first be configured to a 4M offset address from the FLASH memory; then the Multiboot function will be enabled, followed by a system reset. Finally, the BOOTROM will search for the application image bootloader at the 4M offset address in the FLASH memory. This bootloader will start the application image's application and begin executing the application.

[0047] In some optional implementations, after temporarily storing the upgrade file in memory, the integrity of the upgrade file is verified; if the verification fails, an error feedback signal is sent to the upgrade device, and the original application image file remains unchanged; if the verification succeeds, the partition data of the corresponding FLASH memory is erased according to the target address of the upgrade instruction, and then the temporary data is written back to the FLASH memory.

[0048] In some alternative implementations, a rollback mechanism is triggered when the programming process is interrupted or fails:

[0049] Reload the original backup image into memory and burn it to the corresponding partition of the FLASH memory; record the upgrade failure log and report it to the upgrade device via the GJB289A bus.

[0050] In some alternative implementations, the upgrade instruction includes dynamic partitioning parameters that indicate the address offset and length of the target partition.

[0051] In this embodiment, the system configuration program adjusts the partition mapping table of the FLASH memory in real time according to dynamic parameters, and reconfigures the storage boundary of the PL end bit stream through the QSPI bus to realize the dynamic expansion or contraction of the partition space.

[0052] This application addresses the problems of traditional integrated task computers, such as the inability to upgrade underlying firmware and the lack of software redundancy backup design; it enhances system stability and convenience. The use of a dual-image backup and upgrade strategy effectively improves the stability, security, and reliability of the integrated task computer's software.

[0053] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A comprehensive task computer, characterized in that, The system includes a core processor and a FLASH memory. The FLASH memory contains a boot image file and an application image file arranged from low to high address. The boot image file contains a first bootloader, a first PL bitstream, and a system configuration program arranged from low to high address. The system configuration program contains a module that identifies whether the application image file's bootloader and application software need to be upgraded. The application image file contains a second bootloader, a second PL bitstream, and application software programs arranged from low to high address.

2. The integrated mission computer according to claim 1, characterized in that, The core processor and FLASH memory are connected via a QSPI bus, and the integrated task computer is selectively connected to the upgrade equipment via a GJB289A bus.

3. The integrated mission computer according to claim 2, characterized in that, The first bootloader, first PL bitstream, and system configuration program of the startup image file are packaged into a first bin file and burned into the first address space of the FLASH memory. The second bootloader and second PL bitstream of the application image file are packaged into a second bin file and burned into the second address space of the FLASH memory. The application software program of the application image file is packaged into a third bin file and burned into the third address space of the FLASH memory.

4. The integrated mission computer according to claim 3, characterized in that, The first address space is the 0-4M address space of the FLASH memory, the second address space is the 4M-6M address space of the FLASH memory, and the third address space is the address space of the FLASH memory after 6M.

5. The integrated mission computer according to claim 3, characterized in that, Both the second and third address spaces of the FLASH memory are provided with check code storage areas to store the CRC32 check values ​​of the corresponding partitions.

6. A method for backuping and upgrading a comprehensive task computer, characterized in that, Upgrading the bootloader and application software of the application image file within the integrated mission computer as described in claim 1, the method includes: Step S1: Locate the boot image file at address 0 of the FLASH memory and load the system configuration program; Step S2: Listen for upgrade commands from the upgrade device within the set time period; Step S3: When a first upgrade instruction is received to upgrade the bootloader of the application image file, the upgrade file is burned into the address space of the second bootloader and the second PL bitstream stored in the application image file; when a second upgrade instruction is received to upgrade the application software of the application image file, the upgrade file is burned into the address space of the application software program stored in the application image file; when no upgrade instruction is received, the load address of the FLASH memory is configured to offset towards the address of the application image file, the Multiboot function is enabled, and the system is reset so that the application image file can be directly loaded after restarting.

7. The integrated task computer backup and upgrade method according to claim 6, characterized in that, Before burning the upgrade file, the following further steps are included: The host computer has entered the upgrade phase. The packet handshake receives the bitstream file that needs to be upgraded from the host computer and temporarily stores it in memory.

8. The integrated task computer backup and upgrade method according to claim 7, characterized in that, After temporarily storing the upgrade file in memory, the integrity of the upgrade file is verified; if the verification fails, an error feedback signal is sent to the upgrade device, and the original application image file remains unchanged. If the verification is successful, the partition data of the corresponding FLASH memory is erased according to the target address of the upgrade instruction, and then the temporary data is written into the FLASH memory.

9. The integrated task computer backup and upgrade method according to claim 6, characterized in that, When the programming process is interrupted or fails, a rollback mechanism is triggered: Reload the original backup image into memory and burn it to the corresponding partition of the FLASH storage; Record upgrade failure logs and report them to the upgrade device via the GJB289A bus.

10. The integrated task computer backup and upgrade method according to claim 6, characterized in that, The upgrade instruction includes dynamic partitioning parameters, which indicate the address offset and length of the target partition.

Images