Fault-tolerant method, system and equipment for preventing FPGA (Field Programmable Gate Array) program solidification update failure and medium
By adjusting the address jump register and enabling the countdown rollback mechanism in the FPGA's golden image, the problem of device failure caused by image update failure was solved, achieving stable rollback and multi-platform applicability of the device.
Patent Information
- Application Number
- CN202512016700.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-30
- Publication Date
- 2026-03-20
AI Technical Summary
During the existing FPGA program firmware update process, if the update image fails, a timeout error cannot be triggered to roll back to the gold image, causing the device to fail. Furthermore, it is not applicable to multi-platform systems.
By adjusting the address jump register in the gold image to the starting address of the Timer1 image, and enabling countdown and rollback in Timer1, the update image, and Timer2 images, an MCS file is generated to ensure that the update can time out and roll back to the gold image in case of update failure.
It enables stable rollback of the device in various update failure scenarios, improving the stability and versatility of the system, and is applicable to FPGA chips on multiple platforms.
Smart Images
Figure CN121704876A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of electronic technology, and in particular to a fault-tolerant method, system, device and medium for preventing FPGA program firmware update failure. Background Technology
[0002] FPGA (Field Programmable Gate Array) multiboot technology, often referred to as multiple boot or remote update, is a core function supporting remote firmware upgrades and improving system reliability. It allows the FPGA to select and load a running image from multiple images in external Flash memory based on preset conditions. If the primary image fails, it can automatically revert to the safe, golden image, which typically contains only the most basic system functions (communication interfaces and upgrade logic, etc.), ensuring boot capability under any circumstances. Figure 1 As shown, after the FPGA powers on normally, it automatically loads and runs the gold image bitstream program starting from address 0 of the Flash memory. At the beginning of the file, a countdown and rollback enable are enabled. After executing the built-in IPROOG (address jump instruction) command, it jumps to the specified address A1 in the Flash memory to load the updated image. If the updated image is successfully loaded, the FPGA will run normally. If any error occurs during loading (device identification code (IDCODE) mismatch, CRC (cyclic redundancy check) failure, watchdog timeout, etc.), the FPGA's Fallback function will be triggered, automatically loading the gold image at address 0. During the rollback process, jump commands are ignored to avoid repeated loop jump failures, stabilizing the system under the gold image.
[0003] However, during FPGA development, if the online programming of the update image fails, it will not jump to the gold image normally, causing the entire device to fail. Analysis revealed that during the execution of the IPROG jump, the FPGA sets the countdown timer register to zero. This prevents the timeout error rollback generated in the gold image from occurring during the failed update of the corrupted update image, ultimately causing the FPGA to fail. Secondly, if the update image also contains an IPROG (jump) instruction, the TIMER (countdown timer) register will also be set to zero when loading the update image. This means that the update image program after the jump lacks timeout rollback functionality, failing to guarantee that the device will time out and restart after an update error, causing the entire system to enter an uncontrollable state. Therefore, under the current trend, this traditional combination of gold and update images for FPGA chips has significant limitations. It cannot meet the fault tolerance requirements of system updates and is not suitable for complex multi-platform environments. Summary of the Invention
[0004] In view of this, this application provides a fault-tolerant method, system, device and medium for preventing FPGA program firmware update failure, preventing the failure to trigger a timeout error and rollback to the golden image startup after the FPGA chip fails to update firmware online, and ensuring that the chip can start normally through the fault tolerance mechanism.
[0005] This application discloses a fault-tolerant method for preventing FPGA program firmware update failures, comprising: Step 1: The golden image contains the most basic system functions. The initial position of the image contains address jumps. Adjust the register address of the golden image address jump to the starting address of the Timer1 image. Step 2: In the Timer1 image, enable rollback and start the countdown register TIMER_CFG to ensure that when the address jump instruction IPROG jumps to the starting address of the Timer1 image, the countdown register is reassigned in the Timer1 image. This ensures that even if the data at the beginning of the FPGA online programming update image is corrupted and the FPGA fails to load the update image program, the countdown in the Timer1 image will still be effective, triggering a timeout rollback to the gold image. Step 3: In the constraint file of the updated image, enable rollback and countdown, and make the count length exceed the normal loading time of the FPGA program to ensure that the timeout rollback mechanism will not be triggered during normal loading. If the data after the countdown in the updated image is corrupted during FPGA programming, the timeout rollback to the gold image will be triggered by the countdown register in the updated image. Step 4: In the Timer2 image, enable rollback and start the countdown counter. When the address jump instruction IPROOG exists in the update image, the countdown register is reset to zero. If the data after the address jump instruction IPROOG in the update image is corrupted, the FPGA sequentially loads into the Timer2 image, and the countdown register is reassigned to trigger a timeout rollback to the gold image. Step 5: In the FPGA's Flash memory, set up four partitions in ascending order of address to store the Gold Image, Timer1 Image, Update Image, and Timer2 Image respectively. In the development platform, generate an MCS file for FPGA firmware by storing the Gold Image, Timer1 Image, Update Image, and Timer2 Image according to their corresponding addresses to prevent the inability to jump to the Gold Image after the FPGA firmware update fails.
[0006] Further, step 1 includes: Adjusting the address register WBSTAR of the address jump instruction IPROG in the gold mirror to the starting address of the Timer1 mirror causes the countdown register in the Timer1 mirror to be reassigned, and the timeout rollback takes effect.
[0007] Further, step 2 includes: Generate a Timer1 image in the development platform, and enable rollback and countdown in the Timer1 image so that the countdown register, which was set to zero due to the FPGA jump operation, is reassigned in the Timer1 image.
[0008] Further, step 3 includes: The rollback enable and countdown enabled in the update image are redundant operations. When there is no jump operation in the update image and the damage occurs in the middle, that is, after the rollback enable and countdown are enabled, the FPGA loads the update image to read and write the countdown register and reassign it to accurately control the timeout rollback time.
[0009] Further, step 4 includes: If there is a jump operation in the updated image, causing the countdown register used for assignment in the updated image to be set to zero, even if the program after the jump operation position is corrupted, the Timer2 image can reassign the countdown register to ensure that a timeout rollback to the golden image is triggered.
[0010] Furthermore, the jump address in the gold image is set to the starting address of the Timer1 image. Rollback enable and countdown enable are added to the Timer1 image, update image, and Timer2 image. The firmware file is generated in the development platform according to the corresponding address so that if any operation is performed on the update image or if damage occurs at any location, the system can roll back to the gold image to prevent FPGA program firmware update failure.
[0011] This application also discloses a fault-tolerant system for preventing FPGA program firmware update failures, implementing the aforementioned fault-tolerant method for preventing FPGA program firmware update failures, comprising: The address setting module is used to include the most basic system functions in the golden image. It includes address jumps at the initial position of the image and adjusts the register address of the golden image address jump to the starting address of the Timer1 image. The first rollback module is used to enable rollback in the Timer1 image and simultaneously start the countdown register TIMER_CFG to ensure that when the address jump instruction IPROG jumps to the starting address of the Timer1 image, the countdown register is reassigned in the Timer1 image. This ensures that even if the data at the beginning of the FPGA online programming update image is corrupted and the FPGA fails to load the update image program, the countdown in the Timer1 image will still be effective, triggering a timeout rollback to the gold image. The second rollback module is used to enable rollback and countdown in the constraint file of the update image. The count length exceeds the normal loading time of the FPGA program to ensure that the timeout rollback mechanism is not triggered during normal loading. If the data after the countdown in the update image is corrupted during FPGA programming, the timeout rollback to the gold image is triggered by the countdown register in the update image. The third rollback module is used to enable rollback and start the countdown counter in the Timer2 image. When the address jump instruction IPROOG exists in the update image, the countdown register is reset to zero. If the data after the address jump instruction IPROOG in the update image is corrupted, the FPGA is sequentially loaded into the Timer2 image, and the countdown register is reassigned to trigger a timeout rollback to the gold image. The jump module is used to set up four partitions in the FPGA's Flash memory in ascending order of address, which are used to store the gold image, Timer1 image, update image and Timer2 image respectively. In the development platform, the gold image, Timer1 image, update image and Timer2 image are generated into an MCS file for FPGA hardening according to the corresponding address, so as to prevent the inability to jump to the gold image after the FPGA hardening program update fails.
[0012] This application also discloses an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, it implements the fault-tolerant method described above for preventing FPGA program firmware update failure.
[0013] This application also discloses a computer-readable storage medium comprising a computer program or instructions that, when executed on a computer, cause the computer to perform the fault-tolerant method described above for preventing FPGA program firmware update failure.
[0014] Due to the adoption of the above technical solution, this application has the following advantages: 1. This application ensures that even if the device update firmware fails, it will not become invalid and will be able to roll back to the golden image startup normally: by setting the address jump in the golden image, enabling the countdown and rollback in the Timer1 image, update image, and Timer2 image, and finally generating the firmware file according to the address. This fault tolerance mechanism can prevent the device system from failing in the event of multiple update failures, thus improving system stability.
[0015] 2. This application has stronger versatility, and the fault tolerance mechanism is applicable to FPGA chips on multiple platforms: Currently, the same device may initially be equipped with a chip from one manufacturer, and later replaced with a chip from another manufacturer that was originally installed. The current fault tolerance mechanism can update the software to a single version, avoiding the occurrence of different programs being written to the same device, which would cause management difficulties and chaos. This fault tolerance mechanism has multi-platform versatility. Attached Figure Description
[0016] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments recorded in the embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings.
[0017] Figure 1 This is a schematic diagram of the existing FPGA program firmware update method; Figure 2 This is a schematic diagram of a fault-tolerant method for preventing FPGA program firmware update failure according to an embodiment of this application. Detailed Implementation
[0018] The present application will be further described in conjunction with the accompanying drawings and embodiments. The described embodiments are only some, not all, of the embodiments of the present application. All other embodiments obtained by those skilled in the art should fall within the protection scope of the embodiments of the present application.
[0019] See Figure 2 This application provides an embodiment of a fault-tolerant method for preventing FPGA program firmware update failures, comprising: Step 1: The golden image contains the most basic system functions. The initial position of the image contains address jumps. Adjust the register address of the golden image address jump to the starting address of the Timer1 image. Step 2: In the Timer1 image, enable rollback and start the countdown register TIMER_CFG to ensure that when the address jump instruction IPROG jumps to the starting address of the Timer1 image, the countdown register is reassigned in the Timer1 image. This ensures that even if the data at the beginning of the FPGA online programming update image is corrupted and the FPGA fails to load the update image program, the countdown in the Timer1 image will still be effective, triggering a timeout rollback to the gold image. Step 3: In the constraint file of the updated image, enable rollback and countdown, and make the count length exceed the normal loading time of the FPGA program to ensure that the timeout rollback mechanism will not be triggered during normal loading. If the data after the countdown in the updated image is corrupted during FPGA programming, the timeout rollback to the gold image will be triggered by the countdown register in the updated image. Step 4: In the Timer2 image, enable rollback and start the countdown counter. When the address jump instruction IPROOG exists in the update image, the countdown register is reset to zero. If the data after the address jump instruction IPROOG in the update image is corrupted, the FPGA sequentially loads into the Timer2 image, and the countdown register is reassigned to trigger a timeout rollback to the gold image. Step 5: In the FPGA's Flash memory, set up four partitions in ascending order of address to store the Gold Image, Timer1 Image, Update Image, and Timer2 Image respectively. In the development platform, generate an MCS file for FPGA firmware by storing the Gold Image, Timer1 Image, Update Image, and Timer2 Image according to their corresponding addresses to prevent the inability to jump to the Gold Image after the FPGA firmware update fails.
[0020] Optionally, step 1 includes: Adjusting the address register WBSTAR of the address jump instruction IPROG in the gold mirror to the starting address of the Timer1 mirror causes the countdown register in the Timer1 mirror to be reassigned, and the timeout rollback takes effect.
[0021] Optionally, step 2 includes: Generate a Timer1 image in the development platform, and enable rollback and countdown in the Timer1 image so that the countdown register, which was set to zero due to the FPGA jump operation, is reassigned in the Timer1 image.
[0022] Optionally, step 3 includes: The rollback enable and countdown enabled in the update image are redundant operations. When there is no jump operation in the update image and the damage occurs in the middle, that is, after the rollback enable and countdown are enabled, the FPGA loads the update image to read and write the countdown register and reassign it to accurately control the timeout rollback time.
[0023] Optionally, step 4 includes: If there is a jump operation in the updated image, causing the countdown register used for assignment in the updated image to be set to zero, even if the program after the jump operation position is corrupted, the Timer2 image can reassign the countdown register to ensure that a timeout rollback to the golden image is triggered.
[0024] Optionally, the jump address in the gold image is set to the starting address of the Timer1 image. Rollback enable and countdown enable are added to the Timer1 image, update image, and Timer2 image. The firmware file is generated in the development platform according to the corresponding address so that if any operation is performed on the update image or if damage occurs at any location, the system can roll back to the gold image to prevent FPGA program firmware update failure.
[0025] This application also provides an embodiment of a fault-tolerant system for preventing FPGA program firmware update failures, implementing the fault-tolerant method for preventing FPGA program firmware update failures described in the above embodiment, comprising: The address setting module is used to include the most basic system functions in the golden image. It includes address jumps at the initial position of the image and adjusts the register address of the golden image address jump to the starting address of the Timer1 image. The first rollback module is used to enable rollback in the Timer1 image and simultaneously start the countdown register TIMER_CFG to ensure that when the address jump instruction IPROG jumps to the starting address of the Timer1 image, the countdown register is reassigned in the Timer1 image. This ensures that even if the data at the beginning of the FPGA online programming update image is corrupted and the FPGA fails to load the update image program, the countdown in the Timer1 image will still be effective, triggering a timeout rollback to the gold image. The second rollback module is used to enable rollback and countdown in the constraint file of the update image. The count length exceeds the normal loading time of the FPGA program to ensure that the timeout rollback mechanism is not triggered during normal loading. If the data after the countdown in the update image is corrupted during FPGA programming, the timeout rollback to the gold image is triggered by the countdown register in the update image. The third rollback module is used to enable rollback and start the countdown counter in the Timer2 image. When the address jump instruction IPROOG exists in the update image, the countdown register is reset to zero. If the data after the address jump instruction IPROOG in the update image is corrupted, the FPGA is sequentially loaded into the Timer2 image, and the countdown register is reassigned to trigger a timeout rollback to the gold image. The jump module is used to set up four partitions in the FPGA's Flash memory in ascending order of address, which are used to store the gold image, Timer1 image, update image and Timer2 image respectively. In the development platform, the gold image, Timer1 image, update image and Timer2 image are generated into an MCS file for FPGA hardening according to the corresponding address, so as to prevent the inability to jump to the gold image after the FPGA hardening program update fails.
[0026] This application also provides an embodiment of an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, it implements the fault-tolerant method for preventing FPGA program firmware update failure as described in the above embodiment.
[0027] This application also provides an embodiment of a computer-readable storage medium, which includes a computer program or instructions that, when executed on a computer, cause the computer to perform the fault-tolerant method for preventing FPGA program firmware update failure as described in the above embodiment.
[0028] For ease of understanding, this application provides a more specific embodiment: See Figure 2 This application provides a method for generating a firmware file, which can prevent the failure of domestic FPGA chips after online update failure and ensure that the FPGA can successfully jump to and start the gold image under various abnormal conditions. The method includes the following steps: In S100, an address jump instruction IPROG is added to the constraints of the gold image project. The specific constraint is "set_property BITSTREAM.CONFIG.NEXT_CONFIG_ADDR 0x17FC00 [current_design]". This information is encoded into the header of the gold image bitstream file. When the FPGA loads the gold image, it executes a built-in jump IPROG command, which jumps to the corresponding address (0x17FC00) in Flash according to the preset address register (WBSTAR) value.
[0029] S200 can optionally call the Xilinx Tcl script multiboot_address_table.tcl, which requires filling in the device type (SPI), Flash data width (1), CCLK clock rate (3MHz), Flash storage capacity (128Mb) and bit stream size Byte (1532000). Then, two Timer1 and Timer2 images are generated. The Timer1 image mainly contains the countdown count value and the enable of the fallback function to ensure that when the image before the synchronization word (0Xaa995566) is damaged, the FPGA can fall back to the Golden image through the Timer1 image fallback after the Update image fails to load.
[0030] In the S300, fallback and countdown instructions are also enabled in the constraint file for updating the image. This is a redundant design so that if the updated image is damaged, it can still roll back to the gold image after a timeout error during the countdown. If the updated image is damaged after an IPROOG jump, the FPGA will load from the current address and continue until it reads the starting address of Timer2Image.
[0031] S400 utilizes the Timer2 image generated in S200. When the file after the update image synchronization word (0Xaa995566) is corrupted, the FPGA can sequentially load the Timer2 image and successfully trigger a timeout error to roll back to the gold image. At the same time, it also avoids the situation where the countdown register of the Timer1 image is set to zero when there is a jump in the update image, and the FPGA continues to load the image. It can also quickly return to the gold image through the Timer2 image.
[0032] The S500 generates a fixed MCS file in the development platform. The starting address of the gold image is set to 0x000000, the starting address of the Timer1 image is set to 0x17FC00, the starting address of the update image is set to 0x180000, and the starting address of the Timer2 image is set to 0x360000. This avoids the overlap of all images and prevents errors.
[0033] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application and not to limit them. Although this application has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of this application. Any modifications or equivalent substitutions that do not depart from the spirit and scope of this application should be covered within the protection scope of the claims of this application.
Claims
1. A fault-tolerant method for preventing FPGA program firmware update failure, characterized in that, include: Step 1: Adjust the register address for the jump to the gold mirror address to the starting address of the Timer1 mirror; Step 2: In the Timer1 image, enable rollback and start the countdown register TIMER_CFG to ensure that when the address jump instruction IPROG jumps to the starting address of the Timer1 image, the countdown register is reassigned in the Timer1 image. This ensures that even if the data at the beginning of the FPGA online programming update image is corrupted, causing the FPGA to fail to load the update image program, the countdown in the Timer1 image will still be effective, triggering a timeout rollback to the gold image. Step 3: In the constraint file of the updated image, enable rollback and countdown, and make the count length exceed the normal loading time of the FPGA program to ensure that the timeout rollback mechanism will not be triggered during normal loading. If the data after the countdown in the updated image is corrupted during FPGA programming, the timeout rollback to the gold image will be triggered by the countdown register in the updated image. Step 4: In the Timer2 image, enable rollback and turn on the countdown counter. When the address jump instruction IPROOG exists in the update image, the countdown register is reset to zero. If the data after the address jump instruction in the update image is corrupted, the FPGA is sequentially loaded into the Timer2 image, and the countdown register is reassigned to trigger a timeout rollback to the gold image. Step 5: In the FPGA's Flash memory, set up four partitions in ascending order of address to store the Gold Image, Timer1 Image, Update Image, and Timer2 Image respectively. In the development platform, generate an MCS file for FPGA firmware by storing the Gold Image, Timer1 Image, Update Image, and Timer2 Image according to their corresponding addresses to prevent the inability to jump to the Gold Image after the FPGA firmware update fails.
2. The fault-tolerant method for preventing FPGA program firmware update failure according to claim 1, characterized in that, Step 1 includes: Adjust the address register WBSTAR of the address jump instruction IPROG in the gold mirror to the starting address of the Timer1 mirror, so that the countdown register in the Timer1 mirror is reassigned and the timeout rollback takes effect.
3. The fault-tolerant method for preventing FPGA program firmware update failure according to claim 1, characterized in that, Step 2 includes: Generate a Timer1 image in the development platform, and enable rollback and countdown in the Timer1 image so that the countdown register, which was set to zero due to the FPGA jump operation, is reassigned in the Timer1 image.
4. The fault-tolerant method for preventing FPGA program firmware update failure according to claim 1, characterized in that, Step 3 includes: The rollback enable and countdown enabled in the update image are redundant operations. When there is no jump operation in the update image and the damage occurs in the middle, that is, after the rollback enable and countdown are enabled, the FPGA loads the update image to read and write the countdown register and reassign it to accurately control the timeout rollback time.
5. The fault-tolerant method for preventing FPGA program firmware update failure according to claim 1, characterized in that, Step 4 includes: If there is a jump operation in the updated image, causing the countdown register used for assignment in the updated image to be set to zero, even if the program after the jump operation position is corrupted, the Timer2 image can reassign the countdown register to ensure that a timeout rollback to the golden image is triggered.
6. The fault-tolerant method for preventing FPGA program firmware update failure according to claim 1, characterized in that, The jump address in the gold image is set to the starting address of the Timer1 image. Rollback enable and countdown enable are added to the Timer1 image, update image and Timer2 image. The firmware file is generated in the development platform according to the corresponding address so that if any operation in the update image causes damage at any location, it can roll back to the gold image to prevent the FPGA program firmware update from failing.
7. A fault-tolerant system for preventing FPGA program firmware update failures, implementing the fault-tolerant method for preventing FPGA program firmware update failures as described in any one of claims 1-6, characterized in that, include: The address setting module is used to include the most basic system functions in the golden image. It includes address jumps at the initial position of the image and adjusts the register address of the golden image address jump to the starting address of the Timer1 image. The first rollback module is used to enable rollback in the Timer1 image and simultaneously start the countdown register TIMER_CFG to ensure that when the address jump instruction IPROG jumps to the starting address of the Timer1 image, the countdown register is reassigned in the Timer1 image. This ensures that even if the data at the beginning of the FPGA online programming update image is corrupted and the FPGA fails to load the update image program, the countdown in the Timer1 image will still be effective, triggering a timeout rollback to the gold image. The second rollback module is used to enable rollback and countdown in the constraint file of the update image. The count length exceeds the normal loading time of the FPGA program to ensure that the timeout rollback mechanism is not triggered during normal loading. If the data after the countdown in the update image is corrupted during FPGA programming, the timeout rollback to the gold image is triggered by the countdown register in the update image. The third rollback module is used to enable rollback and start the countdown counter in the Timer2 image. When the address jump instruction IPROOG exists in the update image, the countdown register is reset to zero. If the data after the address jump instruction IPROOG in the update image is corrupted, the FPGA is sequentially loaded into the Timer2 image, and the countdown register is reassigned to trigger a timeout rollback to the gold image. The jump module is used to set up four partitions in the FPGA's Flash memory in ascending order of address, which are used to store the gold image, Timer1 image, update image and Timer2 image respectively. In the development platform, the gold image, Timer1 image, update image and Timer2 image are generated into an MCS file for FPGA hardening according to the corresponding address, so as to prevent the inability to jump to the gold image after the FPGA hardening program update fails.
8. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the computer program is executed by the processor, it implements the fault-tolerant method for preventing FPGA program firmware update failure as described in any one of claims 1-6.
9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a computer program or instructions that, when executed on a computer, cause the computer to perform the fault-tolerant method for preventing FPGA program firmware update failure as described in any one of claims 1-6.