Program redundancy backup and online updating method and system for fiber-optic gyroscope

Abstract

The invention provides a program redundancy backup and online updating method and system for a fiber-optic gyroscope. The method comprises the following steps: dividing a FLASH into n partitions in sequence; carrying out power-on self-test, carrying out primary verification on each partition in sequence, and setting a partition starting mark; when the equipment is started, the processor judges the starting mark of each partition in sequence, and secondary verification is carried out on each partition; traversing each partition starting mark in the FLASH, if at least one partition starting mark can be normally started, erasing data of a storage area to be updated in the processor, transmitting a program image to be updated to the storage area to be updated of the processor, carrying out three-level verification, and starting to update each partition in a reverse order; and performing four-level verification and setting an update mark. According to the invention, multi-zone redundant backup, starting and upgrading of the fiber-optic gyroscope can be realized, system dysfunction caused by external interference and partial damage of the memory is avoided, and the reliability of the fiber-optic gyroscope is improved.

Description

Technical Field

[0001] The invention belongs to the technical field of fiber optic gyroscopes, and in particular relates to a method and system for redundant backup and online updating of programs for fiber optic gyroscopes. Background Art

[0002] Considering the program size, cost and ease of use, most fiber optic gyroscope systems currently use FLASH (flash memory) as the medium for storing and updating programs and important parameters. After the device is powered on, it will load and execute the program image from FLASH to complete the device startup, configuration and operation.

[0003] Such devices present the following risks:

[0004] 1. When writing or updating an image, the device will go through the processes of unlocking, erasing sectors, writing data to a specified location, and locking write protection in sequence. If power is lost or the data stream is affected by electromagnetic interference and changes, the device may be abnormally written or updated and unable to start.

[0005] 2. The equipment generally has a shelf life of several years or even more than ten years. During this period, some storage units of the memory may be affected by the production process or external factors (such as drift effect, etc.), resulting in bit flipping, which may cause the entire program to fail to run normally.

[0006] 3. With the trend of localization, fiber optic gyroscopes have begun to use domestic chips on a large scale. However, due to the short development time and uneven production processes of domestic chips, the probability of abnormal data storage bit flipping and data loss has increased significantly.

[0007] In this case, if the device only stores one program image, serious consequences will occur. Take the fiber optic gyroscope system as an example. Once the program has problems, its angular velocity sensing ability will be lost, which will cause the inertial navigation function of the system equipped with the device to fail and become paralyzed.

[0008] Currently, there are several mainstream solutions to solve this problem:

[0009] 1. Use multiple storage devices to form a storage array. When an exception occurs in the program, the flag is activated, the main processor is reset and the device for reading the program image is replaced. This method has a relatively complex control switching logic and circuit structure, which makes the cost higher and increases the circuit area.

[0010] 2. AMD has added MultiBoot and QuickBoot functions to its Xilinx7 series FPGAs, corresponding to dual-zone backup and remote update functions respectively. This design is easy to operate, but has a limited scope of use. It can only be used on the corresponding company's FPGA (programmable logic controller) devices. Once the FPGA platform is changed, it cannot be used. In addition, if the data bit stream is flipped during the update transmission process, the program cannot identify the fault. Summary of the invention

[0011] The object of the present invention is to provide a method and system for redundant program backup and online update of a fiber optic gyroscope, so as to realize redundant backup, startup and upgrade of multiple zones of the fiber optic gyroscope, avoid system dysfunction caused by external interference and partial damage of the memory, and improve the reliability of the fiber optic gyroscope.

[0012] The technical solution adopted by the present invention to achieve the above-mentioned purpose is as follows:

[0013] As one aspect of the present invention, a method for redundant backup and online update of a program for a fiber optic gyroscope is provided, comprising the following steps:

[0014] S1, dividing the FLASH into n partitions in sequence, n≥3, each of the partitions includes a status flag, a startup flag, an update flag, an image storage address, and a program image in sequence;

[0015] S2, the device performs a power-on self-check, the state flag is set to the startup state, and each partition is checked in turn. If the check is correct, the startup flag of the i-th partition is set to be able to start normally. If the check is wrong, the startup flag of the i-th partition is set to be unable to start normally, where i represents one of the n partitions;

[0016] S3, the device starts, and the processor determines the startup flag of each partition in turn. If the startup flag of the i-th partition indicates that it can be started normally, the partition is subjected to secondary verification. If the verification is correct, the startup is completed. Otherwise, the startup flag of the partition is re-judged; if the startup flag of the i-th partition indicates that it cannot be started normally, the startup flag of the next partition is determined;

[0017] S4, traverse each partition startup flag in FLASH, if at least one partition startup flag indicates that it can be started normally, go to step S5, otherwise the feedback cannot be updated;

[0018] S5, erase the data in the storage area to be updated in the processor, transfer the program image to be updated to the storage area to be updated in the processor, and carry out a three-level verification. If the verification is correct, proceed to step S6. If the verification is incorrect, retransmit the program image to be updated to the storage area to be updated in the processor;

[0019] S6. Update in reverse order starting from the last partition, set the corresponding partition status flag to the update status, write the program image to be updated into the partition image storage address, and perform a four-level check on the partition program image after the update. If the check is correct, the partition update flag is set to update success, the startup flag is set to normal startup, and the next partition is updated; if the check is incorrect, the partition startup flag is set to unable to start normally, the update status is set to update failure, and the partition update is restarted.

[0020] Furthermore, the program redundant backup and online update method further includes the following steps:

[0021] S7, all partitions are updated, and all partitions in FLASH are traversed. At least one partition is in the update state, can be started normally, and the update is successful. The update success is returned, and the update and overwriting operations are performed on other partitions that can be started normally. Otherwise, the update failure is returned, and the partition that can be started normally is started.

[0022] Furthermore, the first-level verification is used to verify whether the program image is correct through a verification code;

[0023] The first-level check includes reading the image storage address of the i-th partition. If the reading is successful, jump to the i-th partition program image for CRC check, check the CRC check result with the CRC value at the end of the program image, and determine whether the check is wrong. i represents one of the n partitions. If the reading fails, the i-th partition startup flag is set to fail to start normally;

[0024] The secondary check is used to check whether the program image is correct through the check code;

[0025] The secondary check includes the processor reading the image storage address of the i-th partition. If the reading is successful, jumping to the i-th partition image storage address to read the program image, performing CRC check inside the processor, and comparing the CRC check result with the CRC value at the end of the program image to determine whether the check is incorrect. If the reading fails, the i-th partition startup flag is set to fail to start normally.

[0026] Furthermore, the three-level verification is used to verify whether the program image to be updated is correct through a verification code;

[0027] The three-level verification includes verifying the header of the program image to be updated, and verifying the program image to be updated through CRC.

[0028] Furthermore, the four-level verification is used to verify whether the updated program image is correct through the verification code;

[0029] The four-level check includes performing a CRC check on the updated program image, comparing the CRC check result with the CRC value at the end of the program image, and determining whether the check is incorrect.

[0030] Furthermore, the device power-on self-test process in step S2 further includes the following steps:

[0031] A self-test time threshold is set. If the self-test time of the i-th partition is greater than the self-test time threshold, the self-test program will skip the i-th partition and go to the next partition, and set the startup flag of the i-th partition to fail to start normally.

[0032] Furthermore, the device startup process in step S3 further includes the following steps:

[0033] Set the startup time threshold. If the read time of the i-th partition is greater than the startup time threshold, the startup program will skip the i-th partition and set the startup flag of the i-th partition to fail to start normally.

[0034] Furthermore, the updating process in step S6 further includes the following steps:

[0035] Set the update time threshold. If the update time of the i-th partition is greater than the update time threshold, the update program will skip the i-th partition. Set the update flag of the i-th partition to update failure and the startup flag to failure to start normally.

[0036] Furthermore, the status flag includes a startup status and an update status; the startup flag includes normal startup and failure to start normally; and the update flag includes update success and update failure.

[0037] Furthermore, in the program redundancy backup and online update method, if only the last partition among all the partitions can be started normally, step S6 starts updating from the second to last partition.

[0038] The program redundancy backup and online update system for fiber optic gyroscope provided by the present invention comprises:

[0039] An embedded processor for temporarily storing, executing and verifying program images, including a storage area to be updated;

[0040] FLASH is used to store program images and their status, and includes n partitions, where n≥3. Each partition includes a status flag, a startup flag, an update flag, an image storage address, and a program image in sequence.

[0041] The beneficial effects of the present invention compared with the prior art are as follows:

[0042] The present invention provides a method for redundant backup and online update of programs for fiber optic gyroscopes. Through the embedded program image multi-zone backup method, the fiber optic gyroscope multi-zone redundant backup, startup and upgrade are realized, the system function failure caused by external interference and partial damage of the memory is avoided, and the reliability of the fiber optic gyroscope is improved. Compared with the existing technology, the structure is simpler, the number of redundant backups is larger, the cost is lower, the stability is higher, and the scope of application is wider.

[0043] Compared with the prior art, the program redundancy backup and online update system for fiber optic gyroscope provided by the present invention has the following advantages:

[0044] The structure is simpler, and the hardware structure only includes a processor and FLASH; the number of redundant backups is greater, and triple backups and quadruple backups can be achieved. If the FLASH storage space is increased, the number can continue to increase; the cost is lower, and the present invention only considers the hardware cost, which can be as low as less than 100 yuan; the system stability is higher, and a large number of redundant backups means that the probability of errors decreases exponentially; the scope of application is wider, and all embedded devices, including but not limited to single-chip microcomputers, ARM, FPGA, DSP, etc., can be realized as long as they have the function of realizing SPI bus communication. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] The included drawings are used to provide a further understanding of the embodiments of the present invention, which constitute a part of the specification, are used to illustrate the embodiments of the present invention, and together with the text description, explain the principles of the present invention. Obviously, the drawings in the following description are only some embodiments of the present invention, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0046] Figure 1 A self-checking flow chart of a method for redundant backup and online updating of a program for a fiber optic gyroscope provided by a specific embodiment of the present invention;

[0047] Figure 2 A startup flow chart of a method for redundant backup and online update of a program for a fiber optic gyroscope provided by a specific embodiment of the present invention;

[0048] Figure 3 A flowchart of the update preparation of the program redundant backup and online update method for the fiber optic gyroscope provided by the specific embodiment of the present invention;

[0049] Figure 4 A flowchart of updating and redundant backup of a program redundant backup and online updating method for a fiber optic gyroscope provided by a specific embodiment of the present invention;

[0050] Figure 5 A schematic diagram of the FLASH partition data structure provided in a specific embodiment of the present invention. DETAILED DESCRIPTION

[0051] Specific embodiments of the present invention are described in detail below. In the following description, for the purpose of explanation and not limitation, specific details are set forth to help fully understand the present invention. However, it will be apparent to those skilled in the art that the present invention may also be practiced in other embodiments that depart from these specific details.

[0052] It should be noted that in order to avoid obscuring the present invention due to unnecessary details, only the device structure and / or processing steps closely related to the scheme of the present invention are shown in the drawings, while other details that are not closely related to the present invention are omitted.

[0053] As one aspect of the present invention, a program redundant backup and online update system for a fiber optic gyroscope is provided, the system includes an embedded processor for temporarily storing, executing and verifying program images, and a FLASH for storing program images, wherein the FLASH addresses store the following contents from low to high: status flag, startup flag, update flag, image storage address, program image in area A; status flag, startup flag, update flag, image storage address, program image in area B; status flag, startup flag, update flag, image storage address, program image in area C... and so on. Image partitioning is determined by user needs and memory space. The status flag is divided into startup status and update status; the startup flag is divided into normal startup and abnormal startup; the update flag is divided into update success and update failure. The image storage address is the image storage address of the program image in this area. The program image is the program impact loaded when the system starts.

[0054] As another aspect of the present invention, a method for redundant backup and online update of a program for a fiber optic gyroscope is provided. Figures 1 to 4 As shown, the following steps are included:

[0055] 1. Self-examination

[0056] When the device is powered on, it first enters the self-test state, reads the storage address of the A-area image from the 0 address of FLASH, and then jumps to the A-area program image for CRC verification. The result is checked with the CRC value at the end of the program image. If the verification is correct, the A-area startup flag is changed to normal startup; if the verification is incorrect, the A-area startup flag is changed to normal startup failure, and so on, respectively check the B-area, C-area, etc. images and set the corresponding startup flags. To ensure that the self-test process ends smoothly, set the self-test time threshold. If the self-test time of any partition is greater than the self-test time threshold, the self-test program will skip the image of the area and set the corresponding partition startup flag to normal startup failure.

[0057] It should be noted that for the three flags, only the status flag is set to the startup state during self-checking, and the startup state is switched to the update state after the update preparation is completed. As for the startup flag and the update flag, they are configured only during startup and update respectively.

[0058] 2. Start

[0059] After the device is powered on, all partition status flags are in the startup state by default. The embedded processor starts reading from address 0 and starts loading the configuration items of area A here. When reading for the first time, it determines whether the startup flag in the image of area A can be started normally. If it can be started normally, it will read its image storage address and jump to the A image storage address to read the program image. After reading, the CRC check is performed again inside the embedded processor and compared with the CRC value at the end of the program image. If they are consistent, the power-on startup is completed. If they are inconsistent, the above process is repeated until the power-on startup is completed or the startup time threshold is exceeded; if it cannot be started normally, it will continue to read the startup flag of area B... and so on. To ensure that the startup process ends smoothly, set the startup time threshold. If the read check time of a partition is greater than the startup time threshold, the startup program will skip the image of the partition and modify the corresponding partition startup flag to fail to start normally.

[0060] It should be noted that the failure to read the program image is likely to be due to an error in the stored image itself, but there is also a lower possibility that the data flow is disturbed during the image reading process. In this case, the read and stored contents are inconsistent. The stored content may be correct but the read content is wrong, so repeating the reading process may be able to read the correct image. Of course, even if it cannot be started normally, it will enter the next step due to timeout.

[0061] 3. Update

[0062] Before the update procedure starts, you first need to traverse all the partition boot flags in the FLASH. You need to ensure that at least one partition boot flag can be started normally before you can proceed with subsequent actions. Otherwise, it will return that the update conditions are not met and the update cannot be performed.

[0063] When updating, first erase the data in the storage area to be updated in the embedded processor, and the update program image enters the storage area of ​​the package to be updated in the embedded processor through wired or remote transmission (the above process must ensure power supply and normal operation, otherwise data reception cannot be performed). The update program image includes a header and a data image to be updated. The header includes a check character. The embedded processor first checks the header and verifies the correctness of the update program image through CRC. When the header meets the specified format and the program is correct, the embedded processor will start from the initial address of the last partition of FLASH through the configuration interface (if only the last partition image of all programs can be started normally, start from the second to last partition), first set the status flag to the update status, read the storage address of the partition image, and write the update data into the corresponding partition image storage address.

[0064] After writing is completed, perform a CRC check on the data, and compare the result with the CRC value at the end of the program image. If the check is correct, set the partition update flag to update success, modify the boot flag to normal boot, and write the update image program to other partition locations according to the above process (the first partition image that can be normally booted determined before the update starts will not be overwritten and updated temporarily); if the check is incorrect, modify the partition boot flag to unable to boot normally, the update status to update failure, and restart the update program. If the update time is greater than the update time threshold, jump to the second to last area except the first normally bootable image and repeat the process. To ensure that the update process ends smoothly, set the update time threshold. If the update time of a partition is greater than the update time threshold, the update process will skip the image of the area and keep the corresponding partition update flag set to update failure, and the boot flag set to unable to boot normally.

[0065] When all partitions are updated, traverse the update status of all partitions in FLASH. It is necessary to ensure that at least one and at least one partition status is updated, can be started normally, and updated successfully. Return update success and update and overwrite the retained image that can be started normally. Otherwise, return update failure and the program will start according to the previously retained image that can be started normally.

[0066] The present invention adopts a reverse order method to update the program image, and tries to update the program image from the idle partition first, and retains the partition image that can be started normally.

[0067] The method and system for redundant backup and online update of fiber optic gyroscope programs provided in this embodiment have the following advantages:

[0068] 1. Most common embedded device backup solutions are dual-area backup. If both areas are damaged, the backup solution will fail completely. At the same time, the program damage and jump judgment are relatively simple. If the data bit stream reading is stuck, the entire system will stop working. The present invention provides multiple backup areas in FLASH, greatly reducing the probability of backup system failure. At the same time, multiple criteria and forced reset methods are used to ensure that at least one partition image of the system can work stably.

[0069] 2. The system of the present invention has a simple composition and low cost. The redundant backup system in the prior art generally contains storage devices such as DDR3 for data transfer, while the present invention only includes a processor and FLASH, and the hardware cost is extremely low.

[0070] As another aspect of the present invention, the technical solution of the present invention is described in detail in conjunction with a specific embodiment.

[0071] The embedded memory is used to temporarily store, execute and verify program images. This embodiment uses the Gowin GW2A series FPGA (GW2ALV18MG256C8 / I7).

[0072] FLASH is used to store program images and status. It uses GigaDevice 32M FLASH chip and is mounted on the FPGA chip for communication through the SPI protocol. Its address space range is 0x00000000-0x003FFFFF. Set up three partitions: Area A address range 0x00000000-0x000FFFFF; Area B address range 0x00100000-0x001FFFFF; Area C address range 0x00200000-0x002FFFFF.

[0073] Taking area A as an example, each partition is composed of: status flag 0x00000000, startup flag 0x00000001, update flag 0x00000002, image storage address 0x00000003~0x00000007, program image starts from 0x00000008 (refer to the manual, the size of a single FS (solidified executable program file name) file is about 6M) to 0x000FFFFF. After the program image is filled, the blank part of this area is supplemented with 0xffffffff filler word, and the last 32 bits are the program image CRC check value.

[0074] In this embodiment, the program redundant backup and online update system for the fiber optic gyroscope includes an embedded processor for temporarily storing, executing and verifying program images, and a FLASH for storing program images and status. The storage contents of the FLASH addresses from low to high are respectively the status flag, startup flag, update flag, image storage address, and program image of area A; the status flag, startup flag, update flag, image storage address, and program image of area B; the status flag, startup flag, update flag, image storage address, and program image of area C. The status flag is divided into startup status (0x11111111) and update status (0x00000000); the startup flag is divided into normal startup (0x111111111) and normal startup failure (0x00000000); the update flag is divided into update success (0x111111111) and update failure (0x00000000). An area is solidified in the FPGA to temporarily store the program image data stream to be updated. The FLASH is mounted on the FPGA chip through the SPI protocol for communication.

[0075] In this embodiment, the fiber optic gyroscope uses a program redundant backup and online update method, and the redundancy number is set to 3 during operation, that is, there are three partitions A / B / C at the same time:

[0076] 1. Self-examination

[0077] When the device is powered on, it first enters the self-test state, reads the A-area image storage address from the 0x00000003 address of FLASH, and then jumps to the A-area program image for CRC verification. The result is checked with the CRC value at the end of the program image. If the verification is correct, the A-area startup flag is modified to 0x11111111, which can be started normally; if the verification is incorrect, the A-area startup flag is modified to 0x00000000, which cannot be started normally. Similarly, the B-area and C-area images are checked respectively and the corresponding startup flags are set. To ensure that the self-test process ends smoothly, a self-test time threshold is set. If the self-test time of a partition is greater than the self-test time threshold, the self-test program will skip the image of the area and set the corresponding partition startup flag to 0x00000000, which cannot be started normally.

[0078] 2. Start

[0079] After power-on is completed, if the status flag of area A defaults to the startup status 0x11111111, the FPGA starts reading from address 0x00000001 to determine whether the startup flag in the image of area A can be started normally. If it can be started normally, it will read the image position of area A stored at address 0x00000003, jump to the image position of area A to read the program image, and after reading, perform CRC check again inside the FPGA and check with the CRC value at the end of the program image. If they are consistent, the power-on startup is completed. If they are inconsistent, repeat the above process until the power-on startup is completed or the startup time threshold is exceeded; if it cannot be started normally, it will continue to read the startup flag of area B at address 0x00100001... and so on. To ensure that the startup process ends smoothly, set the startup time threshold. If the read check time of a partition is greater than the startup time threshold, the startup program will skip the image of the partition and modify the corresponding partition startup flag to be unable to start normally.

[0080] 3. Update

[0081] Before the update procedure starts, the FPGA receives the update instruction and first needs to traverse all the partition startup flags in the FLASH. It needs to ensure that at least one partition startup flag can be started normally before subsequent actions can be performed. Otherwise, it returns that the update conditions are not met and the update cannot be performed.

[0082] When updating, first erase the data in the storage area of ​​the package to be updated in the FPGA, and the update program image enters the storage area of ​​the package to be updated in the FPGA through wired or remote transmission (the above process must ensure power supply and normal operation, otherwise data reception cannot be performed). The FPGA first checks the header and verifies the correctness of the program image to be updated through CRC. When the header meets the specified format and the program image to be updated is correct, the FPGA will start from the initial address 0x00200000 of the C area of ​​FLASH through the configuration interface (if only the image in area C can be started normally for all programs, start from the image in area B). First, set the status flag of area C to the update status 0x00000000, read the image position at address 0x00200003, and write the image data of the program to be updated to the corresponding address.

[0083] After writing is completed, perform CRC check on the program image data, and compare the result with the CRC value at the end of the program image. If the check is correct, set the update flag of area C to update successfully, set the boot flag to boot normally, and write the program image to the A / B area location according to the above process (the first partition image that can be booted normally before the update starts will not be overwritten and updated temporarily); if the check is incorrect, modify the boot flag of area C to fail to boot normally, the update status to update failure, and restart the update program. If the update time is greater than the update time threshold, jump to the second to last area except the first partition that can be booted normally and repeat the update process. To ensure the smooth completion of the update process, set the update time threshold. If the update time of a partition is greater than the update time threshold, the update process will skip the image of the area and keep the corresponding partition update flag set to update failure, and the boot flag set to fail to boot normally.

[0084] When all partitions are updated, traverse the update status of all partitions in FLASH. It is necessary to ensure that at least one and at least one partition status is updated, can be started normally, and updated successfully. Return update success and update and overwrite the retained normally bootable image. Otherwise, return update failure and the program will start according to the previously retained normally bootable image.

[0085] Compared with the prior art, the present invention provides a method and system for redundant backup and online update of programs for fiber optic gyroscopes, which has a simpler structure, a larger number of redundant backups, a lower cost, a higher stability, and a wider range of applications. Specifically:

[0086] (1) The premise of the update in the present invention is that at least one partition can work normally, ensuring that even if the update fails, it can be started normally based on the original image. At the same time, the probability of successful update is greatly improved by writing the updated image into the partition.

[0087] (2) The present invention achieves the purpose of long-term storage of storage images by backing up multiple program images to reduce the risk of problems occurring in all images (multi-area images can be considered normal as long as one is normal).

[0088] (3) The present invention is applicable to commonly used embedded processing devices (mainly four categories: FPGA, DSP, ARM, and single-chip microcomputer).

[0089] Features described and / or illustrated above for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or used in place of features in other embodiments.

[0090] It should be emphasized that the term "include / comprises" when used herein refers to the presence of features, integers, steps or components, but does not exclude the presence or addition of one or more other features, integers, steps, components or combinations thereof.

[0091] The many features and advantages of these embodiments are apparent from this detailed description, and thus the appended claims are intended to cover all such features and advantages of these embodiments that fall within their true spirit and scope. Furthermore, since numerous modifications and changes will readily occur to those skilled in the art, it is not intended that the embodiments of the invention be limited to the exact construction and operation illustrated and described, but rather all suitable modifications and equivalents falling within the scope thereof are intended to be covered.

[0092] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

[0093] Parts of the present invention that are not described in detail are well known to those skilled in the art.

Claims

1. A method for redundant backup and online update of a program for a fiber optic gyroscope, characterized in that: The steps include: S1, dividing the FLASH into n partitions in sequence, n≥3, each of the partitions includes a status flag, a startup flag, an update flag, an image storage address, and a program image in sequence; S2, the device performs a power-on self-check, the state flag is set to the startup state, and each partition is checked in turn. If the check is correct, the startup flag of the i-th partition is set to be able to start normally. If the check is wrong, the startup flag of the i-th partition is set to be unable to start normally, where i represents one of the n partitions; S3, the device starts, and the processor determines the boot flag of each partition in turn. If the boot flag of the i-th partition indicates that it can be started normally, the partition performs a secondary check. If the check is correct, the boot is completed. Otherwise, the boot flag of the partition is re-determined; If the boot flag of the i-th partition indicates that it cannot be started normally, then determine the boot flag of the next partition; S4, traverse each partition startup flag in FLASH, if at least one partition startup flag indicates that it can be started normally, go to step S5, otherwise the feedback cannot be updated; S5, erase the data in the storage area to be updated in the processor, transfer the program image to be updated to the storage area to be updated in the processor, and carry out a three-level verification. If the verification is correct, proceed to step S6. If the verification is incorrect, retransmit the program image to be updated to the storage area to be updated in the processor; S6, starting from the last partition, the update is performed in reverse order, the corresponding partition status flag is set to the update status, the program image to be updated is written into the partition image storage address, and the partition program image is subjected to a four-level verification after the update. If the verification is correct, the partition update flag is set to update successfully, the boot flag is set to be able to boot normally, and the next partition is updated; If the verification is incorrect, the partition startup flag is set to fail to start normally, the update status is set to update failure, and the partition update is restarted.

2. The method according to claim 1, characterized in that The following steps are also included: S7, all partitions are updated, and all partitions in FLASH are traversed. At least one partition is in the update state, can be started normally, and the update is successful. The update success is returned, and the update and overwriting operations are performed on other partitions that can be started normally. Otherwise, the update failure is returned, and the partition that can be started normally is started.

3. The method according to claim 1, characterized in that The first-level verification is used to verify whether the program image is correct through the verification code; The first-level check includes reading the image storage address of the i-th partition. If the reading is successful, jump to the i-th partition program image for CRC check, check the CRC check result with the CRC value at the end of the program image, and determine whether the check is wrong. i represents one of the n partitions. If the reading fails, the i-th partition startup flag is set to fail to start normally; The secondary check is used to check whether the program image is correct through the check code; The secondary check includes the processor reading the image storage address of the i-th partition, if the reading is successful, jumping to the i-th partition image storage address to read the program image, performing CRC check inside the processor, and checking the CRC check result with the CRC value at the end of the program image to determine whether the check is wrong, and if the reading fails, setting the i-th partition startup flag to fail to start normally; The three-level verification is used to verify whether the program image to be updated is correct through the verification code; The three-level verification includes verifying the header of the program image to be updated, and verifying the program image to be updated through CRC; The four-level verification is used to verify whether the updated program image is correct through the verification code; The four-level check includes performing a CRC check on the updated program image, comparing the CRC check result with the CRC value at the end of the program image, and determining whether the check is incorrect.

4. The method according to claim 1, characterized in that: The step S2 includes the following steps: A self-test time threshold is set. If the self-test time of the i-th partition is greater than the self-test time threshold, the self-test program will skip the i-th partition and go to the next partition, and set the startup flag of the i-th partition to fail to start normally.

5. The method according to claim 1, characterized in that: The device startup process in step S3 further includes the following steps: Set the startup time threshold. If the read time of the i-th partition is greater than the startup time threshold, the startup program will skip the i-th partition and set the startup flag of the i-th partition to fail to start normally.

6. The method according to claim 1, characterized in that The updating process in step S6 further includes the following steps: Set the update time threshold. If the update time of the i-th partition is greater than the update time threshold, the update program will skip the i-th partition. Set the update flag of the i-th partition to update failure and the startup flag to failure to start normally.

7. The method according to claim 1, characterized in that If only the last partition of all the partitions can be started normally, step S6 starts updating from the second to last partition.

8. A program redundancy backup and online update system for a fiber optic gyroscope, characterized in that: include: An embedded processor for temporarily storing, executing and verifying program images, including a storage area to be updated; FLASH is used to store program images and their status, and includes n partitions, where n≥3. Each partition includes a status flag, a startup flag, an update flag, an image storage address, and a program image in sequence.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program implements the method described in any one of claims 1 to 7 when executed by a processor.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: The processor executes the computer program to implement the method described in any one of claims 1 to 7.

Images