Method and system for program redundancy backup and online updating of fiber-optic gyroscope

Abstract

The application provides a kind of optical fiber gyroscope program redundancy backup and on-line updating method and system, the method includes that FLASH is divided into n partitions in turn;Power-on self-test, carry out first-level check to each partition in turn, set partition start flag;Device starts, processor successively judges each partition start flag, carries out second-level check to each partition;Traverse each partition start flag in FLASH, if at least one partition start flag is normal start, then erase the data of the storage area to be updated in processor, transfer the program image to be updated to the storage area to be updated in processor, carry out third-level check, start updating in reverse order to each partition, carry out fourth-level check and set update flag.The application can realize optical fiber gyroscope multi-zone redundancy backup, start and upgrade, avoid system dysfunction caused by external interference and partial damage of memory, and improve the reliability of optical fiber gyroscope.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of fiber optic gyroscope, and particularly relates to a program redundancy backup and online updating method and system for a fiber optic gyroscope. BACKGROUND

[0002] From the perspective of program size, cost and ease of use, most fiber optic gyroscope systems currently generally use FLASH (flash memory) as a medium for storing and updating programs and important parameters. After the device is powered on, the program image is loaded and executed from the FLASH to complete the startup, configuration and operation of the device, etc.

[0003] Such devices have the following risks:

[0004] 1. When the image is written or updated, the device will sequentially perform unlocking, sector erasing, writing data to a specified location, locking write protection, etc. If a jump occurs during the process due to power failure, data stream affected by electromagnetic interference, etc., it is extremely likely that the device will have abnormal writing or updating and will not be able to start.

[0005] 2. The device generally has a storage period of several years or even several decades. During this period, part of the memory storage unit is affected by production process or external factors (such as drift effect), which may cause bit flipping, which may cause the entire program to fail to run normally.

[0006] 3. With the trend of localization, fiber optic gyroscopes have begun to use domestic chips on a large scale. However, due to the short development time of localized chips and uneven production processes, the probability of abnormal bit flipping and data loss of data storage is significantly increased.

[0007] In this case, if the device only stores one copy of the program image, it will have serious consequences. For example, if the fiber optic gyroscope system has a problem, its angular velocity transmission capability will be lost, which will cause the inertial navigation function of the system equipped with the device to fail and be in a paralyzed state.

[0008] Currently, there are several mainstream solutions to solve this problem:

[0009] 1. Multiple storage devices are used to form a storage array. When the program has an abnormality, the flag bit is activated, the main processor is reset and the program image reading device is replaced. This method has complex control switching logic and complex circuit structure, which makes the cost higher and increases the circuit area.

[0010] 2. AMD company in the Xilinx 7 series FPGA, added MultiBoot and QuickBoot function, corresponding to the dual area backup and remote update function. This design is simple and convenient to operate, but the scope of use is limited, only on the corresponding company's FPGA (programmable logic controller) device, once the FPGA platform is replaced, it cannot be used, and if the program data bit stream is reversed during the update transmission process, the fault cannot be identified. SUMMARY

[0011] The application aims to provide a program redundancy backup and online updating method and system for fiber-optic gyroscope, to realize multi-area redundancy backup, startup and upgrade of fiber-optic gyroscope, avoid system dysfunction caused by external interference and partial damage of memory, and improve the reliability of fiber-optic gyroscope.

[0012] The technical solution adopted by the application to achieve the above-mentioned purposes is as follows:

[0013] As an aspect of the application, a program redundancy backup and online updating method for fiber-optic gyroscope is provided, comprising the following steps:

[0014] S1, dividing the FLASH into n partitions in sequence, n≥3, each of the partitions comprising state flag, startup flag, update flag, image storage address and program image in sequence;

[0015] S2, power-on self-test of the device, setting the state flag to startup state, performing primary verification on each partition in sequence, if the verification is correct, setting the startup flag of the i-th partition to normal startup, if the verification is incorrect, setting the startup flag of the i-th partition to abnormal startup, i representing one of the n partitions;

[0016] S3, device startup, the processor judges the startup flag of each partition in sequence, if the startup flag of the i-th partition is normal startup, the partition performs secondary verification, if the verification is correct, the startup is completed, otherwise, the startup flag of the partition is re-judged; if the startup flag of the i-th partition is abnormal startup, the startup flag of the next partition is judged;

[0017] S4, traversing the startup flags of each partition in the FLASH, if at least one of the startup flags is normal startup, step S5 is entered, otherwise, it is fed back that the update cannot be performed;

[0018] S5, erasing the data in the storage area of the processor to be updated, transmitting the program image to be updated to the storage area of the processor to be updated, and performing tertiary verification, if the verification is correct, step S6 is entered, if the verification is incorrect, the program image to be updated is re-transmitted to the storage area of the processor to be updated;

[0019] S6, updating in reverse order from the last partition, setting the corresponding partition state flag to update state, writing the to-be-updated program image into the partition image storage address, performing four-level check on the partition program image after updating, if the check is correct, setting the partition update flag to update success, setting the start flag to normal start, and updating the next partition; if the check is incorrect, setting the partition start flag to abnormal start, setting the update state to update failure, and starting the partition update again.

[0020] Further, the program redundancy backup and online updating method further comprises the following steps:

[0021] S7, after all partitions are updated, traversing all partitions in the FLASH, at least one partition is in update state, can be normally started, and update success, returning update success, performing update cover operation on other normally started partitions, otherwise, returning update failure, and starting according to the normally started partition.

[0022] Further, the first-level check is used to check whether the program image is incorrect through the check code;

[0023] The first-level check comprises reading the image storage address of the i-th partition, if the reading is successful, jumping to the i-th partition program image for CRC check, comparing the CRC check result with the CRC value at the end of the program image, judging whether the check is incorrect, i represents one of the n partitions, if the reading fails, setting the i-th partition start flag to abnormal start;

[0024] The second-level check is used to check whether the program image is incorrect through the check code;

[0025] The second-level check comprises reading, by the processor, the image storage address of the i-th partition, if the reading is successful, jumping to the i-th partition image storage address to read the program image, performing CRC check in the processor, comparing the CRC check result with the CRC value at the end of the program image, judging whether the check is incorrect, if the reading fails, setting the i-th partition start flag to abnormal start.

[0026] Further, the third-level check is used to check whether the to-be-updated program image is incorrect through the check code;

[0027] The third-level check comprises checking the word head of the to-be-updated program image, and performing CRC check on the to-be-updated program image.

[0028] Further, the fourth-level check is used to check whether the updated program image is incorrect through the check code;

[0029] The four-level check includes CRC check on the updated program image, and comparison of the CRC check result with a CRC value at the end of the program image to determine whether the check is incorrect.

[0030] Further, the step S2 device power-on self-checking process further comprises the following steps:

[0031] A self-checking time threshold is set, and if the self-checking time of the i-th partition is greater than the self-checking time threshold, the self-checking program will skip the i-th partition and enter the next partition, and the i-th partition startup flag is set as unable to normally start.

[0032] Further, the step S3 device startup process further comprises the following steps:

[0033] A startup time threshold is set, and if the reading time of the i-th partition is greater than the startup time threshold, the startup program will skip the i-th partition, and the i-th partition startup flag is set as unable to normally start.

[0034] Further, the step S6 updating process further comprises the following steps:

[0035] An updating time threshold is set, and if the updating time of the i-th partition is greater than the updating time threshold, the updating program will skip the i-th partition, and the i-th partition updating flag is set as updating failure, and the startup flag is set as unable to normally start.

[0036] Further, the state flag comprises a startup state and an updating state; the startup flag comprises normal startup and unable to normally start; and the updating flag comprises updating success and updating failure.

[0037] Further, in the program redundancy backup and online updating method, if only the last partition of all the partitions can normally start, the step S6 starts updating from the second last partition.

[0038] The program redundancy backup and online updating system for fiber-optic gyroscope provided by the application comprises:

[0039] An embedded processor is used for temporarily storing, executing and checking the program image, and comprises a to-be-updated storage area;

[0040] A FLASH is used for storing the program image and its state, and comprises n partitions, n>=3, each of the partitions comprises a state flag, a startup flag, an updating flag, an image storage address and a program image.

[0041] Compared with the prior art, the application has the following beneficial effects:

[0042] This invention provides a method for program redundancy backup and online update of fiber optic gyroscopes. By employing an embedded program image multi-zone backup method, it achieves multi-zone redundancy backup, startup, and upgrades of the fiber optic gyroscope, avoiding system malfunctions caused by external interference and partial memory damage, thus improving the reliability of the fiber optic gyroscope. Compared to existing technologies, it has a simpler structure, more redundant backups, lower cost, higher stability, and a wider range of applications.

[0043] Compared with existing technologies, the fiber optic gyroscope program redundancy backup and online update system provided by this invention has the following advantages:

[0044] The structure is simpler, with the hardware structure consisting only of a processor and FLASH; there are more redundant backups, enabling three or four backups, and this number can be further increased by adding FLASH storage space; the cost is lower, with hardware costs alone potentially below 100 yuan; the system stability is higher, as a larger number of redundant backups means an exponential decrease in the probability of errors; and the applicability is wider, applicable to all embedded devices, including but not limited to microcontrollers, ARM, FPGA, DSP, etc., as long as they have the ability to implement SPI bus communication. Attached Figure Description

[0045] The accompanying drawings, which form part of this specification, are provided to further illustrate embodiments of the invention and, together with the textual description, explain the principles of the invention. It is obvious that the drawings described below are merely some embodiments of the invention, and those skilled in the art can obtain other drawings based on these drawings without any creative effort.

[0046] Fig. 1 A self-test flowchart of a program redundancy backup and online update method for fiber optic gyroscopes provided in a specific embodiment of the present invention;

[0047] Fig. 2 A flowchart illustrating the startup process of a program redundancy backup and online update method for fiber optic gyroscopes provided in a specific embodiment of the present invention;

[0048] Fig. 3 A flowchart illustrating the update preparation process for a program redundancy backup and online update method for fiber optic gyroscopes provided in a specific embodiment of the present invention;

[0049] Fig. 4 A flowchart illustrating the update and redundancy backup process for a program redundancy backup and online update method for fiber optic gyroscopes, provided as a specific embodiment of the present invention.

[0050] Fig. 5 This is a schematic diagram of the FLASH partition data structure provided for a specific embodiment of the present invention. Detailed Implementation

[0051] The specific embodiments of the present application will be described in detail below. In the following description, for the purpose of explanation and not limitation, specific details are set forth in order to provide a thorough understanding of the present application. However, it will be apparent to one skilled in the art that the present application can be practiced in other embodiments that depart from these specific details.

[0052] It is to be noted that, in order to avoid the present application being obscured by unnecessary details, only the device structures and / or processing steps closely related to the solution of the present application are shown in the drawings, and other details not closely related to the present application are omitted.

[0053] As an aspect of the present application, a program redundancy backup and online updating system for fiber-optic gyroscope is provided, which comprises an embedded processor for temporarily storing, executing and checking program images, a FLASH for storing program images, and the contents of the FLASH addresses from low to high are as follows: A area state flag, start flag, update flag, image storage address, program image; B area state flag, start flag, update flag, image storage address, program image; C area state flag, start flag, update flag, image storage address, program image; and so on. The image partitions are determined by user demand and memory space. The state flags are divided into start state and update state; the start flags are divided into normal start and abnormal start; and the update flags are divided into update success and update failure. The image storage address is the image storage address of the program image in the present area. The program image is the program loaded when the system starts.

[0054] As another aspect of the present application, a program redundancy backup and online updating method for fiber-optic gyroscope is provided, as shown in the flow chart of FIG. 2, which comprises the following steps: Figs. 1-4

[0055] 1. Self-checking

[0056] When the device is powered on, it first enters a self-checking state, reads the image storage address of A area from the 0 address of FLASH, and then jumps to the program image of A area to perform CRC checking. The result is compared with the CRC value at the end of the program image. If the checking is correct, the start flag of A area is modified to normal start. If the checking is incorrect, the start flag of A area is modified to abnormal start. The images of B area, C area, and so on are checked respectively, and the corresponding start flags are set. In order to ensure that the self-checking process ends smoothly, a self-checking time threshold is set. If the self-checking time of any partition is greater than the self-checking time threshold, the self-checking program will skip the image of the area and set the start flag of the corresponding partition to abnormal start.

[0057] ​It should be noted that for the three flags, only the status flag is set to the start state during self-checking, and the start state is switched to the update state after the update preparation is completed. As for the start flag and the update flag, they are respectively configured only during the start and update.

[0058] 2. Start

[0059] After the power-on of the device is completed, all partition status flags are set to the start state by default, and the embedded processor starts reading from address 0, first loading the A area configuration item here. When reading for the first time, it is determined whether the start flag in the A area image is normal start. If it is normal start, the image storage address is read and the program image is read from the A image storage address. After reading is completed, CRC check is performed again in the embedded processor, and the CRC value at the end of the program image is compared. If they are consistent, the power-on is completed. If they are not consistent, the above process is repeated until the power-on is completed or the start time threshold is exceeded. If it is not normal start, the B area start flag is read, and so on. To ensure the smooth end of the start process, a start time threshold is set. If the reading and checking time of a certain partition is greater than the start time threshold, the start program will skip the area image and modify the corresponding partition start flag to not normal start.

[0060] It should be noted that the failure of reading the program image has a high possibility of being an error in the stored image itself, but also has a low possibility of being an abnormality in the data stream during reading the image. In this case, the read and stored contents are inconsistent, and the stored content may be correct but the read content is incorrect, so the repeated reading process can read the correct image. Of course, even if it cannot be started normally, it will enter the next step due to timeout.

[0061] 3. Update

[0062] Before starting the update program, it is necessary to traverse all the partition start flags in the FLASH. It is necessary to ensure that at least one partition start flag is normal start, so that subsequent actions can be performed. Otherwise, it returns that the update condition is not met and cannot be updated.

[0063] When updating, the data in the storage area to be updated in the embedded processor is first erased, and the program image to be updated is transmitted into the storage area of the embedded processor to be updated through wired or remote transmission (the above process must ensure that power supply and work are normal, otherwise data reception cannot be performed), the program image to be updated includes a header and data to be updated, the header includes a check character, the embedded processor first checks the header and verifies the correctness of the program image to be updated through CRC, when the header meets the specified format and the program is correct, the embedded processor starts from the initial address of the last partition of FLASH (if only the image of the last partition can be normally started, then the second last partition is started), first sets the state flag to the update state, reads the image storage address of the partition, and then writes the update data into the corresponding image storage address.

[0064] After writing is completed, the data is subjected to CRC check, and the result is compared with the CRC value at the end of the program image, if the check is correct, the update flag of the partition is set to update success, the start flag is modified to be able to normally start, and the update image program is written into other partition positions according to the above process (the first partition image that can be normally started determined before updating is temporarily not updated); if the check is incorrect, the start flag of the partition is modified to be unable to normally start, the update state is set to update failure, and the updating program is restarted, if the update time is greater than the update time threshold, the process jumps to the second last area except the first normally started image to repeat the process. In order to ensure that the updating process is successfully completed, the update time threshold is set, if the update time of a certain partition is greater than the update time threshold, the updating process skips the image of the partition and sets the update flag of the corresponding partition to update failure and the start flag to be unable to normally start.

[0065] When all the partitions are updated, all the update states of the partitions in FLASH are traversed, it is required to ensure that at least one and at least one partition state is in the update state, can be normally started, and is updated successfully, the update success is returned, and the normally started image is updated and covered, otherwise the update failure is returned, and the program is started according to the previously reserved normally started image.

[0066] The program image updating is performed in the reverse order, the program image is updated from the idle partition as much as possible, and the partition image that can be normally started is reserved.

[0067] The program redundancy backup and online updating method and system for the fiber optic gyroscope have the following advantages:

[0068] 1. The common embedded device backup scheme is mostly dual-zone backup, if two areas are damaged, the backup scheme will be completely invalid; at the same time, the program damage and jump determination are relatively simple, if the data bit stream reading is stuck, the whole system will also stop working. The application provides multiple backup areas in FLASH, greatly reduces the probability of backup system failure, and uses multiple criteria and forced reset means to ensure that at least one partition image can work stably.

[0069] 2. The system of the application has simple composition and low cost, the redundant backup system composition in the prior art generally contains DDR3 and other storage devices for data transfer, and the application only contains a processor and a FLASH, so the hardware cost is very low.

[0070] As another aspect of the application, the technical solutions of the application are described in detail in combination with a specific embodiment.

[0071] The embedded memory is used for temporarily storing, executing and verifying program images, and the embodiment adopts a GW2A series FPGA (GW2ALV18MG256C8 / I7) of Gaoke.

[0072] The FLASH is used for storing program images and states, and a 32M FLASH chip of Megachips is adopted, which is mounted on the FPGA chip through SPI protocol for communication, and the address space range is 0x00000000-0x003FFFFF. Three partitions are set: the address range of A area is 0x00000000-0x000FFFFF, the address range of B area is 0x00100000-0x001FFFFF, and the address range of C area is 0x00200000-0x002FFFFF.

[0073] Taking the A area as an example, each partition is composed of: state flag 0x00000000, start flag 0x00000001, update flag 0x00000002, image storage address 0x00000003-0x00000007, program image from 0x00000008 (consult the manual, the size of a single FS (frozen executable program file name) is about 6M) to 0x000FFFFF, the blank part is filled with 0xffffffff filling words after the program image is filled, and the last 32 bits are the CRC check value of the program image.

[0074] In the embodiment, the program redundancy backup and online updating system for fiber-optic gyroscope includes an embedded processor for temporarily storing, executing and checking program image, and a FLASH for storing program image and state. The contents of the FLASH address from low to high are respectively A area state flag, start flag, update flag, image storage address and program image; B area state flag, start flag, update flag, image storage address and program image; C area state flag, start flag, update flag, image storage address and program image. The state flag is divided into start state (0x11111111) and update state (0x00000000); the start flag is divided into normal start (0x11111111) and abnormal start (0x00000000); and the update flag is divided into update success (0x11111111) and update failure (0x00000000). A piece of area in the FPGA is solidified to temporarily store the program image data stream to be updated. The FLASH is mounted on the FPGA chip through SPI protocol for communication.

[0075] In the embodiment, the program redundancy backup and online updating method for fiber-optic gyroscope sets the redundancy number as 3, i.e. A / B / C three partitions exist simultaneously.

[0076] 1. Self-checking

[0077] When the device is powered on, it first enters the self-checking state, reads the A area image storage address from the address 0x00000003 of the FLASH, and then jumps to the A area program image for CRC checking. The result is compared with the CRC value at the end of the program image. If the checking is correct, the A area start flag is modified as normal start 0x11111111. If the checking is incorrect, the A area start flag is modified as abnormal start 0x00000000. Similarly, the B area and C area images are checked and the corresponding start flags are set. In order to ensure the smooth end of the self-checking process, a self-checking time threshold is set. If the self-checking time of a certain partition is greater than the self-checking time threshold, the self-checking program will skip the image of the partition and set the start flag of the corresponding partition as abnormal start 0x00000000.

[0078] 2. Start

[0079] After power-on is completed, if the A area state flag is by default in the start state 0x11111111, the FPGA starts reading from the address 0x00000001, judges whether the start flag bit in the A area image is normal start, if it is normal start, the A area image position stored at the address 0x00000003 is read, and the program image is read by jumping to the A area image position, after the reading is completed, the CRC check is performed again in the FPGA, and the CRC value at the end of the program image is compared, if they are consistent, the power-on start is completed, if they are inconsistent, the above process is repeated until the power-on start is completed or the start time threshold is exceeded; if it is not normal start, the B area start flag bit at the address 0x00100001 is continuously read, and so on. In order to ensure that the start process is successfully completed, the start time threshold is set, if the reading and checking time of a partition is greater than the start time threshold, the start program will skip the area image and modify the corresponding partition start flag to be not normal start.

[0080] 3. Update

[0081] Before the update program starts, the FPGA receives an update instruction, first needs to traverse all the partition start flags in the FLASH, needs to ensure that at least one partition start flag is normal start, can perform subsequent actions, otherwise returns that the update condition is not met, and cannot be updated.

[0082] When updating, first erase the data in the FPGA to-be-updated package storage area, the update program image enters the FPGA to-be-updated package storage area through a wired or remote transmission mode (the above process must ensure that the power supply and work are normal, otherwise data reception cannot be performed), the FPGA first checks the header and verifies the correctness of the to-be-updated program image through CRC, when the header meets the specified format and the to-be-updated program image is correct, the FPGA starts from the initial address 0x00200000 of the C area of the FLASH through the configuration interface (if only the C area image can be normally started in the whole program, the B area image is started), first sets the C area state flag to the update state 0x00000000, reads the image position at the address 0x00200003, and then writes the to-be-updated program image data into the corresponding address.

[0083] After the writing is completed, the CRC check is performed on the program image data, the result is compared with the CRC value at the end of the program image, if the check is correct, the C area update flag is set as update success, the start flag is set as normal start, and the program image is written into the A / B area position according to the above process (the first partition image that can be normally started before updating is not temporarily covered and updated); if the check is incorrect, the C area start flag is modified as unable to normally start, the update state is modified as update failure, and the program is restarted to update, if the update time is greater than the update time threshold, the update process jumps to the second last area except the first partition that can be normally started to repeat the update process. In order to ensure that the update process is successfully completed, the update time threshold is set, if the update time of a certain partition is greater than the update time threshold, the update process skips the area image and keeps the corresponding partition update flag as update failure and the start flag as unable to normally start.

[0084] When all partitions are updated, all partition update states in the FLASH are traversed, at least one partition state is ensured to be in the update state, the normal start state and the update success state, the update success is returned, and the reserved normally started image is updated and covered, otherwise, the update failure is returned, and the program is started according to the previously reserved normally started image.

[0085] Compared with the prior art, the application provides a program redundancy backup and online updating method and system for a fiber-optic gyroscope, which has a simpler structure, more redundancy backups, lower cost, higher stability and wider application range.

[0086] (1) The prerequisite for updating in the application is that at least one partition can work normally, so that the original image can be normally started even if the update fails, and the update success probability is greatly improved by writing the update image into the partition.

[0087] (2) The application reduces the risk of all images being problematic to achieve the purpose of long-term storage of the image (as long as one of the multiple partition images is normal, the multiple partition images are considered to be normal).

[0088] (3) The application has application applicability for commonly used embedded processing devices (mainly four categories: FPGA, DSP, ARM and single-chip microcomputer).

[0089] Features described and / or illustrated above in relation to one embodiment can be used in one or more other embodiments in the same or similar manner, and / or in combination with or in place of features in other embodiments.

[0090] It should be emphasized that the term "comprises / comprising" when used in this specification is taken to mean the presence of stated features, integers, steps or components but does not preclude the presence or addition of one or more other features, integers, steps, components or groups thereof.

[0091] Many of the advantages of the embodiments will be apparent from the detailed description, and it is intended to cover all such features and advantages of the embodiments which fall within the true spirit and scope of the application. Further, since numerous modifications and changes will readily occur to those skilled in the art, it is not desired to limit the embodiments of the present application to the exact construction and operation

[0092] The above description is only preferred embodiments of the present application, and is not intended to limit the present application. The present application can be variously changed and modified by those skilled in the art without departing from the spirit and scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the scope of the present application.

[0093] Portions of the present application that are not specifically described herein are well known to those skilled in the art.

Claims

1. A method for program redundancy backup and on-line update for fiber-optic gyroscope, characterized in that, The method comprises the following steps: S1, dividing the FLASH into n partitions in sequence, n≥3, each of the partitions comprising a state flag, a start flag, an update flag, an image storage address, and a program image in sequence; S2, power-on self-checking of the device, setting the state flag to a start state, performing a first-level check on each partition in sequence, if the check is correct, setting the start flag of the i-th partition to normal start, if the check is incorrect, setting the start flag of the i-th partition to abnormal start, i representing one of the n partitions; S3, starting the device, the processor judging the start flags of each partition in sequence, if the start flag of the i-th partition is normal start, performing a second-level check on the partition, if the check is correct, completing the start, otherwise, re-judging the start flag of the partition; if the start flag of the i-th partition is abnormal start, judging the start flag of the next partition; S4, traversing the start flags of each partition in the FLASH, if at least one of the start flags is normal start, entering step S5, otherwise, feeding back that the update is impossible; S5, erasing the data in the storage area of the processor to be updated, transmitting the program image to be updated to the storage area of the processor to be updated, performing a third-level check, if the check is correct, entering step S6, if the check is incorrect, re-transmitting the program image to be updated to the storage area of the processor to be updated; S6, starting from the last partition to perform the update in reverse order, setting the state flag of the corresponding partition to an update state, writing the program image to be updated into the image storage address of the partition, performing a fourth-level check on the program image of the partition after the update, if the check is correct, setting the update flag of the partition to update success and the start flag to normal start, and updating the next partition; if the check is incorrect, setting the start flag of the partition to abnormal start and the update state to update failure, and starting the update of the partition again.

2. The method of claim 1, wherein, The method further comprises the following steps: S7, after the update of all the partitions is completed, traversing all the partitions in the FLASH, if at least one of the partitions is in the update state, can be started normally, and is updated successfully, returning update success, performing an update covering operation on the other partitions that can be started normally, otherwise, returning update failure and starting according to the partitions that can be started normally.

3. The method of claim 1, wherein, The first-level check is used to check whether the program image is incorrect through a check code; The first-level check comprises reading the image storage address of the i-th partition, if the reading is successful, jumping to the program image of the i-th partition to perform CRC check, comparing the CRC check result with the CRC value at the end of the program image, judging whether the check is incorrect, i representing one of the n partitions, if the reading fails, setting the start flag of the i-th partition to abnormal start; The second-level check is used to check whether the program image is incorrect through a check code; The second-level check comprises reading the image storage address of the i-th partition by the processor, if the reading is successful, jumping to the program image in the image storage address of the i-th partition to perform CRC check in the processor, comparing the CRC check result with the CRC value at the end of the program image, judging whether the check is incorrect, if the reading fails, setting the start flag of the i-th partition to abnormal start. The third level check is used to check whether the to-be-updated program image is incorrect by a check code. The third level check includes checking the word head of the to-be-updated program image and checking the to-be-updated program image by CRC. The fourth level check is used to check whether the updated program image is incorrect by a check code. The fourth level check includes performing CRC on the updated program image, comparing the CRC check result with the CRC value at the end of the program image, and judging whether the check is incorrect.

4. The method of claim 1, wherein, The step S2 of the power-on self-checking process further includes the following steps: A self-checking time threshold is set, if the self-checking time of the i-th partition is greater than the self-checking time threshold, the self-checking program will skip the i-th partition and enter the next partition, and the i-th partition startup flag is set as unable to normally start.

5. The method of claim 1, wherein, The step S3 of the device startup process further includes the following steps: A startup time threshold is set, if the reading time of the i-th partition is greater than the startup time threshold, the startup program will skip the i-th partition, and the i-th partition startup flag is set as unable to normally start.

6. The method of claim 1, wherein, The step S6 of the updating process further includes the following steps: An updating time threshold is set, if the updating time of the i-th partition is greater than the updating time threshold, the updating program will skip the i-th partition, and the i-th partition updating flag is set as updating failure and the startup flag is set as unable to normally start.

7. The method of claim 1, wherein, If all the partitions can only have the last partition normally started, the step S6 starts updating from the second last partition.

8. A program redundancy backup and on-line updating system for a fiber-optic gyroscope, characterized in that, The system includes: An embedded processor for temporarily storing, executing and checking the program image, including a to-be-updated storage area; A FLASH for storing the program image and its state, including n partitions, n≥3, each of the partitions includes a state flag, a startup flag, an updating flag, a storage address of the program image and the program image.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, wherein the computer program is executed by the processor to implement the method in any one of claims 1 to 7.

10. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the computer program to implement the method in any one of claims 1 to 7.

Images