A firmware upgrade system and method that supports real-time status monitoring and is resistant to power outages.

Abstract

This invention provides a firmware upgrade system and method that supports real-time status monitoring and is resistant to power outages, relating to the field of industrial Internet of Things (IoT) technology. It includes a storage module, a power outage protection module, and a processing module. The storage module comprises an on-chip FLASH memory and an off-chip NOR FLASH memory. The on-chip FLASH memory is divided into a BOOT area, an APP area, and an upgrade parameter storage area. The off-chip NOR FLASH memory is divided into BANK1 and BANK2 areas. This invention provides data redundancy for firmware upgrades through a dual-zone backup mechanism in the storage module. The hardware power outage detection and supercapacitor energy storage design of the power outage protection module prevent data loss and storage structure damage during power outages at the hardware level. The processing module's precise data recording and recovery strategy ensures accurate recovery and upgrade after a power outage.

Description

Technical Field

[0001] This invention relates to the field of industrial Internet of Things (IoT) technology, and in particular to a firmware upgrade system and method that supports real-time status monitoring and is resistant to power outages. Background Technology

[0002] In industrial IoT applications, the DTU is a key device for realizing remote data transmission from equipment, and the stability of its firmware upgrades is crucial.

[0003] However, existing DTU firmware upgrade processes have serious flaws: Firstly, traditional upgrade methods lack hardware power-loss protection circuits, and if a power outage occurs during the upgrade process, the firmware is in a half-written state, easily rendering the device unusable. Furthermore, since DTUs are often deployed in remote areas such as oil fields and base stations, manual on-site repair costs are extremely high. Secondly, some dual-zone upgrade solutions only implement simple partition switching functions, lacking effective management of intermediate states in the upgrade process. After a power outage, the upgrade progress cannot be accurately resumed, often requiring the entire upgrade process to be restarted, significantly reducing upgrade efficiency and increasing upgrade time and bandwidth consumption. Statistics show that the recovery success rate of traditional upgrade solutions in power-loss scenarios is less than 70%, seriously affecting the normal operation of DTU devices and the stability of industrial IoT systems. Therefore, this invention proposes a firmware upgrade system and method that supports real-time status monitoring and is resistant to power outages to solve the problems existing in the prior art. Summary of the Invention

[0004] To address the aforementioned issues, this invention proposes a firmware upgrade system and method that supports real-time status monitoring and is resistant to power outages. Through innovative hardware architecture design and software algorithm optimization, it solves the problem of upgrade failure and equipment damage caused by power outages during existing DTU firmware upgrades, significantly improving the success rate of firmware upgrades and equipment reliability, reducing equipment maintenance costs, and ensuring that DTU devices can successfully complete firmware upgrades in various complex power supply environments.

[0005] To achieve the objectives of this invention, the following technical solution is provided: A firmware upgrade system that supports real-time status monitoring and is resistant to power outages, comprising a storage module, a power outage protection module, and a processing module. The storage module includes an on-chip FLASH memory and an off-chip NOR FLASH memory. The on-chip FLASH memory is divided into a BOOT area, an APP area, and an upgrade parameter storage area. The off-chip NOR FLASH memory is divided into a BANK1 area and a BANK2 area. The power outage protection module includes a hardware power outage detection unit and a supercapacitor energy storage unit. The hardware power outage detection unit monitors the power supply voltage in real time. The supercapacitor energy storage unit is coupled to the power outage detection unit and provides power to maintain power supply after a power outage when a voltage drop is detected.

[0006] The processing module is coupled to the storage module and the power failure protection module, and performs a state saving operation when the power failure protection module is triggered.

[0007] A further improvement is that: when the processing module performs a firmware upgrade, it writes the new firmware to be upgraded to the BANK1 area and backs up the currently running firmware to the BANK2 area; the upgrade parameter storage area records in real time the progress information of the new firmware being written to the BANK1 area, the pre-write check value of the new firmware in the BANK1 area, and the pre-write check value of the backup firmware in the BANK2 area.

[0008] A further improvement is made in that: when the power failure protection module is triggered, the current upgrade status is saved to the upgrade parameter storage area by utilizing the power supply time provided by the supercapacitor energy storage unit. After the device restarts, the progress information and verification value saved in the upgrade parameter storage area are read in the BOOT program. The data integrity is verified by comparing the pre-write verification value of the new firmware in BANK1 area with the new firmware verification value recorded in the upgrade parameter storage area, and by comparing the pre-write verification value of the backup firmware in BANK2 area with the backup firmware verification value recorded in the upgrade parameter storage area.

[0009] Further improvements are made in that the progress information recorded in the upgrade parameter storage area includes at least the current breakpoint position pointer of the new firmware being written to the BANK1 area, the check value being correct flag, the program being running normally flag, the parameter being initialized flag, the program being running normally flag, the complete check value of the new firmware, the complete check value of the old firmware, the pre-written check value of the new firmware, and the pre-written check value of the old firmware.

[0010] A further improvement is that after the device receives the new firmware, the processing module reads the new firmware that was just written to BANK1, calculates its check value, compares the check value with the new firmware check value recorded in the upgrade parameter storage area, writes the result to the upgrade parameter storage area, and then moves the old firmware to BANK2. Before moving it, the check value of the old firmware is calculated and stored in the upgrade parameter storage area. After the move is complete, the data in BANK2 is read and its check value is calculated. The check value is compared with the old firmware check value calculated before the move, and the result is written to the upgrade parameter storage area.

[0011] A further improvement is that the supercapacitor energy storage unit is configured to provide a maintenance power supply for no less than 1 second after a power outage, and to write the current data block and upgrade parameter data within 1 second, so as to prevent the sudden power outage from damaging the on-chip FLASH storage structure.

[0012] A further improvement is that the hardware power failure detection unit includes an SGM803 voltage monitoring chip, which is used to monitor the power supply voltage. When the power supply voltage is detected to be lower than the set threshold, the boost converter chip TPS63060 is put into operation and the processing module is notified to perform a status saving operation.

[0013] A firmware upgrade method that supports real-time status monitoring and is resistant to power outages includes the following steps:

[0014] The upgrade process begins, and the system receives new firmware data.

[0015] Status monitoring and recording: Write new firmware data to the BANK1 area of ​​the off-chip NOR FLASH memory, record the progress information of writing new firmware to the BANK1 area in real time in the upgrade parameter storage area of ​​the on-chip FLASH memory, and calculate and record the pre-write check value of new firmware in the BANK1 area to the upgrade parameter storage area.

[0016] Backup and write: Back up the currently running firmware to the BANK2 area of ​​the off-chip NOR FLASH memory, and store the check value of the backup firmware in the BANK2 area to the upgrade parameter storage area.

[0017] Power failure response: When the hardware power failure detection unit detects that the voltage is lower than the threshold, it triggers the supercapacitor energy storage unit to supply power. Using the power supply time provided by the supercapacitor energy storage unit, the current critical upgrade status is saved to the upgrade parameter storage area.

[0018] After power failure and device restart, read the progress information and pre-write verification value in the upgrade parameter storage area, locate the breakpoint based on the progress information, and continue to write the remaining data of the new firmware to the BANK1 area.

[0019] Integrity verification: After the new firmware is completely written to BANK1, the checksum of the actual data in BANK1 is calculated and compared with the checksum of the new firmware recorded in the upgrade parameter storage area. The actual checksum of the backup firmware in BANK2 is calculated and compared with the checksum of the backup firmware recorded in the upgrade parameter storage area. When the two comparisons are consistent, the upgrade data is determined to be complete and valid, and the upgrade is completed. Otherwise, the error handling process is executed.

[0020] A further improvement is made in the following steps during power outage recovery, before writing new firmware data after the device restarts:

[0021] Read the data that has already been written to BANK1 and calculate its current checksum.

[0022] The current check value is partially compared with the new firmware pre-written check value recorded in the upgrade parameter storage area;

[0023] If the comparison is successful, locate the breakpoint based on the progress information and continue writing;

[0024] If the comparison is inconsistent, restart the firmware upgrade.

[0025] A further improvement is that the error handling process includes: based on the information in the upgrade parameter storage area, selecting to roll back to the backup firmware in the BANK2 area or re-initiating the upgrade process.

[0026] The beneficial effects of this invention are as follows:

[0027] 1. This invention provides data redundancy for firmware upgrades through a dual-zone backup mechanism in the storage module; the hardware power failure detection and supercapacitor energy storage design of the power failure protection module prevent data loss and storage structure damage during power failures at the hardware level; the precise data recording and recovery strategy of the processing module ensures accurate recovery of the upgrade after a power failure. The combination of these technologies effectively solves the power failure problem in the DTU firmware upgrade process. Compared with traditional solutions, the power failure recovery success rate is significantly increased from less than 70% to over 99.9%, greatly improving the reliability of firmware upgrades, preventing the device from "freezing" due to upgrade failures, and ensuring the stable operation of the DTU device.

[0028] 2. This invention monitors the firmware upgrade process in real time through a processing module and records key information in detail. Combined with dual-zone checksum comparison and multiple verification mechanisms, it ensures the integrity and accuracy of data during the upgrade process. Whether it is a normal upgrade process or a power outage recovery upgrade, it can promptly detect and process data errors, effectively preventing upgrade failures caused by data corruption, ensuring the security and reliability of the device firmware, and providing a solid data foundation for the stable operation of the device.

[0029] 3. This invention employs hardware protection through a hardware power failure detection unit and a supercapacitor energy storage unit, combined with a software control strategy for the processing module, forming a comprehensive hardware and software-based anti-power failure protection system. This system prevents damage to the storage structure at the hardware level and achieves precise power failure recovery and data verification at the software level, significantly improving the system's fault tolerance and recovery efficiency, reducing equipment maintenance costs and downtime, and providing users with a better and more reliable user experience. It has good market application prospects and promotional value. Attached Figure Description

[0030] Figure 1 This is a flowchart of the normal upgrade procedure of the present invention;

[0031] Figure 2 This is a flowchart of the power outage and recovery procedure of the present invention. Detailed Implementation

[0032] To enhance understanding of the present invention, the present invention will be further described in detail below with reference to embodiments. These embodiments are only used to explain the present invention and do not constitute a limitation on the scope of protection of the present invention.

[0033] Example 1

[0034] according to Figure 1 , 2 As shown, this embodiment proposes a firmware upgrade system that supports real-time status monitoring and is resistant to power outages, including a storage module, a power outage protection module, and a processing module:

[0035] Storage Module: The storage module includes on-chip FLASH memory and off-chip NOR FLASH memory. The on-chip FLASH memory is divided into a BOOT area, an APP area, and an upgrade parameter storage area. The BOOT area is used to run the system bootloader. During device startup, this program is responsible for initializing hardware resources, including configuring and testing key hardware such as the processor, memory, and communication interfaces, building the basic environment for normal device operation. It also determines whether to run new firmware or roll back old firmware by reading upgrade parameter information. The APP area is used to run the firmware program currently running on the DTU device, carrying core functions such as data transmission, protocol parsing, and data processing. The upgrade parameter storage area is specifically used to record key information during the firmware upgrade process, including progress information of the new firmware being written to the BANK1 area, such as the current breakpoint pointer to accurately identify the interruption position of data writing; the checksum and pre-write checksum of the new firmware in the BANK1 area, and the checksum and pre-write checksum of the backup firmware in the BANK2 area. It also includes auxiliary information such as whether the checksum is correct, whether the program is running normally, whether parameters have been initialized, and whether the program is running normally. This data provides important evidence for power-off recovery upgrades and data integrity verification.

[0036] The off-chip NOR FLASH memory is divided into BANK1 and BANK2. BANK1 is used to write the new firmware to be upgraded, providing storage space for firmware upgrades; BANK2 is used to back up the currently running firmware, playing a role in data redundancy backup during the upgrade process. If problems occur during the upgrade, the device can be quickly restored to its original normal working state, ensuring the security of the upgrade process.

[0037] Power Failure Protection Module: The power failure protection module consists of a hardware power failure detection unit and a supercapacitor energy storage unit. The hardware power failure detection unit uses the SGM803 voltage monitoring chip, which can monitor the power supply voltage of the DTU equipment in real time and accurately. When the detected power supply voltage is lower than a preset threshold, the hardware power failure detection unit will immediately trigger the boost converter chip TPS63060 to start working, and at the same time send a power failure signal to the processing module, notifying it to perform a status saving operation.

[0038] The supercapacitor energy storage unit is coupled to the hardware power failure detection unit. Upon receiving a power failure trigger signal, it quickly activates, providing the system with a sustaining power supply for at least one second. This one-second power supply time is crucial for the system, ensuring that the system completely writes the current data block and upgrade parameter data into the storage module. This prevents ECC errors caused by damage to the on-chip FLASH storage structure due to sudden power failure, thus preventing the main chip from failing to operate normally due to storage errors. From a hardware perspective, it provides reliable data security for the system in the instant of power failure.

[0039] Processing module: The processing module is coupled to the storage module and the power failure protection module. It is the core control unit of the entire firmware upgrade system, responsible for executing the entire firmware upgrade process and performing state saving operations in a timely manner when the power failure protection module is triggered.

[0040] During firmware upgrade, the processing module first writes the new firmware to be upgraded to the BANK1 area of ​​the external NOR FLASH, and at the same time backs up the currently running firmware to the BANK2 area of ​​the external NOR FLASH. During the writing process, the processing module records the progress information of the new firmware being written to the BANK1 area, the pre-write check value of the new firmware in the BANK1 area, and the pre-write check value of the backup firmware in the BANK2 area in real time in the upgrade parameter storage area of ​​the on-chip FLASH. When the power failure protection module is triggered, the processing module uses the power supply time provided by the supercapacitor to quickly save the current upgrade status (including but not limited to writing progress, key configuration parameters, pre-write check information of written data, etc.) to the upgrade parameter storage area.

[0041] After the upgrade is complete, the new firmware data written to BANK1 is read, its checksum is calculated, and this checksum is compared with the new firmware checksum recorded in the upgrade parameter storage area. The comparison result is written to the upgrade parameter storage area. Additionally, the checksum of the backup firmware in BANK2 is compared with the backup firmware checksum recorded in the upgrade parameter storage area to rigorously verify data integrity and ensure successful firmware upgrade. After the device restarts, the processing module reads the progress information and pre-written checksum stored in the upgrade parameter storage area. Based on the progress information, it accurately locates the power outage point and resumes the operation of writing the new firmware to BANK1.

[0042] A firmware upgrade method that supports real-time status monitoring and is resistant to power outages includes the following steps:

[0043] Upgrade Startup: The DTU device receives new firmware data via wired (such as Ethernet, serial port, etc.) or wireless (such as 4G, 5G, WiFi, etc.) communication methods. After receiving the data, the device enters the firmware upgrade preparation stage.

[0044] Status monitoring and recording: During the process of writing new firmware to BANK1 area, the processing module records the progress information of writing new firmware to BANK1 area in real time in the upgrade parameter storage area of ​​on-chip FLASH, and accurately tracks the writing status; at the same time, it calculates and records the pre-written check value of new firmware in BANK1 area according to the predetermined verification algorithm (such as CRC32, MD5, etc.), providing a benchmark for subsequent data integrity verification.

[0045] Backup and Write: The processing module fully backs up the currently running firmware to the BANK2 area of ​​the off-chip NOR FLASH. This dual-area operation establishes a dual data protection mechanism during the firmware upgrade process, ensuring that the original state can be restored if problems occur during the upgrade.

[0046] Power outage response: The hardware power outage detection unit continuously monitors the supply voltage. When the voltage is detected to be lower than a preset threshold, the supercapacitor energy storage unit is immediately triggered to supply power. The processing module utilizes the power supply time provided by the supercapacitor to quickly save the current critical upgrade status (such as writing progress, verification information of written data, key configuration parameters, etc.) to the upgrade parameter storage area, preventing data loss due to power outage and preserving critical information for subsequent recovery upgrades.

[0047] Power outage recovery: After the device restarts, the processing module reads the progress information and expected verification value from the upgrade parameter storage area; first, it reads the data already written in the BANK1 area and calculates its current verification value; it then partially compares this current verification value with the new firmware pre-written verification value recorded in the upgrade parameter storage area; only when the partial comparison matches, it locates the breakpoint based on the progress information and continues to write the remaining part of the BANK1 area with the new firmware data, ensuring a safe and accurate recovery of the upgrade operation from the power outage position and avoiding upgrade failure due to data errors.

[0048] Integrity Verification: After the new firmware is fully written to BANK1, the processing module calculates the checksum of the actual data in BANK1 and compares it with the checksum of the new firmware recorded in the upgrade parameter storage area. At the same time, it calculates the actual checksum of the backup firmware in BANK2 and compares it with the checksum of the backup firmware recorded in the upgrade parameter storage area. Only when the two comparisons are consistent is the upgrade data deemed complete and valid, and the upgrade is completed. If the comparisons are inconsistent, the error handling process is executed. Based on the information in the upgrade parameter storage area, it selects to roll back to the backup firmware in BANK2 to restore the device to its normal state before the upgrade, or it re-initiates the upgrade process to attempt to complete the firmware upgrade again.

[0049] Example 2

[0050] according to Figure 1 , 2 As shown, this embodiment proposes a firmware upgrade system and method that supports real-time status monitoring and is resistant to power outages, including a storage module, a power outage protection module, and a processing module:

[0051] Storage module:

[0052] On-chip FLASH (main chip: STM32H743ZIT6):

[0053] BOOT area (0x8000000-0x8020000)

[0054] APP area (0x8020000-0x80E0000)

[0055] Upgrade parameter storage area (0x08100000-0x08120000, independent sector)

[0056] Off-screen NOR FLASH (W25Q256JVFIQ):

[0057] BANK1 (0x000000-0x0C0000, stores new firmware (768KB))

[0058] BANK2 (0x0C0000-0x180000, backup of current firmware (768KB))

[0059] Power failure protection module:

[0060] Voltage detection chip: SGM803-SXN3L / TR (threshold set to 2.93V)

[0061] Energy storage unit: 2×2.7V / 10F supercapacitors connected in series, maintained at 5V / 1s power supply via TPS63060 boost converter;

[0062] Triggering logic: When the SGM803B detects VCC < 2.93V, it sends an interrupt signal (EXTI_Line15) to the MCU, and at the same time, the TPS63060 activates the backup power supply.

[0063] Processing module: STM32H743ZIT6 main chip, ARM Cortex-M7 core.

[0064] For the normal upgrade process, see Figure 1 :

[0065] Step 1: Upgrade Startup

[0066] The DTU device receives new firmware data (bin file) sent by the host computer via serial port / network port. The first frame contains the expected checksum of the new firmware (CRC32 stored in the first 32 bytes).

[0067] The processing module parses the first frame, writes the expected verification value of the new firmware into the on-chip FLASH upgrade parameter storage area, and initializes the progress information:

[0068] Upgrade parameter data structure:

[0069] struct UpdateParams {

[0070] uint32_t new_breakpoint; / / Pointer to the breakpoint location (byte address) in the new firmware

[0071] uint8_t new_check_flag; / / New firmware verification flag

[0072] uint8_t old_check_flag; / / Old firmware inspection flag

[0073] uint32_t new_pre_crc; / / Pre-write CRC32 value for new firmware

[0074] uint32_t new_actual_crc; / / New firmware CRC32 value (first 32 bytes obtained)

[0075] uint32_t old_actual_crc; / / CRC32 value of old firmware

[0076] uint32_t old_yesORno_flag; / / Flag indicating whether the firmware has been run

[0077] uint8_t system_run_flag; / / Program running status

[0078] uint8_t power_loss_flag; / / Power loss flag

[0079] ... / / Other flags

[0080] params_t;

[0081] Step 2: Status Monitoring and Recording

[0082] Write new firmware: Write the new firmware data to the BANK1 area (NOR FLASH) frame by frame. Every 4KB of data written, update the upgrade parameter new_breakpoint to the latest address. Calculate the CRC of the data already written to BANK1 and store it in the upgrade parameter new_pre_crc. Only when the upgrade is complete or a power-off signal is received will the progress information be written to the on-chip FLASH upgrade parameter storage area in real time (reducing the number of FLASH erase / write cycles and extending the chip's lifespan).

[0083] Step 3: Backup and Verification

[0084] New firmware verification: After all the new firmware has been received, read all the data in BANK1 to calculate the actual CRC, compare it with new_pre_crc in the upgrade parameter storage area, and write the result to new_check_flag (1: success, 2: failure).

[0085] Old firmware backup: If the new firmware verification is successful, copy the current firmware in the APP area to the BANK2 area; calculate the actual CRC of the backup firmware and compare it with the expected CRC (pre-stored) of the original firmware in the APP area; write the result to old_check_flag (1: success, 2: failure).

[0086] Step 4: Firmware Switching

[0087] If the double verification is successful (new_check_flag=1 and old_check_flag=1): copy the new firmware from BANK1 to the APP area of ​​the on-chip FLASH, and jump to the APP area to start the new firmware.

[0088] If verification fails: trigger the error handling process (rollback or re-upgrade).

[0089] For power outage recovery procedures, see Figure 2 :

[0090] Step 1: Power Outage Response

[0091] Hardware trigger: SGM803 detects voltage <2.93V → sends an interrupt signal to MCU, TPS63060 enables supercapacitor power supply (maintained for ≥1s), after the MCU enters the power-down interrupt, it will stop all current NORFLASH operations and write the current upgrade status to the on-chip FLASH upgrade parameter storage area, including parameters: new firmware breakpoint position pointer new_breakpoint, new firmware pre-written CRC32 value new_pre_crc, power-loss flag bit power_loss_flag;

[0092] Step 2: Restore after restarting

[0093] The BOOT program detects the power loss flag, reads the upgrade parameter storage area, and if power_loss_flag=1, it enters the power loss recovery mode. First, it reads the data written in BANK1 according to the breakpoint information new_breakpoint and calculates the checksum. Then, it compares it with the new firmware pre-written CRC32 value new_pre_crc in the upgrade parameters. If the comparison fails, it is determined that the data is corrupted and firmware rollback or downloading the new firmware needs to be performed again. If the comparison succeeds, it requests data from the host computer according to the breakpoint information new_breakpoint and continues to write the remaining new firmware to the BANK1 area.

[0094] Step 3: Final Verification and Processing

[0095] New firmware verification: Calculate the actual CRC of BANK1 and compare it with the new firmware verification value in the upgrade parameter storage area.

[0096] Backup firmware verification: Calculate the actual CRC of BANK2 and compare it with the backup firmware verification value in the upgrade parameter storage area.

[0097] The processing results are shown in Table 1:

[0098] New firmware verification Backup firmware verification action success success Copy BANK1 data to the APP area and start the new firmware. fail success Rollback: Copy the BANK2 backup firmware to the APP area success fail Clear upgrade parameters and wait for the upgrade to restart. fail fail Clear upgrade parameters and wait for the upgrade to restart.

[0099] Implementation results:

[0100] Power outage recovery success rate: In 100 simulated power outage tests, the upgrade was completed successfully 99 times through breakpoint resume, and the data was corrupted once due to the FLASH block being erased during the power outage. The data was recovered by rolling back the old firmware, resulting in a success rate of 99.9%.

[0101] Equipment availability: Traditional solutions often cause the device to "freeze" (success rate <70%) after a power outage due to damage to the on-chip FLASH structure. This solution avoids underlying storage failures through hardware protection, improving recovery efficiency by more than 3 times.

[0102] Data integrity: Segmented verification (every 4KB) + final full verification ensures zero errors in the upgraded data. Compared with the traditional solution's single full verification, the error detection granularity is improved by 256 times (from 1MB level to 4KB level).

[0103] In summary, the hardware and software collaborative power-loss protection features: real-time monitoring via SGM803 and supercapacitor energy storage prevent on-chip FLASH damage at the hardware level, compensating for the shortcomings of pure software solutions; multi-level verification and status recovery: segmented verification (4KB granularity) + breakpoint verification + full verification ensure data integrity; the upgrade parameter storage area records breakpoints, check values, and status flags to achieve accurate recovery; dual-zone isolated storage architecture: BANK1 / BANK2 independently store new and old firmware, supporting lossless rollback and avoiding firmware loss caused by power outages during traditional single-zone upgrades.

[0104] This invention provides data redundancy for firmware upgrades through a dual-zone backup mechanism in the storage module; the hardware power failure detection and supercapacitor energy storage design of the power failure protection module prevent data loss and storage structure damage during power outages at the hardware level; and the precise data recording and recovery strategy of the processing module ensures accurate recovery of the upgrade after a power failure. These combined technologies effectively solve the power failure problem during DTU firmware upgrades, significantly increasing the power failure recovery success rate from less than 70% to over 99.9% compared to traditional solutions. This greatly improves the reliability of firmware upgrades, prevents devices from "freezing" due to upgrade failures, and ensures the stable operation of DTU devices. Furthermore, this invention monitors the firmware upgrade process in real time through the processing module and records key information in detail. Combined with dual-zone checksum comparison and multiple verification mechanisms, it ensures the integrity and accuracy of data during the upgrade process. Whether in a normal upgrade process or a power failure recovery upgrade, it can promptly detect and process data errors, effectively preventing upgrade failures due to data corruption, ensuring the security and reliability of the device firmware, and providing a solid data foundation for the stable operation of the device. Meanwhile, this invention employs hardware protection through a hardware power failure detection unit and a supercapacitor energy storage unit, combined with a software control strategy for the processing module, forming a comprehensive anti-power failure protection system that integrates hardware and software. This system prevents damage to the storage structure at the hardware level and achieves precise power failure recovery and data verification at the software level, significantly improving the system's fault tolerance and recovery efficiency, reducing equipment maintenance costs and downtime, and providing users with a better and more reliable user experience. It has good market application prospects and promotional value.

[0105] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of the present invention is defined by the appended claims and their equivalents.

Claims

1. A power-fail safe firmware upgrade system supporting real-time status monitoring, comprising a storage module, a power-fail protection module and a processing module, characterized in that: The storage module includes an on-chip FLASH memory and an off-chip NOR FLASH memory, the on-chip FLASH memory is divided into a BOOT area, an APP area and an upgrade parameter storage area, and the off-chip NOR FLASH memory is divided into a BANK1 area and a BANK2 area; the power-off protection module includes a hardware power-off detection unit and a super capacitor energy storage unit, the hardware power-off detection unit is used for monitoring the power supply voltage in real time, and the super capacitor energy storage unit is coupled to the power-off detection unit and provides power supply maintenance after power-off when voltage sag is detected; The processing module is coupled to the storage module and the power-off protection module, and performs a state saving operation when the power-off protection module is triggered; when the processing module performs firmware upgrade, the new firmware to be upgraded is written into the BANK1 area, and the currently running firmware is backed up to the BANK2 area; The upgrade parameter storage area records the progress information of the new firmware written into the BANK1 area, the pre-write check value of the new firmware in the BANK1 area and the pre-write check value of the backup firmware in the BANK2 area in real time; when the power-off protection module is triggered, the current upgrade state is saved to the upgrade parameter storage area by using the maintenance power supply time provided by the super capacitor energy storage unit; after the device is restarted, the progress information and the check value saved in the upgrade parameter storage area are read in the BOOT program; the data integrity is verified by comparing the pre-write check value of the new firmware in the BANK1 area with the check value of the new firmware recorded in the upgrade parameter storage area, and comparing the pre-write check value of the backup firmware in the BANK2 area with the check value of the backup firmware recorded in the upgrade parameter storage area; the progress information recorded in the upgrade parameter storage area at least includes a current breakpoint position pointer of the new firmware written into the BANK1 area, a check value correctness flag, a program normal running flag, a parameter initialization flag, a program normal running flag, a new firmware complete check value, an old firmware complete check value, a new firmware pre-write check value and an old firmware pre-write check value; after the device receives the new firmware, the processing module reads the new firmware just written into the BANK1 area to calculate the check value, compares the check value with the check value of the new firmware recorded in the upgrade parameter storage area, writes the result into the upgrade parameter storage area, moves the old firmware to the BANK2 area, calculates the check value of the old firmware and stores it in the upgrade parameter storage area before moving, reads the BANK2 data and calculates the check value after moving, compares the check value with the check value of the old firmware calculated before moving, and writes the result into the upgrade parameter storage area.

2. The firmware upgrade system that supports real-time status monitoring and is resistant to power-off according to claim 1, wherein: In the super capacitor energy storage unit, the maintenance power supply after power-off is not less than 1 second, and the current data block and the upgrade parameter data are written in 1 second to prevent sudden power-off from damaging the storage structure of the on-chip FLASH.

3. The firmware upgrade system of claim 1, wherein: The hardware power-off detection unit includes an SGM803 voltage monitoring chip, which is used for monitoring the power supply voltage; when it is detected that the power supply voltage is lower than a set threshold, a boost converter chip TPS63060 is put into work and informs the processing module to perform a state saving operation.

4. A method for upgrading firmware with real-time status monitoring and anti-power-off, applied to the system for upgrading firmware with real-time status monitoring and anti-power-off as claimed in any one of claims 1-3, characterized in that, The method comprises the following steps: Upgrade start, receive new firmware data; State monitoring and recording, write new firmware data into BANK1 area of off-chip NOR FLASH memory, record the progress information of new firmware writing into BANK1 area in real time in upgrade parameter storage area of on-chip FLASH memory, calculate and record the pre-write check value of new firmware in BANK1 area into upgrade parameter storage area; Backup and write, backup the currently running firmware into BANK2 area of off-chip NOR FLASH memory, and store the check value of the backup firmware in BANK2 area into upgrade parameter storage area; Power-off response, when the hardware power-off detection unit detects that the voltage is lower than the threshold value, trigger the super capacitor energy storage unit to supply power, save the current upgrade key state to the upgrade parameter storage area by using the maintenance power supply time provided by the super capacitor energy storage unit; Power-off recovery, after the device restarts, read the progress information and pre-write check value in the upgrade parameter storage area, locate the breakpoint according to the progress information, and continue to write the remaining part of the new firmware data into BANK1 area; Integrity check, after the new firmware is completely written into BANK1 area, calculate the check value of the actual data in BANK1 area, compare it with the new firmware check value recorded in the upgrade parameter storage area, calculate the actual check value of the backup firmware in BANK2 area, compare it with the backup firmware check value recorded in the upgrade parameter storage area, when the two comparisons are consistent, determine that the upgrade data is complete and valid, complete the upgrade, otherwise, execute the error handling process.

5. The method of claim 4, wherein: In the power-off recovery, before continuing to write new firmware data after the device restarts, the following steps are further included: Read the data in the written part of BANK1 area, calculate its current check value; Partially compare the current check value with the pre-write check value of the new firmware recorded in the upgrade parameter storage area; When the comparison is consistent, locate the breakpoint according to the progress information and continue to write; When the comparison is inconsistent, start the firmware upgrade again.

6. The method of claim 4, wherein the method further comprises: The error handling process includes: according to the information of the upgrade parameter storage area, select to rollback to the backup firmware in BANK2 area or re-initiate the upgrade process.

Images