Fault-tolerant method for firmware update, electronic device, storage medium, and program product

Abstract

The application discloses a fault-tolerant method for firmware updating, an electronic device, a storage medium and a program product. When the device is started, the state of a flag register is read first. If the state of the flag register is a preset first value, an old firmware is loaded from a flash memory, and the device is started based on the old firmware. The old firmware is the firmware applied by the device when the device is last successfully started. If the state of the flag register is a preset second value, a new firmware is loaded from a storage unit, and the device is started by using the new firmware. Then, a starting result when the device is started by using the new firmware is acquired. If the starting result indicates that the device fails to start, the state of the flag register is set to the first value. According to the embodiment of the application, when firmware programming is wrong, the starting path is switched by using the flag register, the accurate old firmware in the flash memory is read, the device is restarted to restore the normal starting logic, the PCIe interface initialization continuously fails due to the wrong firmware is avoided, and the reliability of the firmware online updating is improved.

Description

Technical Field

[0001] This invention relates to the field of electronic technology, and more particularly to a fault-tolerant method, apparatus, storage medium, and program product for firmware updates. Background Technology

[0002] In current PCIe (Peripheral Component Interconnect Express) device designs, most devices incorporate a Flash memory chip. The core purpose of this flash memory chip is to store the firmware required for device startup. When a PCIe device powers on, its integrated control core first reads the firmware from the flash memory chip and then executes the pre-defined initialization code within the firmware. After the PCIe device is delivered to the customer for practical use, the device manufacturer often needs to perform online updates to the firmware stored in the flash memory chip based on feature iteration requirements or vulnerability patching needs.

[0003] However, in actual online update operations, it is inevitable that engineers will accidentally burn incorrect firmware to the flash memory chip. When the device completes the burning of the incorrect firmware and restarts, the control core loads the incorrect firmware from the flash memory chip and executes its internal code. Because the incorrect firmware may have problems such as missing initialization logic, incorrect parameter configuration, and abnormal code syntax, it is very easy for the PCIe interface initialization process to fail to complete normally. As the core communication bridge between the host and the device, the failure of the PCIe interface initialization will directly prevent the device from being enumerated by the host, ultimately causing the PCIe device to fail to boot. In addition, once the incorrect firmware is burned to the flash memory chip, no matter how many times the device restarts, the control core will always load the incorrect firmware, and the problem of PCIe interface initialization failure will persist. Summary of the Invention

[0004] The purpose of this invention is to provide a fault-tolerant method, device, storage medium, and program product for firmware updates, which can prevent PCIe interface initialization failures caused by faulty firmware and improve the reliability of online firmware updates.

[0005] To achieve the above objectives, embodiments of the present invention provide a fault-tolerant method for firmware updates, comprising:

[0006] In response to the device's startup operation, read the status of the flag register;

[0007] If the state of the flag register is a preset first value, the old firmware is loaded from the flash memory, and the device is started based on the old firmware; wherein, the old firmware is the firmware applied when the device was last successfully started;

[0008] If the state of the flag register is a preset second value, load the new firmware from the storage unit and start the device using the new firmware;

[0009] Obtain the boot result when the device is booted with the new firmware;

[0010] If the startup result indicates that the device has failed to start, the state of the flag register is set to the first value.

[0011] As an improvement to the above solution, after obtaining the boot result when the new firmware boots the device, the method further includes:

[0012] If the startup result indicates that the device has started successfully, the new firmware is written to the flash memory, and the state of the flag register is configured from the second value to the first value.

[0013] As an improvement to the above solution, when the new firmware is written to the flash memory, the new firmware replaces the old firmware stored in the flash memory.

[0014] As an improvement to the above solution, in response to the device startup operation, the method further includes:

[0015] In response to firmware flashing operations, receive new firmware;

[0016] The new firmware is written to the storage unit, and the state of the flag register is configured to the second value.

[0017] As an improvement to the above solution, when the new firmware is written to the storage unit, the new firmware replaces the original firmware stored in the storage unit.

[0018] As an improvement to the above solution, the flag register has read and write attributes, its default value in the initial state is the first value, and the flag register is not affected by the system reset operation of the device.

[0019] As an improvement to the above solution, the storage unit is a storage module independent of the flash memory, and the storage content of the storage unit is not affected by the system reset operation of the device.

[0020] To achieve the above objectives, embodiments of the present invention also provide an electronic device, including a main controller and flash memory, a storage unit, and a flag register respectively connected to the main controller, wherein the main controller is configured to:

[0021] In response to the device startup operation, the state of the flag register is read;

[0022] If the state of the flag register is a preset first value, the old firmware is loaded from the flash memory, and the device is started based on the old firmware; wherein, the old firmware is the firmware applied by the device during the last successful startup;

[0023] If the state of the flag register is a preset second value, new firmware is loaded from the storage unit, and the device is started using the new firmware;

[0024] Obtain the boot result when the device is booted with the new firmware;

[0025] If the startup result indicates that the device has failed to start, the state of the flag register is set to the first value.

[0026] To achieve the above objectives, embodiments of the present invention also provide a computer-readable storage medium, the computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform a fault-tolerant firmware update method as described in any of the above embodiments.

[0027] To achieve the above objectives, embodiments of the present invention also provide a computer program product, including computer instructions, which, when executed by a processor, implement the fault-tolerant firmware update method as described in any of the above embodiments.

[0028] Compared to existing technologies, the firmware update fault-tolerant method, electronic device, storage medium, and program product disclosed in this invention can switch the boot path through a flag register and read the accurate old firmware in the flash memory when a firmware burning error occurs. This allows the device to restart and restore normal boot logic, avoiding continuous failure of PCIe interface initialization caused by erroneous firmware, improving the reliability of online firmware updates. At the same time, fault tolerance and recovery are completed through an online process, reducing device maintenance costs and improving the convenience of firmware updates. Attached Figure Description

[0029] Figure 1 This is a structural block diagram of an electronic device provided in an embodiment of the present invention;

[0030] Figure 2 This is a flowchart of a fault-tolerant firmware update method provided in an embodiment of the present invention;

[0031] Figure 3 This is another flowchart of a fault-tolerant firmware update method provided in an embodiment of the present invention. Detailed Implementation

[0032] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0033] The online programming process for existing devices is as follows:

[0034] 1) The device's main control core loads and executes the old firmware from the Flash memory, and completes the initialization of core hardware modules such as the PCIe interface, DDR (Double Data Rate), and PLL (Phase-Locked Loop), so that the PCIe interface and the internal workings of the device are in normal working condition.

[0035] 2) The update software running on the host writes new firmware to the device's Flash through the established PCIe communication link. During this process, the old firmware stored in the Flash will be directly overwritten by the new firmware.

[0036] 3) After the writing is complete, the device performs a reboot operation, and the main control core loads the newly burned firmware from the Flash and attempts to execute it;

[0037] 4) If the new firmware is the correct version, the device can successfully boot up and work normally; if the new firmware has logical errors, abnormal parameter configurations, etc., its execution will cause the PCIe interface initialization to fail, the device cannot be enumerated by the host, and the host will be unable to access the device Flash again through the PCIe link, thus getting stuck in a cycle of boot failure and inability to repair online.

[0038] This shows that the validity of the new firmware in the existing technology (whether the device can start normally) has not been verified at all. It directly overwrites the only old firmware in the Flash. The old firmware, which serves as the safety benchmark for the normal startup of the device, is directly replaced. Once the new firmware has errors, the device will lose the basis for normal startup. Moreover, due to the interruption of PCIe interface communication, it is impossible to re-flash the correct firmware online, which will eventually cause the device to lock up, causing great inconvenience to user operation and maintenance and manufacturer after-sales service.

[0039] Based on this, embodiments of the present invention provide a fault-tolerant method, electronic device, storage medium, and program product for firmware updates. By adding a storage unit independent of Flash and a non-volatile flag register to the device, the storage unit is used to temporarily store new firmware to be verified, and the flag register is used to control the firmware boot path. This constructs a fault-tolerant update mechanism that allows new firmware to be tested first and then solidified, achieving the dual goals of validating the new firmware and securely retaining the old firmware. This solves the pain point in the prior art where erroneous firmware burning leads to device failure and difficulty in repair, and improves the reliability of online firmware updates.

[0040] See Figure 1 , Figure 1 This is a structural block diagram of an electronic device provided in an embodiment of the present invention. The electronic device includes a storage unit, a main controller, a flag register, and flash memory.

[0041] The storage unit is a storage module independent of flash memory, used to temporarily store new firmware to be verified. This prevents the new firmware from directly overwriting the old firmware in flash memory. It possesses non-volatile characteristics, meaning the contents of the storage unit are unaffected by system reset operations. For example, if the host has already written new firmware to the storage unit, even if the device restarts, the new firmware will still exist, and the main controller can still read it and attempt to boot. The storage unit can be, for example, SRAM (Static Random Access Memory) or a small NVRAM (Non-Volatile Random Access Memory).

[0042] As the core control module of an electronic device, the main controller integrates a read-only memory (ROM). The pre-stored program (ROM code) in this ROM is responsible for loading the firmware. The main controller as a whole is used to execute the firmware code and complete hardware initialization operations, such as the initialization of hardware like the PCIe interface and DDR. Based on the state of the flag register, the ROM code drives the selection of whether to load the firmware from flash memory or a storage unit. For example, the main controller can be the control core in an MCU (Microcontroller Unit) or a SoC (System on Chip).

[0043] The flag register is a non-volatile register with read and write attributes. It is used to record the firmware boot path selection status and indicate to the main controller the source of the firmware to be loaded. The default value of the flag register in the initial state is the first value (e.g., 0). That is, when the device is powered on for the first time (or powered on again after power-off), the flag register will automatically return to the first value. The flag register is not affected by the system reset operation of the device. That is, when the device is restarted (system reset) during operation, the state of the flag register will not be reset. For example, if it was previously set to 1, it will still be 1 after the reset. Just like a switch that has been manually turned to a certain position, even if it is restarted, the switch will not automatically jump back to the initial position and can maintain the previous selection. For example, the flag register can be an independent register unit in the device hardware circuit or a dedicated register integrated into the main controller.

[0044] Flash memory is a long-term storage module for electronic devices, used to store the old firmware required for the device to start normally, that is, the firmware from the last successful boot, and is the default firmware source for the device; for example, it can be an SPI Flash (Serial Peripheral Interface Flash) or NAND Flash (NAND-type Flash Memory) storage chip.

[0045] It should be noted that the electronic devices described in the embodiments of the present invention can be hardware devices that need to update firmware online, such as PCIe expansion cards, industrial control modules, and network communication devices. They are also applicable to electronic devices deployed in remote scenarios where on-site operation is inconvenient.

[0046] See Figure 2 , Figure 2 This is a flowchart of a firmware update fault tolerance method provided by an embodiment of the present invention. The firmware update fault tolerance method is implemented by the main controller in the above-mentioned electronic device and includes steps S1 to S5.

[0047] S1. In response to the device startup operation, read the status of the flag register.

[0048] For example, the startup operation refers to the triggering event that causes the device to load firmware and initialize hardware, including the device's first power-on startup, system-wide reset startup (such as a restart triggered by a host resetting command or a restart triggered by a device malfunction), and restarts actively triggered during the firmware update process, as well as all operations that require loading firmware from the storage medium to complete the startup. The state of the flag register refers to its two pre-configured switchable states, namely a preset first value and a second value, for example, the first value is 0 and the second value is 1. This state is used to indicate the firmware loading path of the main controller. The first value corresponds to the default path of loading old firmware from flash memory, and the second value corresponds to the update verification path of loading new firmware from the storage unit. This state is not affected by the system reset operation and only returns to the first value when the device is powered off.

[0049] S2. If the state of the flag register is a preset first value, load the old firmware from the flash memory and start the device based on the old firmware; wherein, the old firmware is the firmware applied by the device during the last successful startup.

[0050] For example, if the flag register is in the first value, it means that the device does not need to perform new firmware verification at present and should run according to the default boot logic. The old firmware stored in the flash memory is a valid firmware that has been verified in practice, that is, the firmware that successfully booted and completed all hardware initializations last time. At this time, the main controller first reads the complete code data of the old firmware from the flash memory, including the hardware initialization program, the device function operation program, etc. Then, the main controller executes the old firmware code line by line, and completes the initialization configuration of the core hardware modules, the establishment of peripheral interface links, etc., in sequence, so that the device can reach a normal working state. The entire boot process is consistent with the boot logic under the normal working scenario of the device, ensuring the stability and compatibility of the device operation.

[0051] S3. If the state of the flag register is a preset second value, load the new firmware from the storage unit and start the device using the new firmware.

[0052] For example, if the flag register is in the second value, it indicates that the device has received the firmware update instruction and the host has written the new firmware to be verified into a separate storage unit. The new firmware's boot verification process needs to be executed. At this time, the main controller skips the default flash boot path and preferentially accesses the storage unit independent of flash memory to read the complete new firmware data temporarily stored therein. Subsequently, the main controller, according to the execution logic of the new firmware, sequentially attempts to complete the initialization of core hardware modules, the establishment of peripheral links, and functional self-tests, thereby attempting to boot the device to a normally functioning state to verify the validity and compatibility of the new firmware. It should be noted that this process does not affect the integrity of the old firmware in flash memory, providing a guarantee for the rollback mechanism in case of subsequent boot failures.

[0053] S4. Obtain the startup result when the new firmware starts the device.

[0054] For example, the startup result indicates whether the new firmware can successfully drive the device to complete hardware initialization and functional readiness verification, reflecting the compatibility of the new firmware. The startup result includes two scenarios: successful device startup and device startup failure. If the new firmware can execute completely and meet the preset readiness conditions, it is determined that the device has started successfully. The preset readiness conditions may include: all core hardware modules (such as PCIe interface, DDR, PLL) have completed initialization configuration, the device peripheral links (such as PCIe communication links) are established normally, the host can successfully enumerate the device, and the device can respond to basic control commands issued by the host, etc. If any of the above readiness conditions are not met during the execution of the new firmware, it is determined that the device has started unsuccessfully, and the device cannot enter the normal working state.

[0055] S5. If the startup result indicates that the device has failed to start, set the status of the flag register to the first value.

[0056] For example, when a new firmware fails to boot, such as due to core hardware module initialization failure or the host's inability to enumerate devices, it indicates that the new firmware has compatibility defects, logical errors, or configuration anomalies, making it unable to support normal device operation. In this case, the main controller forcibly sets the flag register from the second value to the first value, i.e., switching back from the new firmware verification path to the default old firmware boot path, executing an automatic failure rollback mechanism. This mechanism ensures that when the device restarts subsequently, the main controller will read the first value of the flag register and automatically switch to the old firmware boot path in flash memory, avoiding repeated boot failures or even a locked state due to invalid new firmware. It should be noted that this state reset operation is not affected by subsequent system resets; a single setting is sufficient to solidify the default boot logic until the host initiates a new firmware update command and resets the flag register to the second value. This logic ensures rapid recovery capability after device failure without affecting the subsequent normal firmware update process.

[0057] In this embodiment of the invention, by executing the above steps S1 to S5, when a firmware burning error occurs, the boot path can be switched via the flag register to read the accurate old firmware from the flash memory. This allows the device to resume normal boot logic after restarting, preventing erroneous firmware from causing continuous failures in PCIe interface initialization and improving the reliability of online firmware updates. Furthermore, when the new firmware fails to boot, the flag register is automatically reset to its first value. After the device restarts, it can directly load the previously successfully booted old firmware from the flash memory, ensuring the device quickly resumes normal operation and avoiding a cycle of unrepairable issues due to PCIe interface initialization failures. Simultaneously, by completing fault tolerance and recovery through an online process, device maintenance costs are significantly reduced, and the convenience of firmware updates is improved.

[0058] Furthermore, after performing step S4, the method further includes: if the startup result indicates that the device has started successfully, writing the new firmware into the flash memory, and configuring the state of the flag register from the second value to the first value; wherein, when writing the new firmware into the flash memory, the new firmware replaces the old firmware stored in the flash memory.

[0059] For example, when the boot result indicates that the device has booted successfully, it means that the logical integrity, hardware compatibility, and functional effectiveness of the new firmware have been verified through actual operation and can be used as the firmware version for the device's subsequent stable operation. At this time, the main controller will perform a closed-loop operation of new firmware fixation and state reset. First, the new firmware temporarily stored in the storage unit is completely written to the flash memory. During the writing process, the original old firmware in the flash memory is replaced by a full overwrite method. The old firmware, as a historical valid version, has completed its mission, and the new firmware officially becomes the default boot firmware of the device. At the same time, the main controller configures the state of the flag register from the second value back to the first value, indicating that it is switching from the new firmware verification path back to the default boot path. This process is essentially the fixation of the verified version, which ensures that the new firmware is stored for a long time and allows the device to return to the default logic for subsequent boots, so that it can run stably based on the new firmware without additional intervention.

[0060] In this embodiment of the invention, the design of verifying firmware before solidifying it achieves a secure closed loop for firmware updates, preventing invalid firmware from being written to flash memory. Only new firmware that has been verified through actual booting is solidified as the default version, eliminating subsequent boot failures caused by hidden defects in the new firmware from the source. Furthermore, this invention can automatically and smoothly replace old firmware with new firmware, achieving iterative upgrades without manual intervention and improving update efficiency. Moreover, after the flag register is reset to the first value, subsequent device boots directly load the new firmware from flash memory, maintaining the simplicity and efficiency of the conventional boot process, balancing update security and device operational stability, and solving the problem of device boot failure caused by overwriting firmware without verification in existing technologies.

[0061] Furthermore, before performing step S1, the method further includes: receiving new firmware in response to a firmware burning operation; writing the new firmware into the storage unit and configuring the state of the flag register to a second value; wherein, when writing the new firmware into the storage unit, the new firmware replaces the original firmware stored in the storage unit.

[0062] For example, when the host initiates a firmware flashing operation, the device responds to the operation and receives the new firmware data transmitted by the host. This new firmware data includes hardware drivers, functional programs, and configuration parameters. Since the storage unit supports overwrite functionality, when the device writes the new firmware to the storage unit, it directly overwrites any remaining original firmware to complete the firmware replacement process. If the original firmware was faulty and failed to be verified during the previous update, the new firmware will overwrite this faulty firmware during the writing process, ensuring that the storage unit only retains the latest firmware to be verified, thus preventing historical data from interfering with the current update process. Simultaneously, the main controller configures the flag register from a first value to a second value, indicating a switch from the default old firmware boot path to the new firmware verification path. This configuration is unaffected by subsequent system resets, providing a basis for accurately locating the new firmware loading path after the device restarts. The entire process achieves secure temporary storage of the new firmware and pre-switching of the boot path without modifying the old firmware stored in the flash memory, ensuring the security of the device's original normal operating capabilities.

[0063] In this embodiment of the invention, the new firmware is temporarily stored in a separate storage unit, avoiding the risk of directly overwriting the old firmware in the flash memory with the unverified new firmware, ensuring that the old firmware always exists as a safety fallback version. Furthermore, the overwrite mechanism effectively removes historical residual firmware from the storage unit, preventing verification failures caused by data mixing between the old and new firmware, and ensuring the accuracy of the new firmware verification.

[0064] See Figure 3 , Figure 3 This is another flowchart of a fault-tolerant firmware update method provided in an embodiment of the present invention, which is described below in conjunction with... Figure 3 The above steps S1 to S5 will be explained in detail, with the first value being 0 and the second value being 1. The process includes the following steps:

[0065] 1. Initial startup phase;

[0066] The device boots using the old firmware in flash memory by default. At this time, the flag register is 0, and the device completes a normal boot and enters the working state.

[0067] 2. Determine whether to perform firmware flashing;

[0068] The device continuously monitors whether the host initiates a new firmware flashing operation; if the host does not initiate flashing, the process remains in the current state, i.e., the device is operating normally; if the host initiates flashing, proceed to step 3.

[0069] 3. New firmware temporary storage and status switching;

[0070] The host transmits the new firmware to the device, and the device writes the new firmware to a separate storage unit, overwriting the original data in the storage unit. At the same time, the status of the flag register is configured from 0 to 1, completing the pre-switching of the new firmware temporary storage and boot path.

[0071] 4. Trigger device restart;

[0072] After the new firmware is temporarily stored and the status is configured, the device will restart and enter the new firmware verification process.

[0073] 5. Read the status of the flag register;

[0074] After the device restarts, it first reads the status of the flag register. At this time, the status is 1, which means that the new firmware in the storage unit needs to be loaded.

[0075] 6. Load the new firmware and boot;

[0076] The device loads the new firmware from the storage unit according to the flag register state 1, and starts the device according to the logic of the new firmware, while obtaining the startup result;

[0077] 7. Determine the boot result of the new firmware;

[0078] If the device boots successfully, the new firmware in the storage unit is written to the flash memory, replacing the old firmware. At the same time, the state of the flag register is reset from 1 to 0. After the process is completed, the device will run normally based on the new firmware. If the device boots unsuccessfully, the state of the flag register is directly reset from 1 to 0. When the device restarts in the future, it will automatically switch to loading the old firmware from the flash memory to ensure that the device returns to normal operation.

[0079] Furthermore, the fault-tolerant firmware update method described in the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable file, or some intermediate form. The computer-readable medium can include any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium, etc.

[0080] Furthermore, the present invention also provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the fault-tolerant firmware update method as described in any of the above embodiments.

[0081] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A fault-tolerant method for firmware updates, characterized in that, include: In response to the device's startup operation, read the status of the flag register; If the state of the flag register is a preset first value, the old firmware is loaded from the flash memory, and the device is started based on the old firmware; wherein, the old firmware is the firmware applied when the device was last successfully started; If the state of the flag register is a preset second value, load the new firmware from the storage unit and start the device using the new firmware; Obtain the boot result when the device is booted with the new firmware; If the startup result indicates that the device has failed to start, the state of the flag register is set to the first value; If the startup result indicates that the device has started successfully, the new firmware is written to the flash memory, and the state of the flag register is configured from the second value to the first value; wherein the new firmware replaces the old firmware stored in the flash memory.

2. The fault-tolerant method for firmware updates as described in claim 1, characterized in that, Prior to the device startup operation, the method further includes: In response to firmware flashing operations, receive new firmware; The new firmware is written to the storage unit, and the state of the flag register is configured to the second value.

3. The fault-tolerant method for firmware updates as described in claim 2, characterized in that, When the new firmware is written to the storage unit, the new firmware replaces the original firmware stored in the storage unit.

4. The fault-tolerant method for firmware updates as described in claim 1, characterized in that, The flag register has read and write attributes, its default value in the initial state is the first value, and the flag register is not affected by the system reset operation of the device.

5. The fault-tolerant method for firmware updates as described in claim 1, characterized in that, The storage unit is a storage module independent of the flash memory, and the stored content of the storage unit is not affected by the system reset operation of the device.

6. An electronic device, characterized in that, Includes a main controller and flash memory, storage units, and a flag register respectively connected to the main controller, wherein the main controller is configured to: In response to the device startup operation, the state of the flag register is read; If the state of the flag register is a preset first value, the old firmware is loaded from the flash memory, and the device is started based on the old firmware; wherein, the old firmware is the firmware applied by the device during the last successful startup; If the state of the flag register is a preset second value, new firmware is loaded from the storage unit, and the device is started using the new firmware; Obtain the boot result when the device is booted with the new firmware; If the startup result indicates that the device has failed to start, the state of the flag register is set to the first value; If the startup result indicates that the device has started successfully, the new firmware is written to the flash memory, and the state of the flag register is configured from the second value to the first value; wherein the new firmware replaces the old firmware stored in the flash memory.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device on which the computer-readable storage medium resides to perform a fault-tolerant firmware update method as described in any one of claims 1 to 5.

8. A computer program product, characterized in that, It includes computer instructions that, when executed by a processor, implement the fault-tolerant method for firmware updates as described in any one of claims 1 to 5.

Images