Non-inductive OTA upgrading method for escalator main program

Abstract

The invention discloses a non-inductive OTA upgrading method for a main program of an escalator, which comprises the following steps: determining whether the main program needs to be upgraded, the main program being a main program running in a main control electronic unit of the escalator, and the main program being stored in a first program area in a memory of the main control electronic unit; when it is determined that the main program needs to be upgraded, interruption operation is stopped, and the interruption operation is a mechanism for stopping the main program from executing predetermined services triggered by hardware or signals; skipping to an SRAM (Static Random Access Memory) of the main control electronic unit, running the upgraded main program through address remapping, and storing the upgraded main program in a second program area in the memory; and starting an interruption operation. In the process of running the main program in the first program area through the main control electronic unit, when it is determined that the main program needs to be upgraded, the main program upgraded in the second program area is run through address remapping by skipping to the SRAM, resetting and electrifying of the escalator are not needed, and non-inductive upgrading of the main program of the escalator is achieved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of escalator control, and in particular to a method for non-sensing OTA upgrade of an escalator main program. BACKGROUND

[0002] The control system of an escalator includes a main control electronic unit (ECU) and an upgrade module (which usually adopts over-the-air technology (OTA), and can also be referred to as an "OTA module"). The upgrade module is responsible for downloading programs from a server and upgrading the main program of the main control electronic unit.

[0003] In related existing software OTA upgrades, the common technical point is that the actual upgrade behavior occurs in the Bootloader program running at the time of next power-on, and the new program is guided by the Bootloader. Users cannot immediately experience new function upgrades and bug fixes in operation, such as Chinese patent document 1 (CN119668646A) and Chinese patent document 2 (CN119127246A). This mode can only meet the OTA upgrade needs of new energy vehicles and ordinary electronic devices. After the software download is completed, the user can restart the device within the agreed time to complete the upgrade. However, in the use scenario of an escalator, some rail transit and commercial escalators require 24-hour operation. Since the opening and stopping of the escalator require a special key and will affect the normal operation of the escalator, it has always been a major problem for OTA upgrade of escalator software. If upgrading is required in this working condition, it cannot be reset to enter the Bootloader program, that is, it requires true "non-sensing upgrade". This requires that the upgrade behavior cannot affect the high-performance motor control algorithm, and the existing technology obviously cannot meet this requirement.

[0004] Chinese patent document 3 (CN120491989A) discloses a hot update method for partial code, which stores multiple versions of software data in memory to realize arbitrary jumping of a single-chip microcomputer in multiple software. This scheme requires software to be saved in memory. At present, the storage space of most MCU on-chip SRAM is very limited, and the memory resources are relatively tight. If an external memory solution is used, it will increase the access delay of the memory, or occupy a large number of available pins of the MCU. Therefore, in the OTA upgrade of escalator software, this scheme cannot meet the needs of non-sensing upgrade, and is not applicable to existing products.

[0005] Therefore, how to upgrade the main program without interrupting the operation of the escalator is a technical problem currently faced. SUMMARY

[0006] To solve the above technical problems, the application provides a non-inductive OTA upgrading method for an escalator main program, comprising:

[0007] determining whether the main program needs to be upgraded, the main program running in a master control electronic unit of the escalator, the main program being stored in a first program area of a memory of the master control electronic unit;

[0008] stopping an interrupt operation when it is determined that the main program needs to be upgraded, the interrupt operation being a mechanism for stopping the main program from executing a predetermined service triggered by hardware or a signal;

[0009] jumping to the SRAM of the master control electronic unit to run the upgraded main program through address remapping, the upgraded main program being stored in a second program area of the memory;

[0010] starting the interrupt operation.

[0011] Preferably, the determination of whether the main program needs to be upgraded comprises: determining whether an upgrade identifier exists; determining that the main program needs to be upgraded when it is determined that the upgrade identifier exists; and further comprising: clearing the upgrade identifier after jumping to the SRAM of the master control electronic unit to run the upgraded main program through address remapping.

[0012] Preferably, the code executed in the jumping to the SRAM of the master control electronic unit to run the upgraded main program through address remapping is written when the escalator is powered on.

[0013] Preferably, all global variable addresses in the main program are fixed, and the main function address is fixed.

[0014] Preferably, before the determination of whether the main program needs to be upgraded, the method further comprises: receiving an upgrade instruction sent by an upgrade module of the escalator; erasing the main program stored in the second program area according to the upgrade instruction; obtaining upgrade data from the upgrade module; upgrading the main program through the upgrade data to obtain the upgraded main program stored in the second program area.

[0015] Preferably, the upgrade data has been encrypted.

[0016] Preferably, the obtaining of the upgrade data from the upgrade module comprises: downloading the upgrade data from the upgrade module to the memory in the form of multiple data packets through CAN communication.

[0017] Preferably, the upgrading of the main program through the upgrade data comprises: decrypting the multiple data packets to obtain a main program to be verified stored in the second program area; performing a hash check on the main program to be verified, and determining the main program to be verified as the upgraded main program if the check is successful.

[0018] Preferably, the step of performing hash verification on the main program to be verified includes: calculating the hash value of the main program to be verified; if the calculated hash value is the same as the hash value stored in the main program to be verified, then the verification is determined to be successful.

[0019] Preferably, after upgrading the main program using the upgrade data, the method further includes: generating an upgrade identifier, which is used to instruct the main program running in the first program area to perform an upgrade.

[0020] Preferably, the main program includes multiple modules; before determining whether the main program needs to be upgraded, the process further includes: receiving an upgrade instruction sent by the upgrade module of the escalator; identifying modules that need to be upgraded and modules that do not need to be upgraded; erasing the second program area; copying the modules that do not need to be upgraded from the first program area to the second program area; obtaining the upgrade data of the modules that need to be upgraded and downloading it to the second program area to obtain the upgraded main program.

[0021] Preferably, before determining whether the main program needs to be upgraded, the process further includes:

[0022] Determine whether the main program needs initialization;

[0023] When it is determined that the main program needs to be initialized, the interrupt operation is stopped;

[0024] Jump to SRAM to run the preparatory program through address remapping. The preparatory program is stored in the second program area. The preparatory program is the main program with the minimum capacity to support the escalator's journey.

[0025] The initialization operation is performed by running the preparatory program, during which redundant variables in the main program are cleared to zero.

[0026] Preferably, determining whether the main program needs to be initialized includes: determining whether an initialization flag exists; when the initialization flag exists, determining that the main program needs to be initialized.

[0027] Preferably, the initialization operation by running the preparatory program includes:

[0028] The data between the old BSS segment data and the new BSS segment data in the BSS segment is cleared to zero. The old BSS segment data is used to indicate the size of the memory required by the current BSS segment when compiling the main program, and the new BSS segment data is used to indicate the size of the memory of the BSS segment of the upgraded main program.

[0029] Preferably, after performing the initialization operation by running the preparatory program, the method further includes: clearing the initialization flag.

[0030] Compared with the prior art, the present invention has at least the following advantages:

[0031] During the execution of the main program in the first program area by the main control electronic unit, when it is determined that an upgrade of the main program is needed, it jumps to the second program area to run the upgraded main program. Since this jump process is implemented in SRAM through address remapping, it is not necessary to reset the escalator and power it on. This allows for upgrading the main program at any time without interrupting escalator operation. Furthermore, it eliminates the time required for the power-on self-test phase after power-on, reducing upgrade time.

[0032] Meanwhile, by storing the unupgraded main program in the first program area and the upgraded main program in the second program area, it is possible to back up the old main program without using external storage media. When the new main program malfunctions, it can be quickly restored to the old main program, reducing the safety risks of the escalator failing to operate properly due to the upgraded program. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in the specific embodiments of this application or the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0034] Figure 1 This is the escalator main program upgrade flowchart of Example 1;

[0035] Figure 2 This is the program upgrade flowchart in the main program area B of Example 1. Detailed Implementation

[0036] The following specific embodiments illustrate the implementation of the present invention. Those skilled in the art can fully understand other advantages and technical effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through different specific embodiments, and the details in this specification can also be applied based on different viewpoints, with various modifications or changes made without departing from the overall design concept of the invention. It should be noted that, unless otherwise specified, the following embodiments and features can be combined with each other. The following exemplary embodiments of the present invention can be implemented in many different forms and should not be construed as being limited to the specific embodiments set forth herein. It should be understood that these embodiments are provided to make the disclosure of the present invention thorough and complete, and to fully convey the technical solutions of these exemplary embodiments to those skilled in the art.

[0037] Example 1

[0038] The escalator contains several electronic control units, including at least one main control electronic unit and one OTA module. The OTA module is responsible for downloading programs from a cloud server and upgrading the main program of the main control electronic unit.

[0039] The seamless OTA upgrade method for the escalator main program provided in this embodiment is applied to the aforementioned escalator system. In this embodiment and subsequent embodiments, main program area A corresponds to the first program area in the claims, main program area B corresponds to the second program area in the claims, and the OTA module corresponds to the upgrade module.

[0040] This embodiment is applicable to main control electronic units with MCUs that support Dual-Bank architecture and address remapping. Apart from the necessary buffer (no more than 1KB) required for upgrades, it does not consume memory resources.

[0041] In this embodiment, the internal Flash memory of the MCU is divided into main program area A and main program area B. All global variables in the main program have fixed addresses and the main function has a fixed address. Static global variables are not allowed. The main program always runs in main program area A. The exchange between main program area A and main program area B is achieved by address remapping technology.

[0042] This embodiment uses bare metal (without an operating system) and implements software control logic through interrupt service routines (ISRs) and high-precision timers. The main program is an infinite loop, but the upgrade flag FLAG_NEW is checked in the loop.

[0043] The main program upgrade process is as follows: Figure 1As shown, the MCU checks whether the upgrade flag FLAG_NEW is valid in the main program (i.e., infinite loop). If it is valid, all interrupts are disabled and the program jumps to the SRAM program area S to continue execution (FLASH operations cannot be performed during address remapping, so SRAM must be used).

[0044] The SRAM program area S contains fixed code, which is written by the MCU when it is powered on.

[0045] The work of SRAM program area S includes: performing address remapping, swapping main program area A with main program area B; and returning to the main program to continue execution.

[0046] After the MCU finishes executing the SRAM program area S, it clears the upgrade flag FLAG_NEW, restores all interrupts, and continues the infinite loop.

[0047] This embodiment requires the MCU to enable either a software watchdog or a hardware watchdog to prevent the MCU from becoming unrecoverable due to upgrade anomalies, thus ensuring the security of the seamless OTA upgrade process.

[0048] The new program data is generated by encrypting the original program data through AES segments. Before encryption, a hash value should be calculated and stored at the end of the original program data.

[0049] The program upgrade process in main program area B is as follows: Figure 2 As shown.

[0050] After receiving the upgrade command from the OTA module, the MCU erases the main program area B in the internal Flash (erasing and writing to another BANK in the Dual-Bank architecture will not affect the reading / execution of the current BANK).

[0051] The MCU downloads new program data from the OTA module to the main program area B in the internal Flash via CAN communication. The new program data has been encrypted in segments using the AES algorithm (this is just an example, and the specific encryption algorithm used is not limited to this).

[0052] The download process requires dividing the program into packets, each 256 bytes. After receiving the data packets, the MCU decrypts them and writes the data sequentially into the main program area B in the internal Flash memory.

[0053] After receiving all data packets, the MCU reads the program data from the main program area B in the internal Flash and calculates the hash. It then compares the hash with the hash value at the end of the program. If the comparison fails, the upgrade stops and an upgrade failure signal is sent to the OTA module.

[0054] If no errors occur during the above steps, then the upgrade flag FLAG_NEW in memory is set to valid.

[0055] Wait for the MCU to complete all interrupt handling and return to the main program, identify the upgrade flag FLAG_NEW, and complete the swap between main program area A and main program area B.

[0056] Before and after the above operations, the MCU's data registers remain unchanged, the memory data remains unchanged, and the program execution context remains unchanged. However, the program code in the interrupt service routine has been updated, the OTA upgrade is complete, and an upgrade success message is sent to the OTA module.

[0057] For safety reasons, an exception flag FLAG_ERR should be set and reset in case of abnormal interrupts such as hardware error interrupts. When the program detects that the exception flag FLAG_ERR is valid during initialization, it checks whether the program in the current main program area B is valid (by verifying the hash value at the end of the program). If valid, it switches to the backup program in the main program area B and continues execution, sending an upgrade failure message to the OTA module.

[0058] This embodiment requires that the initialization of all global variables be performed manually, and that the code be written in accordance with the specifications, taking into account the possible impact of the old variable values ​​under different processing logics when the program switches.

[0059] In this embodiment, the escalator can be upgraded via OTA during normal operation without affecting the control process or status output, thus enabling OTA upgrades for some escalators that operate 24 hours a day.

[0060] If the software has a multi-module structure, the upgrade process can be followed to improve OTA upgrade efficiency.

[0061] Suppose the software has several modules Mod1, Mod2, ..., Modn, and each module has a corresponding software version Ver1, Ver2, ..., Vern;

[0062] The OTA module reads the current software version from the MCU, compares it with the software version that needs to be upgraded, and determines the modules Modk1, Modk2, ..., Modkn that need to be upgraded in this OTA and the modules Mods1, Mods2, ..., Modsn that do not need to be upgraded.

[0063] The OTA module sends an erase command to the MCU, and the MCU erases the main program area B after receiving the erase command.

[0064] The OTA module sends a copy command to the MCU. After receiving the copy command, the MCU copies the modules that do not need to be upgraded, Mods1, Mods2, ..., Modsn, from the main program area A to the main program area B.

[0065] The OTA module sends a data transmission command to the MCU to download the modules that need to be upgraded, Modk1, Modk2, ..., Modkn, to the main program area B. Then, the standard OTA process of this embodiment can be executed normally.

[0066] Example 2

[0067] This embodiment is a further optimization of the scheme in Embodiment 1, and is implemented based on the scheme given in Embodiment 1.

[0068] In Example 1, all global variables need to be retained when the new software is compiled to avoid exceptions when the control logic uses global variables. However, as a result, the number of global variables will only gradually increase with program upgrades, and some useless global variables will still occupy memory resources. To address this problem, this example provides the following solution.

[0069] The execution state of the MCU in the main program is divided into the following three stages: initialization stage, execution stage, and update stage.

[0070] During the initialization phase, the initialization flag FLAG_INIT is continuously checked in an infinite loop. If the initialization flag FLAG_INIT is valid, the initialization work is performed. This phase is different from the initialization of the BSS segment when the MCU starts up. It is mainly a process of clearing and re-initializing some old variables that are no longer used.

[0071] The execution phase, i.e., the normal program execution, continuously checks the upgrade flag FLAG_NEW in an infinite loop, as described in Example 1.

[0072] During the update phase, i.e., the OTA upgrade process, the main program area A and the main program area B are swapped, as described in Example 1.

[0073] Each time the compiler is compiled, the current BSS segment size is written at the specified location BSS_BOT.

[0074] Before upgrading to the new program, prepare a backup program. This backup program is the minimum program that supports the necessary functions of the current escalator. Calculate the required BSS segment size BSS_SIZE_B for the new program and fill in the initialization code into the backup program.

[0075] After the preparatory program is upgraded according to the process described in Example 1, the initialization flag FLAG_INIT is set to valid, and the program waits to enter the initialization phase. Initialization operations are performed by running the preparatory program, including: clearing the data between the old and new BSS segment data in the BSS segment. The old BSS segment data indicates the size of the memory required by the current BSS segment when compiling the main program, and the new BSS segment data indicates the size of the memory required by the upgraded main program's BSS segment.

[0076] More specifically, during the initialization phase, the size of the BSS segment stored at the current BSS_BOT is taken as BSS_SIZE_A. All data in the BSS segment from index BSS_SIZE_A to index BSS_SIZE_B is cleared to zero, and the pre-filled initialization code is executed. After completion, the initialization flag FLAG_INIT is cleared.

[0077] After the preparatory program runs normally, upgrade the new program according to the process described in Example 1.

[0078] After the new program upgrade is completed, there is no need to enter the initialization phase. The modified and added global variables have already been initialized by the preparatory program, thereby completing the deletion of obsolete global variables.

[0079] The present invention has been described in detail above through specific embodiments and examples, but these are not intended to limit the invention. Many modifications and improvements can be made by those skilled in the art without departing from the principles of the invention, and these should also be considered within the scope of protection of the present invention.

Claims

1. A method for inattentive OTA upgrade of an escalator main program, characterized by, The method comprises the following steps: determining whether the main program needs to be upgraded, the main program being run in a main control electronic unit of an escalator, the main program being stored in a first program area in a memory of the main control electronic unit; stopping an interrupt operation when it is determined that the main program needs to be upgraded, the interrupt operation being a mechanism for stopping the main program from performing a predetermined service triggered by hardware or a signal; jumping to an SRAM of the main control electronic unit to run the upgraded main program through address remapping, the upgraded main program being stored in a second program area in the memory; starting the interrupt operation.

2. The upgrade method of claim 1, wherein, The step of determining whether the main program needs to be upgraded comprises the following steps: determining whether an upgrade identifier exists; and 3. The upgrade method of claim 2, wherein, when it is determined that the upgrade identifier exists, determining that the main program needs to be upgraded.

4. The upgrade method of claim 1, wherein, After jumping to the SRAM of the main control electronic unit to run the upgraded main program through address remapping, the method further comprises the following step:

5. The upgrading method according to any one of claims 1 to 3, characterized by, clearing the upgrade identifier. The code executed in the step of jumping to the SRAM of the main control electronic unit to run the upgraded main program through address remapping is written when the escalator is powered on. All global variable addresses in the main program are fixed, and the main function address is fixed. Before the step of determining whether the main program needs to be upgraded, the method further comprises the following steps: receiving an upgrade instruction sent by an upgrade module of the escalator; 6. The upgrade method of claim 5, wherein, erasing the main program stored in the second program area according to the upgrade instruction; 7. The upgrade method of claim 6, wherein, obtaining upgrade data from the upgrade module; and 8. The upgrade method of claim 7, wherein, upgrading the main program through the upgrade data, so that the upgraded main program is stored in the second program area. The upgrade data has been encrypted. The step of obtaining upgrade data from the upgrade module comprises the following step:

9. The upgrade method of claim 8, wherein, downloading the upgrade data from the upgrade module to the memory in the form of multiple data packets through CAN communication. The step of upgrading the main program through the upgrade data comprises the following steps: decrypting the multiple data packets, so that a to-be-verified main program is stored in the second program area; 10. The upgrade method of claim 9, wherein, performing a hash check on the to-be-verified main program, and determining that the to-be-verified main program is the upgraded main program if the hash check is successful. The step of performing a hash check on the to-be-verified main program comprises the following steps:

11. The upgrading method according to any one of claims 1 to 3, characterized by, calculating a hash value of the to-be-verified main program; and determining that the hash check is successful if the calculated hash value is the same as a hash value stored in the to-be-verified main program. After the step of upgrading the main program through the upgrade data, the method further comprises the following step: generating an upgrade identifier, the upgrade identifier being used to indicate that the main program run in the first program area is upgraded. The main program comprises multiple modules. Before the step of determining whether the main program needs to be upgraded, the method further comprises the following steps: receiving an upgrade instruction sent by an upgrade module of the escalator; 12. The upgrading method according to any one of claims 1 to 3, characterized by, identifying modules that need to be upgraded and modules that do not need to be upgraded; erasing the second program area; copying the modules that do not need to be upgraded from the first program area to the second program area; obtaining upgrade data of the modules that need to be upgraded and downloading the upgrade data to the second program area, so that the upgraded main program is obtained. Before the step of determining whether the main program needs to be upgraded, the method further comprises the following steps: determining whether the main program needs to be initialized; stopping the interrupt operation when it is determined that the main program needs to be initialized; The jump to the SRAM runs a preparation program through address remapping, the preparation program is stored in the second program area, and the preparation program is a main program with the smallest support capacity for the escalator journey operation; Initialization is performed by running the preparation program, and during the initialization, redundant variables in the main program are cleared.

13. The upgrade method of claim 12, wherein, The determination of whether the main program needs to be initialized includes: Determining whether an initialization identifier exists; When it is determined that the initialization identifier exists, it is determined that the main program needs to be initialized.

14. The upgrade method of claim 13, wherein, The initialization operation by running the preparation program includes: Old BSS segment data and new BSS segment data in the BSS segment are cleared, the old BSS segment data is used to indicate the size of the required memory of the current BSS segment when the main program is compiled, and the new BSS segment data is used to indicate the size of the memory of the BSS segment of the upgraded main program.

15. The upgrade method of claim 14, wherein, After the initialization operation by running the preparation program, the initialization identifier is also cleared.

Images