Method and system for upgrading BOOT of electric energy meter

Abstract

The invention is suitable for the technical field of intelligent electric meters, and provides an electric energy meter BOOT upgrading method and system, and the system comprises a metering core which employs a Cortex-M0 + core and is used for executing the electric energy metering; the communication core adopts a Cortex-M0 core, is independent of the metering core and is used for processing a communication task and managing firmware upgrade; wherein the metering core and the communication core perform data interaction through an SPI interface to form a function decoupling hardware architecture, a multi-channel fusion upgrade architecture is constructed, multiple communication modes such as 4G, power line carrier, infrared and MBUS are integrated, and flexible selection and redundant backup of firmware transmission paths are realized; the technical bottleneck that the metering function is easily interfered in the upgrading process is broken through, and it is ensured that the electric energy metering precision is kept stable in the firmware updating period.

Description

Technical Field

[0001] This invention relates to the field of smart meter technology, specifically a method and system for upgrading the BOOT of an electricity meter. Background Technology

[0002] Current electricity meter firmware upgrade technology faces systemic challenges posed by the traditional single-core architecture. The core issue lies in the forced interruption of metering functions during the upgrade process, leading to a series of technical defects and application problems. Specifically, these manifest as three key pain points: First, the metering accuracy is seriously inaccurate. Industry test data shows that the metering error of mainstream brand electricity meters during the upgrade period is as high as ±0.5%, which far exceeds the national standard limit and directly affects the fairness of billing. Secondly, there is the sampling distortion caused by communication interference. High-volume data transmission such as carrier communication can significantly interfere with the ADC sampling circuit, causing a significant error of up to 2.3% in voltage sampling offset, which further aggravates the measurement deviation. Finally, there is the clock synchronization interruption. The suspension of the RTC real-time clock calibration mechanism during the upgrade process directly affects the accuracy of time-of-use billing, and has caused several electricity bill disputes in practical applications.

[0003] Existing solutions such as dual-buffered storage technology can partially alleviate the problem, but there is still a risk of data loss at the second level, and it cannot solve the metering distortion problem caused by communication interference. This technical deficiency not only affects the fairness of billing, but also significantly increases operation and maintenance costs. Each upgrade failure requires manual on-site handling, with a single cost of up to 200 yuan.

[0004] Therefore, in view of the above situation, there is an urgent need to provide an upgrade method and system for the BOOT of electricity meters to overcome the shortcomings in current practical applications. Summary of the Invention

[0005] The purpose of this invention is to provide a method and system for upgrading the BOOT of an electricity meter, aiming to solve the problems mentioned in the background art.

[0006] This invention is implemented as follows: an upgrade system for an electricity meter BOOT, comprising: The metering core, using a Cortex-M0+ core, is used to perform electrical energy metering; The communication core, using a Cortex-M0 core, is independent of the metering core and is used to handle communication tasks and manage firmware upgrades. The metering core and the communication core interact with each other via an SPI interface, forming a functionally decoupled hardware architecture.

[0007] As a further aspect of the present invention, it also includes an isolated power supply system, the power supply system comprising: The first LDO regulator provides power to the metering core; The second LDO regulator, independent of the first LDO regulator, provides power to the communication core. The first LDO regulator and the second LDO regulator are isolated in the power domain through a DC-DC isolation module.

[0008] As a further aspect of the present invention: the ADC sampling circuit of the metering core integrates a magnetic coupler isolator for blocking interference signals generated on the communication side from being transmitted to the metering circuit.

[0009] The present invention also provides a method for upgrading the BOOT of an energy meter based on the above system, comprising the following steps: The communication core receives upgrade data packets via multi-channel communication. During the upgrade process, the metering core continues to perform the power metering task, while the communication core independently processes the upgrade task. After the upgrade is complete, the system will restart to run the new version of the BOOT program.

[0010] As a further aspect of the present invention: during the upgrade process, dynamic resource scheduling is implemented, specifically including: The metering core periodically samples the CPU load rate; When the load rate sampled multiple times exceeds the first threshold, a communication rate reduction strategy is triggered to reduce the communication rate of the communication core or suspend non-critical communication tasks. When the load rate falls below the second threshold, normal communication configuration is restored.

[0011] As a further aspect of the present invention: when the metering core continuously performs the electricity metering task, a dual-buffer mechanism is adopted for metering data protection, wherein the dual buffer includes buffer A and buffer B, specifically as follows: Buffer A serves as the real-time write area, where the metering core writes real-time metering data; Buffer B serves as a synchronization backup area, copying data from buffer A through a timed synchronization mechanism. After the data is copied from buffer A to buffer B, the checksum of the data in buffer B is calculated and stored.

[0012] As a further aspect of the present invention: during the upgrade process, an independent RTC chip is used and periodically clock-synchronized with the metering core via an SPI interface to eliminate clock drift caused by the upgrade process.

[0013] As a further aspect of the present invention, the upgrade data packet adopts a dual signature verification mechanism during transmission, requiring dual verification by both the manufacturer's signature and the device's signature.

[0014] As a further aspect of the present invention: the upgrade data packet is encrypted using the AES-128 algorithm during storage, and the encryption key is stored in the OTP security area of ​​the device.

[0015] As a further aspect of the present invention: after receiving upgrade data, the communication core calculates its hash value and compares it with the hash value pre-stored by the metering core. Only after passing the consistency verification can the upgrade process be started.

[0016] Compared with the prior art, the beneficial effects of the present invention are as follows: By employing dual-core physical isolation and hardware isolation technologies, the interference of the upgrade process on the metering function is completely eliminated, significantly reducing the metering error during the upgrade from ±0.5% in the traditional scheme to within ±0.05%.

[0017] Dynamic resource scheduling and dual-buffered data hot migration technology ensure the stability of the system during the upgrade process, reduce the upgrade failure rate to an extremely low level (>99.5% success rate), and eliminate the risk of second-level data loss.

[0018] Through multiple encryption and verification mechanisms (dual signature, AES-128, SHA-256), an end-to-end security protection system is built to effectively prevent unauthorized firmware injection and data tampering.

[0019] An independent clock synchronization mechanism ensures the accuracy of the RTC clock during the upgrade process, guaranteeing the precision of time-of-use billing. Attached Figure Description

[0020] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0021] Figure 1 This is a flowchart of the normal operation of this system.

[0022] Figure 2 A flowchart for firmware upgrades.

[0023] Figure 3 This is the architecture diagram of this system. Detailed Implementation

[0024] The technical solution of the present invention will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0025] The present invention will be further explained below with reference to specific embodiments.

[0026] Please see Figure 3 The present invention provides an upgrade system for a power meter BOOT, comprising: The metering core, using a Cortex-M0+ core, is used to perform electrical energy metering; The communication core, using a Cortex-M0 core, is independent of the metering core and is used to handle communication tasks and manage firmware upgrades. The metering core and the communication core interact with each other via an SPI interface, forming a functionally decoupled hardware architecture.

[0027] In a more specific example, an isolated power supply system is also included, which includes: The first LDO regulator provides power to the metering core; The second LDO regulator, independent of the first LDO regulator, provides power to the communication core. The first LDO regulator and the second LDO regulator are isolated in the power domain through a DC-DC isolation module; The ADC sampling circuit of the metering core integrates a magnetic coupler isolator to block interference signals generated on the communication side from being transmitted to the metering circuit.

[0028] In embodiments of this invention, the hardware architecture of this system is based on the core design concept of "functional separation + physical isolation," and constructs a secure boundary for metering resources and upgrade communication through dual-core heterogeneous division of labor and multi-level isolation technology. The specific implementation is as follows: Dual-core heterogeneous division of labor: The Cortex-M0+ core is used as the metering core, which is responsible for the core function of electricity metering; the communication core uses the Cortex-M0 core and independently undertakes the upgrade communication task, forming a "metering-communication" functional decoupled architecture, which avoids interference with metering accuracy during the upgrade process from the source.

[0029] The independent power supply system adopts a dual LDO separation design. The metering core is equipped with an RT9193-18GB low-dropout regulator (the first LDO regulator), with an input voltage range of 2.5-5.5V and a stable output of 1.8V / 300mA DC power, with a ripple factor of <5mV, ensuring a clean power supply for the metering circuit. The communication core uses an XC6206P332MR LDO regulator (the second LDO regulator), with an output of 3.3V / 200mA power and overcurrent protection. The two power systems are completely independent. For signal transmission isolation, the ADC sampling circuit integrates a Silicon Labs Si8641 magnetic coupler isolator, using magnetic isolation technology to block the transmission path of interference signals from the communication side to the metering circuit. Power domain isolation uses a B0505S-1WDC-DC isolation module to achieve a 3000VAC isolation voltage between the two power systems, effectively eliminating ground loop interference and further enhancing electromagnetic compatibility.

[0030] To ensure stable operation and data reliability during the BOOT upgrade process of the electricity meter, the system has constructed a closed-loop control logic of "load monitoring - resource scheduling - data protection - clock synchronization". Through three core mechanisms, dynamic bandwidth allocation, double buffer data protection and high-precision clock synchronization, multi-dimensional collaborative management and control are achieved.

[0031] The system establishes a flexible scheduling mechanism for communication resources, using CPU load monitoring as the core trigger condition. The metering core uses a system tick timer to sample load at 10ms intervals and calculates the real-time load rate (i.e., the ratio of idle task runtime to the sampling period) using the idle task runtime percentage method. When the load rate is >60% for three consecutive samplings, a communication speed-down strategy is automatically triggered: the UART communication rate is reduced from 115200bps to 50Kbps, and the MBUS protocol heartbeat packet transmission is suspended at 5-second intervals. When the load rate falls back to <40% and there is no communication restriction flag, normal communication configuration is restored (UART rate returns to 115200bps, and MBUS heartbeat packet transmission is restarted). To ensure the priority of the core metering function, the system sets the priority of the metering sampling task to level 0, which is higher than all communication tasks (levels 3-5), ensuring that metering data collection is not affected during peak load periods.

[0032] At the data protection level, the system employs a dual-buffer architecture to achieve secure backup and migration of real-time data. Buffer A is the real-time write area (addresses 0x20000000-0x200000FF, capacity 256 bytes), allowing only the metering core to write; buffer B is the synchronous backup area (addresses 0x20000100-0x200001FF, capacity 256 bytes), configured as read-only to prevent accidental tampering. Both maintain data consistency through a 50ms timed synchronization mechanism, the specific process of which is as follows: Disabling global interrupts → Copying data from area A to area B → Calculating the CRC16 checksum of the first 254 bytes of area B and storing it in the last 2 bytes → Restoring global interrupts. This process can effectively avoid interrupt conflicts during data transmission.

[0033] To eliminate the impact of the upgrade process on the accuracy of time-of-use metering, the system employs an independent RTC chip (such as the RX8025T) and a dual-core SPI synchronization protocol to construct a clock calibration system. During the upgrade, the main core performs clock calibration with the independent RTC chip every 100ms via the SPI interface, ensuring that the deviation between the metering core and the external clock source is controlled within microseconds. This solution, through a hardware-level clock synchronization mechanism, effectively avoids clock drift issues caused by software upgrades, guaranteeing the timestamp accuracy of the time-of-use metering data.

[0034] To ensure the security and reliability of the entire BOOT upgrade process for the electricity meter, this device constructs a four-dimensional security verification system encompassing "transmission-storage-verification-recovery," achieving end-to-end protection of upgrade data through multi-layered protection mechanisms. For transmission layer security, a dual-signature verification mechanism is employed, requiring upgrade data to undergo dual verification through both the manufacturer's signature and the device's signature. This eliminates the risk of unauthorized firmware injection at the source, ensuring the integrity and legitimacy of data during transmission. Storage layer security is achieved through the AES-128 encryption algorithm. Upgrade data packets are encrypted during the storage phase, and the encryption key is permanently stored in the device's OTP (One-Time Programmable) security area, effectively preventing key tampering or extraction. This provides dual protection for the confidentiality of stored data from both the physical and logical layers. Verification layer security relies on the SHA-256 hash algorithm to construct a verification mechanism. The specific process is as follows: after receiving the upgrade data, the communication core calculates its SHA-256 hash value and then compares it with the hash value pre-sent by the metering core. Consistency verification ensures that the received data has not been tampered with or damaged, forming a cross-core security verification closed loop.

[0035] refer to Figure 3 This clearly demonstrates the modular design philosophy of the equipment. At its core is a base meter, serving as the connection and dispatch hub, uniformly receiving data input from various communication modules (including infrared, 4G, MBUS, RS485, RS232, and carrier waves). Based on this, the system innovatively adopts a dual-core collaborative architecture, clearly separating tasks: the communication core is dedicated to processing uplink and downlink data across all communication links, and focuses on the critical function of "receiving communication upgrade files"; while the independent metering core is dedicated to "metering backup," ensuring the security and accuracy of core metering data. This design achieves physical isolation and specialized processing of communication management and metering tasks at the hardware level, significantly improving the system's real-time performance, reliability, and the security of upgrades and maintenance.

[0036] Please see Figures 1-3This invention also provides a method for upgrading the BOOT of an energy meter based on the above-described system, comprising the following steps: The communication core receives upgrade data packets via multi-channel communication. During the upgrade process, the metering core continues to perform the power metering task, while the communication core independently processes the upgrade task. After the upgrade is complete, the system will restart to run the new version of the BOOT program.

[0037] In a more specific example, during the upgrade process, dynamic resource scheduling is implemented, which includes: The metering core periodically samples the CPU load rate; When the load rate sampled multiple times exceeds the first threshold, a communication rate reduction strategy is triggered to reduce the communication rate of the communication core or suspend non-critical communication tasks. When the load rate falls below the second threshold, normal communication configuration is restored.

[0038] In a more specific example, when the metering unit continuously performs the electricity metering task, a dual-buffer mechanism is used to protect the metering data. The dual buffer includes buffer A and buffer B, specifically: Buffer A serves as the real-time write area, where the metering core writes real-time metering data; Buffer B serves as a synchronization backup area, copying data from buffer A through a timed synchronization mechanism. After the data is copied from buffer A to buffer B, the checksum of the data in buffer B is calculated and stored.

[0039] In a more specific example, during the upgrade process, an independent RTC chip is used to periodically synchronize the clock with the metering core via an SPI interface to eliminate clock drift caused by the upgrade process.

[0040] In a more specific example, the upgrade data packet employs a dual-signature verification mechanism during transmission, requiring dual verification through both the manufacturer's signature and the device's signature; The upgrade data packet is encrypted using the AES-128 algorithm during storage, and the encryption key is stored in the device's OTP security area.

[0041] In a more specific example, after receiving the upgrade data, the communication core calculates its hash value and compares it with the hash value pre-stored by the metering core. Only after passing the consistency check can the upgrade process be started.

[0042] In this embodiment of the invention, the RN8302 (Cortex-M0+ core) is used as the metering core, operating at a clock frequency of 48MHz, configured with 32KB Flash and 8KB SRAM, responsible for metering data acquisition and processing; the RN8615 (Cortex-M0 core) is used as the communication core, operating at a clock frequency of 30MHz, configured with 16KB Flash and 4KB SRAM, responsible for multi-channel communication and firmware upgrade management. The two cores interact with each other through an internal SPI interface, with a communication rate set to 2Mbps, and CRC16 checksum is used to ensure data transmission reliability.

[0043] This method ensures the stability and security of the upgrade process through dynamic resource scheduling and secure transmission mechanisms. The key sub-processes are as follows: Load sampling: CPU load rate is collected every 10ms. When the sampling value is >60% for 3 consecutive times, a rate reduction strategy is triggered (UART communication rate is reduced to 50Kbps and MBUS heartbeat packet transmission is suspended). Recovery mechanism: When the load rate is consistently below 40%, automatically restore UART to the default rate (115.2Kbps) and restart the MBUS heartbeat (cycle 1 second). Priority configuration: Set the load monitoring task to priority level 0 (highest) to ensure that the control response latency is <1ms.

[0044] To ensure uninterrupted service during the upgrade process, a dual-buffer (Area A: 0x20000000-0x200001FF; Area B: 0x20000200-0x200003FF) data hot migration technology is adopted. Synchronization cycle: A full data copy from area A to area B is performed every 50ms. During the synchronization process, CPU-free transmission is achieved through DMA channel 1. Verification mechanism: CRC16 verification (polynomial 0x8005) is performed on the data blocks before and after migration, and a 3-retry mechanism is triggered when the verification fails. Upgrade preparation: After verification, the data in area B will be encrypted and written to the Flash upgrade area (starting from address 0x08040000, capacity 64KB).

[0045] The encrypted transmission of the upgraded firmware is achieved through hardware acceleration and secure storage. Key management: The AES-128 key is stored in the OTP (One-Time Programmable) secure area (address 0x1FFF7800-0x1FFF780F), and cannot be read or modified after being written. Encryption process: The firmware data received by the communication core is encrypted with AES-128 (ECB mode) through the hardware encryption engine, and the encryption result is transmitted to the Flash backup area through DMA channel 2. Integrity verification: After the data is written, the communication core calculates the SHA-256 hash value of the firmware data and compares it with the hash value brought by the upgrade package. If they match, the upgrade process is started.

[0046] Through the coordinated design of the above hardware configuration and software process, this device can realize safe, efficient and uninterrupted upgrade of the electricity meter firmware. Key performance indicators include: upgrade success rate >99.5%, average upgrade time <8s, and maximum communication latency <50ms.

[0047] refer to Figure 1 and Figure 2 This fully demonstrates the collaborative data protection mechanism of a dual-core electricity meter system under both normal operation and firmware upgrade states. During normal system operation, a 50-millisecond synchronization timer periodically triggers an interrupt. Upon interruption, the process immediately disables global interrupts to prevent task switching and thus avoid data conflicts. It then copies 256 bytes of real-time data from buffer A to buffer B, calculates the CRC16 checksum of the first 254 bytes, stores it at the end, and finally restores the global interrupt and returns, repeating this cycle to ensure continuous hot backup of the running data. When the communication core initiates a firmware upgrade request, an independent upgrade protection process is initiated: the metering core first checks the current CPU load. If the load is confirmed to be below 50%, it pauses the normal data synchronization task, encrypts the data in buffer B, and securely transmits the encrypted data to the fixed backup area of ​​Flash via the DMA channel. Afterward, the communication core calculates the SHA-256 hash value of the received data and compares it with the hash value pre-stored by the metering core. Only after the verification is completely consistent and the data is confirmed to be complete and error-free will the firmware upgrade begin; otherwise, the process will be aborted and an error will be reported. This mechanism ensures that core data is continuously and securely protected, whether in dynamic operation or before critical upgrades.

[0048] In summary, this invention achieves significant technological breakthroughs and economic benefits through innovative technical solutions, demonstrating comprehensive advantages in the BOOT upgrade process of electricity meters. Within the operating temperature range of -25℃ to +55℃ specified in the IEC 62053-21:2020 standard, this invention achieves performance improvements unmatched by traditional solutions through three core technologies: Metering resource hard isolation technology: controlling voltage / current sampling accuracy within ±0.05% during the upgrade, an order of magnitude improvement over the traditional ±0.5% (IEC 62053-21 standard limit), eliminating the risk of metering data tampering due to communication core anomalies at the hardware level; Dynamic bandwidth control method: under full-load upgrade scenarios, the metering cycle error can be controlled within 10μs, while increasing the communication core resource utilization rate to 95%, solving the resource allocation conflict problem in traditional solutions; Real-time hot migration technology for metering data: ensuring data loss of <0.001kWh after upgrade failure, completely eliminating the second-level data loss risk present in traditional double-buffering solutions.

[0049] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. An upgrade system for an electricity meter BOOT, characterized in that, include: The metering core, using a Cortex-M0+ core, is used to perform electrical energy metering; The communication core, using a Cortex-M0 core, is independent of the metering core and is used to handle communication tasks and manage firmware upgrades. The metering core and the communication core interact with each other via an SPI interface, forming a functionally decoupled hardware architecture.

2. The upgrade system for the electricity meter BOOT according to claim 1, characterized in that, It also includes an isolated power supply system, which comprises: The first LDO regulator provides power to the metering core; The second LDO regulator, independent of the first LDO regulator, provides power to the communication core. The first LDO regulator and the second LDO regulator are isolated in the power domain through a DC-DC isolation module.

3. The upgrade system for the electricity meter BOOT according to claim 2, characterized in that, The ADC sampling circuit of the metering core integrates a magnetic coupler isolator to block interference signals generated on the communication side from being transmitted to the metering circuit.

4. A method for upgrading the BOOT of an electricity meter based on the system described in any one of claims 1-3, characterized in that, Includes the following steps: The communication core receives upgrade data packets via multi-channel communication. During the upgrade process, the metering core continues to perform the power metering task, while the communication core independently processes the upgrade task. After the upgrade is complete, the system will restart to run the new version of the BOOT program.

5. The method for upgrading the BOOT of an electricity meter according to claim 4, characterized in that, During the upgrade process, dynamic resource scheduling is implemented, specifically including: The metering core periodically samples the CPU load rate; When the load rate sampled multiple times exceeds the first threshold, a communication rate reduction strategy is triggered to reduce the communication rate of the communication core or suspend non-critical communication tasks. When the load rate falls below the second threshold, normal communication configuration is restored.

6. The method for upgrading the BOOT of an electricity meter according to claim 4, characterized in that, When the metering unit continuously performs electricity metering tasks, a dual-buffer mechanism is used to protect the metering data. The dual buffer includes buffer A and buffer B, specifically: Buffer A serves as the real-time write area, where the metering core writes real-time metering data; Buffer B serves as a synchronization backup area, copying data from buffer A through a timed synchronization mechanism. After the data is copied from buffer A to buffer B, the checksum of the data in buffer B is calculated and stored.

7. The method for upgrading the BOOT of an electricity meter according to claim 4, characterized in that, During the upgrade process, an independent RTC chip is used to periodically synchronize the clock with the metering core via the SPI interface to eliminate clock drift caused by the upgrade process.

8. The method for upgrading the BOOT of an electricity meter according to claim 4, characterized in that, The upgrade data packet employs a dual-signature verification mechanism during transmission, requiring dual verification through both the manufacturer's signature and the device's signature.

9. The method for upgrading the BOOT of an electricity meter according to claim 4, characterized in that, The upgrade data packet is encrypted using the AES-128 algorithm during storage, and the encryption key is stored in the device's OTP security area.

10. The method for upgrading the BOOT of an electricity meter according to claim 4, characterized in that, After receiving the upgrade data, the communication core calculates its hash value and compares it with the hash value pre-stored in the metering core. Only after passing the consistency check can the upgrade process be started.

Images