A wireless upgrade method

Abstract

This invention discloses a wireless upgrade method applied to a microcontroller. The method is based on a dual-bootstrap architecture, dividing the microcontroller's storage space into a first bootstrap area, a second bootstrap area, and an application area. Upon system startup, the first bootstrap reads the wireless upgrade identifier and performs integrity checks on each program area. Based on the check results, it selectively jumps to the second bootstrap or the application. The second bootstrap is used to complete the wireless upgrade and verification of the application, and the application supports wireless upgrades to the second bootstrap during normal operation. Through the coordinated control of the upgrade identifier and verification mechanism, recoverable wireless upgrades are achieved in case of upgrade anomalies, improving the reliability of the wireless upgrade process and the stability of system operation.

Description

Technical Field

[0001] This invention relates to the field of wireless upgrade technology for embedded systems, and in particular to a wireless upgrade method. Background Technology

[0002] With the continuous development of IoT and wireless communication technologies, an increasing number of terminal electronic devices are adopting microcontrollers (MCUs) as their core control units and remotely upgrading their programs wirelessly to meet needs such as functional expansion, performance optimization, and defect repair. Wireless upgrade methods (such as OTA upgrades) can reduce manual maintenance costs, improve device maintainability and lifespan, and have been widely used in various embedded systems.

[0003] Existing wireless upgrade solutions typically employ a structure combining a bootloader and an application (APP). The bootloader handles system startup, application verification, and application upgrades, while the application implements the specific functionalities. In practical applications, common wireless upgrade structures primarily include a single bootloader structure, where the system has only one bootloader area and one application area, with the bootloader performing wireless upgrades on the application.

[0004] However, the aforementioned single-bootloader wireless upgrade solution still has certain limitations in practical use. On the one hand, when the bootloader itself has defects or requires functional optimization, it is usually difficult to upgrade the bootloader wirelessly. On the other hand, if an anomaly occurs during the bootloader upgrade process, such as upgrade interruption, write error, or verification failure, the bootloader may fail to run normally, thus preventing the device from restarting the upgrade process and ultimately causing device failure, requiring on-site maintenance or hardware recovery.

[0005] To address these issues, some existing technologies propose wireless upgrade schemes that incorporate a dual-bootstrap architecture. By setting up two bootstrap zones, the reliability of system upgrades can be improved. However, existing dual-bootstrap schemes still have shortcomings in the division of responsibilities among the bootstraps and the upgrade control logic. For example, there is a lack of effective upgrade coordination mechanisms between the bootstraps and applications, and the upgrade status management is unclear, which may still lead to the system being unable to recover wirelessly under certain abnormal conditions.

[0006] Therefore, how to ensure stable upgrades of the application program and reliable upgrades of the bootloader during the wireless upgrade process of a microcontroller, and how to maintain recovery capability in the event of upgrade anomalies, through reasonable program structure division and upgrade control mechanism, has become a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0007] In view of the problem that abnormal bootloader upgrades in existing wireless upgrade technologies may prevent devices from being restored wirelessly, the purpose of this invention is to provide a wireless upgrade method that, by constructing a dual bootloader structure and introducing an upgrade identifier and integrity verification mechanism, enables reliable upgrades and secure jumps of application programs and bootloaders, thereby improving the reliability of the wireless upgrade process and the stability of system operation.

[0008] To achieve the above objectives, the present invention provides the following technical solution: In one possible implementation, a wireless upgrade method is provided, applied to a microcontroller (MCU). The wireless upgrade method is based on a dual-bootstrap architecture, wherein the MCU's storage space is at least divided into a first bootstrap area, a second bootstrap area, and an application area. The method includes: The MCU is started by the first boot program in the first boot program area, and the wireless upgrade identifier is read; Based on the wireless upgrade identifier and the verification result of the corresponding storage area, selectively jump to execute the second bootloader or the application program; When the second bootloader is executed, it performs wireless upgrades and verifications of the application, and executes the application after the verification is successful. When the application is executed, it responds to the upgrade command during its operation and performs a wireless upgrade on the second bootloader.

[0009] In one possible implementation, the steps executed after the first bootloader starts include: Read the wireless upgrade identifier; When the wireless upgrade identifier indicates that an application upgrade is required, an integrity check is performed on the second bootloader area; If the verification passes, proceed to execute the second bootloader; If the wireless upgrade identifier does not indicate that the application needs to be upgraded, or if the second bootloader area verification fails, an integrity verification is performed on the application area.

[0010] In one possible implementation, when the integrity check of the application area passes, the first bootloader directly jumps to execute the application; If the integrity verification of the application area fails, the wireless upgrade identifier is set to the application upgrade identifier, and a software reset is performed.

[0011] In one possible implementation, the steps performed by the second bootstrap program include: Detect whether a wireless communication handshake for application upgrade has been established; Upon successful handshake, a wireless upgrade write operation is performed on the application area; After the upgrade is complete, the integrity of the application area is verified. When the verification passes, the application upgrade identifier in the wireless upgrade identifier is cleared, and the application is executed. If the verification fails, a software reset is performed.

[0012] In one possible implementation, the steps performed by the application during runtime include: Check if an application upgrade command has been received; Upon receiving an application upgrade instruction, the wireless upgrade identifier is set as the application upgrade identifier, and a software reset is performed; Check if a second bootloader upgrade command has been received; Upon receiving the second bootloader upgrade instruction, the wireless upgrade identifier is set as the second bootloader upgrade identifier, and a wireless upgrade write operation is performed on the second bootloader area.

[0013] In one possible implementation, the application performs an integrity check on the second bootloader area after completing the wireless upgrade of the second bootloader area; Upon successful verification, the identifier information corresponding to the second bootloader upgrade in the wireless upgrade identifier is cleared.

[0014] In one possible implementation, the first bootloader area, the second bootloader area, and the application area each store their corresponding verification codes for integrity verification after program jump or upgrade.

[0015] Based on the above technical solution, the present invention provides a wireless upgrade method that, by setting a dual bootloader structure in the microcontroller and combining an upgrade identifier and integrity verification mechanism, achieves reliable upgrades and secure jumps between the application program and the bootloader. This avoids the problem that abnormal bootloader upgrades can cause the device to fail to start the upgrade process or fail to recover wirelessly, thereby improving the reliability of the wireless upgrade process and the stability of system operation.

[0016] Specifically, the present invention manages the reading of upgrade identifiers and the integrity verification of each storage area in a unified manner during the system startup phase through a first boot program. Based on the verification results, it selectively jumps to a second boot program or application, thereby avoiding the risk of directly entering the execution of a failed program when the boot program or application is abnormal. At the same time, the second boot program is specifically responsible for the wireless upgrade and verification of the application, so that the upgrade process of the application has a clear control entry point and security verification process.

[0017] Furthermore, this invention supports wireless upgrades of the second bootloader during normal application operation, ensuring that even if the bootloader encounters defects or requires functional expansion, updates can still be completed wirelessly, thus avoiding the problem of device unrecoverability due to a single bootloader failure. Combined with a verification and upgrade flag clearing mechanism after each upgrade, it ensures that the program is in a controllable and verifiable state after each upgrade.

[0018] Through the above-mentioned technical means, the present invention effectively solves the technical problem that the device cannot be restored wirelessly after the boot program upgrade is abnormal in the existing wireless upgrade scheme, improves the security and reliability of the wireless upgrade process, reduces the cost of equipment maintenance and on-site intervention, and is suitable for microcontroller wireless upgrade scenarios with high requirements for system stability and remote maintenance capabilities. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the embodiments are briefly described below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a schematic diagram of the system structure of a wireless upgrade method provided in an embodiment of the present invention, used to illustrate the storage partitioning relationship of the first boot program area, the second boot program area, and the application program area in a microcontroller; Figure 2 This is a flowchart of the first boot program in a wireless upgrade method provided in an embodiment of the present invention, which is used to illustrate the upgrade identifier judgment, program verification and jump logic of the first boot program in the system startup phase; Figure 3 This is a flowchart illustrating the second bootstrap in a wireless upgrade method provided in an embodiment of the present invention, showing the control flow of the second bootstrap performing wireless upgrades and verifications on the application. Figure 4 This is a flowchart illustrating the application process in a wireless upgrade method provided in an embodiment of the present invention, showing the process of upgrading the application itself and the second bootloader during the application's operation. Detailed Implementation

[0021] The specific embodiments of the present invention will be further described in detail below with reference to the accompanying drawings. It should be understood that the following embodiments are specific descriptions of the technical solutions of the present invention without departing from the technical concept of the present invention, and are intended to help those skilled in the art understand and implement the present invention, rather than limiting the scope of protection of the present invention. After reading this specification, those skilled in the art can make various modifications or substitutions to the technical details of the specific embodiments without departing from the technical solutions defined by the claims of the present invention, and all such modifications or substitutions should fall within the scope of protection of the present invention.

[0022] In the following embodiments, the same or similar technical features are described using the same reference numerals. For any content not described in detail in each embodiment, please refer to the foregoing technical solutions and well-known technologies in the field.

[0023] I. General Description of Implementation Methods This invention provides a wireless upgrade method applicable to embedded devices with a microcontroller (MCU) as their core, suitable for application scenarios requiring remote upgrades of system programs wirelessly. This embodiment achieves secure and reliable upgrades of both the application program and the bootloader by constructing a dual-bootstrap architecture within the MCU.

[0024] like Figure 1 As shown, in this embodiment, the MCU's built-in storage space is divided into multiple independent data areas according to program functions, including at least a first boot program area (Boot1 area), a second boot program area (Boot2 area), and an application program area (APP area). Each storage area is physically or logically independent and is used to store the program code and related data required for different stages of operation.

[0025] The first bootloader area stores the first bootloader, which is primarily responsible for the initial startup control after system power-on or reset, reading the wireless upgrade identifier, and performing integrity checks on the second bootloader area and application area. Based on the check results and the upgrade identifier, it determines the program's jump direction. The first bootloader area also stores the wireless upgrade identifier, which indicates whether the current system is in an upgrade state and the type of program to be upgraded.

[0026] The second bootloader area is used to store the second bootloader and its corresponding verification code. After being executed by the first bootloader, the second bootloader is mainly responsible for the wireless upgrade operation of the application, including receiving upgrade data, writing the program, and verifying the integrity after the upgrade is completed. After the verification is successful, it jumps to the application to run.

[0027] The application area is used to store applications and their corresponding verification codes. The applications are used to implement the specific functions of the device. During normal operation, they are also used to detect wireless upgrade commands. When an upgrade request is detected, the application itself or the second bootloader is wirelessly upgraded by setting a wireless upgrade flag and cooperating with system reset.

[0028] Through the above-mentioned storage structure division and program function division, this embodiment utilizes the collaborative cooperation between the first boot program, the second boot program and the application program to construct a dual-boot program wireless upgrade architecture. This allows the system to still recover or upgrade again wirelessly in the event of an application program or boot program upgrade anomaly, thereby improving the reliability of the wireless upgrade process and the stability of system operation.

[0029] II. Implementation of the First Bootstrap Procedure In one embodiment of the present invention, the first boot program is stored in the first boot program area (Boot1 area) of the MCU, and is used to start and execute first after the system is powered on or a software reset occurs, so as to complete the upgrade judgment and program jump control during the system startup phase.

[0030] Specifically, after the MCU is powered on or reset, it first enters the execution flow of the first boot program. After the first boot program starts, it reads the wireless upgrade identifier stored in the first boot program area to determine whether the current system has an upgrade requirement and the type of program to be upgraded.

[0031] After reading the wireless upgrade identifier, the first bootloader first determines whether the identifier indicates that an application upgrade is needed. When the wireless upgrade identifier indicates that an application upgrade is needed, the first bootloader performs an integrity check on the program in the second bootloader area to determine whether the second bootloader is in a normal operating state. This integrity check can be achieved by comparing the calculated check value with a pre-stored checksum.

[0032] When the integrity verification of the second bootloader area passes, the first bootloader control program flow jumps to the second bootloader area to execute the second bootloader, which then continues to complete the wireless upgrade operation of the application.

[0033] If the wireless upgrade indicator does not indicate that an application upgrade is required, or if the integrity verification of the second bootloader area fails, the first bootloader further verifies the integrity of the application in the application area. If the integrity verification of the application area passes, the first bootloader controls the program flow to jump directly to the application area, execute the application, and enter the normal operating state of the device.

[0034] When the integrity check of the application area fails, the first bootloader determines that the current application cannot run normally. At this time, the first bootloader sets the wireless upgrade flag to the application upgrade flag and performs a software reset. Through the software reset, the MCU restarts and re-enters the execution flow of the first bootloader, thus creating conditions for the subsequent wireless upgrade of the application through the second bootloader.

[0035] Through the control flow of the first boot program, unified management of the upgrade status and effective judgment of program integrity are achieved during the system startup phase, avoiding direct entry into the execution of invalid programs in case of program abnormalities, and improving the reliability and security of the system's wireless upgrade process.

[0036] III. Implementation of the Second Boot Procedure In one embodiment of the present invention, the second bootloader is stored in the second bootloader area (Boot2 area) of the MCU and is selectively executed after the first bootloader completes the upgrade identifier judgment and integrity verification. The second bootloader is used to undertake the wireless upgrade control task of the application during the system upgrade phase.

[0037] Specifically, after the first boot program jumps to the second boot program based on the wireless upgrade identifier and verification result, the second boot program first performs initialization operations to establish the basic operating environment required for wireless upgrade, and then enters the application upgrade detection process.

[0038] After initialization, the second bootstrap program checks whether a wireless communication handshake has been established for application upgrades. This handshake confirms the successful establishment of a communication connection between the upgrade device and the device itself, ensuring that subsequent wireless upgrade data can be transmitted correctly. When a successful wireless communication handshake is detected, the second bootstrap program proceeds to the application's wireless upgrade process.

[0039] During the application's over-the-air upgrade process, the second bootloader receives the application's upgrade data wirelessly and writes the received upgrade data into the application area according to a predetermined writing strategy. During the writing process, the second bootloader stores the upgrade data sequentially to complete the overall update of the application.

[0040] After the application wireless upgrade is complete, the second bootloader performs an integrity check on the application in the application area to determine whether the upgraded application is complete and valid. This integrity check is achieved by comparing the calculated check value with a checksum pre-stored in the application area.

[0041] When the integrity verification of the application area passes, the second bootloader clears the identification information related to application upgrades from the wireless upgrade identifier, and controls the program flow to jump to the application area to execute the application, so that the system enters normal operation.

[0042] When the integrity verification of the application area fails, the second bootloader determines that the upgrade has not been completed successfully. At this time, the second bootloader performs a software reset operation, causing the MCU to restart and re-enter the execution flow of the first bootloader so that the wireless upgrade process can be triggered again in the future.

[0043] Through the implementation of the second bootstrap procedure described above, centralized management and verification control of the application wireless upgrade process are achieved, ensuring that the system can safely roll back and re-enter a controllable upgrade process in the event of an upgrade anomaly, thereby improving the reliability of wireless upgrades.

[0044] IV. Implementation of the Application In one embodiment of the present invention, the application program is stored in the application area (APP area) of the MCU and is used to implement the device's business functions during normal system operation. Simultaneously, the application program also undertakes some functions in the wireless upgrade control, used to trigger the wireless upgrade process of the application program itself or the second bootloader during operation.

[0045] Specifically, after the system passes the verification of the first or second bootloader and jumps to the application, the application enters normal operation and executes the corresponding application functions of the device. During normal operation, the application periodically or according to event triggering checks whether it has received a wireless upgrade command.

[0046] When the application detects an application upgrade command, it sets the wireless upgrade identifier as the application upgrade identifier to indicate that the system needs to perform a wireless upgrade. Subsequently, the application performs a software reset operation, causing the MCU to restart. After the reset, the first bootloader reads the wireless upgrade identifier, thereby entering the corresponding boot upgrade process.

[0047] During application execution, the application also detects whether an upgrade command from the second bootloader has been received. When a second bootloader upgrade command is detected, the application sets the wireless upgrade identifier to the second bootloader upgrade identifier and enters the wireless upgrade processing flow of the second bootloader.

[0048] During a wireless upgrade of the second bootloader, the application receives the upgrade data from the second bootloader via wireless communication and writes the upgrade data into the second bootloader area to complete the update. After the upgrade is completed, the application performs an integrity check on the program in the second bootloader area to determine whether the upgraded second bootloader is complete and valid.

[0049] When the integrity verification of the second bootloader area passes, the application clears the identification information corresponding to the second bootloader upgrade in the wireless upgrade identifier and returns to normal operation; when the verification fails, the application ends the current upgrade process, and the system re-triggers the corresponding upgrade process through subsequent procedures.

[0050] The above-described application implementation method enables wireless upgrades to the application itself or the second bootloader to be triggered during normal system operation, thereby achieving coordinated upgrades of the bootloader and the application, further improving the flexibility of the wireless upgrade process and the overall maintainability of the system.

[0051] V. Implementation Methods for Verification Mechanism and Upgrade Identifier Management In one embodiment of the present invention, to ensure the security and reliability of the wireless upgrade process, a corresponding verification code is provided in the first bootloader area, the second bootloader area, and the application area to verify the integrity of the programs in each storage area. The verification code is generated after the program is written and stored together with the corresponding program in the corresponding storage area.

[0052] During system operation, integrity verification is performed at multiple critical points during program jumps and wireless upgrades. Specifically, before the first bootloader determines the program jump, integrity verification is performed on the programs in the second bootloader area or application area to ensure that the program to be executed is in a valid state; after the second bootloader or application completes the wireless upgrade write operation, integrity verification is performed on the upgraded program to determine whether the upgrade was successfully completed.

[0053] The wireless upgrade identifier is uniformly stored in the first bootloader area, used to indicate the current system upgrade status and the type of program to be upgraded. The wireless upgrade identifier can be read and determined by the first bootloader, or it can be set or cleared by the second bootloader or application during operation. Through the setting and updating of the wireless upgrade identifier, upgrade status transmission and process coordination are achieved among the first bootloader, the second bootloader, and the application.

[0054] Specifically, when the application detects an upgrade request, it sets a wireless upgrade flag and, in conjunction with a software reset, enables the system to enter the corresponding upgrade process via the first bootloader after restarting. Once the second bootloader or application completes the upgrade and passes verification, it clears the wireless upgrade flag, indicating that the current system exits the upgrade state and enters the normal operation process.

[0055] Through the aforementioned verification mechanism and wireless upgrade identifier management method, the system can effectively judge and control the program status during the wireless upgrade process, preventing the execution of invalid programs in cases of incomplete programs or abnormal upgrades. Simultaneously, the coordinated operation of the verification mechanism and upgrade identifiers provides clear status indications and recoverability for the wireless upgrade process, thereby improving the reliability of the wireless upgrade process and the overall stability of the system operation.

[0056] VI. Summary of the Technical Effects of the Implementation Method As can be seen from the above specific embodiments, the wireless upgrade method provided by the present invention, by constructing a dual boot program structure consisting of a first boot program, a second boot program, and an application program in the microcontroller, and combining it with a wireless upgrade identifier and integrity verification mechanism, realizes hierarchical control and status management of the wireless upgrade process, effectively improving the reliability of the wireless upgrade process and the security of system operation.

[0057] Specifically, this implementation method uses a first bootloader to uniformly complete the upgrade status judgment and program integrity verification during the system startup phase, avoiding direct entry into the execution of invalid programs in case of program abnormalities; a second bootloader is specifically responsible for the wireless upgrade and verification of applications, so that the application upgrade process has a clear and controllable execution entry point; at the same time, by supporting wireless upgrades of the second bootloader during the normal operation phase of the application, the bootloader can still be upgraded wirelessly when defects occur or updates are needed.

[0058] By leveraging the setting, reading, and clearing mechanism of wireless upgrade identifiers, upgrade status information can be effectively transmitted between programs. In the event of upgrade anomalies or verification failures, the upgrade process can be re-entered through software reset, thereby enabling upgrade anomalies to be recoverable and preventing the device from becoming unusable due to upgrade failures.

[0059] Therefore, the specific implementation of the present invention improves the stability, maintainability and fault tolerance of the wireless upgrade system without increasing hardware costs, and is suitable for microcontroller application scenarios with high requirements for remote upgrade reliability.

[0060] It should be understood that the specific embodiments described above are merely preferred embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Those skilled in the art can make various modifications or substitutions to the above embodiments without departing from the technical concept of the present invention, and all modifications or substitutions falling within the scope of the claims of the present invention should be considered within the scope of protection of the present invention.

Claims

1. A wireless upgrade method, applied to a microcontroller (MCU), characterized in that, The wireless upgrade method is based on a dual-bootstrap architecture. The MCU's storage space is divided into at least a first bootstrap area, a second bootstrap area, and an application area. The method includes: The MCU is started by the first boot program in the first boot program area, and the wireless upgrade identifier is read; Based on the wireless upgrade identifier and the verification result of the corresponding storage area, selectively jump to execute the second bootloader or the application program; When the second bootloader is executed, it performs wireless upgrades and verifications of the application, and executes the application after the verification is successful. When the application is executed, it responds to the upgrade command during its operation and performs a wireless upgrade on the second bootloader.

2. The wireless upgrade method according to claim 1, characterized in that, The steps executed after the first bootloader starts include: Read the wireless upgrade identifier; When the wireless upgrade identifier indicates that an application upgrade is required, an integrity check is performed on the second bootloader area; If the verification passes, proceed to execute the second bootloader; If the wireless upgrade identifier does not indicate that the application needs to be upgraded, or if the second bootloader area verification fails, an integrity verification is performed on the application area.

3. The wireless upgrade method according to claim 2, characterized in that, When the integrity verification of the application area passes, the first bootloader directly jumps to execute the application. If the integrity verification of the application area fails, the wireless upgrade identifier is set to the application upgrade identifier, and a software reset is performed.

4. The wireless upgrade method according to claim 1, characterized in that, The steps performed by the second bootloader include: Detect whether a wireless communication handshake for application upgrade has been established; Upon successful handshake, a wireless upgrade write operation is performed on the application area; After the upgrade is completed, the integrity of the application area is verified. When the verification passes, the application upgrade identifier in the wireless upgrade identifier is cleared, and the application is executed. If the verification fails, a software reset is performed.

5. The wireless upgrade method according to claim 1, characterized in that, The steps performed by the application during its operation include: Check if an application upgrade command has been received; Upon receiving an application upgrade instruction, the wireless upgrade identifier is set as the application upgrade identifier, and a software reset is performed; Check if a second bootloader upgrade command has been received; Upon receiving the second bootloader upgrade instruction, the wireless upgrade identifier is set as the second bootloader upgrade identifier, and a wireless upgrade write operation is performed on the second bootloader area.

6. The wireless upgrade method according to claim 5, characterized in that, After completing the wireless upgrade of the second bootloader area, the application performs an integrity check on the second bootloader area. Upon successful verification, the identifier information corresponding to the second bootloader upgrade in the wireless upgrade identifier is cleared.

7. The wireless upgrade method according to claim 1, characterized in that, The first bootloader area, the second bootloader area, and the application area each store their corresponding verification codes, which are used to perform integrity verification after the program jumps or upgrades.

Images