A Method for Online Incremental Upgrade and Fault Rollback Protection of Industrial Controller Programs

Abstract

This invention discloses an online incremental upgrade and fault rollback protection method for industrial controller programs, relating to the field of industrial control technology. The method includes: obtaining the currently running program version and the target upgrade program version; dividing their binary image files into fixed-size data blocks; generating a unique feature fingerprint for each data block; identifying the target difference data block that changes only in the target upgrade program version through fingerprint comparison; transmitting the incremental upgrade package to the industrial controller; retaining a complete copy of all data blocks of the currently running program version in memory; simultaneously replacing the corresponding old data blocks in memory with the target difference data blocks from the incremental upgrade package to generate a new running program version; and directly jumping the program execution entry point from the current running program version to the new running program version to complete the online incremental upgrade. This method maintains a complete copy of the original program during the upgrade process and can automatically roll back if the new program malfunctions.

Description

Technical Field

[0001] This invention relates to the field of industrial control technology, specifically to a method for online incremental upgrade and fault rollback protection of industrial controller programs. Background Technology

[0002] During long-term operation, industrial controllers require periodic version upgrades of their internal programs due to functional optimization, vulnerability patching, or process adjustments. Existing upgrade methods typically generate a difference file between two complete program imagery versions, transmit this file to the controller, and then erase and rewrite the program storage area during shutdown or specific maintenance modes. This method generates a difference file based on byte streams. When partial insertions or deletions occur in the program structure, the difference file often contains a large amount of context data unrelated to the changes, resulting in redundant upgrade package size. Transmitting large amounts of redundant data not only consumes communication bandwidth but also prolongs the controller's upgrade window, increasing the risk of production interruption. Furthermore, traditional online upgrade processes often use in-situ overwrite methods. If a communication interruption or write anomaly occurs during the overwrite process, the program data in the controller's memory will be in an inconsistent state, a mixture of old and new versions, causing the device to fail to start or its execution logic to malfunction. Some solutions mitigate this risk by setting up a backup area, but the backup area requires a complete erase and write operation before a full program replacement, a time-consuming process that cannot immediately retain the previous stable version as a hot backup after the upgrade. If the controller malfunctions after the upgrade, manual intervention or external tools are usually required to restore the program to the old version, resulting in insufficient real-time and automation of fault recovery. Summary of the Invention

[0003] This application aims to address the problem of how to reduce the size of incremental upgrade packages when the program structure changes, as well as how to maintain the complete and runnable state of the previous version of the program during the upgrade process and immediately resume execution when the new version is abnormal.

[0004] The purpose of this invention is to provide an online incremental upgrade and fault rollback protection method for industrial controller programs, so as to reduce the size of the incremental upgrade package, maintain the complete and runnable state of the previous version of the program throughout the upgrade process, and realize immediate automatic recovery when the new version of the program is abnormal.

[0005] The objective of this invention can be achieved through the following technical solutions: This invention provides a method for online incremental upgrade and fault rollback protection of an industrial controller program, comprising the following steps: obtaining binary image files of the current running program version and the target upgrade program version of the industrial controller; dividing the binary image files of the two versions into multiple fixed-size data blocks to form a current version data block sequence and an upgrade version data block sequence; generating a unique data block feature fingerprint for each data block; identifying target difference data blocks that change only in the target upgrade program version by comparing the feature fingerprints of each data block in the upgrade version data block sequence with the feature fingerprints of each data block in the current version data block sequence; and extracting all target difference data blocks from the target upgrade program version. The method involves comparing the differences in the binary image file at the block level and transmitting only the changed data blocks. This significantly reduces the amount of data transmission and memory writes during the upgrade process. It ensures the continuous online operation of the industrial controller while completing the program upgrade. Furthermore, it utilizes the retained complete copy of the old version and the automatic fault rollback mechanism to effectively reduce upgrade risks and improve the reliability and maintainability of the industrial control system.

[0006] As a technical solution of the present invention, when segmenting the binary image file, the smallest storage unit size of the industrial controller is used as a fixed-size reference value, and the binary image file is segmented sequentially along the address order to obtain the current version data block sequence. and upgraded version data block sequence ,in: This indicates the version number of the currently running program. A fixed-size data block Indicates the version number of the target upgrade program. A fixed-size data block This represents the total number of data blocks in the current version. The total number of data blocks for the upgrade version; simultaneously, the start and end offset addresses of each data block in its respective binary image file are recorded, forming a data block location mapping table. When generating a unique data block feature fingerprint for each data block, the following is performed: Each data block in The corresponding feature fingerprint is obtained by applying the cyclic redundancy check algorithm. ,right Each data block in Obtain the corresponding feature fingerprint ,in: This represents the Cyclic Redundancy Check (CRC) function. The specific process for identifying the target difference data blocks is as follows: For each data block in the upgraded version data block sequence... to its characteristic fingerprint Feature fingerprints of all data blocks in the current version's data block sequence Compare them one by one; if at least one exists Make Then determine For non-differentiated data blocks; if for all All Then determine For the target difference data block; traverse After processing all data blocks, the complete target difference data block is obtained. Preferably, when... When the feature fingerprints of multiple data blocks in the current version's data block sequence are the same, select the one with the starting offset address that is the same as the feature fingerprint of the data block in the current version's data block sequence. The data block with the closest offset address is used as the matching non-differential data block, thereby further improving the accuracy of difference identification and avoiding misjudgment as no change due to the accidental identical content of data blocks in different locations.

[0007] During the transmission of incremental upgrade packets, the incremental upgrade packets are divided into multiple transmission frames. Each transmission frame includes a frame header, data payload, and frame trailer. The frame header contains the total frame sequence number and the current frame sequence number of the transmission frame in the incremental upgrade packet. The communication interface of the industrial controller sends each transmission frame sequentially. After sending the current transmission frame, it waits for the industrial controller to return an acknowledgment character. If an acknowledgment character is received within a preset timeout period, the next transmission frame is sent. If no acknowledgment character is received within the timeout period, the current transmission frame is retransmitted. The upgrade process is terminated and a communication failure is reported after the number of retransmissions reaches the preset retransmission limit. This ensures that the incremental upgrade data is delivered to the controller completely and reliably in the industrial field communication environment.

[0008] The program replacement operation in the industrial controller's memory specifically includes: establishing a first program storage area and a second program storage area in the industrial controller's memory. The first program storage area stores copies of all data blocks of the currently running program version. The second program storage area is initially empty and set to a non-executable state, preventing the central processing unit from reading instructions from the second program storage area. All data block copies from the first program storage area are copied to the second program storage area to form the program version to be updated. Based on the offset address information of each target difference data block carried in the incremental upgrade package, the corresponding old data block position is located in the program version to be updated in the second program storage area. The old data block is deleted and written to the target difference data block. After the data block replacement is completed, a new running program version is generated. Preferably, after the data block replacement is completed in the second program storage area, an overall checksum calculation is performed on the new running program version to obtain the actual checksum. ,in: This indicates the version number in the new running program. One data unit, The total number of data units. The modulus bit width of the checksum; the actual checksum Compared with the overall checksum preset in the incremental upgrade package Comparison is performed only when... If an error occurs, the second program storage area is set to an executable state; otherwise, the upgrade package or replacement process is deemed to have an error and the upgrade is terminated, thereby ensuring the integrity and correctness of the new running program version.

[0009] When the program execution jumps to the entry point, the target address value in the industrial controller's program counter is modified, changing it from the starting address of the current running program version to the starting address of the new running program version. Simultaneously, the industrial controller's interrupt vector table is locked, preventing any interrupt requests from being responded to during the program jump. After the program counter modification is complete and the central processing unit begins fetching instructions from the starting address of the new running program version, the interrupt vector table is unlocked, resuming normal response to interrupt requests. This process ensures the atomicity of the execution flow switch, preventing program crashes or inconsistent states caused by responding to interrupts during the jump.

[0010] In this invention, the data block feature fingerprint can also be a hash value generated based on a hash algorithm, i.e. , ,in: This indicates a preset hash function that uniquely identifies the content of each data block through its hash value, further enhancing collision prevention capabilities. During the operation of the newly upgraded program version, if a program execution error occurs or the preset watchdog timer times out, the industrial controller automatically redirects the program counter to the starting address of the current running program version stored in the first program storage area, resuming execution of the original program version. This achieves rapid, uninterrupted fault rollback, maximizing the continuity and security of the industrial control process.

[0011] The beneficial effects of this invention are: After obtaining the current running program version and the target upgrade program version of the industrial controller, the binary image files of both versions are divided into a fixed-size data block sequence based on the minimum storage unit size, and the offset address of each data block is recorded. A cyclic redundancy check (CRC) algorithm is applied to each data block of the current version and the upgrade version to generate a feature fingerprint. The feature fingerprints of each data block in the upgrade version's data block sequence are compared one by one with all feature fingerprints of the current version's data block sequence. If the feature fingerprint of the current data block is the same as that of any data block in the current version's sequence, its content is determined to be unchanged and it is not considered for upgrade. Only when the fingerprint does not match any data block in the current version is the data block identified as the target difference data block. Because the comparison granularity is based on fixed storage blocks rather than flowing byte differences, when program structure adjustments cause large offsets, only data blocks whose actual content has changed are identified and extracted. Unchanged data blocks are not repeatedly included, thus ensuring that the incremental upgrade package only contains the substantially changed parts, reducing the amount of data transmitted and shortening communication time. A first program storage area and a second program storage area are allocated in the memory of the industrial controller. The first program storage area stores a complete copy of all data blocks of the currently running program version, while the second program storage area is initially empty and set to a non-executable state. After completely copying all data block copies from the first program storage area to the second program storage area, the corresponding old data block is located and deleted in the second program storage area based on the offset address information of each target difference data block in the incremental upgrade package. Then, the target difference data block is written, and a new running program version is formed after the replacement is completed. During the entire replacement operation, the first program storage area always maintains the current running version without modification, and the program execution entry point of the industrial controller still points to the first program storage area. The controller is not affected by the writing process in the second program storage area. If an anomaly is detected or the watchdog timeout occurs during the operation of the new running program version, the program execution entry point can be directly pointed back to the first program storage area. Thus, without adding additional backup write operations, an instant rollback can be completed using the retained original version copy, avoiding the problems of program state inconsistency and recovery time. Attached Figure Description

[0012] The invention will now be further described with reference to the accompanying drawings.

[0013] Figure 1 This is a flowchart of the online incremental upgrade and fault rollback protection method for industrial controller programs; Figure 2 This is a flowchart of the incremental upgrade process for an industrial controller program; Figure 3 This is a flowchart of the industrial controller program version switching and interrupt management process; Detailed Implementation

[0014] See Figure 1 A method for online incremental upgrade and fault rollback protection of an industrial controller program is disclosed. The method involves obtaining the current running program version and the target upgrade program version of the industrial controller; comparing the binary image files of the two versions and dividing the binary image files into multiple fixed-size data blocks; generating a unique data block feature fingerprint for each data block; identifying target difference data blocks that only change in the target upgrade program version based on the data block feature fingerprint; extracting all target difference data blocks from the target upgrade program version and combining these target difference data blocks into an incremental upgrade package; transmitting the incremental upgrade package to the industrial controller through its communication interface; retaining a copy of all data blocks of the current running program version in the industrial controller's memory; and replacing the corresponding old data blocks in memory with the target difference data blocks from the incremental upgrade package to generate a new running program version; after the replacement is completed, directly jumping the program execution entry point of the industrial controller from the current running program version to the new running program version to complete the online incremental upgrade.

[0015] Obtain the minimum storage unit size of the industrial controller and use it as a fixed-size baseline. Using this baseline size as the unit, sequentially segment the binary image file of the currently running program version from beginning to end to obtain the current version's data block sequence. Similarly, using the baseline size as the unit, sequentially segment the binary image file of the target upgrade program version from beginning to end to obtain the upgrade version's data block sequence. Record the start and end offset addresses of each data block in the current version's data block sequence within the current running program version's binary image file, and record the start and end offset addresses of each data block in the upgrade version's data block sequence within the target upgrade program version's binary image file. Based on these records, form a data block location mapping table.

[0016] Apply a Cyclic Redundancy Check (CRC) algorithm to each data block in the current version data block sequence to obtain the feature fingerprint of each data block in the current version data block sequence; apply the CRC algorithm to each data block in the upgraded version data block sequence to obtain the feature fingerprint of each data block in the upgraded version data block sequence. Compare the feature fingerprint of the first data block in the upgraded version data block sequence with the feature fingerprints of all data blocks in the current version data block sequence one by one. If the feature fingerprint of the currently compared data block in the upgraded version data block sequence is the same as the feature fingerprint of any data block in the current version data block sequence, then the currently compared data block in the upgraded version data block sequence is determined to be a non-differential data block. If the feature fingerprint of the currently compared data block in the upgraded version data block sequence is different from the feature fingerprints of all data blocks in the current version data block sequence, then the currently compared data block in the upgraded version data block sequence is determined to be a target differentiable data block. Traverse all data blocks in the upgraded version data block sequence from the first data block to the last data block to obtain all target differentiable data blocks.

[0017] In some implementations, the Cyclic Redundancy Check (CRC32) algorithm is used.

[0018] During the comparison process, when the feature fingerprint of a data block in the upgraded version data block sequence is the same as the feature fingerprint of multiple data blocks in the current version data block sequence, the absolute value of the offset difference between the starting offset address of the data block in the upgraded version data block sequence and the starting offset address of each data block with the same feature fingerprint in the current version data block sequence is calculated. From these multiple data blocks with the same feature fingerprint in the current version data block sequence, the data block with the smallest absolute value of the offset difference is selected as the matching non-differential data block.

[0019] In practice, the incremental upgrade packet is divided into multiple transmission frames. Each transmission frame contains a frame header, a data payload, and a frame trailer. The frame header contains the total frame number and the current frame number. The total frame number indicates the total number of transmission frames formed after the incremental upgrade packet is divided, and the current frame number indicates the position number of the current transmission frame in the entire sequence of transmission frames.

[0020] Each transmission frame is sent sequentially through the industrial controller's communication interface. After sending the current transmission frame, the industrial controller's communication interface enters a waiting state, awaiting a confirmation character from the industrial controller. A preset timeout period is set; if a confirmation character is received from the industrial controller within the preset timeout period, the current transmission frame is considered successfully sent, and the next transmission frame is sent.

[0021] If no acknowledgment character is received from the industrial controller within the preset timeout period, the current transmission frame is determined to have failed, and a retransmission operation is performed. The number of retransmissions of the current transmission frame is recorded and compared with a preset retransmission limit. If the number of retransmissions is less than the preset retransmission limit, the current transmission frame is retransmitted and the system continues to wait for an acknowledgment character. If the number of retransmissions reaches the preset retransmission limit, the incremental upgrade packet transmission process is terminated, a communication failure report is generated, and the communication failure report is sent to the external monitoring system or host computer.

[0022] In some implementations, the preset timeout is set to 500 milliseconds, and the preset retransmission limit is set to 3 times. The reason for setting the preset timeout to 500 milliseconds is that, under normal communication load conditions, the round-trip time from receiving a transmission frame, completing verification, to returning an acknowledgment character is typically no more than 200 milliseconds. A preset timeout of 500 milliseconds can cover the normal round-trip time and leave a margin. The reason for setting the preset retransmission limit to 3 times is that in an industrial electromagnetic interference environment, three consecutive transmission failures indicate a persistent physical layer fault in the communication link. Continuing to retransmit cannot restore communication quality, requiring external intervention to troubleshoot the link problem.

[0023] During the process of dividing the incremental upgrade packet into multiple transmission frames, the data payload carries a segment of continuous binary data after the incremental upgrade packet has been divided. The frame tail contains a check field to verify the frame header and data payload. After receiving each transmission frame, the industrial controller performs integrity verification on the frame header and data payload based on the check field in the frame tail. If the verification passes, it extracts the total frame number and the current frame number from the frame header and returns an acknowledgment character.

[0024] See Figure 2 A first program storage area and a second program storage area are allocated in the random access memory (RAM) inside the industrial controller. The first program storage area stores copies of all data blocks of the currently running program version. The data block copies stored in the first program storage area are in an executable state, and the central processing unit of the industrial controller can read instructions from the first program storage area and execute them. The second program storage area is initially empty and does not contain any valid data.

[0025] The second program storage area is set to a non-executable state. This non-executable state is achieved by configuring the memory protection unit of the industrial controller. The memory protection unit sets the access attribute of the address range corresponding to the second program storage area to non-executable. When the program counter of the central processing unit points to the address range of the second program storage area, the memory protection unit triggers an access violation exception, preventing the central processing unit from reading instructions from the second program storage area.

[0026] Copy all data blocks of the currently running program version stored in the first program storage area one by one to the second program storage area. The copying process is performed sequentially according to the starting offset address of the data blocks in the binary image file, from smallest to largest. After the copying is completed, a program image that is completely identical to the currently running program version is formed in the second program storage area, and this program image is marked as the program version to be updated.

[0027] The offset address information corresponding to each target difference data block is extracted from the incremental upgrade package. The offset address information of each target difference data block includes the start offset address and end offset address of the target difference data block in the binary image file. Based on the start offset address and end offset address, the storage location of the old data block corresponding to the offset address range is located within the version of the program to be updated stored in the second program storage area.

[0028] The located old data block is deleted from the program version to be updated in the second program storage area. The deletion operation is completed by marking the data within the corresponding offset address range in the program version to be updated as invalid. The target difference data block corresponding to this offset address range in the incremental upgrade package is written to the offset address range corresponding to the deletion location in the second program storage area. The above location, deletion, and writing operations are performed on all target difference data blocks in the incremental upgrade package. After all data blocks are replaced, the program image stored in the second program storage area is transformed from the program version to be updated to the new running program version.

[0029] After replacing all data blocks in the second program storage area, a comprehensive checksum calculation is performed on the new running program version. The comprehensive checksum calculation is performed according to the following formula: in: This represents the overall checksum of the newly calculated running program version; This indicates the total number of data blocks in the new running program version; This indicates the version number of the new running program. The integer values ​​corresponding to the binary values ​​of each data block, where The value ranges from to ; This represents the modulo operation; This represents the modulus used in the modulo operation. Set as , Set as The basis is equal This ensures the overall checksum obtained from the calculation. It is limited to a 16-bit unsigned integer value, satisfying the length constraint of the checksum field in the industrial controller communication protocol.

[0030] The incremental upgrade package pre-stores a preset overall checksum. This preset checksum is obtained by the host computer performing the same calculation on the complete binary image file of the target upgrade program version using the aforementioned overall checksum calculation formula and modulus parameters when generating the incremental upgrade package, and is then written into the end field of the incremental upgrade package. The calculated overall checksum... Compare the values ​​with the preset overall verification value. If If the new program version's integrity check is equal to the preset overall check value, it is determined that the integrity check has passed, and the second program storage area is changed from an inexecutable state to an executable state. This is done by modifying the access attribute of the corresponding address range in the second program storage area within the memory protection unit to executable. If the value is not equal to the preset overall check value, the integrity check of the new running program version is determined to have failed. The second program storage area remains in an unexecutable state, all data in the second program storage area is discarded, and a check failure report is generated.

[0031] See Figure 3 The process modifies the target address value in the program counter of the industrial controller. The program counter is a register inside the central processing unit (CPU) of the industrial controller. The target address value stored in the program counter points to the memory address of the instruction that the CPU will next read. The target address value in the program counter is changed from the starting address of the currently running program version in memory to the starting address of the new running program version in memory. The starting address of the currently running program version is the first address of the first program memory area, and the starting address of the new running program version is the first address of the second program memory area. The modification operation of the program counter is completed by the CPU executing a jump instruction, with the starting address of the new running program version as the operand.

[0032] While modifying the program counter, the interrupt vector table of the industrial controller is locked. The interrupt vector table is a data table in the industrial controller's memory that stores the entry addresses of interrupt service routines. When an external device or internal timer generates an interrupt request signal, the central processing unit (CPU) looks up the corresponding interrupt service routine entry address in the interrupt vector table based on the type of the interrupt request signal and jumps to that entry address to execute the interrupt handling. Locking the interrupt vector table is achieved by setting the interrupt enable flag inside the CPU, disabling it. When the interrupt enable flag is disabled, the CPU does not respond to any interrupt requests, and all interrupt request signals arriving at the CPU are suspended and not processed.

[0033] After the program counter has been modified and the central processing unit (CPU) of the industrial controller begins fetching instructions from the starting address of the new program version, the interrupt vector table is unlocked. The CPU begins fetching instructions from the starting address of the new program version when the target address value in the CPU's program counter has been changed to the starting address of the new program version, and the CPU's instruction decoder has decoded the first instruction read from the starting address of the new program version. Unlocking the interrupt vector table is achieved by restoring the interrupt enable flag within the CPU from a disabled state to an enabled state. Once the interrupt enable flag is enabled, the CPU processes all interrupt request signals that were pending while the interrupt enable flag was disabled, resuming normal response to interrupt requests.

[0034] During the operation of the new runtime version, the program execution monitoring module inside the industrial controller continuously monitors the running status of the new runtime version. The running status monitored by the program execution monitoring module includes whether the program counter of the central processing unit points to an illegal memory address, whether the central processing unit executes an undefined instruction, whether memory access exceeds the address range of the second program storage area, and whether the stack pointer overflows. If the program execution monitoring module detects any of the above abnormal running states in the new runtime version, the program execution monitoring module generates an exception trigger signal.

[0035] The industrial controller has an internal watchdog timer, a hardware timer that decrements at fixed time intervals after startup. During normal program execution, the central processing unit (CPU) periodically writes a reload value to the watchdog timer, returning its count to its initial value. If the CPU fails to write a reload value within a preset watchdog timeout interval, the watchdog timer's count decrements to zero, generating a watchdog timeout signal. The preset watchdog timeout interval is determined based on the industrial controller's program execution cycle; in practice, it is set to 100 milliseconds.

[0036] Both the exception trigger signal generated by the program execution monitoring module and the watchdog timeout signal generated by the watchdog timer are sent to the reset control logic circuit of the industrial controller. Upon receiving either the exception trigger signal or the watchdog timeout signal, the reset control logic circuit triggers a fault rollback operation. The specific process of the fault rollback operation is as follows: the reset control logic circuit modifies the target address value in the industrial controller's program counter from the starting address of the new running program version in memory back to the starting address of the current running program version in memory. The starting address of the current running program version is the first address of the first program storage area. After the target address value in the program counter is modified, the central processing unit fetches and executes instructions starting from the first address of the first program storage area. The program execution entry point of the industrial controller jumps from the new running program version back to the current running program version, and the industrial controller continues to run the current running program version.

[0037] In some implementations, the feature fingerprint of a data block is a hash value generated based on a hash algorithm. The hash algorithm used is the 256-bit version of the Secure Hash Algorithm, namely the SHA-256 algorithm. When generating the feature fingerprint of each data block in the current version of the data block sequence, the binary data of each data block in the current version of the data block sequence is used as the input message of the SHA-256 algorithm. After calculating the input message, the SHA-256 algorithm outputs a 256-bit message digest value, which serves as the feature fingerprint of the corresponding data block. When generating the feature fingerprint of each data block in the upgraded version of the data block sequence, the binary data of each data block in the upgraded version of the data block sequence is used as the input message of the SHA-256 algorithm. After calculating the input message, the SHA-256 algorithm outputs a 256-bit message digest value, which serves as the feature fingerprint of the corresponding data block. The feature fingerprint generated by the SHA-256 algorithm can uniquely identify the content of each data block. The probability that any two data blocks with different contents will have different feature fingerprints after being calculated by the SHA-256 algorithm is 1 - 2 to the power of 256.

Claims

1. A method for online incremental upgrade and fault rollback protection of an industrial controller program, characterized in that, include: Obtain the current running program version and the target upgrade program version of the industrial controller. By comparing the binary image files of the two versions of the program, the binary image file is divided into multiple data blocks of fixed size. A unique data block feature fingerprint is generated for each data block, and the target difference data blocks that change only in the target upgrade program version are identified based on the data block feature fingerprint. Extract all target difference data blocks from the target upgrade program version and combine the target difference data blocks into an incremental upgrade package; The incremental upgrade package is transmitted to the industrial controller through the industrial controller's communication interface. The industrial controller retains a copy of all data blocks of the current running program version in its memory, and replaces the corresponding old data blocks in memory with the target difference data blocks in the incremental upgrade package to generate a new running program version. After the replacement is completed, the program execution entry point of the industrial controller will be directly switched from the current running program version to the new running program version, thus completing the online incremental upgrade.

2. The method for online incremental upgrade and fault rollback protection of an industrial controller program according to claim 1, characterized in that, The process of comparing two versions of the program's binary image files and dividing the binary image file into multiple fixed-size data blocks specifically includes: Determine the minimum storage cell size for the industrial controller and use this minimum storage cell size as a baseline value for a fixed size; Using this baseline value as the unit, the binary image file of the current running program version and the binary image file of the target upgrade program version are sequentially split from beginning to end to obtain the data block sequence of the current version and the data block sequence of the upgrade version. Record the start and end offset addresses of each data block in its respective binary image file to form a data block location mapping table.

3. The method for online incremental upgrade and fault rollback protection of an industrial controller program according to claim 2, characterized in that, The step of generating a unique data block feature fingerprint for each data block, and identifying target difference data blocks that change only in the target upgrade program version based on the data block feature fingerprint, specifically includes: Apply the Cyclic Redundancy Check algorithm to each data block in the current version data block sequence and each data block in the upgraded version data block sequence to obtain the feature fingerprint of each data block; The feature fingerprint of the first data block in the upgraded version data block sequence is compared one by one with the feature fingerprints of all data blocks in the current version data block sequence; If the feature fingerprint of the current data block in the upgraded version data block sequence is the same as the feature fingerprint of any data block in the current version data block sequence, then the current data block is determined to be a non-differential data block; If the feature fingerprint of the current data block in the upgraded version data block sequence is different from the feature fingerprints of all data blocks in the current version data block sequence, then the current data block is determined to be the target difference data block; Traverse all data blocks in the upgraded version data block sequence to obtain all target difference data blocks.

4. The method for online incremental upgrade and fault rollback protection of an industrial controller program according to claim 3, characterized in that, When the feature fingerprint of the current data block in the upgraded version data block sequence is the same as the feature fingerprint of multiple data blocks in the current version data block sequence, the data block with the closest starting offset address is selected as the non-differential data block.

5. The method for online incremental upgrade and fault rollback protection of an industrial controller program according to claim 1, characterized in that, The transmission of the incremental upgrade package to the industrial controller via the industrial controller's communication interface specifically includes: The incremental upgrade packet is divided into multiple transmission frames. Each transmission frame contains a frame header, a data payload, and a frame trailer. The frame header contains the total frame sequence number and the current frame sequence number of the transmission frame in the incremental upgrade packet. Each transmission frame is sent sequentially through the communication interface of the industrial controller, and after sending the current transmission frame, the system waits for the industrial controller to return an acknowledgment character. If an acknowledgment character is received within the preset timeout period, the next transmission frame will be sent. If no acknowledgment character is received within the preset timeout period, the current transmission frame will be retransmitted. The upgrade process will terminate after the number of retransmissions reaches the preset retransmission limit, and a communication failure will be reported.

6. The method for online incremental upgrade and fault rollback protection of an industrial controller program according to claim 1, characterized in that, The process of retaining a complete copy of all data blocks of the current running program version in the memory of the industrial controller, while replacing the corresponding old data blocks in memory with the target difference data blocks from the incremental upgrade package to generate a new running program version, specifically includes: In the memory of the industrial controller, a first program storage area and a second program storage area are allocated. The first program storage area is used to store all data block copies of the currently running program version, and the second program storage area is initially empty. Set the second program storage area to a non-executable state, prohibiting the central processing unit of the industrial controller from reading instructions from the second program storage area; Copy all data blocks from the first program storage area to the second program storage area to form the program version to be updated; Based on the offset address information of each target difference data block in the incremental upgrade package, the corresponding old data block location is located in the program version to be updated in the second program storage area; The located old data block is deleted from the second program storage area, and the target difference data block in the incremental upgrade package is written to the corresponding deletion location. After the data block replacement is completed, a new running program version is generated.

7. The method for online incremental upgrade and fault rollback protection of an industrial controller program according to claim 6, characterized in that, After the data block replacement is completed in the second program storage area, the new running program version is subjected to overall verification and calculation, and compared with the overall verification value preset in the incremental upgrade package. Only after the verification is passed can the second program storage area be set to an executable state.

8. The method for online incremental upgrade and fault rollback protection of an industrial controller program according to claim 1, characterized in that, The process of directly switching the program execution entry point of the industrial controller from the current running program version to the new running program version to complete the online incremental upgrade specifically includes: Modify the target address value in the program counter of the industrial controller, changing the target address value from the starting address of the current running program version to the starting address of the new running program version; While modifying the program counter, the interrupt vector table of the industrial controller is locked, preventing any interrupt requests from being responded to during program jumps. Once the program counter modification is complete and the central processing unit of the industrial controller begins fetching instructions from the starting address of the newly running program version, the interrupt vector table is unlocked, and normal response to interrupt requests is restored.

9. The method for online incremental upgrade and fault rollback protection of an industrial controller program according to claim 1, characterized in that, If an abnormal program is detected or a preset watchdog timeout is triggered during the operation of a new version of the program, the program execution entry point will be automatically redirected back to the current version of the program to achieve a rollback in case of failure.

10. The method for online incremental upgrade and fault rollback protection of an industrial controller program according to claim 1, characterized in that, The data block feature fingerprint is a hash value generated based on a hash algorithm, used to uniquely identify the content of each data block.

Images