Bootloader upgrade method and system maintaining communication response

Abstract

The application discloses a Bootloader upgrading method and system for keeping communication response, and belongs to the technical field of embedded systems. The method comprises the following steps: entering a Boot pilot program after receiving an upgrading instruction sent by an upper computer, sending a storage address of a current running program to the upper computer, saving a context field of the current running program, removing storage space protection of a program area to be updated, and jumping to a Bootloader program for execution; the upper computer sends a program file to be updated to the processor; the Bootloader program receives the program file to be updated, writes the program file to be updated into a non-running area of the storage space, and performs verification; according to a verification result and a type of the program to be updated, the original program context field is recovered to continue running or jump to a new application program for execution. The application can continuously respond to various interruptions during the upgrading process, guarantees uninterrupted communication and application, and has certain convenience and universality.

Description

Technical Field

[0001] This invention belongs to the field of embedded system technology, specifically relating to a bootloader upgrade method and system that maintains communication response. Background Technology

[0002] With the rapid development of fields such as the Internet of Things, industrial control, drones, and vehicle electronic information, the functions of embedded devices are becoming increasingly complex. Online upgrades of applications or firmware have become an essential key technology. As the first piece of code to run after the system powers on, the bootloader is responsible for hardware initialization and self-test functions. More importantly, it is responsible for subsequent upgrades when the application version changes. Its online upgrade function has become a key part of the use and maintenance of the entire software system.

[0003] As an improvement, most mainstream bootloader online upgrade solutions currently use hardware or software reset to upgrade applications. This involves entering the bootloader program from the application, receiving the application via the communication interface, erasing the old application, and then burning the new application to storage. The processor then jumps to execute the new application. Some bootloader solutions include a backup space, storing the same application in both spaces to prevent system malfunction if one fails. Other solutions use a communication bus, where the controller acts as the host, sending different applications to different nodes to update their applications. However, in current online bootloader upgrades, the program may be forced to stop during the download process, potentially preventing critical code from running. Summary of the Invention

[0004] This invention provides a bootloader upgrade method and system that maintains communication responsiveness, aiming to solve the problem that in current online bootloader upgrades, the program may be forced to stop during the bootloader program download process, resulting in critical code not being able to continue running.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: This invention provides a bootloader upgrade method that maintains communication responsiveness, comprising the following steps: After receiving the upgrade command sent by the host computer, the processor enters the Boot program. The Boot program sends the memory address of the currently running program to the host computer, saves the context of the currently running program, removes the memory space protection of the area to be updated, and jumps to the Bootloader program for execution. Based on the storage address of the currently running program, the host computer sends the program file to be updated to the processor; The Bootloader program receives the program file to be updated, writes the program file to the non-running storage space, and verifies it. Based on the verification results and the type of program to be updated, restore the original program context and continue running, or jump to the new application for execution.

[0006] In some implementations, after receiving an upgrade command from the host computer, the processor enters the Boot pilot program, including: after receiving the upgrade command, the processor does not perform a reset operation, but directly jumps from the currently running application to the Boot pilot program in a fixed storage area for execution.

[0007] In some implementations, saving the context of the current program includes: the bootloader saving the register state, stack pointer, and interrupt context information of the current application to the context storage space of the off-chip random access memory.

[0008] In some implementations, removing the storage space protection of the area to be updated includes: removing write protection permissions for non-running area storage space by configuring the processor's memory protection unit.

[0009] In some implementations, the host computer sends the program file to be updated to the processor, including: the host computer determines the target storage address of the program to be updated based on the received storage address of the currently running program, and sends the program file to be updated, which contains the target address, file size and checksum, to the processor using a transmission method of one frame of data corresponding to one frame of acknowledgment.

[0010] In some implementations, burning the program file to be updated to the non-running area storage space includes: the bootloader program first temporarily stores the received program file to be updated in the non-running area random access memory, erases the non-running area flash memory, and then burns the program file to be updated to the non-running area flash memory; the verification includes: the bootloader program performs an integrity verification on the program file to be updated burned to the flash memory, and if the verification fails, it sends an update failure command to the host computer.

[0011] In some implementations, restoring the original program context and continuing execution includes: when the program to be updated is a Bootloader program and the verification passes, the processor jumps from the Bootloader program back to the Boot program, restores the original program's context and stack pointer from the context storage space, and returns to the position where the original application was interrupted to continue execution.

[0012] In some implementations, jumping to the execution of a new application includes: when the program to be updated is an application and the verification passes, the processor waits for the currently executing interrupt service routine to finish, disables global interrupts, jumps to the starting address of the new application to execute, and enables global interrupts after completing the initialization of the new application's stack, modules, and interrupt controller.

[0013] In some implementations, the non-running area is a storage region in the on-chip flash memory or off-chip flash memory that is different from the area where the currently running program is located, and the running program and the program to be updated are stored alternately in a ping-pong operation mode.

[0014] This invention also provides a bootloader upgrade system that maintains communication responsiveness, for implementing the aforementioned bootloader upgrade method that maintains communication responsiveness, including an instruction jump and preprocessing module, a file distribution and transmission module, a receiving, writing, and verification module, and a program scheduling and execution module; wherein: The instruction jump and preprocessing module is used for: after the processor receives the upgrade instruction sent by the host computer, it enters the boot program, sends the storage address of the currently running program to the host computer through the boot program, saves the context of the currently running program, removes the storage space protection of the area to be updated, and jumps to the Bootloader program for execution. The file distribution module is used to: send the program file to be updated from the host computer to the processor based on the storage address of the currently running program; The receive and write verification module is used to: receive the program file to be updated through the Bootloader program, write the program file to be updated to the non-running area storage space and perform verification; The program scheduling and execution module is used to restore the original program context and continue running or jump to the new application for execution based on the verification result and the type of program to be updated.

[0015] Compared with the prior art, the Bootloader upgrade method and system of the present invention, which maintains communication response, has the following advantages: This invention enables the processor to continuously respond to peripheral interrupts and its own timer interrupts during the upgrade process. The host computer sends an application or bootloader program update instruction to the chip. Upon receiving this instruction, the processor does not enter the bootloader area via a reset function. Instead, it transfers control of the processor from the application to the bootloader code through a pointer jump, while simultaneously maintaining its response to peripheral interrupts and timer interrupts from the original application. Normally, the bootloader requires a software or hardware reset before completing the application update. During the bootloader application update, the processor can only handle tasks required by the bootloader process; the original application must stop running, and peripheral interrupts and timer interrupts cannot be handled. The interrupt-response-preserving update method proposed in this invention retains some of the processor's interrupt handling capabilities from the original application, allowing the processor to handle some peripheral interrupts and timer interrupts during the application upgrade process. This invention can also perform upgrade operations only on the Bootloader program, maintaining the application's interrupt response capability during the upgrade process. This allows the processor to handle some peripheral interrupts or timer interrupts during the Bootloader program, and after completing the Bootloader upgrade, it can return to the application and continue executing the interrupted application. Attached Figure Description

[0016] The accompanying drawings are provided to further understand the invention and constitute a part of this invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0017] Figure 1 A flowchart illustrating the update process in an embodiment of the Bootloader upgrade method for maintaining communication response according to the present invention; Figure 2 A schematic diagram of the hardware circuitry and its components in an embodiment of the Bootloader upgrade method for maintaining communication response according to the present invention; Figure 3 A schematic diagram of the contents stored in on-chip and off-chip FLASH and RAM in an embodiment of the Bootloader upgrade method for maintaining communication response of the present invention; Figure 4 This diagram illustrates the processor time usage during the update of the bootloader program or application program in an embodiment of the bootloader upgrade method for maintaining communication response according to the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0019] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0020] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0021] It should be noted that the apparatus and methods disclosed in the embodiments herein can also be implemented in other ways. The apparatus embodiments described above are merely illustrative; for example, the flowcharts and block diagrams in the accompanying drawings show the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments herein. In this regard, each block in a flowchart or block diagram may represent a module, program, or part of code containing one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system to perform the specified function or action, or can be implemented using a combination of dedicated hardware and computer instructions.

[0022] In addition, the functional modules in the various embodiments of this article can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0023] How to provide an online upgrade solution with dual storage areas that continuously responds to external event interrupts and processor internal timer interrupts during application or bootloader upgrades to ensure high system reliability.

[0024] Based on this, the present invention provides a bootloader upgrade method that maintains communication response, comprising the following steps: After receiving the upgrade command sent by the host computer, the processor enters the Boot program. The Boot program sends the memory address of the currently running program to the host computer, saves the context of the currently running program, removes the memory space protection of the area to be updated, and jumps to the Bootloader program for execution. Based on the storage address of the currently running program, the host computer sends the program file to be updated to the processor; The Bootloader program receives the program file to be updated, writes the program file to the non-running storage space, and verifies it. Based on the verification results and the type of program to be updated, restore the original program context and continue running, or jump to the new application for execution.

[0025] Specifically, this invention uses a communication interface (such as, but not limited to, CAN, SPI, UART, Ethernet, etc.) to realize communication between the processor and the host computer, achieving an upgrade method similar to ping-pong operation, with two storage spaces, external FLASH and internal FLASH, working together. The bootloader program and application program each have fixed storage addresses in both the internal and external FLASH. The processor uses flag bits to record the currently running application program or the valid bootloader program. When the host computer issues an update command request, the processor sends the address of the currently running application program or bootloader program to the host computer, and the host computer obtains the download address of the program to be downloaded from the processor. If the bootloader program to be updated is currently running externally, then the bootloader to be updated will be moved to the internal memory. If the application program to be updated is currently running internally, then the application to be updated will be moved externally.

[0026] After receiving an update command from the host computer, the processor enters the bootloader from the application program. The bootloader sends the address of the currently running application or bootloader program to the host computer, saves the current program's context, and finally jumps to the currently active bootloader to execute the bootloader program. The bootloader program and the host computer communicate via a CAN interface to receive and update the program to be updated. After the bootloader writes the program to be updated into the FLASH memory, it verifies the program. If the verification fails, it sends an update failure command to the host computer and then returns to the bootloader, restoring program execution using the previously saved program context. If the update is to the bootloader program, the bootloader program returns to the bootloader after completing the update and successful verification, restoring program execution using the saved program context. If the update is to the application program, the bootloader program directly jumps to the new application to execute after completing the update and successful verification.

[0027] The process of context saving and program switching in this invention is as follows: 1) After receiving the update instruction, the processor enters the Boot program; 2) The bootloader saves the current application context to the off-chip RAM context storage space; 3) Configure the MPU to remove storage space protection for the area of ​​the program to be updated; 4) Jump to the Bootloader application for execution; 5) If the update is to the application, after the Bootloader program finishes executing, it returns to the next instruction after step 3) of the Bootloader program to execute; 6) The bootloader restores the context of the previous application from the context storage space of the off-chip RAM.

[0028] 7) Resume execution from where the application was interrupted.

[0029] With the above-mentioned hardware and software design, the upgrade of the bootloader or application can be completed without interrupting the critical interrupts of the current program.

[0030] like Figure 2The diagram illustrates the hardware circuitry and composition of this invention, specifically the connection between the host computer and the hardware circuitry, and the structural diagram of each component of the hardware circuitry. The hardware circuitry mainly includes a processor, external FLASH, external RAM, a power supply module, a transceiver, and a JTAG interface. The host computer is software running on a PC, communicating with the processor via a first communication interface (e.g., CAN bus) for the Bootloader function, and downloading programs from the processor's internal or external flash memory via a second communication interface (e.g., JTAG). The power supply module provides power to the entire hardware board. The transceiver module is a CAN transceiver, performing the physical transmission and reception of CAN data. The external FLASH stores the Bootloader, application program, and Bootloader program. The external RAM mainly stores the stack, variables, interrupt service functions, and Bootloader program required by the Bootloader program and application program in the external FLASH. The processor mainly includes a Cortex-R4 core, MPU, VIC, CAN, FLASH, and RAM. The MPU is the processor's memory space protection unit, responsible for defining and protecting the address space. VIC is the processor's interrupt controller, primarily responsible for managing the processor's various interrupts. The processor's FLASH and RAM are the on-chip FLASH and on-chip RAM, respectively. The on-chip FLASH stores the bootloader code and application code. The on-chip RAM primarily stores the stack, variables, and interrupt service functions required by the bootloader and application programs stored in the on-chip FLASH.

[0031] like Figure 3As shown, the on-chip FLASH of this invention is divided into two areas for storing the Bootloader1 program and the Application1 program. The off-chip FLASH is divided into three areas for storing the Bootloader2 program, the Application2 program, and the Boot Preview program. Only one of the Bootloader1 and Bootloader2 programs can be active at any given time, and only one Bootloader program can run. Similarly, only one of the Application1 and Application2 programs can be active at any given time, and only one Application program can run. Additionally, the off-chip FLASH also stores the Boot Preview program, which can be called by both the Application1 and Application2 programs. The Boot Preview program primarily handles responses to host computer update commands, saving and restoring the program context, and removing storage space protection for the program area to be updated from the MPU. The on-chip RAM is divided into two areas for storing the stacks and variables of the Bootloader1 and Application1 programs, as well as the interrupt service functions of the Application1 program. The off-chip RAM is divided into three areas for storing the stacks and variables of the Bootloader2 and Application2 programs, as well as the interrupt service functions of the Application2 program. In addition, the off-chip RAM also contains the boot program and context storage space. The boot program is moved from the off-chip FLASH to the off-chip RAM by the application program for execution, and the context storage space is used by the code in the boot program to save and restore the context.

[0032] like Figure 4As shown, the top represents the execution time of the Bootloader program in the processor, and the bottom represents the interrupt execution time of the original application. A low level indicates no operation at that time, and a high level indicates operation. The original application interrupt time includes a 5ms timer interrupt and peripheral interrupts. Peripheral interrupts generally do not have a fixed time and may occur at any time. T1 to T2, T4 to T5, T8 to T9, and T12 to T13 represent the execution time of the processor's timer interrupt handling function; T6 to T7 and T10 to T11 represent the processor's peripheral communication interrupt handling time. T3 to T4, T5 to T6, T7 to T8, T9 to T10, T11 to T12, and T13 to T14 represent the execution time of the Bootloader and Bootpreprocessor programs. After receiving the update command from the host computer, T3 to T4 execute the Bootpreprocessor program, returning the starting address of the currently running Bootloader and application to the processor. During the time intervals T5 to T6, T7 to T8, T9 to T10, and T11 to T12, the Bootloader program receives the new application program or its bin file, erases the corresponding area in the on-chip or off-chip flash memory, and then programs the application program or Bootloader program's bin file into the on-chip or off-chip flash memory. During the time interval T13 to T14, if the update is to the Bootloader program, the processor returns to the Boot Preview, restores the original application's context, and then continues execution within the original application. If the update is to the application program, the processor waits for the current interrupt to finish running, disables global interrupts, and then jumps to the new application. In the new application, the stack, variables, modules, etc., are reinitialized, global interrupts are enabled, and execution of the new application continues.

[0033] like Figure 1 As shown, in some operating conditions, the application program or bootloader program of this invention is updated according to the following steps: Step 1: The host computer sends an upgrade command. Upon receiving the upgrade command, the processor enters the Bootloader program, which is stored in both external FLASH and external RAM. In the Bootloader program, the processor returns the FLASH address of the currently running application to the host computer. Then, the processor saves the current main program's context and stack pointer, waiting to resume the main program's execution upon returning to the Bootloader program. Simultaneously, the processor switches the protected address space of the MPU unit. After saving the program context and removing the memory space protection of the program area to be updated, the processor transfers control from the Bootloader program to the Bootloader code. Entry to the Bootloader code is achieved by directly jumping to its starting address.

[0034] Step 2: After receiving the FLASH starting address of the current space, the host computer sends a Download command to the processor. The Download command contains the address of the bin file to be downloaded, the size of the bin file, and the checksum.

[0035] Step 3: In the Bootloader code, the host computer and the processor transmit data using a data frame followed by an acknowledgment frame to ensure the correctness of the data transmission until the entire bin file is transferred.

[0036] Step 4: The bootloader stores the received entire bin file in non-running RAM. It then erases the non-running FLASH memory and executes the FLASH programming program to write the bin file to the non-running FLASH. After successful programming, the bootloader verifies the newly written bin file in the FLASH. If the verification passes, it proceeds to the next step; otherwise, it returns an update failure command to the host computer and then proceeds to Step 7.

[0037] Step 5: If the update is for the application, proceed to Step 6. If the update is for the bootloader, proceed to Step 7.

[0038] Step Six: The processor waits for the currently executing interrupt service routine to finish, disables global interrupts, and then transfers control from the bootloader to the new application. After the new application runs, it initializes the stack space, the functions of each module, and the VIC controller. After completing the initialization of the new program, the processor enables global interrupts and executes the new application.

[0039] Step 7: The processor transfers control from the bootloader to the bootloader, and then restores the previous main program context and stack pointer in the bootloader. The processor returns to the point where the application was interrupted and continues execution.

[0040] This invention also provides a bootloader upgrade system that maintains communication response, including an instruction jump and preprocessing module, a file distribution and transmission module, a receiving, writing, and verification module, and a program scheduling and execution module; wherein: The instruction jump and preprocessing module is used for: after the processor receives the upgrade instruction sent by the host computer, it enters the boot program, sends the storage address of the currently running program to the host computer through the boot program, saves the context of the currently running program, removes the storage space protection of the area to be updated, and jumps to the Bootloader program for execution. The file distribution module is used to: send the program file to be updated from the host computer to the processor based on the storage address of the currently running program; The receive and write verification module is used to: receive the program file to be updated through the Bootloader program, write the program file to be updated to the non-running area storage space and perform verification; The program scheduling and execution module is used to restore the original program context and continue running or jump to the new application for execution based on the verification result and the type of program to be updated.

[0041] In some embodiments, the Bootloader upgrade method of the present invention that maintains communication response is applied to the online loading program of MCU chip, which provides important support for application scenarios that need to maintain critical communication without interruption, such as application upgrades of servers or critical platforms, and can improve the security and reliability of the system.

[0042] In summary, this invention enables embedded systems to continuously respond to peripheral interrupts and processor timer interrupts, ensuring uninterrupted critical applications and communication services, and is adaptable to high-reliability embedded device upgrade scenarios. This invention employs a ping-pong storage architecture, combining on-chip and off-chip storage, and features automatic recovery capabilities in case of upgrade failure. Based on an independently configured bootloader, this invention implements program jumps, context saving, and storage space permission switching functions. Programs running in both on-chip and off-chip flash memory can be invoked, demonstrating versatility and practicality. The upgrade process of this invention can complete program switching without hardware or software reset. Combined with a context saving and restoration mechanism, it can accurately return to the original program breakpoint after an upgrade interruption. A frame-by-frame confirmation data frame transmission mechanism ensures the accuracy of upgrade file transmission, and this mechanism is decoupled from specific communication interfaces, adapting to various industrial bus protocols and improving the overall reliability of online program upgrades.

[0043] Finally, it should be noted that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Anyone skilled in the art can readily implement the present invention according to the description and above. Any modifications, alterations, or equivalent variations made using the technical content disclosed above are equivalent embodiments of the present invention. Furthermore, any modifications, alterations, or variations made to the above embodiments based on the essential technology of the present invention are still within the protection scope of the present invention.

Claims

1. A bootloader upgrade method that maintains communication response, characterized in that, Includes the following steps: After receiving the upgrade command sent by the host computer, the processor enters the Boot program. The Boot program sends the memory address of the currently running program to the host computer, saves the context of the currently running program, removes the memory space protection of the area to be updated, and jumps to the Bootloader program for execution. Based on the storage address of the currently running program, the host computer sends the program file to be updated to the processor; The Bootloader program receives the program file to be updated, writes the program file to the non-running storage space, and verifies it. Based on the verification results and the type of program to be updated, restore the original program context and continue running, or jump to the new application for execution.

2. The Bootloader upgrade method for maintaining communication response according to claim 1, characterized in that, After receiving the upgrade command from the host computer, the processor enters the Boot program, which includes: after receiving the upgrade command, the processor does not perform a reset operation, but directly jumps from the currently running application to the Boot program in a fixed storage area for execution.

3. The Bootloader upgrade method for maintaining communication response according to claim 1, characterized in that, Save the current program's context, including: the bootloader saves the current application's register state, stack pointer, and interrupt context information to the context storage space of the off-chip random access memory.

4. The Bootloader upgrade method for maintaining communication response according to claim 1, characterized in that, Remove storage space protection for the area to be updated, including: removing write protection permissions for non-running storage space by configuring the processor's memory protection unit.

5. The Bootloader upgrade method for maintaining communication response according to claim 1, characterized in that, The host computer sends the program file to be updated to the processor, including: the host computer determines the target storage address of the program to be updated based on the received storage address of the currently running program, and sends the program file to be updated, which contains the target address, file size and check value to the processor using a transmission method of one frame of data corresponding to one frame of acknowledgment.

6. The Bootloader upgrade method for maintaining communication response according to claim 1, characterized in that, The process of burning the program file to be updated to the non-running area storage space includes: the bootloader program first temporarily stores the received program file to be updated in the non-running area random access memory, erases the non-running area flash memory, and then burns the program file to be updated to the non-running area flash memory; the verification includes: the bootloader program performs an integrity verification on the program file to be updated burned to the flash memory, and if the verification fails, it sends an update failure command to the host computer.

7. The Bootloader upgrade method for maintaining communication response according to claim 1, characterized in that, Restore the original program context and continue execution, including: when the program to be updated is the Bootloader program and the verification is successful, the processor jumps from the Bootloader program back to the Boot program, restores the original program's context and stack pointer from the context storage space, and returns to the position where the original application was interrupted to continue execution.

8. The Bootloader upgrade method for maintaining communication response according to claim 1, characterized in that, Jumping to the new application execution includes: when the program to be updated is an application and the verification passes, the processor waits for the currently executing interrupt service routine to finish, disables global interrupts, jumps to the starting address of the new application to execute, and enables global interrupts after completing the initialization of the new application's stack, modules, and interrupt controller.

9. The Bootloader upgrade method for maintaining communication response according to claim 1, characterized in that, The non-running area is a storage area in the on-chip flash memory or off-chip flash memory that is different from the area where the currently running program is located. The running program and the program to be updated are stored alternately using a ping-pong operation method.

10. A bootloader upgrade system that maintains communication response, for implementing the bootloader upgrade method that maintains communication response as described in any one of claims 1-9, characterized in that, It includes an instruction jump and preprocessing module, a file distribution and transmission module, a receive, write, and verify module, and a program scheduling and execution module; among which: The instruction jump and preprocessing module is used for: after the processor receives the upgrade instruction sent by the host computer, it enters the boot program, sends the storage address of the currently running program to the host computer through the boot program, saves the context of the currently running program, removes the storage space protection of the area to be updated, and jumps to the Bootloader program for execution. The file distribution module is used to: send the program file to be updated from the host computer to the processor based on the storage address of the currently running program; The receive and write verification module is used to: receive the program file to be updated through the Bootloader program, write the program file to be updated to the non-running area storage space and perform verification; The program scheduling and execution module is used to restore the original program context and continue running or jump to the new application for execution based on the verification result and the type of program to be updated.

Images