An industrial control system firmware online upgrading method

Abstract

This invention discloses an online firmware upgrade method for industrial control systems, comprising the following steps: receiving a Bootloader mode command issued by the master controller and sending it to each slave controller; determining the slave controller to be upgraded based on the consistency judgment result between the current firmware version of the slave controller and the target firmware version in the Bootloader mode command; receiving a firmware data packet issued by the master controller, sending it to the slave controller to be upgraded for parsing and reassembly, and writing the reassembled firmware data packet into its own Flash memory; performing local integrity verification on the firmware data packet written to the Flash memory; receiving a firmware version switching command issued by the master controller and sending it to the slave controller to be upgraded that has passed the integrity verification for firmware version switching. This invention solves the problem in existing online firmware upgrade schemes for industrial control systems where, after the master controller sends firmware data to each slave controller, the lack of a data integrity verification mechanism leads to slave controllers updating based on incomplete data, resulting in upgrade failure.

Description

Technical Field

[0001] This invention relates to the field of industrial control system upgrade technology, specifically a method for online firmware upgrade of industrial control systems. Background Technology

[0002] In industrial control systems, the mainstream architecture is a single-master, multi-slave setup, where one master industrial controller manages multiple slave industrial controllers. To address the low efficiency of traditional point-to-point upgrades for individual devices, the industry commonly uses broadcast upgrades for batch firmware upgrades. However, in existing online firmware upgrade solutions for industrial control systems, after the master industrial controller broadcasts the firmware upgrade data to each slave industrial controller, the lack of a robust firmware upgrade data integrity verification mechanism leads to some slave industrial controllers updating based on incomplete or incorrect firmware upgrade data, thus increasing the risk of upgrade failure. Summary of the Invention

[0003] To address the aforementioned shortcomings, this invention proposes an online firmware upgrade method for industrial control systems. The aim is to solve the problem in existing online firmware upgrade schemes for industrial control systems where, after the master controller sends firmware data to each slave controller, the lack of a firmware data integrity verification mechanism leads to slave controllers updating based on incomplete firmware data, resulting in upgrade failure.

[0004] To achieve this objective, the present invention adopts the following technical solution: An online firmware upgrade method for an industrial control system, the industrial control system including a master industrial controller and several slave industrial controllers, the method comprising the following steps: Step S1: Receive the Bootloader mode command issued by the master industrial controller and broadcast it to each slave industrial controller. The Bootloader mode is the underlying operating mode for firmware version updates. Step S2: Determine whether the firmware version of the current slave industrial controller is consistent with the target firmware version in the Bootloader mode instruction. If they are consistent, it is determined that the current slave industrial controller does not need firmware upgrade; if they are inconsistent, the current slave industrial controller is designated as a slave industrial controller to be upgraded. Step S3: First, receive the firmware sub-packet information and firmware data packet sent by the main industrial controller. Then, send the firmware data packet to each slave industrial controller to be upgraded in a broadcast manner for parsing and reassembly. Write the reassembled firmware data packet to the Flash memory of the corresponding slave industrial controller to be upgraded. Step S4: Perform local integrity verification on each firmware data packet written from the Flash memory of the industrial controller to be upgraded, and obtain the corresponding integrity verification results; Step S5: Receive the integrity verification result polling command issued by the master industrial controller and broadcast it to each slave industrial controller to be upgraded in order to obtain the integrity verification result of each slave industrial controller to be upgraded; Step S6: Receive the firmware version switching command issued by the main industrial controller and broadcast it to the industrial controllers to be upgraded that have passed integrity verification to switch the firmware version and complete the online firmware upgrade.

[0005] Preferably, in step S3, the firmware data packet issued by the main industrial controller is sent to each slave industrial controller to be upgraded for parsing and reassembly, and the reassembled firmware data packet is written to the corresponding Flash memory. This specifically includes the following sub-steps: Step S31: Establish a receive status table for each industrial controller, wherein the receive status table is used to record the sequence number information of the received firmware data packets; Step S32: Based on the serial number information of the firmware data packets, perform out-of-order rearrangement and continuity verification on each firmware data packet received from the industrial controller to be upgraded. Step S33: Determine whether the firmware data packet processed in step S32 has filled the entire page of the preset Flash page. If yes, write the currently accumulated firmware data packet to the Flash memory of the industrial controller to be upgraded; otherwise, do not perform the write operation.

[0006] Preferably, in step S3, during the process of sending the firmware data packet issued by the main industrial controller to the slave industrial controller to be upgraded, the following steps are also included: receiving the file transfer end instruction issued by the main industrial controller and broadcasting it to each slave industrial controller to be upgraded to perform the remaining firmware data packet writing operation that has not filled the entire preset Flash page.

[0007] Preferably, in step S3, the firmware packet information includes the total firmware CRC; in step S4, the following sub-steps are specifically included: Step S41: Calculate the cyclic redundancy check value of the firmware data packet currently being upgraded and written from the Flash memory of the industrial controller using the CRC32 standard polynomial algorithm; Step S42: Determine whether the cyclic redundancy check value calculated in step S41 is consistent with the total firmware CRC. If yes, it is determined that the firmware data packet currently being upgraded and received from the industrial controller is complete and error-free, i.e., the integrity verification is qualified; if no, it is determined that the firmware data packet currently being upgraded and received from the industrial controller is missing or erroneous, i.e., the integrity verification is unqualified.

[0008] Preferably, in step S6, the firmware version switching instruction issued by the main industrial controller is sent to the industrial controller to be upgraded that has passed the integrity verification to perform firmware version switching. Specifically, this includes the following sub-steps: mapping the physical memory start address of the industrial controller to be upgraded that has passed the integrity verification to an independent storage partition in the Flash memory used to store the new version firmware.

[0009] Preferably, the method further includes the following steps: receiving a firmware version polling instruction issued by the master industrial controller and sending it to the slave industrial controller that has completed the firmware upgrade, so as to trigger it to perform firmware version verification.

[0010] The technical solution provided by this invention may include the following beneficial effects: In this solution, the firmware data issued by the main industrial controller is first parsed and reconstructed by the industrial controller to be upgraded, and the reconstructed firmware data is written to its own Flash memory. Subsequently, local integrity verification is performed on the firmware data already written to the Flash memory. This can effectively prevent the industrial controller from switching versions based on incomplete or incorrect firmware data, thereby ensuring the success rate of industrial controller firmware upgrade. Attached Figure Description

[0011] Figure 1 This is a flowchart illustrating the steps of an online firmware upgrade method for an industrial control system. Detailed Implementation

[0012] Embodiments of the present invention are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0013] An online firmware upgrade method for an industrial control system, the industrial control system including a master industrial controller and several slave industrial controllers, the method comprising the following steps: Step S1: Receive the Bootloader mode command issued by the master industrial controller and broadcast it to each slave industrial controller. The Bootloader mode is the underlying operating mode for firmware version updates. Step S2: Determine whether the firmware version of the current slave industrial controller is consistent with the target firmware version in the Bootloader mode instruction. If they are consistent, it is determined that the current slave industrial controller does not need firmware upgrade; if they are inconsistent, the current slave industrial controller is designated as a slave industrial controller to be upgraded. Step S3: First, receive the firmware sub-packet information and firmware data packet sent by the main industrial controller. Then, send the firmware data packet to each slave industrial controller to be upgraded in a broadcast manner for parsing and reassembly. Write the reassembled firmware data packet to the Flash memory of the corresponding slave industrial controller to be upgraded. Step S4: Perform local integrity verification on each firmware data packet written from the Flash memory of the industrial controller to be upgraded, and obtain the corresponding integrity verification results; Step S5: Receive the integrity verification result polling command issued by the master industrial controller and broadcast it to each slave industrial controller to be upgraded in order to obtain the integrity verification result of each slave industrial controller to be upgraded; Step S6: Receive the firmware version switching command issued by the main industrial controller and broadcast it to the industrial controllers to be upgraded that have passed integrity verification to switch the firmware version and complete the online firmware upgrade.

[0014] This solution provides a method for online firmware upgrades of industrial control systems, such as... Figure 1As shown, the first step is to receive the Bootloader mode command issued by the master industrial controller and broadcast it to each slave industrial controller. Bootloader mode is the underlying operating mode for firmware version updates. In this embodiment, broadcasting the Bootloader mode command from the master industrial controller to each slave industrial controller ensures that all slave industrial controllers receive the command synchronously and quickly, effectively avoiding the time overhead of traditional point-to-point command distribution. The second step is to determine whether the firmware version of the current slave industrial controller is consistent with the target firmware version in the Bootloader mode command. If they are consistent, the current slave industrial controller does not need a firmware upgrade; if they are inconsistent, the current slave industrial controller is designated as a slave industrial controller awaiting upgrade. In this embodiment, by introducing a firmware version consistency judgment mechanism before firmware upgrades, slave industrial controllers with inconsistent current firmware versions and target firmware versions can be accurately identified, effectively eliminating slave industrial controllers that do not need upgrades and avoiding unnecessary consumption of network resources. The third step involves first receiving the firmware packet information and firmware data packets from the master industrial controller, then broadcasting the firmware data packets to the slave industrial controllers to be upgraded for parsing and reassembly. The reassembled firmware data packets are then written to the Flash memory of the corresponding slave industrial controller. In this embodiment, by broadcasting the firmware packet information and firmware data packets from the master industrial controller to each slave industrial controller, each slave controller can clearly understand the overall parameter configuration and data organization method of the current firmware. By sending the firmware data packets to the slave industrial controllers to be upgraded for parsing and reassembly, each slave industrial controller can perform sequential organization and missing data detection on the received firmware data during the reassembly process, effectively overcoming common transmission defects such as packet loss and out-of-order delivery in wireless broadcast channels. By writing the reassembled firmware data packets to the Flash memory of the slave industrial controllers to be upgraded, a solid data foundation is laid for subsequent integrity verification and version switching. The fourth step is to perform local integrity verification on the firmware data packets written to the Flash memory of each industrial controller to be upgraded, and obtain the corresponding integrity verification results. In this embodiment, by performing local integrity verification on the firmware data packets written to the Flash memory of the industrial controller to be upgraded, firmware data incompleteness or errors caused by transmission interference, storage anomalies, etc., can be detected in advance. The fifth step is to receive the integrity verification result polling instruction issued by the master industrial controller and broadcast it to each industrial controller to be upgraded to obtain the integrity verification results of each industrial controller to be upgraded. In this embodiment, by broadcasting the result polling instruction to each industrial controller to be upgraded by the master industrial controller to collect the integrity verification results of each industrial controller to be upgraded, the number of interactions and waiting delays under the traditional one-by-one query method can be effectively reduced, enabling the master industrial controller to quickly and reliably grasp the firmware data readiness status of each node in the entire industrial control system.The sixth step is to receive the firmware version switching command issued by the main industrial controller and broadcast it to the slave industrial controllers to be upgraded that have passed integrity verification, thereby completing the online firmware upgrade. In this embodiment, the main industrial controller broadcasts the firmware version switching command to the slave industrial controllers to be upgraded that have passed integrity verification and executes it, ensuring that only slave industrial controllers with correct and complete firmware data perform the version switching operation. Furthermore, slave industrial controllers to be upgraded that fail integrity verification retain their original firmware version.

[0015] In this solution, the firmware data issued by the main industrial controller is first parsed and reconstructed by the industrial controller to be upgraded, and the reconstructed firmware data is written to its own Flash memory. Subsequently, local integrity verification is performed on the firmware data already written to the Flash memory. This can effectively prevent the industrial controller from switching versions based on incomplete or incorrect firmware data, thereby ensuring the success rate of industrial controller firmware upgrade.

[0016] Preferably, in step S3, the firmware data packet issued by the main industrial controller is sent to each slave industrial controller to be upgraded for parsing and reassembly, and the reassembled firmware data packet is written to the corresponding Flash memory. This specifically includes the following sub-steps: Step S31: Establish a receive status table for each industrial controller, wherein the receive status table is used to record the sequence number information of the received firmware data packets; Step S32: Based on the serial number information of the firmware data packets, perform out-of-order rearrangement and continuity verification on each firmware data packet received from the industrial controller to be upgraded. Step S33: Determine whether the firmware data packet processed in step S32 has filled the entire page of the preset Flash page. If yes, write the currently accumulated firmware data packet to the Flash memory of the industrial controller to be upgraded; otherwise, do not perform the write operation.

[0017] In this embodiment, in step S31, a receiving status table is established from the industrial controller to record the sequence number information of the received firmware data packets, providing a structured data foundation for subsequent data reassembly and continuity verification. In step S32, the firmware data packets are rearranged in random order to ensure that they are assembled into a complete firmware image in the correct sequence; continuity verification of the firmware data packets can promptly detect missing or abnormal firmware data packets. In step S33, by determining whether the processed firmware data packets fill the preset Flash page's full page data volume, Flash write operations are only performed when the full page condition is met, effectively reducing the number of Flash memory erase / write cycles and extending the Flash memory's lifespan.

[0018] Preferably, in step S3, during the process of sending the firmware data packet issued by the main industrial controller to the slave industrial controller to be upgraded, the following steps are also included: receiving the file transfer end instruction issued by the main industrial controller and broadcasting it to each slave industrial controller to be upgraded to perform the remaining firmware data packet writing operation that has not filled the entire preset Flash page.

[0019] In this embodiment, the main industrial controller broadcasts a file transfer termination command to each slave industrial controller to be upgraded, enabling each slave industrial controller to clearly understand that data transmission has terminated, effectively ensuring the reliability of the transmission termination. Upon receiving the file transfer termination command, the slave industrial controller will write any remaining firmware data packets in its cache that have not yet filled a preset Flash page into its own Flash memory, effectively avoiding the risk of data loss due to data remaining in the cache.

[0020] Preferably, in step S3, the firmware packet information includes the total firmware CRC; in step S4, the following sub-steps are specifically included: Step S41: Calculate the cyclic redundancy check value of the firmware data packet currently being upgraded and written from the Flash memory of the industrial controller using the CRC32 standard polynomial algorithm; Step S42: Determine whether the cyclic redundancy check value calculated in step S41 is consistent with the total firmware CRC. If yes, it is determined that the firmware data packet currently being upgraded and received from the industrial controller is complete and error-free, i.e., the integrity verification is qualified; if no, it is determined that the firmware data packet currently being upgraded and received from the industrial controller is missing or erroneous, i.e., the integrity verification is unqualified.

[0021] In this embodiment, in step S41, the CRC32 standard polynomial algorithm is an internationally recognized data integrity verification algorithm with advantages such as fast calculation speed and extremely low collision probability. By using this algorithm to calculate the cyclic redundancy check value of each firmware data packet written from the Flash memory of the industrial controller to be upgraded, the cyclic redundancy check value of the firmware data packet can be efficiently extracted as a feature identifier, providing an accurate and reliable quantitative basis for subsequent integrity comparison. In step S42, by comparing the cyclic redundancy check value calculated from each industrial controller to be upgraded with the total CRC of the firmware issued by the main industrial controller, accurate determination of firmware data integrity can be achieved.

[0022] Preferably, in step S6, the firmware version switching instruction issued by the main industrial controller is sent to the industrial controller to be upgraded that has passed the integrity verification to perform firmware version switching. Specifically, this includes the following sub-steps: mapping the physical memory start address of the industrial controller to be upgraded that has passed the integrity verification to an independent storage partition in the Flash memory used to store the new version firmware.

[0023] In this embodiment, by switching the physical memory starting address mapping to an independent storage partition in the Flash memory where the new firmware version is stored, the running version can be switched instantly without having to move the firmware data package, thereby saving firmware version switching time and enabling the industrial controller to quickly enter the new firmware version running state.

[0024] Preferably, the method further includes the following steps: receiving a firmware version polling command from the master industrial controller and sending it to the slave industrial controllers that have completed firmware upgrades to trigger them to perform firmware version verification. In this embodiment, by sending a firmware version polling command from the master industrial controller to the slave industrial controllers that have completed firmware upgrades, the current firmware version information of each slave industrial controller can be obtained in real time. By comparing and verifying with the target firmware version, it can be accurately confirmed whether each slave industrial controller has successfully completed the firmware upgrade.

[0025] Furthermore, the functional units in the various embodiments of the present invention can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0026] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. An industrial control system firmware online upgrade method, the industrial control system comprising a master industrial controller and a plurality of slave industrial controllers, characterized in that: The method includes the following steps: Step S1: Receive the Bootloader mode command issued by the master industrial controller and broadcast it to each slave industrial controller. The Bootloader mode is the underlying operating mode for firmware version updates. Step S2: Determine whether the firmware version of the current slave industrial controller is consistent with the target firmware version in the Bootloader mode instruction. If they are consistent, it is determined that the current slave industrial controller does not need firmware upgrade; if they are inconsistent, the current slave industrial controller is designated as a slave industrial controller to be upgraded. Step S3: First, receive the firmware sub-packet information and firmware data packet sent by the main industrial controller. Then, send the firmware data packet to each slave industrial controller to be upgraded in a broadcast manner for parsing and reassembly. Write the reassembled firmware data packet to the Flash memory of the corresponding slave industrial controller to be upgraded. Step S4: Perform local integrity verification on each firmware data packet written from the Flash memory of the industrial controller to be upgraded, and obtain the corresponding integrity verification results; Step S5: Receive the integrity verification result polling command issued by the master industrial controller and broadcast it to each slave industrial controller to be upgraded in order to obtain the integrity verification result of each slave industrial controller to be upgraded; Step S6: Receive the firmware version switching command issued by the main industrial controller and broadcast it to the industrial controllers to be upgraded that have passed integrity verification to switch the firmware version and complete the online firmware upgrade.

2. The method for online firmware upgrade of an industrial control system according to claim 1, characterized in that: In step S3, the firmware data packet issued by the main industrial controller is sent to each slave industrial controller to be upgraded for parsing and reassembly, and the reassembled firmware data packet is written to the corresponding Flash memory. This includes the following sub-steps: Step S31: Establish a receive status table for each industrial controller, wherein the receive status table is used to record the sequence number information of the received firmware data packets; Step S32: Based on the serial number information of the firmware data packets, perform out-of-order rearrangement and continuity verification on each firmware data packet received from the industrial controller to be upgraded. Step S33: Determine whether the firmware data packet processed in step S32 has filled the entire page of the preset Flash page. If yes, write the currently accumulated firmware data packet to the Flash memory of the industrial controller to be upgraded; otherwise, do not perform the write operation.

3. The method for online firmware upgrade of an industrial control system according to claim 2, characterized in that: In step S3, the process of sending the firmware data packet issued by the main industrial controller to the slave industrial controller to be upgraded also includes the following steps: Receive the file transfer end command issued by the main industrial controller and broadcast it to each industrial controller to be upgraded to perform the remaining firmware data packet writing operation that does not fill the preset Flash page.

4. The method for online firmware upgrade of an industrial control system according to claim 1, characterized in that: In step S3, the firmware packet information includes the total firmware CRC; Step S4 specifically includes the following sub-steps: Step S41: Calculate the cyclic redundancy check value of the firmware data packet currently being upgraded and written from the Flash memory of the industrial controller using the CRC32 standard polynomial algorithm. Step S42: Determine whether the cyclic redundancy check value calculated in step S41 is consistent with the total CRC of the firmware. If yes, it is determined that the firmware data packet received from the industrial controller to be upgraded is complete and error-free, i.e., the integrity verification is qualified; if no, it is determined that the firmware data packet received from the industrial controller to be upgraded is missing or erroneous, i.e., the integrity verification is unqualified.

5. The method for online firmware upgrade of an industrial control system according to claim 1, characterized in that: In step S6, the firmware version switching command issued by the main industrial controller is sent to the industrial controller to be upgraded that has passed integrity verification to perform the firmware version switching. This specifically includes the following sub-steps: The integrity verification-qualified upgrade candidates are switched from the physical memory starting address mapping of the industrial controller to a separate storage partition in the Flash memory used to store the new firmware version.

6. The method for online firmware upgrade of an industrial control system according to claim 1, characterized in that: It also includes the following steps: Receive firmware version polling instructions from the master industrial controller and send them to the slave industrial controller that has completed the firmware upgrade to trigger it to perform firmware version verification.

Images