Failsafe Bootloader Firmware Update via Jump Code
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for updating bootloader firmware in systems like fire protection and intrusion detection systems are prone to failure due to the risk of the controller becoming inoperable if it loses power or is restarted during the update process, leading to potential corruption or incomplete updates.
Innovation Solution
A method that involves storing a bootloader update application in a second set of memory blocks and using a jump code in the initial memory block to ensure that the update process can resume safely even if power is lost, by providing internal energy to complete the update and bypass potentially corrupted bootloader code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional bootloader update methods are used, then the update process is simple, but the controller becomes vulnerable to power loss and may become inoperable
Solution Approach 1:
The non-volatile memory is divided into two separate sets of memory blocks: a first set for storing the bootloader and a second set for storing the bootloader update application. This segmentation allows the update application to execute from the second set while writing to the first set, preventing corruption during updates and enabling recovery if power is lost.
Solution Approach 2:
The bootloader update application is loaded and executed before the actual bootloader update begins. The application prepares the memory blocks, establishes the update mechanism, and can restore the initial bootloader state if needed. This preliminary setup ensures that even if power is lost during the update, the system can recover by re-executing the same update application.
2Ease of manufacture
If the bootloader is updated in-place, then the update process is straightforward, but power loss during updating can corrupt the bootloader and brick the controller
Solution Approach 1:
The bootloader update application serves as an intermediary between the external update source and the bootloader memory blocks. It manages the update process by reading update data, validating it, and writing to the bootloader blocks in a controlled manner. This intermediary layer provides error checking and can restore the original bootloader if the update fails or power is lost.
Solution Approach 2:
Different memory blocks are assigned different functions: the first set of blocks stores the bootloader with its initial block containing startup code, while the second set stores the update application. This local differentiation allows the system to maintain a working bootloader while performing updates, ensuring that power loss during updates does not corrupt the active bootloader.
3Reliability
If the initial memory block is overwritten with jump code, then power loss can be survived and update can resume, but the memory structure becomes more complex
Solution Approach 1:
Instead of overwriting the initial bootloader block with a jump code that points to the update application, the patent inverts the approach: the update application is stored in the second set of memory blocks and executes itself to perform the update. The initial block of the first set retains its bootloader functionality, and the update mechanism works by coordinating between the two sets rather than replacing the startup code.
Data Source
AI summary
A method of updating firmware stored in a non-volatile memory of a controller is disclosed. The non-volatile memory includes a first set of memory blocks configured to store a bootloader for the controller. The method includes storing a bootloader update application in a second set of memory blocks of the non-volatile memory, and storing a jump code in an initial memory block of the first set of memory blocks, wherein the jump code comprises an instruction to jump to an initial memory block of the second set of memory blocks.