Failsafe Firmware Updates via Segmented Non-Volatile Memory
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Firmware updates in embedded devices often result in devices becoming unusable due to power loss or communication interruptions, with existing solutions either not being fully failsafe or requiring excessive memory resources.
Innovation Solution
The implementation of a non-volatile memory divided into three sections: a bootstrap image section, an updater image section, and an application image section, allowing for safe firmware updates by temporarily storing the updater program in the application image section, verifying it, and then moving it to the updater section, ensuring the device remains operational even during reboots or errors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If firmware is buffered in external memory (RAM) before erasing existing firmware, then verification can be performed before update, but the device is vulnerable to power loss during the erase-to-write transition and requires large external buffer memory
Solution Approach 1:
The non-volatile memory is segmented into three distinct sections: application image section, updater image section, and a third section for bootstrap. This segmentation allows the updater program to be temporarily stored in the application image section during updates, eliminating the need for large external buffers while maintaining update safety through structured memory organization.
Solution Approach 2:
The new updater program is completely written and verified in the application image section before any erasure of the existing updater section occurs. This preliminary action ensures that a valid updater program is ready before the old one is destroyed, preventing brick scenarios during power loss.
2Reliability
If a fully redundant firmware copy is maintained, then the device is protected against power loss during updates, but the storage requirement doubles
Solution Approach 1:
The memory is divided into three non-overlapping sections, allowing the updater program to be temporarily placed in the application image section during updates. This segmentation enables a form of redundancy protection without requiring a complete duplicate of the entire firmware, thus reducing storage requirements compared to full redundancy.
Solution Approach 2:
The complete updater program is written and verified in the application image section before erasing the existing updater section. This ensures that a valid updater program is already in place and verified before the old updater is removed, providing protection against power loss without needing full redundancy of all firmware components.
3Quantity of substance
If the updater program is stored in the application image section temporarily, then memory footprint is minimized, but the section must serve dual purposes as both application storage and updater temporary storage
Solution Approach 1:
The application image section serves multiple functions: it stores the application program during normal operation, and temporarily stores the updater program during firmware updates. This multi-functionality reduces the overall memory footprint by eliminating the need for separate dedicated updater storage space.
Solution Approach 2:
The memory is segmented into three distinct non-overlapping sections, which provides clear boundaries and management rules for each section. This segmentation manages the complexity of multi-functionality by establishing clear rules for when and how the application image section transitions between storing applications and storing updaters.
Data Source
AI summary
A method of updating an electronic device. The device has a non-volatile memory divided into at least three non-overlapping sections, a bootstrap image section, a updater image section, and a application image section. The method includes erasing the application image section of the non-volatile memory, receiving a firmware update, writing the firmware update into the application image section, rebooting the electronic device, determining one of an application program and an updater program resides in the application image section, executing the application program when the application program is determined to reside in the application image section, erasing the updater image section of the non-volatile memory when the updater program is determined to reside in the application image section, and moving the updater program from the application image section to the updater image section.