200428287 玖、發明說明： 【發明所屬之技術領域】 本發明係關於一種具有雙拷貝升級的穩定性及單拷胃 僅佔用較小儲存空間優點的韌體升級方法。 【先前技術】 對於一個出龜後仍有可能需要進行作軟體更新的IA 或礙入式系統產品種類而言，更新過程中有許多種原因可 能會造成更新過程的不正常結束，包括切斷電源、網路連 線中斷（或無法連線）、伺服s、僖+運你^ ^ ^200428287 (1) Description of the invention: [Technical field to which the invention belongs] The present invention relates to a firmware upgrade method which has the advantages of dual copy upgrade stability and single copy stomach only occupying less storage space. [Previous technology] For an IA or interfering system product type that may still need to be updated after the turtle is released, there are many reasons during the update process that may cause the update process to end abnormally, including cutting off the power. , Internet connection is interrupted (or unable to connect), servos, 僖 + 运 你 ^ ^ ^
m評述如后：m comment as follows:
的雙拷貝（two copy )方式： 要有兩種，一是完全不作保 二是具有軟體更新保護功能Two copy (two copy) method: There are two types, one is not guaranteed at all, and the other is software update protection.
的錯誤，故只有單一 級方法（One Copy Firmware 即必須 I原始的軟體更新方式，在空間上只 仁是全不考量軟體更新時可能發生 拷貝的軟體程式在更新失敗時即必須 200428287 运廠修復，無法單靠產品本身修復内部軟體的錯誤。 雙拷貝拿刃體升級方法（Two c〇py Fir嶋re uErrors, so there is only a single level method (One Copy Firmware must be the original software update method. In terms of space, only software programs that may be copied when the software update is not taken into account must be repaired by the factory when the update fails. The internal software error cannot be repaired by the product alone. Two-copy upgrade method (Two c〇py Fir 嶋 re u
Aigorlthm)是安全性相對較高的軟體更新方式（如美國第 5m256、6357G21號發明專利案），主要是在產品内部伴 仔兩份軟體程式的拷貝，當軟體更新時會升級1中—/ 若更新過程失敗，還能夠利用另一個拷貝開機，並重：下 編本軟體。前述方法有多種變形，包括兩份拷 是不同的版本、每次升級都只更新同一個位置的拷 一份拷貝則永遠不更新（如美國帛6009500、6253281 635702b 653難號等發明專利案）。前述方式的優點在 於可保軟體的可靠性’缺點是兩份軟體程式拷貝造成儲 存空間的浪費，在程式未壓縮的情況下需要極大的錯存* 間，而軟體程式固然可以透過壓縮而減少佔用儲存空間= 惟一旦使用程式壓縮，則將會影響到開機速度。 由上述可知，既杨體升級方法不論是單拷貝或 貝方式都分別存在其缺點··前者可靠性低，發生錯誤= 必須送廢重新燒錄軟體，造成使用不便；後者相對可靠性 高，但須㈣大量儲存空間；故既有升級技術因 而陷入兩難。 * '‘、、而’當省視丽述問題的根源時’會發現所謂可 韋刃體升級方法的問題本質，即是思考如何在升級的㈣階 段被中斷都有回復狀的能力；其反映出之所以必須存放兩 份拷貝的目的，即是為了维持重新開機及重新啟動 W程的能力’換言之’其意味著整份程式碼中需要保護 200428287 的只有開機及下載協定的部分，因此只需要將此部分獨立 出來作特殊處理，便可同時兼顧穩定性、可靠性，並解決 儲存空間浪費的問題。 【發明内容】 因此，本發明主要目的係在節省空間與提升穩定性的 考置下，提供一個具有雙拷貝升級的穩定性及單拷貝較小 儲存空間優點的韌體升級方法。 為達成前述目的採取的主要技術手段係先定義一軟體 由一啟動裝載器、一啟動資料及一應用資料組成，其中啟 動資：僅包含重新開機及啟動軟體更新流程的啟動碼與相 關協疋，且程式碼佔用空間小於應用資料； 前述軟體進行升級_ H清空應用資料以空出—第 一儲存空間， 又下載一新版啟動資料存放於第 ，奴後移除舊版的啟動資料並空出一第二 下載新版應用資料存放在第二儲存空間， 一儲存空間 一第二儲存空間，最後 空間，以完成更新升級Aigorlthm) is a relatively high-security software update method (such as the US Patent No. 5m256 and 6357G21), which is mainly a copy of two software programs inside the product. When the software is updated, it will be upgraded 1-// if The update process failed, you can also boot with another copy, and do the same: edit the software. There are many variants of the foregoing method, including two copies that are different versions, and only one copy of the same location is updated for each upgrade, and one copy is never updated (such as US patents such as 6009500, 6253281, 635702b, 653, etc.). The advantage of the foregoing method is that it can guarantee the reliability of the software. The disadvantage is that two copies of the software program cause a waste of storage space. When the program is not compressed, it requires a large amount of mismatches. * Of course, the software program can reduce the occupation by compressing it. Storage space = But once program compression is used, it will affect boot speed. It can be known from the above that both the Yang body upgrade method has its shortcomings, whether it is a single copy or a shell method. The former has low reliability, and an error occurs. The software must be sent to be re-burned, causing inconvenience; the latter is relatively reliable, but Large amounts of storage space are required; therefore, existing upgrade technologies are in a dilemma. * ”, And 'when looking at the root cause of the Lishu problem', you will find the essence of the so-called Cowell blade upgrade method, that is, the ability to think about how to be interrupted during the rampant stage of the upgrade; its reflection The reason why two copies must be stored is to maintain the ability to restart and restart the process. In other words, it means that only the boot and download part of the 200428287 need to be protected in the entire code, so only the Separating this part for special treatment can take into account both stability and reliability, and solve the problem of wasted storage space. [Summary of the Invention] Therefore, the main purpose of the present invention is to provide a firmware upgrade method with the advantages of dual-copy upgrade stability and smaller storage space under the consideration of saving space and improving stability. The main technical means adopted to achieve the aforementioned purpose is to first define a software consisting of a boot loader, a boot data, and an application data, wherein the boot capital: only includes the boot code and related cooperation code for restarting and booting the software update process, And the code occupies less space than the application data; the aforementioned software is upgraded _H clears the application data to make it empty-the first storage space, and downloads a new version of the startup data to store in the first, after the slave removes the old version of the startup data and vacates one The second download of the new version of the application data is stored in the second storage space, one storage space, the second storage space, and the last space to complete the update.
前述方法亦同時配合儲存空間 的交換， 與可靠性；再 故只需使用單 200428287 拷貝的儲存空間 級時的可信賴度 浪費的問題。 由上述可知，本發明不僅確保了軟體升 更排除了雙拷貝更新方法造成儲存空間 【實施方式】 百先如第-圖所示，本發明係先一定義軟體下列的三 個部份組成：其分別為一啟動裝載器(b〇〇t ―)(丄〇 )、一啟動貢料（boot image) ( 2 〇 )及一應用資料 (application image )( 3 〇 );其中： 忒啟動裝載器（1 〇 )是一個啟動時執行的程式，具 有簡單的判斷機制，藉以選擇特定位址上的啟動資料（2 ◦)複製至記憶體（RAM)中並予執行，而啟動裝載器（1 〇 ))在出廠後即永遠不被更新； «亥啟動資料（2 0 )係包含有：啟動碼（b〇〇t code )、 及微控制碼（Micro-Control ler Code );其中，該微控制碼 可以是完整的硬體驅動程式及硬體支援API，或只是包含 開機及網路相關必須的硬體支援、網路基本協定（TCP/ IP 、DHCP等）以及下載協定（FTP、TFTP等）。該啟動資料（ 2 0 )並負責對硬體進行初始化之後，將應用資料（3 0 )從特定位址複製到記憶體中繼續執行； 該應用資料（3 0 )包含剩餘的微控制碼（Micro-Controller Code )、完整的網路功能協定、狀態機器 (state machine ) # 〇 根據軟體分割的作法區分，該啟動資料（2 0 )與應 200428287 用貝t ( 3 〇 )的分割可以利用下列兩種方式： )一&種方式是讓啟動資料（2 0 )與應用資料（3 〇 「者分別有—份RTOS，在此狀況下，表示啟動資料（2 ，▲人應用貝料（3 0 )各自為完整可執行的資料（image) :動貝料（2 〇 )在本身執行完成後，將應用資料（ 載入到記憶體中以取代啟㈣料（2 Q )繼續執行 料=明採用的第二種方式則只保留一份咖在啟動實 )/，亦即將具有重新開機及啟動軟體更新流程 用：料劃到啟動資料（20) ’其餘部份規劃到應 機與啟動更新流程功能、基本網路協定:而不 與大部份的協定層(protocol stack)，故 ，-1 的空間將小於應用資料（ 、“馬所儲存 令、M、主…戍 猎此可利用更新過程中 透過 > 月除應用資料（30)戶斤釋放出來的儲存 : 由伺服器下載的資料（image)。 存放 /請^第二圖所示’係本發明更新軟體時 間父換不意圖，首先如第二圖入所示，係儲存 子二 狀態，其中啟動裝載器（1 0 )的區塊位置永遠二:4原始 動資料（2 0 )與應用資料r q n、 ^ 、+受，啟 、τ” 3 〇 )白勺區塊起始琴 bl、a1。在進行軟體更新時，係先將應用資料（；：別為 空，以空出一第一儲存空間（31)(如第 ）清 ’接著下載新版的啟動資料（2〇，），椒所示） 資料（3削所釋放出來的第一健 '空應用 / 區塊起始點更 啟動資料（2 / b2)(如第二圖c所示），再將舊版的 動資料（2 ，〇)移除以空出儲存空間，加上儲存新版啟 (2 1 ) ( Y ^後所剩下的儲存空間構成一第二儲存空間 (Q π 5. 第一圖D所示），接著下載新版的應用資料 的M m 、载的新版應用資料（3 Ο，）存放前述 w乐一鍺存空間f 二圖E所厂、 、Z）内（區塊起始點更新為a2)(如第 )和庙1 斤：）；因此’當軟體下載結[啟動資料（20 ^不口應用資料f q n、 、 J U )的起始點將移位到新的位置（b2, a2) 而下次開機時啟勤# 動次斜 動虞載為（1 〇)即從新的位置複製啟 貝广、（2 〇 )到記憶體。 而則述軟體如再奴 ^ ^ jj, η、 丹、、二過另一 X更新後，該啟動資料（2 U )和應用資料f q 〜一 、（3 〇 )將會回到原始的位置（bl，al)(如 第二圖A〜E所示）。 由上述說明可以明顯看出本發明之兩項特點： 1 ·只使用單拷貝的儲存空間：由前述可以明顯看出 ’本發明在更新軟體的過程巾，係交叉的使用一既有容量 的儲存工間’換言 < ’只使用單拷貝的儲存m 定的完成軟體更新。 ~ 2 ·具有雙拷貝軟體升級方法的穩定度與可靠性：其 最重要的突破在於允許出現在更新過程中任何階段的錯誤 ’主要原因係不論更新過程在那一個階段中斷失敗，軟體 中均仍保留了一個完整的啟動資料，可供作為重新開機及 啟動軟體更新流程之用，故即使軟體更新失敗，亦可在重 新開機後重新執行軟體更新。 200428287 本發明啟動軟體的詳細流程係如第四圖所示，啟動時 ，該啟動裝載器（1 0 )程式將先被執行，並選擇由那一 個區塊將啟動碼（boot code )複製到記憶體，其選擇方式The aforementioned method also cooperates with the exchange of storage space, and reliability; therefore, it only needs to use a single 200428287 copy of the storage space level when the issue of reliability is wasted. It can be known from the above that the present invention not only ensures the software upgrade but also eliminates the storage space caused by the dual copy update method. [Embodiment] As shown in the first figure, the present invention first defines the following three components of the software: They are a boot loader (bOOt-) (丄 〇), a boot image (20), and an application image (30); of which: 1 〇) is a program executed at startup, with a simple judgment mechanism, by which the startup data (2 ◦) at a specific address is selected and copied to memory (RAM) and executed, and the loader (1 〇) ) Will never be updated after leaving the factory; «Hai startup data (20) contains: a startup code (b〇〇t code), and a micro-controller code (Micro-Control ler Code); Among them, the micro-controller code It can be a complete hardware driver and a hardware support API, or just include the necessary hardware support for startup and network related, basic network protocols (TCP / IP, DHCP, etc.) and download protocols (FTP, TFTP, etc.). After the startup data (20) is responsible for initializing the hardware, the application data (30) is copied from a specific address to the memory to continue execution; the application data (30) contains the remaining micro control code (Micro -Controller Code), complete network function agreement, state machine (State machine) # 〇 According to the method of software segmentation, the startup data (20) and the application of 200428287 (30) segmentation can use the following two One way:) One way is to use the startup data (20) and the application data (30), or one RTOS respectively. In this case, it means the startup data (2, ▲ person applies shell material (3 0 ) Each is a complete and executable data (image): After the shell material (20) is completed, it will load the application data (into memory to replace the Kai material (2 Q)) and continue to execute the material = clearly adopted The second way is to keep only one copy of the coffee in the startup real) /, also about to restart the system and start the software update process: planning to the startup data (20) 'The rest is planned to respond to the machine and start the update process function Basic network protocols: and And most of the protocol stack, so the space of -1 will be less than the application data (, "Horse storage order, M, master ... Hunting this can be used in the update process through > monthly application data ( 30) Storage released by households: data (image) downloaded by the server. Storage / please ^ The second picture 'is the time when the software update of the present invention is not intended. First, as shown in the second picture, it is Store the second state, where the block position of the boot loader (1 0) is always two: 4 The original dynamic data (20) and the application data rqn, ^, + receive, start, τ "3 〇) Shiqin bl, a1. When performing a software update, first delete the application data (;: Do n’t leave it empty to clear a first storage space (31) (such as the first) and then download the new version of the startup data (2〇 (), As shown in the pepper) data (the first Jian 'empty application / block starting point release data released by 3 cutting (2 / b2) (as shown in the second figure c), and then the old version Move the data (2, 0) to remove the storage space, and save the new storage space after the new version of Kai (2 1) (Y ^ A second storage space (Q π 5. shown in the first figure D) is then downloaded, and then the new version of the application data M m is downloaded, and the new version of the application data (3 0,) is stored to store the aforementioned music storage space f 2 Figure E (Factory,, Z) (the starting point of the block is updated to a2) (such as the first) and the temple 1 kg :); therefore 'When the software download ends [startup data (20 ^ not mouth application data fqn,, JU ) The starting point will be shifted to the new position (b2, a2), and the next time the machine is turned on, Qiqin # will be tilted, and the payload will be (1 0), which means that Qibei Guang and (2 0) are copied from the new position to the memory. body. However, if the software described above is re-slaved ^ ^ jj, η, Dan, and after another X update, the startup data (2 U) and application data fq ~ 1, (3 0) will return to the original position ( bl, al) (as shown in the second figures A to E). From the above description, two features of the present invention can be clearly seen: 1. Use only a single copy of storage space: From the foregoing, it can be clearly seen that the process of updating the software of the present invention uses an existing capacity of storage. Workshop 'In other words <' Complete software update using only a single copy of storage. ~ 2 · Stability and reliability of the dual-copy software upgrade method: The most important breakthrough is to allow errors at any stage of the update process. The main reason is that no matter what stage of the update process is interrupted and failed, the software is still A complete startup data is retained for restarting and starting the software update process, so even if the software update fails, you can re-run the software update after restarting. 200428287 The detailed process of the boot software of the present invention is shown in the fourth figure. When booting, the boot loader (10) program will be executed first, and the block is selected to copy the boot code to the memory. Body, its selection
是檢查存放的系統變數BootVar (該變數可儲存在肝RAM 或Flash巾），i要作用在記錄開機日夺應啟動那一個啟動 貝料（2 0 )區塊’當其值4 1代表第一個區塊⑻），其 值為2代表第二區塊（b2)，若為其他數值則仍使用第一個 區塊（bl); 在決定啟動資料（2 0 )的起始位置之後，啟動裝載 器（1 〇)會判斷啟動資料（2 〇)的總值檢查(check sum)是否正確（301)，如不正確，啟動裝載器（丄〇 )將檢 查另-個啟動資料（2 〇 )是否存在(3〇3)(如果更新曾失 敗，且發生在下載新版啟動資料之後，則軟體中即可能存 在二份啟動資料），如果存在，則判斷其總值檢查（check sum)是否正確（303)，如正確時，啟動裝載器（工〇 )將改 成執行第二份啟動資料（2 0 )，並將系統變數（BootVar) ，定為由該份啟動資料（2 0 )開機⑽4);當啟動碼執行 凡畢後，將根據系統變數（B〇〇tVar)決定應用資料（3 〇 ) 斤在的區塊（3〇5)並判斷其總值檢查（check s⑽）（3〇6);若 ▲應用貝料（3 0 )區域不存在或總值檢查不正確，該啟 動碼則將執仃軟體更新程式（3Q7)，重新下載—份啟動資料 (2 0 )與應用資料（3 〇 )。 、反之’右该應用資料（3 〇 )區塊存在且通過總值檢 二（check sum)’則啟動碼會將應用資料（3 〇 )複製到記 200428287 憶體中並予& 从執行（308)。 如果則述的第二份啟動資料 啟動資料（？ n a 2 〇 )不存在，即表示 復原，故It可在更新過程中損壞，因而無法自動 (_，以通：使：二硬體例如指示燈）顯示錯誤訊息 使用者將產品送廠修復。 迭成更新軟體時的詳細流程係如第五圖所示； 2= 因'包括：當應用資料（3〇)不存在 :’及版本過舊時（由使用者或伺服器端促使執 新版本軟體的動作）皆會啟動軟體更新的流程。 當軟體進行更新時，首先會檢查系統變數(Boo⑽ ，右為1係表示需釋放的應用資料（3 0 )儲存空間 起始點在ai位置⑽），若為2係表示需釋放的應用資料 (3 0 )儲存空間起始點在a2位置（4〇2)，接著程式會清 除快閃記憶體(Flash)中屬於應用資料(3 〇 )部份的區塊 (blodO ’ p遺後將τ載新版本的啟動資料（2 〇 )存放在釋 放出來的儲存空間⑷4, 4G4)，亦即系統變數為i，即存放 在b2的位置，若系統變數為2則存放在μ的位置； 經下載完畢後，程式會判斷啟動資料（2 〇 )的總值 檢查（比^1^挪）（405,406)，若通過檢查’即將系統變數 (BootVar)設在新版的啟動資料（2 〇 )位置，並將原本的 啟動資料（2 0 )移除，若未能通過檢查，則須重新下載 啟動資料（2 0 );接著從伺服器下載新版的應用資料（ 3 0 )，並儲存在剩下的空間（407,408)，且進行總值檢查 (checksum ) (409, 41 0)，若未能通過檢查則重新下載應用資 200428287 料（3 0 ) (407, 408)，若通過檢查則表示軟體更新完成， 即改變系統變數（411，412)，並重新開機（413)以啟動新版 本的軟體。 由上述可知，本發明主要作用在於軟體更新過程的任 何階段皆至少有一份啟動資料是完整且可被執行的，所以 ，在軟體更新過程的任何時候如發生中斷更新的情形，例 如拔掉電源、或網路線等，冑彳利用該啟動資料開機並重新 下載軟體。且前述方法只約使用了單一拷貝的儲存空間： 同時解決了雙拷貝韌體升級方法浪費大量 ,,,^ 丨了工間的缺點 务明兼具雙拷貝/單拷貝韌體升級方法 门α士士 〜1炎黑占’祐 同二克服二者之缺陷，故已具備顯著的實用性與進步性，’ 並付&兔明專利要件，爰依法提起申請。 , 【圖式簡單說明】 (一）圖式部分 第一圖：係本發明之軟體組成示意圖。 第一圖A〜E :係本發明更新軟體時之 一儲存空間交 換狀況示意圖。 第一圖A〜E ··係本發明更新軟體時又 一儲存空間交 換狀況示意圖。 第四圖：係本發明之軟體啟動流程圖。 第五圖：係本發明之軟體升級流程圖。 (二）元件代表符號 (1 〇 )啟動裝載器（2 0 )( 2 0，）啟動資料 200428287 (2 1 )第二儲存空間（3 0 ) ( 3 0 ’）應用資料 (3 1 )第一儲存空間It is to check the stored system variable BootVar (this variable can be stored in the liver RAM or Flash towel), i should be used to record the start-up material (20) block that should be started on the boot day, when its value is 4 1 represents the first Block ⑻), whose value is 2 represents the second block (b2), if it is other values, the first block (bl) is still used; after determining the starting position of the starting data (2 0), start The loader (1 〇) will judge whether the checksum of the startup data (2 〇) is correct (301). If it is incorrect, the startup loader (丄 〇) will check another startup data (2 〇) Whether it exists (3〇3) (if the update has failed and it occurs after downloading the new version of the startup data, there may be two copies of the startup data in the software), if it exists, determine whether the total check (sum) is correct ( 303), if it is correct, the boot loader (work 0) will be changed to execute the second copy of the startup data (20), and the system variable (BootVar) is determined to be booted from the startup data (20) ⑽ 4) ; When the start code is executed, the application data will be determined according to the system variable (B〇〇tVar) The block (3 0) in which the material (30) is present and the total value check (30) is judged; if ▲ the application material (3 0) area does not exist or the total value check is incorrect, The activation code will execute the software update program (3Q7) and download again—a copy of the startup data (20) and the application data (30). Otherwise, the 'right that the application data (30) block exists and passes the checksum' (check sum) ', the activation code will copy the application data (30) to the 200428287 memory and & 308). If the second startup data (? Na 2 〇) mentioned above does not exist, it means recovery, so it can be damaged during the update process, so it cannot be automatically (_, through: make: two hardware such as indicator light ) An error message is displayed and the user sends the product to the factory for repair. The detailed process when updating the software is shown in the fifth figure; 2 = Because of 'including: when the application data (30) does not exist:' and the version is too old (prompted by the user or server to implement the new version of the software Actions) will start the software update process. When the software is updated, it will first check the system variables (Boo⑽, the right is 1 means that the application data needs to be released (30), the starting point of the storage space is at ai position ⑽), if it is 2 means that the application data needs to be released ( 3 0) The starting point of the storage space is at the a2 position (402), and then the program will clear the blocks in the flash memory (Flash) that belong to the application data (30). The startup data of the new version (20) is stored in the released storage space (4, 4G4), that is, the system variable is i, which is stored in the location of b2, and if the system variable is 2, it is stored in the location of μ; after the download is completed, After that, the program will check the total value of the startup data (2 0) (than ^ 1 ^ move) (405,406). If you pass the check, the system variable (BootVar) will be set to the new version of the startup data (2 0), and The original startup data (20) is removed. If the inspection fails, you must download the startup data (20) again; then download the new version of the application data (30) from the server and store it in the remaining space ( 407,408), and check the total value (checksum) (409, 41 0), if not After the inspection, download the application data 200428287 (30) (407, 408). If the inspection is passed, the software update is completed, that is, change the system variables (411, 412), and restart (413) to start the new version of the software. . It can be seen from the above that the main function of the present invention is that at least one startup data is complete and executable at any stage of the software update process. Therefore, if the update is interrupted at any time during the software update process, such as unplugging the power Or network cable, etc., use the startup data to boot and re-download the software. In addition, the foregoing method only uses a single copy of storage space: At the same time, it solves the waste of the dual-copy firmware upgrade method, which greatly wastes the work space. Shi ~ 1 Yanheizhan 'Youtong Er overcomes the shortcomings of the two, so it has significant practicability and progress,' and pays & Rabbit Ming patent requirements, and filed an application according to law. [Simplified description of the drawings] (I) Schematic part The first drawing: is a schematic diagram of the software composition of the present invention. The first pictures A to E are schematic diagrams of a storage space exchange situation when the software is updated in the present invention. The first pictures A to E are schematic diagrams of another storage space exchange situation when the software is updated in the present invention. Fig. 4 is a flowchart of software startup of the present invention. Fifth figure: is a software upgrade flowchart of the present invention. (2) Component representative symbol (10) Start loader (20) (20,) Start data 200428287 (2 1) Second storage space (3 0) (30 ') Application data (3 1) First storage space
1212