1240890 运廠修復，無法單靠產品本身修復内部軟體的錯誤。 雙拷貝韌體升級方法（Two Copy Firmware1240890 Factory repair, unable to repair internal software errors by the product itself. Two copy firmware upgrade method (Two Copy Firmware
Algorithm )是安全性相對較高的軟體更新方式（如美國 5請256、6357〇21號發明專利案），主要是在產品内部保 存兩份軟體程式的拷貝，當軟體更新時會升級其中一份， 若更新過程失敗，還能夠利用另一個拷貝開機，並重新下 載新版本軟體。前述方法有多種變形，包括兩份拷貝可以 是不同的版本、每次升級都只更新同—個位置的拷貝，另 -份拷貝則永遠不更新（如美國帛_95〇〇、6咖以、 635702卜6536G38號等發明專利案）。前述方式的優點在 於可保障軟體的可靠性，棘上曰 軟體程式拷貝造成儲 費，在程式未壓縮的情況下需要極大的儲存空 ]而权體私式固然可以透過麼縮而減少佔用儲存空間， 〖隹一使用％式壓縮，則將會影響到開機速度。 ::述可知’既有動體升級方法不論是單 占.别者可靠性低’發生錯誤時即 必須达廠重新燒錄軟體， 才 高，但須佔用大量儲存^ 便，後者相對可靠性 而陷入兩難。 -間，故既有升級技術因前述因素 方I省視前述問題的根源時’會發現所謂可信賴 早刀月丑升、，及方法的問題本質，b田 段被中斷都有回復狀的4 考何在升級的任何階 份拷貝的目的，即是為 、存放兩 新、…… 維持重新開機及重新啟動軟體更 新級私的能力，換古 肢又 之其思味著整份程式碼中需要保護 l24〇89〇 的只有開機及下載協 出來作特殊處理，便 儲存空間浪費的問題 疋的部分，因此只需要將此部分獨立 可同時兼顧穩定性、可靠性，並解決 L發明内容】 因此’本發明主要目的係在節省空間與提升穩定性的 里下，提供—個具有雙拷貝升級的敎 儲存空間優點“讀升級方法。 早拷貝車乂小 為達成别述目的採取的主要技術手段係先 由：啟動裝載器、—啟動資料及一應用資料組成，並= :協刪包含重新開機及啟動軟體更新流程的啟動碼:: 關協疋，且程式碼你用空間小於應用資料； ” 一儲=體:行升級時，係先清空應用資料以空出-第 :存工間’又下載—新版啟動資料存放於第 ，鼢後移除舊版的啟動資料並空出一第二 工間 下载新版應用資料存放在第_ .子卫間，最後 ； 放在弟—儲存空間，以完成更新升級 而該軟體啟動時，則由啟動裝 動資料，隨後由啟動資料載入應用選擇執行啟 在前述的升級方法中，因係交替的下 ::動趣應用資料’當更新過程中的任何; 斷時，仍都有一份完整的啟動資料可供開機盘\出見中 私功能之用，有效確保了更新過程的穩定度 更新流 者，前述方法亦同時配合儲存空間的 、純，再 、，故只需使用單 1240890 拷貝的儲存空間；由上述可^，本發明不僅確保了軟體升 級時的可信賴冑’更排除了雙拷貝更新方法造成儲存空間 浪費的問題。 【實施方式】 百先如第一圖所示，本發明係先一定義軟體下列的三 個部份組成：其分別為一啟動裝載器（b〇〇t 1〇ader )(工〇 )、一啟動資料（boot image) ( 2 0 )及一應用資料 (application image )( 3 0 );其中： 该啟動裝載器（1 〇 )是一個啟動時執行的程式，具 有簡單的判斷機制，藉以選擇特定位址上的啟動資料（2 0 )複製至記憶體（RAM)中並予執行，而啟動裝載器（1 〇 ))在出廠後即永遠不被更新； 遠啟動資料（2 〇 )係包含有：啟動碼（boot code )、 及微控制碼（Micro-Controller Code);其中，該微控制碼 可以是完整的硬體驅動程式及硬體支援API，或只是包含 開機及網路相關必須的硬體支援、網路基本協定（Tcp/ ιρ 、DHCP等）以及下載協定（FTP、TFTP等）。該啟動資料（ 2 0 )並負責對硬體進行初始化之後，將應用資料（3〇 )攸4寸疋位址複製到記憶體中繼續執行·， 該應用資料（3 〇 )包含剩餘的微控制碼（Micro-Controller Code )、完整的網路功能協定、狀態機器 (state machine )等。 根據軟體分割的作法區分，該啟動資料（2 〇 )與應 6 1240890 、 k ύ U )的分割可以利用下列兩種方式： 第種方式是讓啟動資料（2 〇 )與應用資料（3 0 者刀別有一份RT〇S，在此狀況下，表示啟動資料（2 〇 )與應用貢料（3 0 )各自為完整可執行的資料（image) 亥啟動貝料（2 〇 )在本身執行完成後，將應用資料（ 3 〇 )載入到記憶體中以取代啟動資料（2 0 )繼續執行 _；本發明採用的第二種方式則只保留一份RT0S在啟動資 料^ 2 〇 )中；亦即將具有重新開機及啟動軟體更新流程 力:的伤規劃到啟動資米斗（2 〇 ) ，#餘部份規劃到應 用育料（3 〇 );由於啟動資料（2 〇 )只具備基本的開 機與啟動更新流程功能、基本網路協^，而不含狀態機哭 與大部份的協定層—i stad〇，故其程式竭所 的空間將小於應用資料（3(])，藉此可利用更新過程中 透過清除應用資料（3 0 )所釋放出來的儲存空間 由伺服器下載的資料（image)。 子放 又請參閱第二圖所示’係本發明更新軟體 間交換示意圖’首先如第二圖A所示，係儲存空的子工 狀態’其中啟動裝載器（10)的區塊位置永；二原始 動資料（2 0 )與應用資料（3 〇 )㈣塊起始點：，啟 b卜al。在進行軟體更新時，減將應用資料（·/別為 空，以空出一第一儲存空間（31)(如第二圖5〇)_清 ，接著下載新版的啟動資料（2 〇，），並存放在主=不） 資料（3 0 )後所釋放出來的第一儲存空 /月空應用 1240890 區塊起始點更新 啟動資料（2 f D —圖c所示），再將舊版的 動資料（2 〇，）$ 空出儲存空間，加上儲存新版啟 」谩所剩下的儲存空問播士、 (2 1)(如笛一 省仔工間構成-第二儲存空間 第一圖D所示），接菩丁番亡 (3 0 5),-者下载新版的應用資料 亚將下載的新版應用資料（1 n，、六 的第二儲存空間 貝抖（3 0 )存放前述 二圖E所示）^21)内（區塊起始點更新為必（如第 h應用資料Ο二當軟體下載結束，啟動資料（2〇 ，而下次開機 動資料（2 π、彳載°。（1 〇)即從新的位置複製啟 貝丁十（2 〇)到記憶體。 而：述軟體如再經過另一次更新後，該 第一 R △ ( 3 〇 )將會回到原始的位置（bl，al)(如 弟二圖A〜E所示）。 由上述說明可以明顯看出本發明之兩項特點·· ，t ·只使用單拷貝的儲存m由前料以明顯看出 ’本發明在更新軟體的過程中’係、交叉的使用—既有容量 =儲存空@ ’換言之，只使用單拷貝的儲存空間，即可穩 疋的完成軟體更新。 . =2具有雙拷貝軟體升級方法的穩定度與可靠性：其 取重要的突破在於允許出現在更新過程中任何階段的錯誤 主要原因係不論更新過程在那一個階段中斷失敗，軟體 中均仍保留了一個完整的啟動資料，可供作為重新開機及 啟動軟體更新流程之用，故即使軟體更新失敗，亦可在重 新開機後重新執行軟體更新。 1240890 本發明啟動軟體的詳細流程係如第四圖所示，啟動時 ’該啟動裝載g ( 1 〇)程式將先被執行，並選擇由那一 個區塊將啟動碼（boot code )複製到記憶體，其選擇方式 是檢查存放的系統變數—（該變數可儲存在n侧 f Flash中），主要作用在記錄開機時應啟動那一個啟動 育料（2 0 )區塊，當其值& !代表第一個區塊⑽，其 值為2代表第二區塊(b2)，若為其他數值則仍使用第—個 區塊（bl); 在決定啟動資料（2 〇 )的起始位置之後，啟動裝載 器（1 0 )會判斷啟動資料（2 0 )的總值檢查（check sum)是否正確（301)，如不正確，啟動裝載器（丄〇 )將檢 查另一個啟動資料（20)是否存在（3〇3)(如果更新曾失 敗，且發生在下載新版啟動資料之後，則軟體中即可能存 在二份啟動資料），如果存在，則判斷其總值檢查（ckA sum)是否正確（303)，如正確時，啟動裝載器（丄〇 )將改 成執行第二份啟動資料（2 〇 )，並將系統變數（B〇〇tVar) 設定為由該份啟動資料（2 〇 )開機（3〇4);當啟動碼執行 完畢後，將根據系統變數（Bo〇tVar)決定應用資料（3 〇 ) 所在的區塊（305)並判斷其總值檢查（check sum)(3〇6);若 該應用資料（3 0 )區域不存在或總值檢查不正確，該啟 動碼則將執行軟體更新程式（3〇7)，重新下載一份啟動資料 (2 0 )與應用資料（3 〇 )。 反之，若該應用資料（3 0 )區塊存在且通過總值檢 查（check sum )’則啟動碼會將應用資料（3 〇 )複製到記 1240890 憶體中並予以執行（308)。 如果前述的第二份啟動資料（2 〇 )不存在，即表示 啟動資料（2 〇 ) +是在更新過程中損壞，因而無法自動 復原ϋ此日寸可另以硬體（例如指示燈）顯示錯誤訊息 (309)，以通知使用者將產品送廠修復。 至於本發明更新軟體時的詳細流程係如第五圖所示； 仏成軟體更新的原因係包括：當應用資料（3 〇 )不存在 或不凡t時，及版本過舊時（由使用者或伺服器端促使執 行下載新版本軟體的動作）皆會啟動軟體更新的流程。 當軟體進行更新時，首先會檢查系统·變數（B〇〇tVar) (400) ’若為1係表示需釋放的應用資料（3 〇 )儲存空間 I u 在al位置（401)，若為2係表示需釋放的應用資料 (3 0 )儲存空間起始點在a2位置（4〇2)，接著程式會清 除快閃記憶體(Flash)中屬於應用資料（3 〇 )部份的區塊 (block)’隨後將下載新版本的啟動詞(2 q )存放在釋 放出來的儲存空間⑷4,偏），亦即系統變數為卜即存放 在b2的位置，若系統變數為2則存放在η的位置； 經下載完畢後，程式會判斷啟動資料（2 〇 )的總值 檢查（^!比1^11111)(405,406)，若通過檢查，即將系統變數 (BootVar)設在新版的啟動資料（2 Q )位置，並將原本的 啟動資料（2 〇 )矛多除’若未能通過檢查，則須重新下載 啟動貝料（2 Q )，接著從祠服器下載新版的應用資料（ 3 0 )，並儲存在剩下的空間（4〇7,4〇8)，且進行總值檢查 (checks·)⑽，⑽，若未能通過檢查則重新下載應用資 1240890 料（3 0 ) (407, 408)，若通過檢查則表示軟體更新完成， 即改變系統變數（411，412)，並重新開機（413)以啟動新版 本的軟體。 田上述 何階段皆至 ’在軟體更 如拔掉電源 下载軟體。 同時解決了 ’故本發明 同時克服二 並符合發明 σ Π，本备明主要作用在於軟體更新過程的任 少有一份啟動資料是完整且可被執行的，所以 新過程的任何時候如發生中斷更新的情形，例 或㈣線等，皆可利用該啟動資料開機並重新 且前述方法只約使用了單一拷貝的儲存空間， 雙拷貝款料級方法浪費大量儲存空間的㈣ =具雙拷貝/單拷貝_升級方法之優點，並 之缺陷，故已具備顯著的實用性與進步性， 專利要件，菱依法提起申請。 【圖式簡單說明】 (一）圖式部分 儲存空間交 儲存空間交 第—圖：係本發明之軟體組成示意圖。 第一圖A〜E ··係本發明更新軟體時之一 ^ 換狀況示意圖。 ^ 一圖A〜E •係本發明更新軟體時又一 ^ 換狀況示意圖。 第四圖：係本發明之軟體啟動流程圖。 弟五圖：係本發明之軟體升級流程圖。 (二）元件代表符號Algorithm) is a software update method with relatively high security (such as the US Patent No. 256, 6357〇21 invention patent case), which mainly saves two copies of software programs inside the product, and one of them will be upgraded when the software is updated If the update process fails, you can also boot with another copy and download the new version of the software again. There are many variants of the foregoing method, including that the two copies can be different versions, and only the copy in the same location is updated for each upgrade, and the other copy is never updated (such as US _95500, 6 coffee, 635702 Bu 6536G38 and other invention patent cases). The advantage of the foregoing method is that it can ensure the reliability of the software. It is said that the software program copy causes storage costs. When the program is not compressed, it requires a large amount of storage space. Of course, the private body can reduce the storage space through shrinking. , 〖First use% compression, it will affect the boot speed. :: It can be known that 'existing moving body upgrade methods are single-occupied. Others have low reliability.' When an error occurs, the software must be re-programmed to the factory to be high, but it requires a large amount of storage. The latter is relatively reliable. In a dilemma. -Before, when the existing upgrade technology is based on the foregoing factors, I will ignore the root cause of the aforementioned problems, and will find the so-called credible early knife surge, and the nature of the problem. If the b-field segment is interrupted, it will have a reply of 4 The purpose of testing any copy of the upgrade is to maintain, store two new, ..., maintain the ability to reboot and restart the software update level privately, change the ancient limbs and think about the need to protect the entire code The only part of the 248089 is the booting and downloading cooperation for special treatment, and the problem of wasted storage space. Therefore, this part only needs to be independent and can simultaneously take into account stability, reliability, and solve the content of the invention. The main purpose of the invention is to save space and improve stability, to provide a storage method with the advantages of dual-copy upgrades, and to read the upgrade method. The early copy of the main technical means adopted by the small car to achieve other purposes was first : Boot loader,-boot data and an application data, and =: co-delete an activation code that includes restarting and starting the software update process :: Guan Xieyi, and Cheng The code space you use is less than the application data; "One storage = body: When upgrading, you first empty the application data to empty it-Section: Storage Workshop 'and download again-the new version of the startup data is stored in the section, and then the old version is removed Download the new version of the application data and save it in the second workshop to store the new version of the application data in the _. Ziwei room, and finally; in the brother-storage space to complete the update and upgrade, and the software starts, the installation data is activated by the startup, Subsequently, the startup data is loaded into the application and selected for execution. In the aforementioned upgrade method, the alternate: :: Activity application data 'when any of the update process; when it is broken, there is still a complete startup data available for booting. The use of disks and private functions effectively ensures the stability of the update process. The aforementioned methods also cooperate with the storage space, pure, and then. Therefore, you only need to use a single 1240890 copy of the storage space. The invention not only ensures the reliability during software upgrade, but also eliminates the problem of wasted storage space caused by the dual copy update method. [Embodiment] As shown in the first figure, Baixian firstly defines the following three components of the software: They are a boot loader (b〇〇t〇〇Ader) (工 〇), a Boot image (20) and an application image (30); of which: the boot loader (10) is a program that is executed at startup and has a simple judgment mechanism to select specific The boot data (20) at the address is copied to the memory (RAM) and executed, and the boot loader (10) is never updated after leaving the factory; the remote boot data (20) contains : Boot code and Micro-Controller Code; among them, the micro-control code can be a complete hardware driver and a hardware support API, or it can only include the hardware required for booting and networking. Support, network basic protocols (TCP / IP, DHCP, etc.) and download protocols (FTP, TFTP, etc.). After the startup data (20) is responsible for initializing the hardware, copy the application data (30) and the 4-inch address to the memory to continue execution. The application data (30) contains the remaining micro-controls Code (Micro-Controller Code), complete network function protocol, state machine, etc. According to the method of software segmentation, the startup data (2 0) and Ying 6 1240890 (k υ U) can be divided in the following two ways: The first method is to use the startup data (2 0) and the application data (3 0 The knife has a copy of RTOS. Under this condition, it means that the startup data (20) and the application data (30) are complete and executable data (image). The startup startup material (20) is completed in itself. Then, the application data (30) is loaded into the memory to replace the startup data (20) and the execution is continued; the second method adopted in the present invention retains only one copy of the RTOS in the startup data (^ 2)); It will also have the ability to restart and start the software update process: injury planning to startup Zidou (200), the remaining part is planned to apply breeding materials (30); as the startup data (20) only has basic Start-up and startup update process functions, basic network protocols, and without the state machine cry and most of the protocol layer-istad0, so the space exhausted by its program will be less than the application data (3 ()), so as to Can be used during the update process by clearing the application data (30) The released storage space is the data downloaded by the server (image). For the sub-amplifier, please refer to the second figure, which is the "schematic diagram of the exchange between the updated software of the present invention." State 'where the block location of the boot loader (10) is permanent; the original motion data (20) and the application data (30). The block starting point: 启 b 卜 al. When performing a software update, reduce the Application data (· / Do n’t be empty, in order to free up a first storage space (31) (such as the second figure 5〇) _clear, then download the new version of the startup data (2 0,), and store it in the main = no) The first storage air / moon and air application released after the data (30) is updated at the starting point of the block 1240890 (2 f D — shown in Figure c), and then the old version of the motion data (2 0,) $ Free up storage space, plus the new version of storage ", the remaining storage space is broadcaster, (2 1) (as shown in the first figure D of the second work space in Dizi Province), then Pu Ding Fan Die (3 0 5),-download new version of the application data ya will download the new version of the application data (1 n, the second storage space of six Thumbler (30) is stored in the above two figures E) ^ 21) (the starting point of the block must be updated (such as the hth application data 02) When the software download is completed, start the data (20, and next time Open the mobile data (2 π, load °. (1 0) is to copy the Kai Beiding ten (2 0) from the new location to the memory. And if the software is subjected to another update, the first R △ ( 3 〇) will return to the original position (bl, al) (as shown in Figure A ~ E of the second brother). From the above description, two features of the present invention can be clearly seen, ·, t · Use only a single copy The storage m is clearly seen from the previous materials, and the use of the present invention in the process of updating software is a cross-cutting use—existing capacity = empty storage @ 'In other words, only a single copy of storage space can be used to complete the software steadily. Update. = 2 has the stability and reliability of the dual-copy software upgrade method: an important breakthrough is that it allows errors that occur at any stage of the update process. The main reason is that no matter what stage of the update process is interrupted and failed, the software still retains A complete startup data is available for restarting and starting the software update process, so even if the software update fails, you can re-run the software update after restarting. 1240890 The detailed process of the startup software of the present invention is shown in the fourth figure. At startup, the 'the boot load g (10) program will be executed first, and the block is selected to copy the boot code to the memory. The selection method is to check the stored system variable (this variable can be stored in the n-side f Flash), which is mainly used to record which startup breeding (2 0) block should be started when the device is turned on. When its value & ! Represents the first block ⑽, whose value is 2 represents the second block (b2), if it is other values, the first block (bl) is still used; at the beginning of the decision to start the data (2 〇) After that, the boot loader (1 0) will judge whether the total check (check sum) of the boot data (20) is correct (301). If it is incorrect, the boot loader (丄 〇) will check another boot data (20) ) Existence (303) (If the update has failed and occurs after downloading the new version of the startup data, there may be two copies of the startup data in the software), if it exists, determine whether the total value check (ckA sum) is correct (303), if correct, start the loader (丄) Will be changed to execute the second startup data (20), and the system variable (BOOtVar) is set to boot from this startup data (20) (304); when the startup code is completed, The block (305) where the application data (30) is located will be determined according to the system variable (BoOtVar) and its total value will be checked (check sum) (306); if the area of the application data (30) does not exist Or the total value check is incorrect, the activation code will execute the software update program (307), and download a copy of the startup data (20) and application data (30) again. Conversely, if the application data (30) block exists and passes the total value check (check sum) ', the activation code will copy the application data (30) to the memory 1240890 and execute it (308). If the aforementioned second startup data (2 〇) does not exist, it means that the startup data (2 〇) + was damaged during the update process, so it cannot be restored automatically. This date can be displayed in hardware (such as an indicator). Error message (309) to notify the user to send the product to the factory for repair. As for the detailed process when updating software according to the present invention is shown in the fifth figure; the reasons for the software update include: when the application data (30) does not exist or is unusual, and when the version is too old (by the user or the server) Server-side actions to download a new version of the software) will start the software update process. When the software is updated, the system will first check the system variable (BOOtVar) (400) 'If it is 1 it means the application data to be released (3 〇) The storage space I u is at position al (401), if it is 2 It means that the starting point of the storage space of the application data (30) to be released is at a2 position (402), and then the program will clear the blocks belonging to the application data (30) in the flash memory (Flash). block) 'Then download the new version of the start word (2 q) in the released storage space (4, partial), that is, the system variable is stored in the position of b2, and if the system variable is 2, it is stored in η. Location; After downloading, the program will judge the total value check of the startup data (2 0) (^! Ratio 1 ^ 11111) (405,406). If the check is passed, the system variable (BootVar) will be set in the new version of the startup data (2 Q) position, and remove the original startup information (20). If it fails the inspection, you must download the startup shell material (2Q) again, and then download the new version of the application information from the temple server (30) , And stored in the remaining space (407, 408), and check the total value (checks ·) ⑽, If you fail to pass the inspection, download the application data 1240890 (30) (407, 408). If you pass the inspection, it indicates that the software update is completed, that is, change the system variables (411, 412), and restart (413) to start New version of software. You can go to any of the above stages ‘Unplug the power in the software and download the software. At the same time, it solved the problem that the present invention overcomes the two at the same time and conforms to the invention σ Π. The main purpose of this note is that the software update process has at least one copy of the startup data that is complete and executable, so if the new process is interrupted at any time In the case of cases, such as cymbals, etc., you can use the startup data to boot and restart. The previous method only uses a single copy of storage space. The dual-copy model method wastes a lot of storage space. _The advantages and disadvantages of the upgrade method, so it has significant practicability and progress, patent elements, Ling filed an application according to law. [Schematic description] (I) Schematic part Storage space transfer Storage space transfer Figure-is a schematic diagram of the software composition of the present invention. The first pictures A to E are schematic diagrams of the change situation when the software of the present invention is updated. ^ A picture A ~ E • Schematic diagram of the change situation when the software is updated in the present invention. Fig. 4 is a flowchart of software startup of the present invention. Younger figure: This is the software upgrade flowchart of the present invention. (B) the symbol of the component
1 0)啟動裝载器 2 〇 )啟動資料 1240890 (2 1 )第二儲存空間（3 0 ) ( 3 Ο ’）應用資料 (3 1 )第一儲存空間 121 0) Start loader 2 〇) Start data 1240890 (2 1) Second storage space (3 0) (3 0 ′) Application data (3 1) First storage space 12