Method of remotely upgrading firmware in field-deployed devices

• US 7,093,244 B2
• Filed: 04/18/2002
• Issued: 08/15/2006
• Est. Priority Date: 04/18/2001
• Status: Active Grant

• Current Assignee: Analog Devices BV (Analog Devices, Inc.)
• Original Assignee: Domosys Corporation (Analog Devices, Inc.)
• Inventors: Baril, Steve, St-Arnaud, François, Lajoie, Marie-Eve, Boivin, Jacques
• Primary Examiner(s): Chaki, Kakali
• Assistant Examiner(s): Francis, Mark P.
• Application Number:
  US10/125,240
• Publication Number:
  US 20040015952A1
• Time in Patent Office: 1,580 Days
• Field of Search: 717167-178, 709/223, 711/112
• US Class Current: 717/168
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57

Abstract

The method is used for downloading firmware upgrades to a non-volatile memory (NVM) of a targeted remote programmable embedded field-deployed device over a communication network. The device is connected to the network and requires no human intervention at the remote site. The firmware includes a small upgrade program which performs programming tasks on the device according to commands received by the server. The method carried out by the upgrade program allows to upgrade the application program, the communication protocol stack, a set of mutable interrupt vector table or itself without the need of additional memory. It also has a bootstrap function which is responsible for verifying the integrity of the firmware upon reset of a device before transferring control to or back to the application program. Upgrades can be either server-initiated (the firmware provider pushes the new version out to the field) or device-initiated (the device pulls the latest firmware version from the server).

Claims

1. A method of remotely upgrading an application program in a field-deployed device connected to an upgrade server via a network, the device having a non-volatile memory including an application program memory area containing the application program and an upgrade program memory area containing an upgrade program, the method comprising

transferring control of the device to the upgrade program in the upgrade program memory area to control execution of the updating of the application program;

and

updating the application program by;

copying from the server a new application program directly to the application program memory area over at least a part of the application program memory area containing the application program; and

transferring control of the device to the new application program stored in the application program memory area;

after transferring control of the device to the upgrade program, updating the update program by;

transferring control of the device to the copy of the update program in the application program memory area;

copying from a new update program from the server to the application program memory area over at least a part of the upgrade program memory area containing the upgrade program;

copying from the new update program from the application program memory area to the upgrade program memory area containing the upgrade program; and

transferring control of the device to the new upgrade program in the upgrade program memory area,

wherein

the upgrade program memory area is comprised of base layers;

programs are stored in separate layers of the base layers;

the separate layers are copied from the server to the application program memory area on a layer-by-layer basis; and

the separate layers are subseguently copied from the application program memory area to the upgrade program memory area on a layer-by-layer basis.

2. The method according to claim 1, further comprising:

verifying the new application program in the application program memory area before transferring control of the device thereto.

3. The method according to claim 2, wherein verifying the new application program includes performing a cyclic redundancy check (CRC) thereof.

4. The method according to claim 1, wherein the new application program is copied from the server following a lock step process, the lock step process comprising:

sending a confirmation message from the device to the server once a data packet is successfully received.

5. The method according to claim 1, further comprising:

initiating an upgrade process by sending an escape message from the server to the device, the control of the device being transferred to the upgrade program as a results of the escape message.

6. The method according to claim 1, wherein the firmware further comprises a firmware header stored in a firmware header memory included in the non-volatile memory of the device, the act of copying the new application program from the server comprising:

updating the firmware header in the firmware header memory prior to receiving data for the application program to be stored in the application program memory area.

7. The method according to claim 6, wherein the firmware header comprises data indicative of the length of the new application program.

8. The method according to claim 1, further comprising:

forcing the device to reset before transferring control of the device to the new application program.

9. The method according to claim 1, further comprising:

verifying contents of a layer in the upgrade program memory area of after being copied thereto.

10. The method according to claim 9, wherein the verifying contents of a layer comprises performing a cyclic redundancy check (CRC) therof.

11. The method according to claim 1, wherein a layer of the separate layers and the new application program are copied from the server following a lock step process comprising sending a confirmation message from the device to the server once a block packet is successfully received.

12. The method according to claim 1, further comprising initiating an upgrade process by sending an escape message from the server to the device, the control of the device being initially transferred to the upgrade program as a result of the escape message.

13. The method according to claim 1, wherein the firmware further comprises a firmware header stored in a firmware header memory included in the non-volatile memory of the device, the act of copying from the server at least one new base layer comprising:

updating the firmware header in the firmware header memory prior to receiving data for the new base layer.

14. The method according to claim 13, wherein the firmware header comprises data indicative of the last page of the length of the base layers and data indicative of the length of the application program.

15. The method according to claim 13, wherein the firmware header comprises variable indicative of the last page of each layer of the base layers and a variable indicative of the last page of the application program.

16. The method according to claim 1, further comprising:

forcing the device to reset before transferring control of the device to the new application program.

17. The method according to claim 1, further comprising the act of initiating a self-upgrade process by sending a self-upgrade request message from the device to the server, each layer of the separate layers being copied from the server to the device as a result of the self-upgrade request message.

18. The method according to claim 1, wherein a layer of the separate layers includes a mutable interrupt vector table, the method further comprising:

re-referencing a plurality of addresses for a corresponding plurality of interrupt service routines for an immutable interrupt vector table contained in the mutable interrupt vector table to a plurality of new addresses for other interrupt service routines once the plurality of addresses are copied to the application memory area.

19. The method according to claim 18, wherein the other interrupt service routines relate to routines for the new application program.

20. The method according to claim 1 wherein the network is a power distribution network.

21. A remotely-upgradeable device storing an application program of a firmware, the device comprising:

a non-volatile memory including an application program memory area storing the application program and an upgrade program memory area storing an upgrade application which controls aspects of an upgrade process for the application program;

a communication connection to a server via a network;

an upgrade control module for initiating and controlling the upgrade process;

a data transfer module for obtaining from the server a new application program and storing it in the application program memory area of the device; and

an application control module to control transfer of operation of the device to the new application program,

wherein

when processing the upgrade process, the upgrade control module transfers control of the device to the upgrade program;

the data transfer module copies from the server the new application program directly to the application program memory area over at least a part of the application program memory area containing the application program;

the application control module transfers control of the device to the new application program stored in the application program memory area;

after transferring control of the device to the upgrade program, the update control module;

transfers control of the device to the copy of the update program in the application program memory area;

copies from a new update program from the server to the application program memory area over at least a part of the upgrade program memory area containing the upgrade program;

copies the new update program from the application program memor area to the upgrade program memory area containing the upgrade program; and

transfers control of the device to the new upgrade program in the upgrade program memory area,

and wherein

the upgrade program memory area is comprised of base layers;

programs are stored in separate layers of the base layers;

the separate layers are copied from the server to the application program memory area on a layer-by-layer basis; and

the separate layers are subseguently copied from the application program memory area to the upgrade program memory area on a layer-by-layer basis.

22. The remotely-upgradeable device as claimed in claim 21, further comprising:

an immutable interrupt vector table containing a plurality of addresses to a mutable interrupt vector table,

wherein contents of the mutable interrupt vector table can be modified to point to a plurality of new addresses associated with new interrupt routines provided to the device in the upgrade process.