Programming processors through CAN interface without changing the boot mode select pins

• US 8,826,261 B1
• Filed: 02/24/2011
• Issued: 09/02/2014
• Est. Priority Date: 02/25/2010
• Status: Active Grant

• Current Assignee: Bloom Energy Corporation
• Original Assignee: Bloom Energy Corporation
• Inventors: Anand AG, Vishal, Moodliar, Jayanth
• Primary Examiner(s): Zhen, Li B
• Assistant Examiner(s): MILLER, VIVA L
• Application Number:
  US13/033,990
• Time in Patent Office: 1,286 Days
• Field of Search: 717/168, 717/173, 712/243
• US Class Current: 717/168
• CPC Class Codes: G06F 8/654 using techniques specially adapted for alterable solid state memories, e.g. for EEPROM or flash memories

Abstract

Methods, systems and devices for remotely updating software installed on a digital signal processor (DSP) without setting the mode select pins on the DSP control card. Firmware configured to suspend operations upon receiving a programming signal is installed on the processor. A controlling computing device send the programming signal, causing the processor to halt execution, erase portions of the firmware, set an update firmware flag, and send control signals to the controlling computing device. The remote computing device sends updated firmware and an application program cyclic redundancy check to the processor. The processor compares a cyclic redundancy check of an on-chip flash memory with the received application program cyclic redundancy check. If the two match, the processor installs the received firmware, unsets the update firmware flag, and restarts itself.

Claims

1. A fuel cell system, comprising:

a fuel cell;

a control system connected to the fuel cell;

a controller area network;

a transceiver;

a controller area network to Ethernet (C2E) converter card connected between the transceiver and the controller area network, the C2E converter card being configured to perform operations comprising;

receiving data from the transceiver in an Ethernet-based message format and receiving data from the controller area network in a controller area network format; and

sending the data from the transceiver to the controller area network in the controller area network format and sending the data from the controller area network to the transceiver in the Ethernet-based message format; and

a processor connected to the controller area network and the control system,

wherein;

the processor is a one or more pin chip including an on-chip Flash memory;

the processor is configured with more than one boot mode and is configured to boot to the Flash memory by a physical setting of the one or more pin of the chip;

the on-chip Flash memory includes firmware to control an operation of the control system;

the firmware includes a communication kernel and an application program; and

the processor is configured with processor-executable instructions such that, without changing the physical setting of the one or more pin of the chip, the processor is configured to perform operations comprising;

executing the application program of the firmware to control the operation of the control system thereby controlling the operation of the fuel cell;

receiving a programming signal from the controller area network;

halting execution of the application program of the firmware to control the operation of the control system in response to receiving the programming signal from the controller area network;

erasing the application program of the firmware from the Flash memory in response to receiving the programming signal from the controller area network;

setting an update firmware flag in response to erasing the application program of the firmware;

sending a start programming acknowledgment signal via the controller area network in response to setting the update firmware flag;

restarting the processor in response to sending the start programming acknowledgment signal;

determining whether the update firmware flag is set after restarting the processor;

determining whether a data message is received in response to determining the update firmware flag is set after restarting the processor;

initializing a new application program based on received data message and storing the new application program as part of the firmware in the Flash memory in response to determining the data message is received;

receiving an application program cyclic redundancy check;

performing a cyclic redundancy check of all of the Flash memory after storing the new application program as part of the firmware in the Flash memory;

comparing the cyclic redundancy check of the Flash memory with the received application program cyclic redundancy check to determine whether the cyclic redundancy check of the Flash memory matches the received application program cyclic redundancy check;

unsetting the update firmware flag in response to determining the cyclic redundancy check of the Flash memory matches the received application program cyclic redundancy check;

restarting the processor in response to unsetting the update firmware flag; and

executing the new application program of the firmware to control the operation of the control system in response to determining the update firmware flag is not set after restarting the processor thereby controlling the operation of the fuel cell.

2. The fuel cell system of claim 1, further comprising:

a server configured to update the firmware of the Flash memory of the processor by sending the programming signal and the data message to the controller area network via the transceiver.

11. The fuel cell system of claim 1, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

sending an updated firmware received acknowledgment signal after storing the new application program as part of the firmware in the Flash memory; and

receiving a programming complete signal,

wherein the processor is configured with processor-executable instructions to perform operations such that performing a cyclic redundancy check of all of the Flash memory after storing the new application program as part of the firmware in the Flash memory comprises performing a cyclic redundancy check of all of the Flash memory after storing the new application program as part of the firmware in the Flash memory in response to receiving the programming complete signal.

3. A method for remotely updating firmware on a processor of a fuel cell system comprising a fuel cell, a control system connected to the fuel cell, a controller area network, a transceiver, and a controller area network to Ethernet (C2E) converter card connected between the transceiver and the controller area network, wherein the processor is connected to the controller area network and the control system, wherein the processor is a one or more pin chip including an on-chip Flash memory, wherein the processor is configured with more than one boot mode and is configured to boot to the Flash memory by a physical setting of the one or more pin of the chip, and wherein the on-chip Flash memory includes firmware to control an operation of the control system, the method comprising:

receiving data from the transceiver in an Ethernet-based message format at the C2E converter card;

receiving data from the controller area network in a controller area network format at the C2E converter card;

sending the data from the transceiver to the controller area network in the controller area network format from the C2E converter card;

sending the data from the controller area network to the transceiver in the Ethernet-based message format from the C2E converter card;

executing the application program of the firmware to control the operation of the control system thereby controlling the operation of the fuel cell;

receiving a programming signal from the controller area network;

halting execution of the application program of the firmware to control the operation of the control system in response to receiving the programming signal from the controller area network;

erasing the application program of the firmware from the Flash memory in response to receiving the programming signal from the controller area network;

setting an update firmware flag in response to erasing the application program of the firmware;

sending a start programming acknowledgment signal via the controller area network in response to setting the update firmware flag;

restarting the processor in response to sending the start programming acknowledgment signal;

determining whether the update firmware flag is set after restarting the processor;

determining whether a data message is received in response to determining the update firmware flag is set after restarting the processor;

initializing a new application program based on received data message and storing the new application program as part of the firmware in the Flash memory in response to determining the data message is received;

receiving an application program cyclic redundancy check;

performing a cyclic redundancy check of all of the Flash memory after storing the new application program as part of the firmware in the Flash memory;

comparing the cyclic redundancy check of the Flash memory with the received application program cyclic redundancy check to determine whether the cyclic redundancy check of the Flash memory matches the received application program cyclic redundancy check;

unsetting the update firmware flag in response to determining the cyclic redundancy check of the Flash memory matches the received application program cyclic redundancy check;

restarting the processor in response to unsetting the update firmware flag; and

executing the new application program of the firmware to control the operation of the control system in response to determining the update firmware flag is not set after restarting the processor thereby controlling the operation of the fuel cell,

wherein the method is performed without changing the physical setting of the one or more pin of the chip.

4. The method of claim 3, wherein receiving data from the transceiver in an Ethernet-based message format at the C2E converter card comprises receiving a plurality of data messages from the transceiver in an Ethernet-based message format.

5. The method of claim 4, further comprising converting the plurality of data messages into a plurality of controller area network (CAN) messages.

6. The method of claim 5, wherein each of the plurality of CAN messages include a CAN message identifier and a data message.

7. The method of claim 6, wherein at least one CAN message identifier includes a channel identifier, a card type identifier and a node identifier.

8. The method of claim 7, wherein the card type identifier and node identifier are extracted from the data messages and uniquely identify a particular card in the controller area network.

9. The method of claim 3, further comprising:

sending the programming signal and the data message from a server configured to update the firmware of the Flash memory of the processor to the controller area network via the transceiver;

wherein the processor and the server are physically isolated from one another and wherein the processor is placed in a programming mode and the new application program is received and installed by the processor without changing any setting of the one or more pin of the processor.

10. The method of claim 3, further comprising:

sending an updated firmware received acknowledgment signal after storing the new application program as part of the firmware in the Flash memory; and

receiving a programming complete signal,

wherein performing a cyclic redundancy check of all of the Flash memory after storing the new application program as part of the firmware in the Flash memory comprises performing a cyclic redundancy check of all of the Flash memory after storing the new application program as part of the firmware in the Flash memory in response to receiving the programming complete signal.