Systems and methods for updating software in a hazard detection system

• US 9,513,898 B2
• Filed: 06/30/2014
• Issued: 12/06/2016
• Est. Priority Date: 06/30/2014
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Solnit, Jonathan, Veit, Kelly, Satterthwaite, Edwin H. Jr., Lee, Jeffrey
• Primary Examiner(s): Riad, Amine
• Application Number:
  US14/319,308
• Publication Number:
  US 20150378715A1
• Time in Patent Office: 890 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 8/656 while running
• CPC Class Codes: G06F 9/4401 Bootstrapping security arrangements therefor G06F21/57
• CPC Class Codes: G06F 9/4406 Loading of operating system
• CPC Class Codes: G08B 17/10 Actuation by presence of smoke or gases , e.g. automatic alarm devices for analysing flowing fluid materials by the use of optical means
• CPC Class Codes: G09C 1/00 Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system cryptographic typewriters G09C3/00

Abstract

Systems and methods for updating software in a hazard detection system are described herein. Software updates may be received by, stored within, and executed by a hazard detection system, without disturbing the system'"'"'s ability to monitor for alarm events and sound an alarm in response to a monitored hazard event. The software updates may be received as part of a periodic over-the-air communication with a remote server or as part of a physical connection with a data source such as a computer. The software updates may include several portions of code designed to operate with different processors and/or devices within the hazard detection system. The software updates may also include language specific audio files that can be accessed by the hazard detection system to play back language specific media files via a speaker.

Claims

1. A hazard detection system, comprising:

at least one hazard sensor;

a non-volatile memory comprising a plurality of code images, wherein a first code image is active and a second code image is inactive; and

a plurality of processors each operative to run based on code stored in the active code image, the plurality of processors comprising at least a system processor and a safety processor, wherein the system processor is operative to;

manage a software update process to replace the inactive code image with an updated code image, and

wherein the safety processor is operative to;

monitor the at least one hazard sensor for a hazard event while the system processor is managing the software update process.

2. The hazard detection system of claim 1, wherein the system processor is operative to:

perform a system status check to determine whether to proceed with the software update process.

3. The hazard detection system of claim 2, wherein the system status check comprises status check of at least one state machine.

4. The hazard detection system of claim 2, wherein the system status check comprises power level status of a power source.

5. The hazard detection system of claim 1, wherein the system processor is operative to:

authenticate the updated code image;

proceed with the software update process if the updated code image is authenticated; and

delete the updated code image if the updated code image is not authenticated.

6. The hazard detection system of claim 1, wherein the updated code image comprises system processor code, wherein the system processor is operative to:

install the system processor code in internal memory of the system processor; and

reboot using the installed system processor code.

7. The hazard detection system of claim 6, wherein the system processor is operative to:

verify that reboot is successful; and

set the updated code image as the active code image in response to the verified successful reboot.

8. The hazard detection system of claim 6, wherein the active code image comprises active system processor code, the system processor is operative to:

determine that the reboot is unsuccessful;

install the active system processor code in the internal memory of the system processor; and

reboot using the installed active system processor code.

9. The hazard detection system of claim 6, wherein the system processor is operative to:

verify that the system processor code is successfully installed; and

reboot using the installed system processor code in response to verification that the system processor code is successfully installed.

10. The hazard detection system of claim 6, wherein the active code image comprises active system processor code, the system processor is operative to:

determine that the installation of the system processor code is unsuccessful;

restore the active system processor code in the internal memory of the system processor; and

reboot using the restored active system processor code.

11. The hazard detection system of claim 1, wherein the updated code image comprises safety processor code, wherein the system processor is operative to:

notify the safety processor that the safety processor code is available for a safety processor software update;

wherein the safety processor is operative to;

independently determine when to upgrade its software in response to the safety processor software update notification; and

update its software with the safety processor code in response to its independent determination.

12. The hazard detection system of claim 11, wherein the updated code image comprises first and second safety processor code portions, wherein the safety processor comprises internal non-volatile memory comprising a safety processor (SP) active code portion and a SP inactive code portion, wherein the safety processor is operative to:

copy a selected one of the first and second processor code portions to the SP inactive code portion; and

execute code in the SP active code portion while copying the selected code to the SP inactive code portion to monitor the at least one hazard sensor for a hazard event.

13. The hazard detection system of claim 12, wherein the safety processor is operative to:

authenticate the selected code portion copied to the SP inactive code portion; and

determine whether it is safe to reboot the safety processor in response to a successful authentication of the selected safety processor code portion.

14. The hazard detection system of claim 12, wherein the safety processor is operative to:

authenticate the selected code portion copied to the SP inactive code portion; and

mark the selected code portion as bad in response a failed authentication of the selected safety processor code portion.

15. The hazard detection system of claim 13, wherein the safety processor is operative to:

reboot using the selected code portion copied to the SP inactive code portion;

verify that reboot is successful; and

set the selected code portion as the SP active code portion in response to the verified successful reboot.

16. The hazard detection system of claim 13, wherein the safety processor is operative to:

reboot using the selected code portion copied to the SP inactive code portion;

determine that reboot is unsuccessful;

reboot using the code portion stored in the active code portion; and

verify that the reboot is successful.

17. The hazard detection system of claim 15, wherein the safety processor is operative to:

notify the system processor that the safety processor has been successfully rebooted.

18. The hazard detection system of claim 1, wherein the at least one hazard sensor comprises a smoke sensor.

19. The hazard detection system of claim 1, wherein the at least one hazard sensor comprises a carbon monoxide sensor.

20. A method for updating software in a hazard detection system comprising system and safety processors, at least one sensor, and an alarm, the method comprising:

performing a system status check to determine whether the system processor is permitted to execute a software update process;

executing the software update process while the system status check is satisfied;

ceasing the executing of the software update process if the system status check is not satisfied; and

using the safety processor to monitor the at least one sensor and to activate the alarm in response to a monitored hazard event while the software update process is executing.

21. The method of claim 20, wherein the performing a system status check comprises:

verifying that the hazard detection system is not in an alarming state or a pre-alarming state.

22. The method of claim 20, wherein the performing a system status check comprises:

verifying that a power source is providing power above a threshold.

23. The method of claim 20, wherein the executing the software update process comprises:

determining whether a software update is available by accessing a remote server; and

receiving the software update if available.

24. The method of claim 20, wherein the executing the software update process comprises:

storing a software update image in an inactive portion of a non-volatile memory, wherein the system processor is executing code stored in an active portion of the non-volatile memory.

25. The method of claim 24, wherein the software update image comprises system processor code, wherein the executing the software update process comprises:

installing the system processor code into a memory of the system processor;

rebooting the system processor using the installed system processor code; and

setting the stored software update image as the active portion of the non-volatile memory in response to a successful reboot of the system processing using the installed system processor code.

26. The method of claim 24, wherein the software update image comprises code portions for each of the system processor and the safety processor.

27. The method of claim 26, wherein the software update image comprises at least one other code portion for at least one other processor.

28. The method of claim 24, wherein the software update image comprises code for an audio kit, wherein the system processor accesses the audio kit to playback media via a speaker.

29. The method of claim 24, wherein the software update image comprises safety processor code, wherein the executing the software update process comprises:

selectively updating the safety processor, wherein the safety processor independently determines when to update its software.

30. The method of claim 29, wherein the safety processor comprises internal memory comprising a safety processor (SP) active portion and a SP inactive portion, wherein the safety processor is executing code stored in the SP active portion, where the selectively updating comprises:

storing the safety processor code in the SP inactive portion;

determining if it is safe to reboot;

rebooting the safety processor using the safety processor code stored in the SP inactive portion when it is determined safe to reboot, wherein the monitoring is suspended during the rebooting; and

setting the SP inactive portion as the SP active portion in response to a successful reboot of the safety processor.

31. A method for updating software in a home system comprising first and second processors, at least one sensor, and an alarm, the method comprising:

performing a system status check to determine whether the first processor is permitted to execute a software update process;

executing the software update process while the system status check is satisfied;

ceasing the executing of the software update process if the system status check is not satisfied; and

using the second processor to monitor the at least one sensor and to activate the alarm in response to a monitored event while the software update process is executing.

32. The method of claim 31, further comprising wireless communications circuitry for receiving wireless communications from at least one other device, wherein the performing the system status check comprising determining whether any wireless communications have been received.

33. The method of claim 31, wherein performing the system status check comprises verifying monitored environmental conditions satisfy system check criteria.

34. The method of claim 33, wherein monitored environmental conditions comprise sound, light, smoke, carbon monoxide, and heat.

35. The method of claim 31, wherein performing the system status check comprises verifying monitored security conditions satisfy system check criteria.

36. The method of claim 35, wherein monitored security conditions comprise data received from at least one sensor that is located remote from the home system.