Systems and methods for updating software in a hazard detection system
摘要
說明書
If the integrity check passes at step 1208, the safety processor may determine whether it can reboot at step 1212. The safety processor may reboot if it determines that there is no indication of an imminent hazard being detected by any of the sensors it monitors. As defined herein, an imminent hazard may be a precursor to an actual hazard. For example, a smoke sensor state machine may have several states, including, a monitor state, a pre-alarm state, and an alarm state. As smoke levels rise and certain conditions are met, the state machine may transition from the monitor state, to the pre-alarm state, and then to the alarm state. The monitor state and pre-alarm state may be considered imminent hazards and the alarm state may be considered an actual hazard. If the safety processor detects an unsafe condition, it may wait at step 1214 for the conditions to become safe before proceeding with a reboot. Thus, it should be appreciated that the safety processor is still able to monitor one or more sensors for an alarm event while its inactive portion is replaced with updated code. In addition, the safety processor may be able to communicate data (e.g., sensor data and alarm event notifications) to the system processor while its inactive portion is being updated. The safety processor may continue to monitor its sensor(s) until it is rebooted.
