JP5439400B2 - Image forming apparatus - Google Patents

Description

  The present invention relates to a technique for rewriting a control program executable by an image forming apparatus.

  Conventionally, a control program executed by an image forming apparatus is stored in a nonvolatile memory such as a flash memory in which stored data is not erased even when the power is turned off. The control program stored in the memory can be rewritten.

  However, the rewriting of the control program stored in the non-volatile memory is executed by the procedure of erasing the recorded control program and storing a new control program to be rewritten. There is a risk that the control program may be stored inadequately without being stored until the end, for example, because the power supply is interrupted due to a power failure or the like during execution of. In such a case, if a new control program that is insufficiently stored in the nonvolatile memory is read and executed, the operation of the image forming apparatus may become unstable.

  Therefore, for example, in the following Patent Document 1, before executing the main program expanded in the expanded program storage unit, the main program stored in the program storage unit functioning as a read-only memory is rewritten as a rewritable memory. If the main program is updated by rewriting the main program expanded in the expanded program storage unit using the patch program stored in the functioning patch data storage unit, and the update of the main program fails A technique is disclosed in which the main program stored in the program storage unit is expanded again in the expansion program storage unit.

  That is, a technique for executing a control program provided in another area of the nonvolatile memory even when rewriting of the control program fails is disclosed.

JP 2005-242930 A

  However, depending on the capacity of the nonvolatile memory, when applying the above-described conventional technology, a storage area for storing a control program for restoring the control program when the rewriting of the control program fails is stored in the nonvolatile memory. If rewriting of the control program fails in such a case, the operation of the image forming apparatus may become unstable by reading and executing a new control program that is insufficiently stored in the nonvolatile memory. There was a risk of becoming.

  Therefore, the present invention has been made in view of such circumstances, and even when a control program for restoring the control program is not stored in the nonvolatile memory, it is stored in the nonvolatile memory. When the rewriting of the control program is failed, it is possible to eliminate the possibility that the operation of the image forming apparatus becomes unstable by reading and executing the control program that is not sufficiently stored in the nonvolatile memory. It is an object of the present invention to provide an image forming apparatus that can be used.

The invention according to claim 1 is an image forming apparatus capable of executing a control program,
A non-volatile memory for storing a control program executable by the image forming apparatus;
Rewrite the control mode stored in the non-volatile memory and the normal mode in which the control program is read and executed from the non-volatile memory as the start-up mode that defines the initial processing for the control program stored in the non-volatile memory. A start flag setting unit that stores a start flag, which is data indicating any one start mode, in a rewrite mode and a recovery mode that recovers the control program stored in the non-volatile memory so as to be executable. When,
Execution control for reading the activation flag stored in the non-volatile memory by the activation flag setting unit and executing initial processing on the control program stored in the nonvolatile memory determined in the activation mode indicated by the activation flag And
A program acquisition unit for acquiring a control program stored in an external storage medium connected to the image forming apparatus;
A program rewriting unit for rewriting the control program stored in the nonvolatile memory using the control program acquired by the program acquisition unit;
A program recovery unit that recovers the control program stored in the nonvolatile memory using the control program acquired by the program acquisition unit;
With
The execution control unit
When the startup flag indicating the normal mode is stored in the nonvolatile memory, the control program is read from the nonvolatile memory and executed,
When the start flag indicating the rewrite mode is stored in the nonvolatile memory, the start flag indicating the recovery mode is stored in the nonvolatile memory in the start flag setting unit, and then the control program is stored in the program rewriting unit. When the rewriting is performed and it is determined that the rewriting is successful, the start flag setting unit stores the start flag indicating the normal mode in the nonvolatile memory, and when it is determined that the rewrite has failed, the nonvolatile flag is stored. Maintaining a start flag indicating the recovery mode stored in the memory,
When a startup flag indicating the recovery mode is stored in the non-volatile memory, the control recovery is executed by the program recovery unit, and when it is determined that the recovery is successful, the normal flag is set in the startup flag setting unit. When the startup flag indicating the mode is stored in the nonvolatile memory and it is determined that the recovery has failed, the startup flag indicating the recovery mode stored in the nonvolatile memory is maintained ,
When the activation flag indicating the recovery mode is stored in the nonvolatile memory, the control program is acquired by the program acquisition unit before the program recovery unit executes recovery of the control program. An image that determines whether it is illegal, and if it is determined to be illegal, maintains an activation flag indicating the recovery mode stored in the nonvolatile memory without causing the program recovery unit to execute recovery of the control program Forming device.

  According to the present invention, when the start flag indicating the rewrite mode is stored in the non-volatile memory, the start flag indicating the normal mode is not stored in the non-volatile memory unless the rewrite of the control program by the program rewriting unit is successful. Even when the activation flag indicating the recovery mode is stored in the nonvolatile memory, the activation flag indicating the normal mode is not stored in the nonvolatile memory unless the control program is successfully recovered by the program recovery unit.

In other words, the start flag indicating the normal mode is not stored in the non-volatile memory when rewriting or restoration of the control program fails, so that it remains insufficiently stored in the non-volatile memory due to the failure of rewriting or restoration. And reading and executing the control program that is stored inadequately in the nonvolatile memory may cause the operation of the image forming apparatus to become unstable. Can be resolved.
Further, it is possible to avoid restoring the control program stored in the non-volatile memory by using an unauthorized control program stored in the storage medium. For this reason, the possibility that the control program is restored by an unauthorized control program and the operation of the image forming apparatus becomes unstable can be solved.

  The invention according to claim 2 is the image forming apparatus according to claim 1, wherein the execution control unit is configured to store the start flag indicating the rewrite mode in the nonvolatile memory. Before storing a startup flag indicating the recovery mode in the startup flag setting unit in the nonvolatile memory, the program acquisition unit acquires a control program to determine whether the control program is illegal. If the determination is made, the activation flag indicating the normal mode is stored in the nonvolatile memory in the activation flag setting unit without causing the program rewriting unit to rewrite the control program.

  According to the present invention, it is possible to avoid rewriting the control program stored in the non-volatile memory by using an unauthorized control program stored in the storage medium, and the start flag indicating the normal mode is set in a non-volatile manner. The control program before rewriting can be read out and executed by storing in the volatile memory. For this reason, the possibility that the control program is rewritten with an unauthorized control program and the operation of the image forming apparatus becomes unstable can be solved.

  According to the present invention, even when the control program for restoring the control program is not stored in the nonvolatile memory, when the rewriting of the control program stored in the nonvolatile memory fails, the It is possible to provide an image forming apparatus that can eliminate the possibility that the operation of the image forming apparatus becomes unstable by reading and executing a control program that is stored inadequately in the nonvolatile memory.

1 is a diagram illustrating an outline of an internal structure of an image forming apparatus according to an embodiment of the present invention. FIG. 2 is a block diagram illustrating an electrical configuration of the image forming apparatus. It is a flowchart which shows an example of the control by which a control program is read and performed or rewritten by the execution control part, when starting mode is normal mode or rewriting mode. It is a flowchart which shows an example of the control by which an execution control part recovers | restores when starting mode is recovery mode.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. FIG. 1 is a diagram showing an outline of the internal structure of an image forming apparatus 1 according to an embodiment of the present invention. The image forming apparatus 1 can be applied to, for example, a multifunction machine having functions of a copy, a printer, a scanner, and a facsimile. The image forming apparatus 1 includes a main body unit 100, a document reading unit 200 disposed on the main body unit 100, a document feeding unit 300 disposed on the document reading unit 200, and an operation disposed on the upper front surface of the main body unit 100. Section 400 and a sheet post-processing section 500 disposed on the sheet carry-out side, for example, the left side of the main body section 100.

  The document feeding unit 300 includes a document placement unit 301, a paper feed roller 303, a document transport unit 305, and a document discharge unit 307. The paper feed roller 303 feeds the originals set on the original placement unit 301 one by one. The document transport unit 305 transports the fed document to the document reading unit 200. The document is read by the document reading unit 200 and discharged to the document discharge unit 307.

  The document reading unit 200 includes a carriage 201 on which a CCD (Charge Coupled Device) sensor and an exposure lamp are mounted, a document table 203 formed of a transparent member such as glass, and a document reading slit 205. When reading a document placed on the document table 203, the document is read by the CCD sensor while moving the carriage 201 in the longitudinal direction of the document table 203. On the other hand, when reading a document fed from the document feeding unit 300, the carriage 201 is moved to a position facing the document reading slit 205, and the document fed from the document feeding unit 300 is scanned. Reading is performed by the CCD sensor through the reading slit 205. The CCD sensor outputs the read original as image data.

  The main body unit 100 includes a sheet storage unit 101, an image forming unit 103, and a fixing unit 105. The sheet storage unit 101 is disposed at the lowermost part of the main body unit 100 and includes a sheet tray 107 that can store a bundle of sheets. In the stack of sheets stored in the sheet tray 107, the uppermost sheet is fed out toward the sheet transport unit 111 by driving the pickup roller 109. The sheet is conveyed to the image forming unit 103 through the sheet conveying unit 111.

  The image forming unit 103 forms a toner image on the conveyed paper based on the image data. The image forming unit 103 includes a photosensitive drum 113, an exposure unit 115, a developing unit 117, and a transfer unit 119. The exposure unit 115 generates light corresponding to image data (image data output from the document reading unit 200, image data transmitted from a personal computer, image data received by facsimile, etc.), and is uniformly charged photosensitive drum. The peripheral surface 113 is irradiated. As a result, an electrostatic latent image corresponding to the image data is formed on the peripheral surface of the photosensitive drum 113. In this state, a toner image corresponding to image data is formed on the peripheral surface by supplying toner from the developing unit 117 to the peripheral surface of the photosensitive drum 113. This toner image is transferred by the transfer unit 119 to the sheet conveyed from the sheet storage unit 101 described above.

  The sheet on which the toner image is transferred is sent to the fixing unit 105. In the fixing unit 105, heat and pressure are applied to the toner image and the paper to fix the toner image on the paper. Thereby, the printing of the image on the paper is completed. When post-processing is performed on the printed paper, the printed paper is sent from the paper discharge port 121 of the main body 100 to the paper post-processing unit 500. On the other hand, when no post-processing is performed, the printed paper is discharged to the paper discharge tray 123.

  The paper post-processing unit 500 performs post-processing such as sorting, stapling, punching, and saddle stitching on the printed paper. The paper post-processing unit 500 includes a paper carry-in port 501, a paper transport unit 503, a paper carry-out port 505, a stack tray 507, and the like. The paper transport unit 503 sequentially transports the printed paper carried into the paper carry-in port 501 from the paper discharge port 121, and carries out the post-processed printed paper from the paper carry-out port 505 to the stack tray 507. The stack tray 507 has a configuration capable of moving up and down in the direction of the arrow in accordance with the number of sheets stacked from the paper exit 505.

  The operation unit 400 includes an operation key unit 401 and a display unit 403. The display unit 403 has a touch panel function, and displays a screen including soft keys. The user operates the soft keys while viewing the screen to make settings necessary for executing functions such as copying.

  The operation key unit 401 includes operation keys including hard keys. Specifically, the operation key unit 401 includes a help key 405, a start key 407, a numeric key 409, a function switching key 411, and the like. A help key 405 is a key for displaying a help screen on the display unit 403. The help screen is a screen on which operation methods related to functions such as a scanner, a facsimile, a printer, and a copy are displayed.

  A start key 407 is a key for starting operations such as copying and facsimile transmission. A numeric keypad 409 is a key for inputting numbers such as the number of copies and a facsimile number.

  The function switching key 411 includes a copy key, a transmission key, and the like, and is a key for switching between a copy function, a transmission function, and the like. When the copy key is operated, an initial copy screen is displayed on the display unit 403. When the transmission key is operated, an initial screen for facsimile transmission and mail transmission is displayed on the display unit 403.

  FIG. 2 is a block diagram showing an electrical configuration of the image forming apparatus 1 shown in FIG. The image forming apparatus 1 images the storage medium 5 such as the main body 100, the document reading unit 200, the document feeding unit 300, the operation unit 400, the sheet post-processing unit 500, and a USB memory. An external interface 700 for connecting to the forming apparatus 1, a control unit 600, and a communication unit 800 are connected to each other via a bus.

  The control unit 600 temporarily stores data when a CPU (Central Processing Unit), a flash memory as an example of a nonvolatile memory according to the present invention that stores a control program of the image forming apparatus 1, and a control program are executed. A RAM (Random Access Memory) is provided, and a control program is read from the flash memory by the CPU and executed, thereby performing control necessary for the operation of each part of the apparatus.

  Specifically, the control unit 600 functions as an activation flag setting unit 601, a program acquisition unit 602, a program rewrite unit 603, a program recovery unit 604, and an execution control unit 605.

  The activation flag setting unit 601 stores a normal mode in which a control program is read from the flash memory and executed by the CPU as an activation mode that defines an initial process for the control program stored in the flash memory, and is stored in the flash memory. The start mode is switched between a rewrite mode in which the control program is rewritten and a recovery mode in which the control program stored in the flash memory is restored to be executable.

  Specifically, the activation flag setting unit 601 is one of data indicating the normal mode (for example, 0), data indicating the rewrite mode (for example, 1), and data indicating the recovery mode (for example, 2). Is stored in a predetermined storage area of the flash memory as a start flag, thereby switching the start mode.

  If the activation flag is not stored in a predetermined storage area of the flash memory, or if data other than the data indicating each activation mode is stored as the activation flag, it is assumed that the state is invalid. The start mode is treated as indicating the recovery mode. However, the data indicating each activation mode is not limited to the above example.

  The program acquisition unit 602 stores the storage medium 5 such as a USB memory storing a rewrite control program or a recovery control program in the state in which the storage medium 5 is connected to the image forming apparatus 1 via the external interface 700. The control program for rewriting or the control program for recovery stored in the medium 5 is acquired.

  The program rewrite unit 603 rewrites the control program stored in the flash memory using the rewrite control program acquired by the program acquisition unit 602.

  Note that the rewrite control program refers to the problem of the function implemented in the control program stored in the flash memory or the function implemented in the control program stored in the flash memory. A control program for upgrading the control program, such as correction, is shown.

  The program recovery unit 604 recovers the control program stored in the flash memory using the recovery control program acquired by the program acquisition unit 602.

  The recovery control program is the same control program as the control program stored in the flash memory, and indicates a control program in which the control program stored in the flash memory is backed up to the storage medium 5. The restoration of the control program means that the control program backed up in the storage medium 5 is read, the control program stored in the flash memory is rewritten, and the control program is returned to the original state.

  The execution control unit 605 reads the activation flag stored in the flash memory by the activation flag setting unit 601, and executes an initial process for the control program stored in the flash memory determined by the activation mode indicated by the activation flag. . The execution control of the initial process for the control program by the execution control unit 605 will be described later.

  In addition, each control program on which the activation flag setting unit 601, program acquisition unit 602, program rewriting unit 603, program restoration unit 604, and execution control unit 605 are mounted is stored in a non-rewritable area in the flash memory.

  The communication unit 800 includes a facsimile communication unit 801 and a network I / F unit 803. The facsimile communication unit 801 includes an NCU (Network Control Unit) that controls connection of a telephone line with a destination facsimile, and a modulation / demodulation circuit that modulates and demodulates a signal for facsimile communication. The facsimile communication unit 801 is connected to the telephone line 805.

  The network I / F unit 803 is connected to a LAN (Local Area Network) 807. A network I / F unit 803 is a communication interface circuit for executing communication with a terminal device such as a personal computer connected to the LAN 807.

  Next, among the execution control of the initial process for the control program by the execution control unit 605, when the start mode is the normal mode or the rewrite mode, the control program is read and executed or rewritten by the execution control unit 605 An example will be described with reference to the flowchart shown in FIG.

  When the image forming apparatus 1 is powered on, the execution control unit 605 reads the activation flag stored in a predetermined storage area of the flash memory and determines the activation mode (S1).

  When the execution control unit 605 reads the activation flag indicating the normal mode, the execution control unit 605 determines that the activation mode is the normal mode (S1; normal mode). When an instruction to switch the activation mode to the rewrite mode is not input by the operation of the operation key unit 401 by the user (S2; NO), an instruction to execute the control program is input by the operation of the operation key unit 401 by the user. The execution control unit 605 reads out a control program corresponding to the execution instruction stored in the flash memory and causes the CPU to execute it (S3).

  On the other hand, when reading the activation flag indicating the normal mode, the execution control unit 605 determines that the activation mode is the normal mode (S1; normal mode). When an instruction to switch the activation mode to the rewrite mode is input by the operation of the operation key unit 401 by the user (S2; YES), the execution control unit 605 receives the input instruction and inputs the instruction to the activation flag setting unit 601. In response to the instruction, the start flag setting unit 601 stores a start flag indicating the rewrite mode in the flash memory, and switches the start mode to the rewrite mode (S4). Then, the execution control unit 605 restarts the image forming apparatus 1 (S5).

  In step S1, the execution control unit 605 reads the activation flag indicating the rewrite mode, determines that the activation mode is the rewrite mode (S1; rewrite mode), and instructs the program to acquire a rewrite control program. The program acquisition unit 602 transmits the control program for rewriting from the storage medium 5 connected to the image forming apparatus 1 via the external interface 700 under the instruction (S6).

  Then, the execution control unit 605 determines the validity of the rewrite control program acquired by the program acquisition unit 602 in step S6 (S7). For example, the execution control unit 605 is mounted in a format in which the acquired rewrite control program can be executed by the image forming apparatus 1, and more than a predetermined maximum data size for the rewrite target control program. If it is determined that the acquired rewrite control program is not illegal due to the small data size or the like (S7; NO), an instruction to switch the activation mode to the recovery mode is sent to the activation flag setting unit 601. In response to the instruction, the activation flag setting unit 601 stores an activation flag indicating the recovery mode in the flash memory, and switches the activation mode to the recovery mode (S8).

  Next, the execution control unit 605 sends an instruction to cause the program rewriting unit 603 to rewrite the control program, and the program rewriting unit 603 responds to the rewriting acquired by the program acquisition unit 602 in step S6. The control program stored in the flash memory is rewritten using the control program (S9).

  The execution control unit 605 stores the control program for rewriting acquired by the program acquisition unit 602 in step S6 and the flash memory after rewriting of the control program by the program rewriting unit 603 in step S9. If it is determined that the rewriting of the control program by the program rewriting unit 603 is successful (S10; YES), the start flag setting unit 601 normally sets the start mode. In response to the instruction, the activation flag setting unit 601 stores an activation flag indicating the normal mode in the flash memory and switches the activation mode to the normal mode (S11).

  Then, in a state where the activation flag indicating the normal mode is stored in the flash memory, the execution control unit 605 displays a message indicating that the control program has been successfully rewritten and terminated on the display unit 403 (S12). Then, the process proceeds to step S1 again.

  In step S10, for example, the execution control unit 605 ends the rewriting process even if a predetermined estimated processing time elapses after the program rewriting unit 603 starts rewriting in step S9. Or the data of the control program for rewriting acquired by the program acquisition unit 602 in step S6 and the control program stored in the flash memory after the rewriting of the control program by the program rewriting unit 603 is completed in step S9 If it is determined that the rewriting of the control program by the program rewriting unit 603 has failed due to a size mismatch or the like (S10; NO), the recovery is performed without sending an instruction to switch the activation mode to the activation flag setting unit 601. The start flag indicating the mode is While maintaining the state of Tsu stored in Shrewsbury memory, it failed to rewrite the control program on the display unit 403 displays a message indicating the completion (S14), the process proceeds again to the processing in step S1.

  On the other hand, the execution control unit 605 sends an instruction to acquire the rewrite control program to the program acquisition unit 602 in step S6. For example, the storage medium 5 storing the rewrite control program is the image forming apparatus 1. The reprogramming control program cannot be obtained by the program obtaining unit 602 because the rewriting control program is not stored in the storage medium 5 connected via the external interface 700. The rewrite control program is acquired by the program acquisition unit 602, but the acquired rewrite control program is not implemented in a format that can be executed by the image forming apparatus 1, or is included in the rewrite target control program. A data size larger than the predetermined maximum data size If it is determined that the acquired control program for rewriting is invalid (S7; YES), the activation flag setting unit is not executed without causing the program rewriting unit 603 to rewrite the control program. An instruction to switch the activation mode to the normal mode is sent to 601, and the activation flag setting unit 601 stores an activation flag indicating the normal mode in the flash memory in accordance with the instruction, and switches the activation mode to the normal mode (S 13). . Then, in a state where the activation flag indicating the normal mode is stored in the flash memory, the execution control unit 605 displays a message on the display unit 403 indicating that the rewriting of the control program has failed and ended (S14). Then, the process proceeds to step S1 again.

  Next, of the execution control of the initial process for the control program by the execution control unit 605, an example of control in which the control program is restored by the execution control unit 605 when the activation mode is the recovery mode will be described with reference to FIGS. It demonstrates using the flowchart shown in FIG.

  As described above, the execution control unit 605 sends an instruction to switch the activation mode to the recovery mode to the activation flag setting unit 601 in step S8, and then instructs the program rewriting unit 603 to rewrite the control program in step S9. In step S10, after determining that the rewriting of the control program by the program rewriting unit 603 has failed in response to the instruction, when the process proceeds to step S1, the activation flag indicating the recovery mode is read from the flash memory, It is determined that the activation mode is the recovery mode (S1; recovery mode).

  Then, the execution control unit 605 sends an instruction to acquire a recovery control program to the program acquisition unit 602, and the program acquisition unit 602 is connected to the image forming apparatus 1 via the external interface 700 under the instruction. The control program for restoration is acquired from the storage medium 5 (S21).

  Next, the execution control unit 605 determines the validity of the recovery control program acquired by the program acquisition unit 602 in step S21 (S22). For example, the execution control unit 605 is mounted in a format in which the acquired recovery control program can be executed by the image forming apparatus 1, and more than the maximum data size predetermined for the recovery target control program. If it is determined that there is no fraud in the acquired recovery control program due to the small data size or the like (S22; NO), the program recovery unit 604 sends an instruction to execute the recovery of the control program. In response to the instruction, the program recovery unit 604 uses the recovery control program acquired by the program acquisition unit 602 in step S22 to rewrite the control program stored in the flash memory. (S23).

  The execution control unit 605 includes, for example, the control program for recovery acquired by the program acquisition unit 602 in step S21 and the control stored in the flash memory after the recovery of the control program is completed by the program recovery unit 604 in step S23. If it is determined that the control program has been successfully restored by the program restoration unit 604 because the data size of the program and the like match (S24; YES), the display unit 403 has successfully restored the control program. After displaying the message indicating the end (S25), an instruction to switch the activation mode to the normal mode is sent to the activation flag setting unit 601, and the activation flag setting unit 601 indicates the activation flag indicating the normal mode according to the instruction. Is stored in flash memory and the startup mode is set to normal mode. Switching (S26). Then, in a state where the activation flag indicating the normal mode is stored in the flash memory, the execution control unit 605 proceeds to the process of step S1 again.

  In step S24, the execution control unit 605 terminates the recovery process even if a predetermined estimated processing time elapses after the program recovery unit 604 starts recovery in step S23. Or the data of the recovery control program acquired by the program acquisition unit 602 in step S21 and the control program stored in the flash memory after the recovery of the control program by the program recovery unit 604 is completed in step S23 If it is determined that the restoration of the control program by the program restoration unit 604 has failed due to a size mismatch or the like (S24; NO), the restoration is performed without sending an instruction to switch the activation mode to the activation flag setting unit 601. The startup flag indicating the mode is flash memory While maintaining the state stored in, it fails to recover the control program on the display unit 403 displays a message indicating the completion (S27), the process proceeds again to the processing in step S1.

  On the other hand, the execution control unit 605 sends an instruction to acquire the recovery control program to the program acquisition unit 602 in step S21. For example, the storage medium 5 storing the recovery control program is the image forming apparatus 1. Or a recovery control program cannot be acquired by the program acquisition unit 602 because the recovery control program is not stored in the storage medium 5 connected via the external interface 700. The recovery control program is acquired by the program acquisition unit 602, but the acquired recovery control program is not implemented in a format that can be executed by the image forming apparatus 1, or is included in the control program to be recovered. For example, if the data size is larger than the predetermined maximum data size, If it is determined that the restored control program for recovery is illegal (S22; YES), the activation flag indicating the recovery mode is stored in the flash memory without causing the program recovery unit 604 to execute recovery of the control program. While maintaining the state, the display unit 403 displays a message indicating that the control program for recovery is illegal and cannot be recovered (S28), and the process proceeds to step S1 again.

  As described above, according to this configuration, when the execution control unit 605 determines that the start mode is the rewrite mode, the start flag indicating the normal mode is non-volatile unless the control rewrite by the program rewrite unit 603 is successful. Even if it is determined that the startup mode is the recovery mode without being stored in the volatile memory, the startup flag indicating the normal mode is not stored in the non-volatile memory unless the program recovery unit 604 successfully recovers the control program.

  In other words, the start flag indicating the normal mode is not stored in the non-volatile memory when rewriting or restoration of the control program fails, so that it remains insufficiently stored in the non-volatile memory due to the failure of rewriting or restoration. It is possible to avoid reading and executing the control program, and the operation of the image forming apparatus 1 may become unstable by reading and executing the control program that is not sufficiently stored in the nonvolatile memory. Can be eliminated.

  In addition, by executing the determination in step S7, it is possible to avoid rewriting the control program stored in the flash memory using an unauthorized control program stored in the storage medium 5, By storing the activation flag indicating the normal mode in the flash memory in S11, it is determined in step S1 that the activation mode is the normal mode, and the control program before rewriting can be read from the flash memory and executed. For this reason, it is possible to eliminate the possibility that the operation of the image forming apparatus 1 becomes unstable due to the control program being rewritten with an unauthorized control program.

  In addition, by executing the determination in step S22, it is possible to avoid restoring the control program stored in the flash memory using the unauthorized control program stored in the storage medium 5. For this reason, the possibility that the control program is restored by an unauthorized control program and the operation of the image forming apparatus becomes unstable can be solved.

  Note that, for example, when the control program for rewriting is stored in the storage medium 5 and it is once confirmed that the control program is not illegal, the execution control unit 605 does not execute steps S7 and S13. It may be configured.

  Further, for example, when it is once confirmed that the control program is not illegal by the mechanism that stores the control program for recovery in the storage medium 5, the execution control unit 605 does not execute steps S22 and S28. It may be configured.

  The configuration and processing according to the embodiment shown in FIGS. 1 to 4 are merely examples of the configuration and processing of the image forming apparatus according to the present invention, and the configuration and processing of the image forming apparatus according to the present invention are described above. It is not limited to the contents shown in.

DESCRIPTION OF SYMBOLS 1 Image forming apparatus 600 Control part 601 Startup flag setting part 602 Program acquisition part 603 Program rewriting part 604 Program recovery part 605 Execution control part

Claims (2)

An image forming apparatus capable of executing a control program,
A non-volatile memory for storing a control program executable by the image forming apparatus;
Rewrite the control mode stored in the non-volatile memory and the normal mode in which the control program is read and executed from the non-volatile memory as the start-up mode that defines the initial processing for the control program stored in the non-volatile memory. A start flag setting unit that stores a start flag, which is data indicating any one start mode, in a rewrite mode and a recovery mode that recovers the control program stored in the non-volatile memory so as to be executable. When,
Execution control for reading the activation flag stored in the non-volatile memory by the activation flag setting unit and executing initial processing on the control program stored in the nonvolatile memory determined in the activation mode indicated by the activation flag And
A program acquisition unit for acquiring a control program stored in an external storage medium connected to the image forming apparatus;
A program rewriting unit for rewriting the control program stored in the nonvolatile memory using the control program acquired by the program acquisition unit;
A program recovery unit that recovers the control program stored in the nonvolatile memory using the control program acquired by the program acquisition unit;
With
The execution control unit
When the startup flag indicating the normal mode is stored in the nonvolatile memory, the control program is read from the nonvolatile memory and executed,
When the start flag indicating the rewrite mode is stored in the nonvolatile memory, the start flag indicating the recovery mode is stored in the nonvolatile memory in the start flag setting unit, and then the control program is stored in the program rewriting unit. When the rewriting is performed and it is determined that the rewriting is successful, the start flag setting unit stores the start flag indicating the normal mode in the nonvolatile memory, and when it is determined that the rewrite has failed, the nonvolatile flag is stored. Maintaining a start flag indicating the recovery mode stored in the memory,
When a startup flag indicating the recovery mode is stored in the non-volatile memory, the control recovery is executed by the program recovery unit, and when it is determined that the recovery is successful, the normal flag is set in the startup flag setting unit. When the startup flag indicating the mode is stored in the nonvolatile memory and it is determined that the recovery has failed, the startup flag indicating the recovery mode stored in the nonvolatile memory is maintained ,
When the activation flag indicating the recovery mode is stored in the nonvolatile memory, the control program is acquired by the program acquisition unit before the program recovery unit executes recovery of the control program. An image that determines whether it is illegal, and if it is determined to be illegal, maintains an activation flag indicating the recovery mode stored in the nonvolatile memory without causing the program recovery unit to execute recovery of the control program Forming equipment. When the activation flag indicating the rewrite mode is stored in the nonvolatile memory, the execution control unit is configured to store the activation flag indicating the recovery mode in the nonvolatile memory before the activation flag setting unit stores the activation flag. Let the program acquisition unit acquire a control program, determine whether the control program is illegal, and if it is determined to be illegal, the program rewriting unit does not execute rewriting of the control program, and the activation flag setting unit The image forming apparatus according to claim 1, wherein a startup flag indicating the normal mode is stored in the nonvolatile memory.

Images