JP2007058561A - Program download system, method for it, program supply device, and controller - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To allow download of various programs such as a boot program only from an allowed main substrate to a non-volatile memory in a sub-substrate storing no program. <P>SOLUTION: The sub-substrate 20 releases only a check program area serving as a part of a boot area in a memory space on a sub-substrate 20 side to the main substrate 10. The main substrate 10 downloads a check program to the released area. The sub-substrate 20 starts the downloaded check program to determine whether the connected main substrate 10 is a permitted target, from which program download is allowed, or not. The sub-substrate 20 releases the boot area in the memory space on the sub-substrate 20 when the connected substrate 10 is the permitted target. If the connected substrate 10 is not the permitted target, the sub-substrate 20 does not release the boot area. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a program download system and method for writing a program to a non-volatile memory for storing a program for operating the control device included in the control device, and a program supply device constituting the system. The present invention relates to a control device.

  For example, some multifunction peripherals can be provided with additional sub-boards (control devices) that are set as options so that various functions can be added to the main board (control device) that executes printing operations and image processing. . As such a sub board, a LAN board, a USB board, and the like are provided.

  The main board and sub board are generally a CPU that is a processor for executing a program, an ASIC that controls transmission and reception of various data inside and outside the board, a ROM for storing a program for operating the board, and a RAM. Etc. Nowadays, a ROM for storing a program for operating a substrate is mainly equipped with a nonvolatile memory such as a flash memory in order to cope with an upgrade.

  The program for operating the board is usually composed of a boot program for operating the board at a minimum and a main program for operating all the functions of the board. The initial setting and initial diagnosis of the board are performed by a boot program.

  The boot program is provided to the board by using a flash memory writer (flash ROM writer) or the like to download the boot program to the flash memory in advance and placing the downloaded flash memory on the board. It is generally done by implementing.

  As another method, a peripheral circuit including a flash memory may be a separate substrate such as a flash memory DIMM substrate independent of the substrate body, and the separate substrate may be detachable from the substrate body. is there. In such a configuration, it is not always necessary to download the boot program to the flash memory at the stage of mounting the component on the board. Even after mounting the component on the board, the separate board is removed from the board. A boot program can be downloaded to a flash memory mounted on the board using a dedicated program writer or the like. However, such a configuration has a demerit that the cost of parts required for the entire board is high because the flash memory is mounted on a separate board.

On the other hand, in Patent Document 1, the MPU of the sub board stores the rewriting program (corresponding to the download program) input to the sub board in the RAM on the main board either directly or via the MPU of the main board. A data rewriting method has been proposed in which a rewriting program stored in the RAM on the main board is written in the flash memory on the sub board directly or via the CPU on the main board.
JP 2002-259148 A (released on September 13, 2002)

  However, with the conventional technology that mounts the flash memory with the boot program written in advance on the board, if the sub board becomes a common option for multiple types of main boards in the future, booting that supports various main boards It is necessary to prepare each sub-board on which the program is written, and the advantages of common options cannot be utilized. Also, even if the boot program is expanded in the future, the boot program cannot be upgraded.

  In the conventional technology in which the flash memory is mounted on a separate board configured to be detachable from the board, the boot program can be written in correspondence with the main board to be connected. Although no problem occurs, as described above, since it is a separate substrate, there is a demerit that the component cost is high, which is not preferable.

  As a solution to such a problem, a configuration in which the program of the sub board is directly downloaded from the main board side to the flash memory of the sub board can be considered. According to this, since the boot program corresponding to the main board is downloaded to the flash memory of the sub board, it is not necessary to prepare a sub board on which the corresponding boot program is written according to the type of the main board. It will be over.

  However, in this case, if the sub-board flash memory is released from the main board without any ingenuity, the main board can freely download data to the sub-board flash memory. There is a possibility that illegal data is downloaded from the main board to the sub board, and the sub board is used for an unintended purpose. Also, if an incorrect program is downloaded to the sub board, the sub board may not start.

  Note that, in the above-described Patent Document 1, a program for operating the CPU of the sub board is required at a minimum, and a method for downloading data from a state in which there is no program on the sub board is not particularly mentioned. .

  The present invention has been made in view of the above problems, and a program download system capable of selectively downloading a program only from a permitted program supply device to a control device having no program, and the program download system And providing the program supply device and the control device constituting the system by implementing the method and the program download method, and eventually, when a certain control device becomes a common option of a plurality of other main control devices However, the purpose is to make it possible to take advantage of the common options and to easily handle upgrades of the boot program even if the boot program has been expanded.

  In order to solve the above problems, a program download method according to the present invention provides a program for operating a control device in a non-volatile memory for storing the program for operating the control device included in the control device. A program download method of a program download system for downloading from a program supply device, wherein the control device opens only a predetermined area of a boot program area in the nonvolatile memory to the program supply device, and The program supply device causes the check program to be downloaded to the predetermined area opened in the control device, and the control device starts the check program downloaded from the program supply device and connects the program supply apparatus It is determined whether or not the program is permitted to be downloaded to the control device, and if it is permitted, an area other than the predetermined area in the nonvolatile memory is also opened. An area other than the predetermined area in the nonvolatile memory is not opened.

  According to this, the control device starts the check program downloaded from the program supply device in a predetermined area of the boot program area in the non-volatile memory, so that the connected program supply device is transferred to the own device. It is determined whether or not the program is permitted to be downloaded, and if it is permitted, an area other than the predetermined area in the nonvolatile memory is also released. Do not open areas other than the predetermined area.

  Moreover, since the area in the non-volatile memory that the control device releases to download the check program to the program supply device is only a predetermined area of the boot program area, the program supply apparatus Even if an attempt is made to download the boot program, the entire boot program cannot be stored and the control device cannot be operated.

  Therefore, for the control device, even in a state where no program is stored in the nonvolatile memory, various programs (including a boot program selectively from an authorized program supply device) Download program) can be downloaded, and unauthorized data is downloaded to the control device, so that it is not used for an unintended purpose or the control device does not start.

  In the program download method of the present invention described above, it is preferable that the control device releases the boot program area in the non-volatile memory if the program supply device is permitted.

  According to this, even if it is determined by the check program that the program supply device connected to the control device is a permitted object for which downloading of the program is permitted, the control device operates the device as a minimum. Since only the boot program area necessary for the release is released, it is possible to prevent an unintended program from being downloaded to an area other than the boot program area.

  In the above-described program download method of the present invention, the check program further includes device-specific identification information attached to the program supply device, and it is determined whether or not the control device is a permission target. It is preferable to use the identification information acquired from the program supply device.

  According to this, although the control device side needs the identification information list of the program supply device to be permitted, the control device is the permission target based on the identification information from the connected program supply device. Therefore, it is possible to eliminate any downloading of the program from the unauthorized program supply apparatus.

  In the program download method of the present invention described above, it is preferable to use a jumper setting provided in the control device to determine whether or not the control device is a permission target.

  According to this, since the connected program supply device can be designated as the permitted object by the jumper setting provided in the control device, the control device side has an identification information list of the permitted program supply device. Even if it is not allowed, the program supply device to be permitted can be easily specified.

  A program supply device of the present invention is connected to a control device, shares an I / F memory space with the control device, and stores in a non-volatile memory for storing a program for operating the control device included in the control device. A program supply device for downloading a program for operating the control device via the I / F memory space, wherein the connected program supply device is permitted to download the program to the control device. If it is a permission target, the memory area of the nonvolatile memory included in the control device is released from the I / F memory space, and if it is not a permission target, the memory area of the nonvolatile memory The nonvolatile memory having a check program for executing a process that does not open the I / F memory space It is characterized in that it comprises a check program download unit that downloads the definitive boot program area.

  In order to solve the above problems, a program supply method of a program supply apparatus according to the present invention is connected to a control apparatus, shares an I / F memory space with the control apparatus, and operates the control apparatus included in the control apparatus. A program supply method for a program supply device for downloading a program for operating the control device to a non-volatile memory for storing a program for use via the I / F memory space, wherein the program supply is connected It is determined whether or not the device is a permitted object permitted to download the program to the control device. If the device is permitted, the memory area of the nonvolatile memory included in the control device is assigned to the I / F memory space. If it is not a permission target, execute processing that does not open the memory area of the non-volatile memory to the I / F memory space. The check program which is characterized in that it comprises a checking program download step of downloading the boot program area in the nonvolatile memory of the control apparatus.

  In order to solve the above problems, the control device of the present invention is connected to a program supply device, shares an I / F memory space with the program supply device, and operates the own device included in the own device from the program supply device. A control device in which a program for operating the device is downloaded with respect to the nonvolatile memory for storing the program for causing the boot device to be stored in the boot program area of the nonvolatile memory included in the device It is characterized by comprising check program accepting means for releasing only a predetermined area of the boot program area of the non-volatile memory to the I / F memory space when not stored.

In order to solve the above problems, a control method for a control device according to the present invention is connected to a program supply device and shares an I / F memory space with the program supply device. A control method for a control device in which a program for operating the device is downloaded to a nonvolatile memory for storing a program for operating the device, and booting the nonvolatile memory of the device And a check program receiving step for releasing only a predetermined area of the boot program area of the nonvolatile memory from the I / F memory space in a state where no boot program is stored in the program area. According to this, the program supply device is connected to the check program download means. It is determined whether or not the connected program supply device is permitted to download the program to the control device with respect to the boot program area of the nonvolatile memory in the control device. If there is a non-permitted memory area of the non-volatile memory in the control device is released to the I / F memory space, and if not permitted, the non-volatile memory area is not released to the I / F memory space. Download the check program to be downloaded.

  On the other hand, in the control device, the check program receiving means does not store the boot program in the boot program region of the nonvolatile memory included in the own device, and only the predetermined region of the boot program region of the nonvolatile memory is Open to the I / F memory space.

  Therefore, the program download method in the above-described program download system of the present invention can be easily implemented by the program supply device provided with the check program download means and the control device provided with the check program reception means.

  In the above-described program supply apparatus of the present invention, the check program download means further includes a program generation means for generating a check program to be transmitted to the control device with reference to the check program stored in the program storage area. And a program transmission means for transferring the check program generated by the check program generation means to the control device via the I / F memory space.

  The program supply apparatus of the present invention further includes an identification information storage area for storing identification information unique to the apparatus attached to the own apparatus, and the check program generating means refers to the identification information storage area. Thus, the identification information of the own device can be incorporated into the check program.

  Further, as the control device of the present invention that constitutes a program download system with such a program supply device, the program supply device to be permitted that is allowed to download the program to the own device in the nonvolatile memory. It is preferable that a list of identification information attached to is stored.

  By adopting such a configuration of the program supply device and the control device, it is determined whether or not it is permitted based on the identification information from the program supply device connected on the control device side described above. It is possible to easily implement the program download method of the present invention in which it is possible to eliminate any program download from a program supply apparatus that has not been performed.

  Further, in the control device of the present invention, a jumper is provided for designating that the program supply device connected to the own device is a permission target that is permitted to download the program to the own device. It can also be configured.

  By adopting such a configuration, it is possible to easily specify the program supply device to be permitted even if the control device side does not have the identification information list of the program supply device to be permitted as described above. The program download method of the present invention can be easily implemented.

  Furthermore, in the program supply apparatus of the present invention, the check program further includes an end notification program for executing a process of transmitting check program download end information indicating the end of download of the check program to the program supply apparatus. It is good also as a structure.

  According to this, since it is notified from the control device that the check program has been successfully downloaded, the program supply device can confirm that the download of the check program has been completed normally.

  Furthermore, in the program supply apparatus of the present invention, the program supply apparatus further includes analysis means for determining whether or not the check program download end information is received from the control apparatus, and the check program download means transmits the check program, and then When the analysis unit has not received the check program download end information, the check program may be retransmitted to the control device.

  According to this, when the check program is downloaded from the program supply device to the control device, the check program cannot be normally downloaded due to some influence, and the analysis means of the program supply device receives the check program download end information from the control device. When the check program cannot be received, the check program download means re-sends the check program to the control device and downloads it again, so that the check program download operation can be performed reliably.

  Furthermore, the program supply apparatus of the present invention may further include a download state notifying unit that notifies the user of the download state of the check program to the control device.

  Examples of the download state to be notified include that the check program is being downloaded, that the check program has been downloaded, or that the check program is not permitted to be downloaded.

  In this way, by notifying the user of the status of the check program download, it is possible to call attention to the fact that the power of the program supply device or the control device is turned off during the download of the check program. When the control device is erroneously attached to the program supply device that is not permitted to download the program, the user can be notified that the program download is not permitted.

  Further, the program supply apparatus of the present invention further includes power monitoring means for determining whether or not the power of the own apparatus is turned on, and the check program download means determines that power is turned on by the power monitoring means. Then, it is good also as a structure which starts the operation | movement which makes the said control apparatus download a check program.

  According to this, when the power is supplied to the program supply device, the check program is automatically downloaded to the control device mounted on the program supply device, so that the check program download is mediated by the operation by the user. Can be implemented without.

  Furthermore, in the program supply apparatus of the present invention, when the power monitoring means determines that the power is turned on, the check program download means determines whether or not the control apparatus can start an operation of downloading the check program. It is good also as a structure further provided with the setting means to set with respect to.

  According to this, since it is possible to set whether or not the check program can be automatically downloaded when the power to the program supply device is turned on by the setting means, for example, the check program stored in the nonvolatile memory of the program supply device When the user does not wish to download the check program to the control device, such as when the version is old, the automatic download can be rejected using the setting means.

  Furthermore, the program supply apparatus of the present invention may further comprise an instruction input means for instructing the check program download means to start the operation for causing the control device to download the check program.

  According to this, using the instruction input means, the user can download the check program to the control device at a desired timing.

  Furthermore, the program supply device of the present invention includes at least two input / output units that are connected to an external device and enable input / output of information, and are separate from the input / output unit connected to the control device. A download program for the control device including the check program is acquired via the output unit, and if the acquired download program is not stored in the program storage area, the acquired download program is stored while already stored If the downloaded program is compared, and the acquired download program is newer, program receiving means for updating the contents of the program storage area may be provided.

  According to this, when the control device and the program supply device are connected and it is necessary to download the program to the control device, the program supply device is different from the input / output unit connected to the control device. Since it is possible to obtain the download program (including the check program) to be downloaded each time via the input / output unit, it is necessary to always store the download program in the program storage area of the program supply device. And there is no pressure on the program storage area in the program supply device.

  Furthermore, in the program supply apparatus of the present invention, a download program for the control apparatus including the check program may be compressed and stored in the program storage area.

  Thus, by compressing and storing the download program in the program storage area of the program supply apparatus, it is possible to reduce the pressure on the program storage area in the program supply apparatus.

  As described above, in the program download method according to the present invention, the program for supplying the program for operating the control device is stored in the nonvolatile memory for storing the program for operating the control device included in the control device. A program download method of a program download system for downloading from the program, wherein the control device opens only a predetermined area of a boot program area in the nonvolatile memory to the program supply device, and the program supply device Causes the check program to be downloaded to the predetermined area opened in the control device, the control device starts the check program downloaded from the program supply device, and the connected program supply device Control equipment It is determined whether or not the program is permitted to be downloaded, and if it is permitted, an area other than the predetermined area in the nonvolatile memory is also opened. The area other than the predetermined area is not opened.

  As described above, the program supply device of the present invention is connected to the control device, shares the I / F memory space with the control device, and stores a program for operating the control device of the control device. A program supply device that downloads a program for operating the control device to the nonvolatile memory via the I / F memory space, and the connected program supply device downloads the program to the control device. It is determined whether or not it is a permitted object. If it is a permitted object, the memory area of the nonvolatile memory included in the control device is released from the I / F memory space. The control device has a check program for executing processing that does not open the memory area of the volatile memory to the I / F memory space. It is configured to include a check program downloading means for downloading the boot program area in the volatile memory.

  As described above, the control device of the present invention is connected to the program supply device, shares the I / F memory space with the program supply device, and operates the own device included in the own device from the program supply device. A control device in which a program for operating the device is downloaded with respect to the nonvolatile memory for storing the program, and the boot program is stored in the boot program area of the nonvolatile memory of the device. In this state, there is provided a check program receiving means for releasing only a part of a predetermined area of the boot program area of the nonvolatile memory from the I / F memory space.

  This allows the control device to selectively download the program only from the authorized program supply device, even if no program is stored in the non-volatile memory. Unauthorized data is downloaded to the control device, so that it is not used for an unintended purpose or the control device does not start.

  Therefore, even when the control device becomes a common option for other types of program supply devices, the advantages of the common option can be utilized, and even if the boot program is expanded in function, it is easy to upgrade the boot program. The effect that it can respond is produced.

  An embodiment of the present invention will be described below with reference to FIGS.

  First, the overall configuration of the program download system according to this embodiment will be described with reference to FIG. FIG. 1 shows each hardware configuration of the main board (program supply apparatus) 10 and the sub board (control apparatus) 20 in this embodiment, and the connection relationship between the main board 10 and the sub board 20.

  The main board 10 includes a CPU 11 that controls the main board 10, an ASIC 12 that controls transmission and reception of data to and from the main board, and a flash memory that is a rewritable read-only memory in which a program for the main board 10 is stored (see FIG. Flash) 13, a RAM 14 for temporarily storing programs and data, a first I / F port 15, and a second I / F port 16.

  The sub board 20 includes a CPU 21 that controls the sub board 20, an ASIC 22 that transmits and receives data to and from the sub board, a flash memory 23 that is a rewritable read-only memory in which a control program for the sub board 20 is stored, In particular, it includes a RAM 24 and an I / F port 25 for storing programs and data.

  The main board 10 and the sub board 20 are connected via the first I / F port 15 of the main board 10 and the I / F port 25 of the sub board 20.

  More specifically, the main board 10 is a printer controller board in the multifunction peripheral, and the sub board 20 is a LAN (local area network) board or USB (universal serial bus) for function expansion to the printer controller board. Such as a substrate.

  The present invention is not limited to the above example. The main board 10 and the sub board 20 are configured and connected as shown in FIG. 1, and the main board 10 can be used even when the sub board 20 has no program. As long as the flash memory 23 of the sub-board 20 can be accessed via the I / F port 25, any form may be used.

  FIG. 2 shows the relationship between the memory spaces of the main board 10 and the sub board 20. The memory space of the main board 10 is constituted by the flash memory 13 and the RAM 14 in the main board 10, and the memory space of the sub board 20 is constituted by the flash memory 23 and the RAM 14 in the sub board 20.

  The memory space of the main board 10 and the memory space of the sub board 20 are connected via an I / F memory space. The I / F memory space is a shared memory that can be accessed from either the main board 10 or the sub board 20. The shared memory exists in the ASIC 12 of the main board 10, the ASIC 22 of the sub board 20, or the ASICs 12 and 22 of both the main board 10 and the sub board 20.

  In the example of FIG. 2, address spaces 0x05_0000_0000 to 0x0A_FFFF_FFFF in the memory space of the sub-board 20 are allocated to the program area, and the address space serving as the program area corresponds to the flash memory 13. Of the address spaces 0x05_0000_0000 to 0x0A_FFFF_FFFF, the address space 0x05_0000_0000 to 0x09_FFFF_FFFF is further allocated to the main area of the main program, and the address space 0x0A_0000_0000 to 0x0A_FFFF_FFFF is further allocated to the boot area (boot program area) of the boot program. .

  In the initial state, no program for operating the sub board 20 is written in the program area of the sub board 20, and the program for operating the sub board 20 is downloaded from the main board 10 for the first time. It becomes possible to operate.

  In that case, it is conceivable to open all the program areas of the sub board 20 so that the program can be downloaded from the main board 10 to the sub board 20. However, if the entire program area is released from the main board 10, the main board 10 writes illegal data to the program area, and the sub-board 20 may be used for an unintended purpose.

  Therefore, in the present embodiment, the sub board 20 opens only the check program area which is a part of the boot area in the program area of the sub board 20 with respect to the main board 10. The check program area is an area for writing a check program to be described later, and is a space starting from the head address of the boot area. In the example of FIG. 2, the address space 0x0A_FFFF_0000 to 0x0A_FFFF_FFFF corresponds to the check program area. The space size of the check program area is smaller than that of the boot area, and even if the main board 10 downloads the boot program to the check program area, the boot program cannot be written and the sub board 20 is operated. It is not possible.

  The check program is downloaded to the flash memory 23 of the sub-board 20, the sub-board 20 is turned on / reset, and the check program is started so that the sub-board 20 is connected to the sub-board 20 A process of determining whether or not the side board, that is, the main board 10 is a download permission target (permission target board) that may permit the download of the program to the sub board 20, and if the download permission target, the sub board The program area in the flash memory 23 at 20 is released, and the process that does not release the program area in the flash memory 23 on the sub-board 20 is executed if it is not a download permission target.

  Specifically, the opening of the check program area with respect to the main board 10 is specified in advance in the ASIC 22 of the sub board 20 so as to open the check program area according to the initial setting value. At the time of I / F initialization by the ASIC 22 of the sub-board 20, the ASIC 22 of the sub-board 20 only checks the check program area 0x0A_FFFF_0000 to 0x0A_FFFF_FFFF in the memory space of the sub-board 20 in the I / F memory space connected to the main board 10. Release to check program area 0x0F_FFFF_0000 to 0x0F_FFFF_FFFF. Thereby, the main board 10 can write data to the check program areas 0x0A_FFFF_0000 to 0x0A_FFFF_FFFF in the memory space of the sub board 20 by accessing 0x0F_FFFF_0000 to 0x0F_FFFF_FFFF in the I / F memory space.

  FIG. 3 shows a functional block diagram of a program operating on the main board 10. As shown in the figure, on the main board 10, a CPU 11, an ASIC 12, a flash memory 13, and a RAM 14 are operated in a timely manner, whereby a program generation unit (program generation means) 31, a program storage area 32, and an ID storage area 33 are displayed. , Program transmission unit (program transmission unit) 34, power supply monitoring unit (power supply monitoring unit) 35, program download instruction unit (instruction input unit) 36, analysis unit (analysis unit) 37, download state notification unit (download state notification unit) 38, a download switching setting unit (setting unit) 39, a program compression / decompression unit 40, and a program receiving unit (program receiving unit) 41 are configured.

  In the program storage area 32, as shown in FIG. 4, at least a check program and a boot program for the sub board 20 are stored. Among these, the check program includes each program for realizing each processing unit and storage area shown in FIG. 5 on the sub-board 20 and check program version information indicating the version of the check program.

  Further, in the ID storage area 33, for example, an ID (identification information) such as a character string for individually identifying each main board 10 such as a MAC address, a model name, and a serial number of the main board 10 is stored. ing. Here, a description will be given of a case where a MAC address is used as the ID of the main board 10.

  FIG. 5 shows a functional block diagram of a check program downloaded from the main board 10 that operates on the sub board 20. As shown in the figure, by starting the check program and causing the CPU 21, ASIC 22, flash memory 23, and RAM 24 to operate in a timely manner, the sub-board 20 includes a download permission determination unit 51, a jumper information extraction unit 52, A download permission ID extraction unit 53, a boot area release unit 54, a main board information storage area 55, and a notification unit 56 are configured. The main board information storage area 55 stores main board information (main board ID) included in the check program.

  Further, in the present embodiment, a jumper 60 as shown in FIG. 6A and 6B are diagrams for explaining the configuration of the jumper 60 and the setting method thereof. FIG. 6A is a view of the jumper 60 viewed from the side, and FIG. 6B is a connection diagram of jumper pins.

  The jumper 60 includes a jumper pin 61 and a jumper socket 62, and the pins of the jumper pin 61 to which the jumper socket 62 is attached are electrically connected. For example, if 1 pin (pin) of the jumper pin 61 is connected to the power supply layer (Vcc) and 3 pin of the jumper pin 61 is connected to the GND layer, the jumper socket 62 is connected to the jumper as shown in FIG. By mounting the pin 61 on the 1 pin and the 2 pin, the 2 pin of the jumper pin 61 is connected to the power supply layer (Vcc). As described above, the jumper 60 can switch the voltage level of the 2 pin of the jumper pin 61 depending on the mounting location of the jumper socket 62. A specific method for using the jumper 60 in the sub-board 20 will be described later.

  Hereinafter, an operation in the program download system of the present embodiment will be described.

  First, a check program transmission process that is a basic process performed on the main board 10 will be described.

  In the check program transmission process, the program generation unit 31 collects information from the ID storage area 33 and the program storage area 32 in accordance with the check program generation request, creates a check program, and the program transmission unit 34 creates the check program. Is transmitted to the sub-board 20 and downloaded.

  The check program generation request to the program generation unit 31 can be transmitted from the three processing units of the power supply monitoring unit 35, the program download instruction unit (instruction input means) 36, and the analysis unit 37, which will be described later.

  The procedure of the check program transmission process will be described using the flowchart of FIG. When there is a check program generation request, the program generation unit 31 acquires the check program from the program storage area 32 (S1), and then acquires the ID of the main board 10 from the ID storage area 33 (S2). Then, the program generation unit 31 incorporates the acquired ID of the main board 10 into the acquired check program, and completes the check program (S3). The completed check program is sent to the program transmission unit 34.

  Next, the program transmission unit 34 accesses the I / F memory space to which the main board 10 and the sub board 20 are connected, and addresses corresponding to the memory space of the sub board 20 that the sub board 20 is open to. Information is acquired (S4). The program transmission unit 34 writes the check program sent from the program generation unit 31 in the acquired address information space in the I / F memory space (S5). As a result, the check program is downloaded to the memory space of the sub-board 20 via the I / F memory space, and the check program transmission process ends.

  In the example of FIG. 2, the check program areas 0x0A_FFFF_0000 to 0x0A_FFFF_FFFF in the memory space of the sub-board 20 correspond to 0x0F_FFFF_0000 to 0x0F_FFFF_FFFF in the I / F memory space. Therefore, in S5, the program transmission unit 34 writes the check program in 0x0F_FFFF_0000 to 0x0F_FFFF_FFFF. Only the data written in the 0x0F_FFFF_0000 to 0x0F_FFFF_FFFF in the I / F memory space is moved to the memory space of the sub-board 20 and downloaded.

  Next, a download permission determination process and a boot area release process, which are basic processes in each processing unit of the sub-board 20, will be described. The sub board 20 executes a download permission / inhibition judgment process by starting the check program downloaded from the main board 10.

  The download enable / disable determining process is a process in which the download enable / disable determining unit 51 determines whether or not the partner main board 10 that has downloaded the check program is a download permission target. If it is determined in the download permission determination process that it is a download permission target, the boot area release unit 54 performs a boot area release process. If it is determined that it is not a download permission target, the boot area release unit 54 The release process is not performed. Here, as a more preferable correspondence, when not being a download permission target, the notification unit 56 responds to the main board 10 with a check program download rejection command indicating that the download of the check program is rejected.

  The boot area releasing process is a process in which the boot area releasing unit 54 releases the main board 10 so that data can be downloaded to the boot area of the sub board 20. Here, as a more preferable response, a check program end command (check program end information) indicating that the download of the check program has ended normally is responded to the main board 10. This is realized by including in the check program a program (completion notification program) for executing a process of transmitting a command indicating the end of download of the check program to the main board. Since the main board 10 is notified that the program has been successfully downloaded, the main board 10 can confirm that the download of the check program has been completed normally.

  Further, in the sub-board 20 of the present embodiment, in the download permission / inhibition judgment process, the judgment as to whether or not the partner main board 10 is a download permission target is based on the main board ID stored in the check program. Two cases are possible: a case based on a jumper setting for determining download permission.

  For the determination based on the main board ID, the download permission ID extraction unit 53 extracts the download permission ID list stored in the flash memory of the sub board 20, and the download permission determination part 51 stores the main board information. A determination is made based on whether or not the main board ID stored in the area 55 is included in the list. FIG. 8 shows an example of the download permission ID list 65. The download permission ID list 65 is composed of download permission IDs 66.

  When the jumper setting is used as a basis, the jumper information extraction unit 52 extracts the jumper setting provided in the sub-board 20 for determining the download permission, and the download permission determination unit 51 extracts the jumper setting. Judgment is made based on the setting.

  By making it possible to determine whether or not it is a download permission target by such a jumper setting, it is possible to specify the main board 10 that is a download permission target without having the download permission ID list 65 in the sub board 20 in advance. It becomes possible.

  Specifically, as shown in FIG. 9A, for example, when there are three types of main boards A to C that can be connected to the sub board 20, three jumpers J1, J2, and J3 are provided on the sub board 20. A configuration is possible in which these three jumpers J1 to J3 determine whether to permit or reject the download for the three types of main boards 10 of A to C.

  Here, as shown in the setting table of FIG. 9B, the setting of the jumper J1 corresponds to the download permission / non-permission of the A type main board 10 and the setting of the jumper J2 is the B type main board 10. The setting of the jumper J3 corresponds to the download permission / non-permission of the C main board 10.

  According to the setting table, for example, if the 2 pin voltage level of the jumper J1 is Vcc, the sub board 20 makes the A type main board 10 a download permission target, and if the 2 pin voltage level of the jumper J1 is GND, the A type Download of the main board 10 is not permitted.

  Further, in the sub-board 20 of the present embodiment, whether or not to execute the program download enable / disable determination can be set by a jumper itself, and a jumper for determining the program download enable / disable is provided. In the download permission determination process, the jumper information extraction unit 52 extracts the jumper setting, and the download permission determination unit 51 determines whether or not the program can be downloaded based on the extracted jumper setting. The download permission / inhibition determination process is continued only when the file is downloaded.

  By providing a jumper for determining whether or not the program can be downloaded, it is possible to forcibly reject the check program download from the main board 10 regardless of whether or not the download is permitted.

  Specifically, when the jumper for determining whether or not the program can be downloaded is set to download refusal, no matter what main board 10 is connected, the sub board 20 does not open the boot area and Then, a check program download rejection command for rejecting the check program download is transmitted.

  Here, as shown in FIGS. 10A and 10B, 1 pin of jumper JP1 for determining whether to download a program is connected to Vcc, and 3 pin of jumper JP1 is connected to GND. Then, if the 2pin voltage level of jumper JP1 is Vcc by the jumper socket for determining whether or not program download is possible, the program download enable / disable determination is executed, and if the 2pin voltage level of jumper JP1 is GND, the program download enable / disable determination is made. Is determined in advance so as not to execute.

  Note that it may be switched whether to execute the determination as to whether or not the program download is permitted by a method other than using the jumper setting.

  The flowchart of FIG. 11 shows the procedure of the download permission / inhibition determination process. The check program is downloaded and the sub-board 20 activates the process to start the process. First, the jumper information extraction unit 52 extracts the setting information of the jumper JP1 for determining whether or not to download the program shown in FIG. 10 (S11). Next, the download possibility determination unit 51 determines whether the voltage level of the 2 pin of the jumper JP1, which is the setting information extracted in S11, is Vcc or GND (S12), and if the voltage level of the 2 pin of the jumper JP1 is Vcc, Proceed to S13, and if the voltage level of pin 2 of jumper JP1 is GND, proceed to S19.

  In S <b> 13, the download possibility determination unit 51 extracts the main board ID from the main board information storage area 55. Next, the download permission / non-permission determining unit 51 determines whether or not to determine whether or not it is a download permission target using the download permission ID list 65 stored in the flash memory on the sub-board 20. (S14). The determination in S14 is made based on whether or not the download permission ID list 65 shown in FIG.

  If the download permission ID list 65 exists, the download permission ID list 65 determines the download permission target, and the process proceeds to S15. On the other hand, if there is no download permission ID list, it is determined that the download permission target is determined by the jumper setting on the sub-board 20, and the process proceeds to S16.

  In S15, the download permission extraction unit 53 reads the download permission ID list 65, and proceeds to S17. In S16, the jumper information extraction unit 52 extracts the settings of the download permission jumpers J1 to J3 on the sub-board 20, and similarly proceeds to S17. In S17, the download permission / non-permission determining unit 51 determines whether or not the download is permitted based on the information extracted in S15 or S16.

  If it is determined in S17 that download is permitted, the process proceeds to S18 and a boot area releasing process described later is performed. On the other hand, if it is determined that it is not a download permission target, the process proceeds to S19, where the notification unit 56 transmits a check program download rejection command indicating that the download of the check program is rejected to the main board 10 to determine whether to download the program. Exit.

  The flowchart of FIG. 12 shows the procedure for boot area release processing. The boot area releasing unit 54 changes the initial setting value of the ASIC 22 of the sub board 20 so as to open the boot area on the sub board 20 (0x0A_0000_0000 to 0x0A_FFFF_FFFF in the example of FIG. 2) (S21). Next, the notification unit 56 transmits a check program download end command to the analysis unit 37 of the main board 10 (S22).

  Thereafter, the main board 10 and the sub board 20 are powered on / reset, and the boards 10 and 20 are restarted (S23). The main board 10 includes a command for instructing a restart in the check program download end command, and the main board 10 is restarted when the command is received. On the other hand, the sub-board 20 is set to be restarted when a check program download end command is transmitted.

  In the sub-board 20, when the restart is applied, the boot area of the sub-board 20 is released according to the initial setting value of the ASIC 22 (S <b> 24), and the boot area release processing is ended.

  By such a boot area releasing process, it is possible to access the boot area of the sub board 20 from the main board 10 side, and it is possible to download the boot program for the sub board 20 from the main board 10 side.

  In the example of FIG. 2, the boot areas 0x0A_0000_0000 to 0x0A_FFFF_FFFF in the memory space of the sub-board 20 correspond to 0x0F_0000_0000 to 0x0F_FFFF_FFFF in the I / F memory space. When the main board 10 writes the boot program in these 0x0F_0000_0000 to 0x0F_FFFF_FFFF, only the data written in the 0x0F_0000_0000 to 0x0F_FFFF_FFFF in the I / F memory space is moved and downloaded to the memory space of the sub board 20.

  Next, a check program retransmission process performed on the main board 10 as a more preferable response will be described. In the check program retransmission process, the analysis unit 37 of the main board 10 receives the check program download end command and the check program download refusal command from the notification unit 56 of the sub board 20 and receives the sub program board from the main board 10. 20 is a process of downloading the check program again to the program 20.

  The flowchart of FIG. 13 shows the procedure of the check program retransmission process. The program transmission unit 34 determines whether or not the download of the check program to the sub-board 20 has been completed (S31). If the download of the check program has not been completed, the download of the check program is completed. Until the download of the check program is completed, the determination is repeated.

  In S31, when it is confirmed that the download of the check program has been completed, the analysis unit 37 determines whether or not a check program end command has been received from the notification unit 56 of the sub-board 20 (S32). If it has been received, the check program retransmission processing is terminated.

  On the other hand, if the check program end command has not been received in S32, the analysis unit 37 further determines whether or not a check program rejection command has been received from the notification unit 56 of the sub-board 20 (S33), and rejects the check program. If a command has been received, the check program retransmission process is terminated. If the check program rejection command has not been received, the analysis unit 37 outputs a check program generation request to the program generation unit 31 (S34). Thereby, the check program transmission process described in FIG. 7 is started again.

  As described above, when the check program is downloaded from the main board 10 to the sub board 20 and the check program cannot be normally downloaded due to some influence, a command response indicating the end of the check program download from the sub board 20 is received. Since the check program is automatically re-downloaded from the main board 10 to the sub-board using the absence, the check program download operation from the main board 10 to the sub-board 20 can be performed reliably.

  Next, a download status notification process performed on the main board 10 as a more preferable response will be described. The download status notification process is performed by the download status notification unit 38, that the check program is being downloaded from the main board 10 to the sub-board 20, or that the check program has been downloaded, or that the check program has been downloaded. This is a process for informing the user that the download of the program is not permitted so that the user can recognize it.

  As a notification method, for example, each content is notified on an operation panel of a device on which the main board 10 is mounted. Specifically, as shown in FIGS. 14A to 14C, if the check program is being downloaded, “Downloading program ...” is displayed on the display screen of the operation panel 70, and the check program is downloaded. Is finished, “Program download is complete.” On the display screen of the operation panel 70. ”Is displayed, and if downloading of the check program is not permitted,“ Program download is not permitted on the display screen of the operation panel 70. ”Is displayed.

  It should be noted that the method is not limited to the specific example described above as long as the user can visually recognize that the check program is being downloaded, that the check program has been downloaded, or that the download of the check program is not permitted. Any form is acceptable. For example, a status LED is provided on the main board 10 by a method different from the above example, the status LED blinks when the check program is being downloaded, and the status LED is turned off when the check program is downloaded. If downloading of the check program is not permitted, the status LED may be turned on.

  The flowchart of FIG. 15 shows the procedure of the download status notification process. In this flowchart, the download state is displayed on the operation panel 70 (see FIG. 14) of the device on which the main board 10 is mounted.

  The download state notification unit 38 first accesses the program transmission unit 34 and determines whether or not the check program is being downloaded to the sub-board 20 (S41). If the check program is being downloaded, the process proceeds to S42, where "Program Downloading ..." is displayed on the display screen of the operation panel 70, and the process returns to S41 again. On the other hand, if the check program is not being downloaded, the process proceeds to S43, where the analysis unit 37 is accessed to determine whether or not the download of the check program to the sub-board 20 has been completed.

  If the download of the check program has been completed, the download status notifying unit 38 will indicate “The program has been downloaded on the operation panel display screen. Is displayed (S44), and the download state notification process is terminated.

  On the other hand, if the download of the check program has not ended, the download state notification unit 38 accesses the analysis unit 307 to determine whether a check program download rejection command has been received from the sub-board 20 (S45). If the check program download refusal command is received, “Program download is not permitted.” On the display screen of the operation panel 70. Is displayed (S46), and the download state notification process is terminated. If the check program download refusal command has not been received from the sub-board 20, the process returns to S41 again.

  In this way, by notifying the user of the status of the check program download from the main board 10 to the sub board 20, attention should be paid to the fact that the main board 10 or the sub board 20 is turned off during the check program download. If the sub board 20 is erroneously attached to the main board 10 that is not a program download permission target, the user can be notified that the program download is not permitted.

  Next, the power supply monitoring process performed on the main board 10 as a more preferable response will be described. In the power supply monitoring process, the power supply monitoring unit 35 monitors whether or not the main board 10 is turned on, and at the same time the main board 10 is turned on, the program generation unit 31 is checked as described above. This is a process for making a program generation request.

The flowchart of FIG. 16 shows the procedure of the power supply monitoring process. The power monitoring unit 35 determines whether the main board 10 is turned on (S51). If the main board 10 is not turned on, the process returns to S51 and the power is turned on again. It is determined whether or not.
On the other hand, when the main board 10 is turned on, a check program generation request is output to the program generation unit 31 (S52). Thereby, the check program transmission process described in FIG. 7 is started.

  Thus, when the main board 10 is powered on, the check program is automatically downloaded to the sub-board 20 mounted on the main board 10 so that the user can operate the download of the check program. It can be carried out without intervention.

  However, there may be a case where the user does not want the check program to be automatically downloaded to the sub-board 20 when the power is turned on. For example, the check program is not stored in the flash memory 13 of the main board 10 or the version of the check program stored in the flash memory 13 of the main board 10 is old. In such a case, a configuration that can be set by the user so that the check program is not downloaded when the power is turned on is preferable.

  Therefore, in the main board 10 of the present embodiment, as a more preferable response, it is possible to specify on the user side whether or not to download the check program when the power is turned on. When specified, the check program is downloaded when the power is turned on.

  Specifically, a jumper JP2 for switching download is provided on the main board 10, and the download timing of the check program from the main board 10 to the sub board 20 is switched depending on the mounting position of the jumper socket for download switching. Can do. In this embodiment, the download switching setting unit 39 downloads the check program when the power to the main board 10 is turned on by the power supply monitoring process described in FIG. 16 if the voltage level of the 2 pin of the jumper JP2 is Vcc. If the voltage level of pin 2 of jumper JP2 is GND, the check program is not downloaded when the power to the main board 10 is turned on.

  Note that the present invention is not limited to the specific example described above, and any method may be used as long as it can switch the download process. For example, if a switch is provided on the main board 10 by a method different from the above example and the switch is in the ON state, the check program is downloaded when the power is turned on to the main board 10 and the switch is in the OFF state. For example, the configuration may be such that the check program is not downloaded when the power to the main board 10 is turned on.

  The flowchart of FIG. 18 shows the procedure of the download switching process in the download switching setting unit 39 of the main board 10. In this flowchart, the download switching jumper JP2 is used. The download switching setting unit 38 determines whether or not the voltage level of pin 2 of the download switching jumper JP2 is Vcc (S61). If it is Vcc, the process proceeds to S62, and the power monitoring process described with reference to FIG. I do. On the other hand, if it is not Vcc, the process is terminated as it is, and the power supply start process by the power supply monitoring unit 35 is not performed.

  Next, a program download instruction process performed on the main board 10 as a more preferable response will be described. When setting to not download the check program when the power to the main board 10 is turned on, the user instruction of the download execution of the check program is enabled, and the user performs an operation to instruct the download of the check program. The check program can be downloaded at the timing intended by the user.

  For example, as shown in FIG. 19, a program download execution menu 71, an OK button 72, and a cancel button 73 are displayed on the display screen of the operation panel 70 of the device on which the main board 10 is mounted, and the user presses the OK button. A configuration in which download of the check program is executed by pressing 72 is conceivable.

  Note that the present invention is not limited to the specific example described above, and any method may be used as long as it can instruct execution of downloading the check program. For example, a configuration may be adopted in which a push switch is provided on the main board 10 and a check program is downloaded when the push switch is depressed by a method different from the above example.

  The flowchart of FIG. 20 shows a program download instruction process in the program download instruction unit 36. In this flowchart, the check program is downloaded by an operation on the operation panel 70 of the device on which the main board 10 is mounted.

  The program download instruction unit 36 first displays a program download execution menu 71 on the display screen of the operation panel 70 (S71). Next, it is determined whether or not the OK button 72 is pressed (S72). If the OK button 72 is pressed, a check program generation request is output to the program generation unit 31 (S73). Thereby, the check program transmission process described in FIG. 7 is started.

  On the other hand, if the OK button 72 is not pressed, the process proceeds to S74 to determine whether or not the cancel button 73 is pressed. If the cancel button 73 is pressed, the program download instruction process is terminated. If the cancel button 73 is not pressed, the process returns to S72 again to determine whether or not the OK button 72 is pressed.

  Next, a program reception process performed on the main board 10 as a more preferable response will be described. The program reception process is for the sub board 20 acquired by the program receiving unit 41 via the second I / F port 16 different from the first I / F port 15 connected to the sub board 20. This is a process of storing program data (download program) for downloading in the program storage area 32. When receiving the download program including the check program, the program receiving unit 41 stores the received program data in the program storage area 32 as it is when it is not stored. If it is newer, store (update) it.

  When the check program is described as an example of the download program, specifically, the second I / F 16 of the main board 10 may be LAN, USB, RS-232C, etc., and the I / F port is connected from the PC. A configuration in which the check program is downloaded to the main board 10 via the above is conceivable. With this program reception process, there is no need to always store a check program for downloading to the sub-board 20 in the program storage area 32 of the main board 10, and when the check program needs to be downloaded, the second program of the main board 10 is stored. The check program may be acquired each time via the I / F 16. Even if the function of the check program is expanded in the future, it is possible to easily realize an upgrade of the check program.

  The flowchart of FIG. 21 shows the procedure of the program reception process. The program receiving unit 41 determines whether or not the check program data is received via the second I / F port 16 different from the first I / F port 15 connected to the sub-board 20 by the board 10. Judgment is made (S81). If no check program data has been received, the process returns to S81 again to determine whether check program data has been received. On the other hand, when the check program data is received, it is determined whether or not the check program data is already stored in the program storage area 32 (S82).

  If the check program data is not stored in the program storage area 32 in S82, the check program data acquired in S81 is stored in the program storage area 32, and the process returns to S81 again.

  On the other hand, when the check program data is stored in the program storage area 32 in S82, the program version information of the check program data acquired in S81 and the program version information of the check program already stored in the program storage area 32 To determine which program is newer (S83).

  In S83, if the newly acquired check program data is newer, delete the check program data already stored in the program storage area 32, store (overwrite) the acquired check program data, Return to S81. On the other hand, if the check program data already stored in the program storage area 32 is newer in S83, the check program data acquired in S81 is deleted (S86), and the process returns to S81 again. Although the end of the processing is not particularly described, it ends when the power of the main board 10 is turned off.

  In addition, the target program acquired via the second I / F port 16 in the program reception process is not limited to the check program, and the boot program can be acquired in the same procedure. It is. That is, when boot program data is received via the second I / F port 16 different from the first I / F port 15 connected to the sub-board 20 in the program reception process, the program storage area 32 is received. Is stored in the program storage area 32 as it is, if it is already stored in the program storage area 32, it is stored (overwritten) when the received boot program is newer. .

  Thereby, it is not necessary to always store the boot program for downloading to the sub-board 20 in the program storage area 32 of the main board 10, and when the boot program needs to be downloaded, the second I / O of the main board 10 is stored. What is necessary is just to acquire a boot program each time via F port 16. FIG. In addition, even if the boot program is expanded in the future, it is possible to easily upgrade the boot program.

  Further, in the above-described program reception process, the check program data or boot program data acquired via the second I / F port 16 is already stored in the program storage area 32. When it is newer than the program data, the acquired check program data or boot program data is overwritten and stored in the program storage area 32, and when the storage is completed, the program reception unit 41 outputs a check program generation request to the program generation unit 31. It is good also as composition to do. As a result, the check program transmission process described with reference to FIG. 7 is started, so that the newly acquired check program or the newly acquired boot program can be downloaded to the sub-board 20.

  The main board 10 may have a configuration in which a program to be downloaded to the sub board 20 is stored as compressed state data when stored in the flash memory 13 of the main board 10. Thereby, the pressure on the area of the flash memory 13 of the main board 10 can be reduced.

  Next, a program expansion process performed on the main board 10 as a more preferable response will be described. The program expansion process is performed when the program compression / decompression unit 40 stores a program to be downloaded to the sub board 20 in a compressed state on the flash memory 13 of the main board 10. It is processing.

  The program compression / decompression unit 40 stores these programs as compressed data in the program storage area 32 of the main board 10 when downloading the check program or boot program from the main board 10 to the sub board 20. In this case, the program data is decompressed.

  The flowchart of FIG. 22 shows the procedure of the program expansion process in the program compression / decompression unit 40. The program compression / decompression unit 40 determines whether or not the program generation unit 31 performs the program transmission process (S91). If the program transmission process is not performed, the program compression / decompression unit 40 returns to S91 again. On the other hand, when the program transmission process is performed, it is next determined whether or not the program data to be transmitted stored in the program storage area 32 is in a compressed state (S92). If it is in a compressed state, the program data is expanded (S93), and the expanded program data is stored in the flash memory 13 of the main board 10. On the other hand, if the program data to be transmitted is not compressed, the process returns to S91 again. Although the end of the processing is not particularly described, it ends when the power of the main board 10 is turned off.

  Further, the program compression / decompression unit 40 performs a compression process when program data to be downloaded to the sub-board 20 such as a check program or a boot program is already downloaded to the main board 10 in a compressed state. However, if it is downloaded without being compressed, it is stored in the program storage area 32 after being compressed.

  The program download method of the present invention includes a nonvolatile memory and a RAM in which a program for operating the processor and the main board is stored on the main board, and a program for operating the processor and the sub board on the sub board. In a program download method for downloading a program for operating a sub board from a main board to a non-volatile memory on a sub board, the sub board is non-volatile with respect to the main board. The main board downloads the check program to the relevant area, and after downloading the check program, the sub board starts the check program and is connected to the sub board. Have It is determined whether or not the in-board is a program download permission target. In other words, it can be said that the processing is terminated without releasing the area in the non-volatile memory of the sub-board.

  Since the control device having no program can selectively download a program for operating the control device including a boot program only from an authorized program supply device, for example, a multifunction device Can be used between a main board and a sub board that is set as an option so that a function can be added, and is used as a shared option for a plurality of types of main boards.

FIG. 2 is a configuration diagram illustrating each hardware configuration and connection relationship between a main board as a program supply apparatus and a sub board as a control apparatus in a program download system according to an embodiment of the present invention. It is drawing for demonstrating the memory relationship of the main board | substrate and sub board | substrate in the said program download system. It is a functional block diagram of the program which operate | moves on the said main board | substrate. It is a figure for demonstrating the data stored in the program storage area of the said main board | substrate. It is a functional block diagram of a check program downloaded from the main board to the sub board and operating on the sub board. (A) (b) is drawing for demonstrating the jumper provided in a main board | substrate or a sub board | substrate. It is a flowchart which shows the procedure of the check program transmission process implemented with the said main board | substrate. 4 is a diagram illustrating a download permission ID list provided on the sub-board. (A) and (b) are both drawings for explaining a download permission jumper setting provided on a sub-board. (A) (b) is a figure explaining the jumper setting of download possibility judgment provided in a sub board | substrate. It is a flowchart which shows the procedure of the download permission judgment processing implemented with the said sub board | substrate. It is a flowchart which shows the procedure of the boot area open | release process implemented with the said sub board | substrate. It is a flowchart which shows the procedure of the check program resending process implemented with the said main board | substrate. Both (a) to (c) are notification examples of the download state of the check program executed on the main board. It is a flowchart which shows the procedure of the program download state alerting | reporting process implemented with the said main board | substrate. It is a flowchart which shows the procedure of the power supply monitoring process implemented with the said main board | substrate. (A) and (b) are drawings for explaining a jumper setting for download switching provided on the main board. It is a flowchart which shows the procedure of the download switching process implemented with the said main board | substrate. 6 is a diagram illustrating a method of executing a download of a check program by an operation on an operation panel in a program download instruction process performed on the main board. It is a flowchart which shows the procedure of the program download instruction | indication process implemented with the said main board | substrate. It is a flowchart which shows the procedure of the program reception process implemented with the said main board | substrate. It is a flowchart which shows the procedure of the program expansion | extension process implemented with the said main board | substrate.

Explanation of symbols

10 Main board (program supply device)
15 First I / F port (input / output unit)
16 Second I / F port (input / output unit)
20 Sub-board (control device)
22 ASIC (check program acceptance means)
23 Flash memory (nonvolatile memory)
31 Program generator (check program download means)
32 Program storage area 33 ID storage area (identification information storage area)
34 Program transmitter (check program download means)
35 Power supply monitoring unit (Power supply monitoring means)
36 Program download instruction section (instruction input means)
37 Analysis unit (analysis means)
39 Switching setting section (setting means)
38 Download Information Notification Unit (Download Information Notification Unit)
41 Program receiving unit (program receiving means)

Claims (21)

A program download method of a program download system for downloading a program for operating the control device from a program supply device to a non-volatile memory for storing a program for operating the control device included in the control device,
The control device opens only a predetermined area of the boot program area in the nonvolatile memory to the program supply apparatus,
The program supply device downloads a check program to the predetermined area opened in the control device,
The control device activates the check program downloaded from the program supply device, and whether or not the connected program supply device is permitted to download the program to the control device. A program download characterized in that if it is a permission target, an area other than the predetermined area in the nonvolatile memory is also released, and if it is not a permission object, an area other than the predetermined area in the nonvolatile memory is not released. Method.   2. The program download method according to claim 1, wherein if the program supply device is a permission target, the control device releases a boot program area in the nonvolatile memory. The check program includes device-specific identification information attached to the program supply device,
The program download method according to claim 1, wherein the identification information acquired from the program supply device is used for determining whether or not the control device is a permission target.   The program download method according to claim 1, wherein a jumper setting provided in the control device is used to determine whether or not the control device is permitted. A program that operates the control device in a nonvolatile memory that is connected to the control device, shares an I / F memory space with the control device, and stores a program for operating the control device included in the control device Is a program supply device for downloading via the I / F memory space,
It is determined whether or not the connected program supply device is permitted to download the program to the control device. If it is permitted, the memory area of the nonvolatile memory included in the control device is determined. The non-volatile memory that the control device has a check program that opens to the I / F memory space and executes a process that does not open the memory area of the non-volatile memory to the I / F memory space unless it is a permission target. A program supply device comprising check program download means for downloading to a boot program area in a memory. The check program download means
A program generating means for generating a check program for referring to the check program stored in the program storage area and transmitting it to the control device;
6. The program supply device according to claim 5, further comprising: a program transmission unit that transfers the check program generated by the check program generation unit to the control device via the I / F memory space. . An identification information storage area for storing identification information unique to the device attached to the device;
7. The program supply apparatus according to claim 6, wherein the check program generation means incorporates identification information of the own apparatus into the check program with reference to the identification information storage area.   6. The end notification program for causing the check program to further execute a process of transmitting check program download end information indicating the end of download of the check program to the program supply device. Program supply device. Analysis means for determining whether or not the check program download end information has been received from the control device;
9. The check program download means, after transmitting the check program, when the analysis means has not received check program download end information, retransmits the check program to the control device. The program supply apparatus described in 1.   6. The program supply apparatus according to claim 5, further comprising download state notifying means for notifying a user of a download state of the check program to the control device. It further comprises power monitoring means for determining whether or not the power of its own device is turned on,
6. The program supply device according to claim 5, wherein the check program download unit starts an operation of causing the control device to download a check program when the power monitoring unit determines that the power is turned on.   When the power monitoring means determines that the power is turned on, it further comprises setting means for setting whether or not to start the operation of causing the control device to download the check program to the check program download means. The program supply device according to claim 11, wherein   13. The program supply apparatus according to claim 5, further comprising instruction input means for instructing the check program download means to start an operation for causing the control apparatus to download a check program. At least two input / output units connected to an external device and enabling input / output of information are provided.
A download program for the control device including the check program is acquired via an input / output unit different from the input / output unit connected to the control device, and the acquired download program is stored in the program storage area. If not, the downloaded program is stored, while if already stored, the two downloaded programs are compared, and if the downloaded program is newer, the program storage area is updated. The program supply device according to claim 6, further comprising a receiving unit.   7. The program supply apparatus according to claim 6, wherein a download program for the control apparatus including the check program is compressed and stored in the program storage area. A program that operates the control device in a nonvolatile memory that is connected to the control device, shares an I / F memory space with the control device, and stores a program for operating the control device included in the control device A program supply method for a program supply apparatus that downloads the program via the I / F memory space,
It is determined whether or not the connected program supply device is permitted to download the program to the control device. If it is permitted, the memory area of the nonvolatile memory included in the control device is determined. The non-volatile memory that the control device has a check program that opens to the I / F memory space and executes a process that does not open the memory area of the non-volatile memory to the I / F memory space unless it is a permission target. A program supply method comprising a check program download step for downloading to a boot program area in a memory. A non-volatile memory that is connected to the program supply apparatus, shares an I / F memory space with the program supply apparatus, and stores a program for operating the own apparatus included in the own apparatus from the program supply apparatus A control device in which a program for operating the device is downloaded,
In a state where no boot program is stored in the boot program area of the non-volatile memory of the own device, only a predetermined area of the boot program area of the non-volatile memory is opened to the I / F memory space. A control device comprising check program receiving means.   18. The control device according to claim 17, wherein the non-volatile memory stores a list of identification information attached to a permitted program supply device that is permitted to download a program to its own device. .   18. The control device according to claim 17, further comprising a jumper for designating that the connected program supply device is a permission target for which downloading of a program to the device is permitted. . A non-volatile memory that is connected to the program supply apparatus, shares an I / F memory space with the program supply apparatus, and stores a program for operating the own apparatus included in the own apparatus from the program supply apparatus A control method for a control device in which a program for operating the device is downloaded,
In a state where no boot program is stored in the boot program area of the non-volatile memory of the own device, only a predetermined area of the boot program area of the non-volatile memory is opened to the I / F memory space. A control method comprising a check program receiving step. A program download system for downloading a program for operating the control device from a program supply device to a non-volatile memory for storing a program for operating the control device included in the control device,
A program download system comprising the program supply device according to any one of claims 5 to 15 and the control device according to any one of claims 17 to 19.

Images