JP2009042818A - Image forming apparatus, program and recording medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an image forming apparatus, a program and a recording medium that can implement a safe update on programs such as system firmware. <P>SOLUTION: The image forming apparatus 10, which has a plurality of systems for redundancy, includes a start control means 210 for reading out a control program 310 corresponding to a specified system 250 to be started out of the plurality of systems by reference to a start control flag specifying the system 250 to execute a starting process, and an update control means 214 for, according to external update data, setting the start control flag 300 at a value specifying another system different from a target system to be updated, setting update progress information 302 representing the target system and updated systems, and starting to update the control program corresponding to the target system. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an image forming apparatus, and more particularly, to an image forming apparatus, a program, and a recording medium for safely updating a program.

  When a program such as a system firmware of an image forming apparatus is updated in accordance with the network support of an image forming apparatus such as a printer or a multifunction peripheral, the program is updated via a medium such as a ROM exchange or an SD (Secure Digital) memory card. In addition to the method performed by the operator, remote update using an update file downloaded via the network is also possible. As a technique related to program update via a network, for example, JP-A-11-203218 (Patent Document 1) can be cited.

Further, as the storage capacity of the image forming apparatus increases, an image forming apparatus has been developed in which the system is duplicated and the fault tolerance of the system is increased. In such an image forming apparatus, even if one system suffers a failure due to a power failure or the like during the system firmware update process, the other system can be activated. In the redundant system described above, the system can be restored by re-updating the system firmware, and a situation in which the apparatus cannot be activated can be suitably prevented. In relation to system duplication, for example, Japanese Patent Application Laid-Open No. 2005-339271 (Patent Document 2) discloses a rescue system using a card type memory.
Japanese Patent Laid-Open No. 11-203218 JP 2005-339271 A

  However, even when the system is duplicated as described above, interruption of the system firmware program update may cause both systems to fail, and the two systems are both destroyed. If this happens, there is a problem that the system cannot be recovered and used.

  For example, in an image forming apparatus that is duplicated as system A and system B, even when system A is destroyed due to a power interruption during updating of system A, activation by system B is possible. Yes. However, if the power supply is interrupted again during the update of the system B and the system B is also destroyed, both systems are in a state of being destroyed, so that there is a problem that the system cannot be started. .

  Further, in the duplex system as described above, it is preferable that the update states of the two systems are synchronized, and it has been desired to perform the update process continuously with one update file.

  The present invention has been made in view of the above-mentioned problems, and at any timing of the update of a software module such as system firmware that may damage the system due to interruption of the update process, the update process is performed at any timing. Even when an interruption occurs or even when interruptions occur continuously, at least one system can be activated and a damaged system can be recovered, and program update processing can be performed safely. An object of the present invention is to provide an image forming apparatus, a program, and a recording medium.

  In order to solve the above-described problem, the present invention relates to an activation control flag for designating a system to be activated among a plurality of systems in an image forming apparatus multiplexed by a plurality of systems. A configuration is adopted that includes a start control unit that reads a corresponding control program and executes a start process, and an update control unit that starts a control program update process for the target system in accordance with the acquired update data.

  In the present invention, multiplexing by a plurality of systems means that a plurality of sets of control programs corresponding to system firmware including an operating system and various control services for providing the functions of the image forming apparatus are stored in a storage unit. A configuration in which system firmware that reads and activates a control program can be switched in accordance with the activation control flag. The update control unit of the present invention sets a specified value of another system different from the target system to start the update to the activation control flag stored in the nonvolatile storage unit and the update with the target system is completed After the update progress information indicating the updated system is set, control for starting update processing for the target system is performed.

  With this control, even if the process is interrupted during the update process due to a power failure or the like, at the next startup, the system is started by another system that is different from the system that was updated at the time of the interruption, and the system is re-updated. Is restored from the system where the update is interrupted, and the update process for the next system can be started after the update is completed. Thus, even when the update process is interrupted at any timing or even when the interrupt process is continuously generated, the startup by at least one system is guaranteed, so that the program update process is safe. Is improved.

That is, according to the present invention, an image forming apparatus multiplexed by a plurality of systems, wherein the image forming apparatus includes:
A startup control unit that reads a control program corresponding to the specified system and executes a startup process with reference to a startup control flag that specifies a system to be started out of the plurality of systems;
In accordance with externally acquired update data, a specified value of another system that is different from the target system that starts the update is set in the start control flag, and update progress information that indicates the target system and the system that has been updated is set Then, there is provided an image forming apparatus including update control means for starting control program update processing for the target system.

  The update control means refers to the update progress information, detects that the update process has been interrupted, and is updating the system at the time of the interruption and the system that has been updated by the interruption And the update process for the incomplete system can be started sequentially from the system being updated. In addition, the update control unit can set the activation control flag to a default value and erase the setting of the update progress information when update processing for all the plurality of systems is completed. Further, the update control means compares the update target module identification value included in the update data with the updating module identification value set together with the update progress information before starting the update, before and after the interruption. It is possible to confirm the matching of the update target modules. The update control means can determine the validity of the update data with reference to an electronic signature included in the update data. Furthermore, in response to the failure of the update process, notification means for notifying the failure and the reason for failure may be included.

  Further, the image forming apparatus analyzes the data structure of the acquired update data, specifies an operation when starting update processing of each system, a specified value for setting the start control flag, and each system The update control means sets the extracted specified value in the activation control flag, and uses the extracted execution order as the update progress information. Set and start the update process for each system.

  Further, according to the present invention, there is provided an apparatus executable program for causing an image forming apparatus to function as each of the above-described means. According to the present invention, there is provided a device-readable recording medium that records a device-executable program for causing the image forming apparatus to function as each of the above-described means. Further, according to the present invention, there is provided a recording medium used by the image forming apparatus, the update module control program, an electronic signature that guarantees the validity of the control program, and a module identification value associated with the control program And a computer-readable recording medium in which update data having a data structure including a specified value for specifying activation by another system different from the system and an execution order of update processing for the system is provided for each system Is done.

  Hereinafter, although embodiment of this invention is described, embodiment of this invention is not limited to the following embodiment. In this embodiment, as an example of an image forming apparatus, an example in which a multifunction machine 10 having a complex function for handling images such as a copy, a facsimile, a scanner, and a print will be described.

  FIG. 1 shows an embodiment of a hardware configuration of the multifunction machine 10. The multifunction machine 10 includes a controller 12, an operation panel 42, an FCU (facsimile control unit) 44, and an engine unit 46. The controller 12 includes a CPU (Central Processing Unit) 14, an NB (North Bridge) 18, an ASIC 20 connected to the CPU 14 via the NB 18, and a system memory 16. The ASIC 20 executes various types of image processing and is connected to the NB 18 via an AGP (Accelerated Graphic Port) 48. The system memory 16 is used as a drawing memory or the like.

  The ASIC 20 is connected to a local memory 22, a hard disk drive (hereinafter referred to as HDD) 24, and a nonvolatile memory 26 (hereinafter referred to as NV-RAM) such as a flash memory. The HDD 24 is a storage device that accumulates image data and the like. In this embodiment, the storage area is logically divided into two partitions, and a control program group corresponding to each system firmware for duplicating the system Is stored in each partition. The NV-RAM 26 stores various system information and various setting information of the multifunction peripheral 10, and stores a rescue flag and update interruption information, which will be described later, in this embodiment.

  The controller 12 further includes an SB (South Bridge) 28, a NIC (Network Interface Card) 30, an SD card slot 32, a USB interface 34, an IEEE 1394 interface 36, and a Centronics interface 38. These are connected to the NB 18 via the PCI bus 50. The SD card slot 32 is configured so that an SD memory card can be attached and detached, and an update file of system firmware can be read from the loaded SD memory card. The NIC 30 is an interface device that connects the multifunction peripheral 10 to a network such as the Internet or a LAN, and can receive an update file of a system firmware via the network. The USB interface 34, the IEEE 1394 interface 36, and the Centronics interface 38 are interfaces conforming to the respective standards, and accept print jobs.

  The operation panel 42 is connected to the ASIC 20 of the controller 12 and provides a user interface for receiving input of various instructions from the operator and displaying a screen. The FCU 44 and the engine unit 46 are connected to the ASIC 20 via the PCI bus 52. The engine unit 46 receives a print command or a scan command issued by the application and executes an image forming process or an image reading process.

  FIG. 2 shows a software and hardware configuration of the multifunction machine 10 of the present embodiment. The MFP 10 shown in FIG. 2 receives processing requests from the various applications 62 to 70 by the application layer 60 including various applications 62 to 70 for providing various functions and a predefined function included in the API 72. It includes a receiving platform layer 100 and a hardware resource 102 connected to the platform layer 100 via an engine interface (I / F) 98.

  In the embodiment shown in FIG. 2, the application layer 60 includes a copy application 62, a fax application 64, a scanner application 66, and a printer application 68, for user services related to images. Perform specific processing. In addition, the application layer 60 of the MFP 10 according to the present embodiment further includes a remote update application 70, and the remote update application 70 controls reception of update files such as system firmware.

  The platform layer 100 interprets processing requests from the applications 62 to 70 together with the OS 94, manages control services 74 to 84 that generate hardware resource acquisition requests, and one or a plurality of hardware resources, and controls each control. A system resource management manager (SRM) 90 that arbitrates acquisition requests from the services 74 to 84 and an image memory handler (IMH) 92 that controls transfer of image data between the engine unit 46 and the controller through the OS 94 are configured. . For example, UNIX (registered trademark) can be employed as the OS 94, but WINDOWS (registered trademark) or any other OS can be employed.

  In the embodiment shown in FIG. 2, the platform layer 100 includes an engine control service (ECS) 74, a memory control service (MCS) 76, an operation control service (OCS) 78, a facsimile control service (FCS) 80, A network control service (NCS) 82 and a system control service (SCS) 84 are included.

  The SCS 84 manages applications 62 to 70, controls user interfaces such as system screen display and LED display, manages hardware resources, and controls interrupt applications. The MCS 76 performs memory control such as acquisition and release of image memory and compression / decompression of image data. The ECS 74 controls hardware resources such as the engine unit 46 and the HDD 24, and controls image reading and image forming operations. The FCS 80 is connected to the GSTN interface and controls facsimile transmission / reception and facsimile reading using the GSTN network. The OCS 78 controls the operation panel 42 serving as an interface between the operator and the main body control. The NCS 82 controls the NIC 30 to connect the MFP 10 to Ethernet (registered trademark) or the Internet, and provides a service that can be commonly used for applications that require network I / O. Data received by the protocol is distributed to each application, and mediation is performed when data from each application is transmitted to the network side. Note that a set of software means of the platform layer 100 including the OS 94 described above is referred to as system firmware.

  The multi-function peripheral activation unit 58 is activated when the power of the multi-function peripheral 10 is turned on. The control program corresponding to the process group of the platform layer 100 and the application layer 60 described above is stored in a ROM, HDD 24, SD card (not shown), And is expanded on the system memory 16 which provides the working memory area of the CPU 14, and the process of the software means is started. Thereby, the above-described software means and each functional means described later are realized.

  The MFP 10 of the present embodiment is redundantly made up of a primary system that is normally used and a secondary system for spare rescue, and one of the systems has suffered a failure due to, for example, interruption of the update process. Even in such a case, the system can be activated by the other system. Here, the system refers to a set composed of the system firmware and the upper-level applications 62 to 70. The duplexing by the system refers to a configuration in which two sets of control programs corresponding to the system are stored in each partitioned partition of the HDD 24 and the system to be activated can be selected. Each system may have the same configuration, or may have a different configuration such as a combination of a normal system and a rescue system including only a minimum configuration. In this embodiment, a case where the system is duplicated will be described as an example. However, multiplexing can be performed by two or more systems. Details of the activation process of the multifunction machine 10 will be described below.

  FIG. 3 is a block diagram illustrating a main functional configuration related to the activation process of the multifunction machine 10 according to the present embodiment. FIG. 3 shows the boot loader 210, the NV-RAM 26, and the first partition 24 a and the second partition 24 b given by the storage area of the HDD 24. The first partition 24a of the HDD 24 stores the control program 310a for the primary system, the second partition 24b stores the control program 310b for the secondary system, and the multifunction machine 10 designates the system to be activated. In response, the partition from which the control program is read is switched. The NV-RAM 26 stores a rescue flag 300 that designates a system to be activated. The boot loader 210 is first activated when the MFP 10 is turned on, and the rescue flag 300 stored in the NV-RAM 26 is displayed. The system to be activated is determined by referring to the control program, the control program is read from the partition corresponding to the designated system, and the activation process of the system 250 is executed. In this embodiment, the boot loader 210 constitutes an activation control unit, and the rescue flag 300 constitutes an activation control flag.

  The NV-RAM 26 further stores update interruption information 302 indicating the status of the update process. As will be described in detail later, the update interruption information 302 includes a module ID to be updated and an index indicating the progress status of the update process. The system 250 activated by the boot loader 210 includes an update interruption detection unit 212 and an update unit 214, and the update unit 214 executes program update of software modules that constitute each system. The update interruption detection unit 212 attempts to refer to the update interruption information 302 and detects that the module update process has been interrupted. In this embodiment, the update interruption information 302 is set when the update process is started, and the setting is deleted when the update process is completed. For this reason, the presence of the update interruption information 302 indicates that the update process has been interrupted due to power interruption or the like. In other words, the update interruption detection unit 212 detects an update interruption from the presence or absence of the update interruption information 302. When the update interruption is detected, the update interruption detection unit 212 causes the operation panel 42 to display that the interruption of the update process is detected as shown in FIG. Do.

  FIG. 10 shows an example of a graphical user interface (GUI) screen 400 displayed on the operation panel 42 when the interruption of the update process is detected. Hereinafter, for ease of explanation, a case where the operation panel 42 is configured by a touch panel or the like will be described as an example.

  The GUI screen 400 shown in FIG. 10 displays that the update of the system firmware has been detected, a message 402 that the update of the predetermined software module is incomplete, and a message that displays the incomplete module 404, a re-update start button 406, and a confirmation button 408. The re-update start button 406 waits for an instruction to start re-update from the operator, and activates the update unit 214 in response to being pressed to start re-update processing of the system firmware. On the other hand, the confirmation button 408 is a button for instructing the start of re-update once again after the system is activated in the normal format, and the activation processing in the normal format is executed in response to pressing. In this case, when a re-update start request such as an instruction from the operator is received again, the multi-function device 10 activates the update unit 214 and starts re-update processing of the system firmware.

  Details of the software module program update by the update unit 214 will be described below. FIG. 4 is a block diagram showing a main functional configuration related to program update in the multifunction machine 10 of the present embodiment. FIG. 4 shows the update unit 214, the NV-RAM 26, the first partition 24a and the second partition 24b, and an update file 304 for program update. The update file 304 is received via the network by the remote update application 70, read from a removable medium such as the SD memory card 54 storing the update file 304, and expanded in a storage area such as the system memory 16.

  More specifically, the update unit 214 illustrated in FIG. 4 analyzes the update control unit 216 that controls execution of the program update process, the rewrite unit 218 that rewrites the control program of each system, and the acquired update file 304. And an analysis unit 220 for performing the configuration. The analysis unit 220 analyzes the update file 304 according to a predetermined data structure, and extracts information necessary for the update. The update control unit 216 controls the progress of the update process, sets the rescue flag 300 and the update interruption information 302 each time before starting the update process for each system, and then sequentially updates each system by the rewrite unit 218. The control program is rewritten. The rewrite unit 218 rewrites the update part 312a of the primary system control program 310a and the update part 312b of the secondary system control program 310b in order according to the update file under the control of the update control part 216.

  The details of the update file 304 used for the above-described program update will be described below. FIG. 5 shows an example of the data structure of the update file 304. The update file 304 includes a header portion including a common header, a primary system header, and a secondary system header, and a data portion including an electronic signature and update entity data. The common header includes a model ID field in which the identification value of the model to be updated by the update file 304 is input, and a module ID field in which the identification value of the software module to be updated by the update file 304 is input. Consists of including.

  The update entity data included in the data portion includes entity data for rewriting each update portion 312a, b of each partition 24a, b, including a control program described by the binary execution code of the software module to be updated. is there. The electronic signature is attached to guarantee the validity of the update entity data, and it is possible to detect falsification of the update entity data by confirming the validity. As such an electronic signature, any type of electronic signature can be adopted, for example, RSA signature, DSA (Digital Signature Algorithm) signature, Schnorr signature, elliptical Schnorr signature, ElGamal signature, elliptical ElGamal signature, etc. Can do.

  Each system header includes an update destination address field indicating an update destination storage area, an update destination area length field indicating the size of the update destination storage area, a rescue flag specification value field, and an index specification value field. Consists of including. Here, in the rescue flag designation value field, a value for setting the rescue flag 300 is input before starting the update of the control program of each system, and the update file 304 is based on a system different from the system of each header. Distribution can be performed with the value specifying start-up entered. That is, in this embodiment, the value of [ON] that specifies activation by the rescue secondary system is input to the rescue flag designation value of the primary system header, and the rescue flag designation value of the secondary system header is the primary flag. A value of [OFF] that specifies activation by the system is input.

  Further, a value for setting the index of the update interruption information 302 is input to the index designation value field before starting the update of the control program of each system. Here, the index is information for identifying a plurality of write destinations, and is information indicating the execution order of update processing. That is, when it is stipulated that the update is performed in the order of the primary system and the secondary system, the update file 304 is input with [1/2] as the index designation value of the primary system header, and the index of the secondary system header. The specified value is distributed with [2/2] entered. The number at the beginning of the index indicates the execution order of update processing of each system, and the number after the number indicates the total number of processes. The index is set as the update interruption information 302 in the NV-RAM 26 before the update process is started, so that the progress information of the update process is held.

  In the update destination address field, the address on the storage area of the MFP 10 of the module to be updated in each system is input, and in the update destination area length field, the storage area size of the module is input. The start position and end position of the area where the control program to be stored is stored are shown. For example, the address and size corresponding to the update portion 312a on the first partition 24a are input to the update destination address field of the primary system header.

  In the present embodiment, the update file 304 has been referred to as including update entity data of one update target software module. However, the update file 304 may include update entity data of a plurality of update target modules. .

  The details of the update processing flow will be described below with reference to FIGS. 6 and 7 show flowcharts of control in program update executed by the update control unit 216 of the present embodiment. The control shown in the figure is, for example, activated to execute update processing triggered by insertion of the SD memory card 54 storing the update file 304 or reception of the update file 304 from the distribution server for remote update. The system is restarted according to the style, and starts from step S100.

  First, in step S101, it is determined whether or not the update interruption information 302 exists in the NV-RAM 26. In step S101, by confirming the presence of the update interruption information 302, it is detected that the process has been interrupted due to a power interruption or the like during the previous update. If it is determined in step S101 that the update interruption information 302 exists (YES), the control is branched to point A. Control after point A will be described later. On the other hand, if it is determined in step S101 that the update suspension information 302 does not exist (YES), the control branches to step S102, the model ID and module ID are acquired from the common header of the update file 304, and the present multifunction device 10 is verified whether the update file 304 conforms to the above. In step S103, the validity of the update entity data is verified by the electronic signature of the update file 304.

  In step S104, it is determined whether or not to continue the update process from the results of the verification in steps S102 and S103. In this case, when the model ID matches that of the MFP 10, the MFP 10 has a software module corresponding to the module ID, and the validity of the update entity data by the electronic signature is proved In addition, it can be determined that the execution of the update process is continued. In another embodiment, here, it can be controlled to verify whether or not the update entity data included in the update file 304 corresponds to a newer version than the module included in the multifunction machine 10. If it is determined in step S104 that execution of the update process is to be continued (YES), the control is branched to step S105, and thereafter, the update process for the primary system from step S105 to step S108, and from step S109 to step S112. The update process for the secondary system is sequentially executed.

  In step S105, an update destination address, an update destination area length, a rescue flag specified value, and an index specified value are acquired from the primary system header. In step S106, the rescue flag 300, module ID, and index stored in the NV-RAM 26 are set to the acquired rescue flag designation value, module ID, and index designation value, respectively. In step S107, the rewrite unit 218 starts the update process of the primary system. In step S108, a response from the rewriting unit 218 is waited to determine whether or not the update process for the primary system has been completed. If not completed (NO), the control is looped in step S108. If a normal completion response is received from the rewrite unit 218 and it is determined in step S108 that the update process has been completed (YES), the control is branched to step S109.

  In step S109, the update destination address, the update destination area length, the rescue flag designation value, and the index designation value are acquired from the secondary system header. In step S110, the rescue flag, module ID, and index stored in the NV-RAM 26 are obtained. The rescue flag specified value, module ID, and index specified value are set. In step S111, the rewrite unit 218 starts the update process of the secondary system. In step S112, it waits for a response from the rewriting unit 218, and determines whether or not the update process for the secondary system is completed. If not completed (NO), the control is looped in step S112. If a normal completion response is received from the rewrite unit 218 and it is determined in step S112 that the update process has been completed (YES), the control is branched to step S113.

  In step S113, the update interruption information 302 is deleted from the NV-RAM 26, and in step S114, the operation panel 42 is notified that the program update has been completed normally. In step S115, the control is terminated. On the other hand, when it is determined in step S104 that the execution of the update process is not continued (NO), the control is branched to step S116. In step S116, the operation panel 42 is notified of an error together with information on the error factor such as the fact that the update file is not compatible or the validity of the update entity data cannot be confirmed, and the control is terminated in step S115.

  Referring back to the determination in step S101 described above, if it is determined in step S101 that the update interruption information 302 exists (YES), as described above, control branches to step S117 in FIG. A re-updating process for recovery from the interruption is performed. In step S117, the update interruption information 302 including the module ID and the index is read from the NV-RAM 26. In step S118, the model ID and the module ID are acquired from the common header of the update file 304, and it is verified whether the update file 304 is suitable for the multifunction machine 10. At the time of recovery, in step S119, it is verified whether the module ID of the update interruption information 302 read from the NV-RAM 26 matches the module ID acquired from the common header of the update file 304. In step S120, the validity of the update entity data is verified based on the electronic signature of the update file 304.

  In step S121, it is determined from the verification results in steps S118 to S120 whether or not to continue the update process. Here, the MFP 10 has a software module corresponding to the module ID corresponding to the module ID and corresponding to the module ID, the validity of the update entity data by the electronic signature is verified, and the module When the IDs match, it can be determined that the execution of the update process is continued. If it is determined in step S121 that the execution of the update process is not continued (NO), the process branches to point C, that is, the control in step S116 in FIG. In step S116, an error is notified to the operation panel 42 that the update file is not compatible, the validity of the update entity data cannot be confirmed, or that the update file is different before and after the interruption if the modules do not match. In step S115, the control is terminated.

  On the other hand, if it is determined in step S121 that execution of the update process is to be continued (YES), the control is branched to step S122, and thereafter, re-updating of the primary system from step S122 to step S126, and from step S127 to step S122. Re-updating of the secondary system up to S130 will be attempted sequentially.

  In step S122, an update destination address, an update destination area length, a rescue flag designation value, and an index designation value are acquired from the primary system header. In step S123, the index value of the update interruption information 302 is compared with the index designation value acquired from the header, and the execution order of the update process indicated by the index of the update interruption information 302 is the execution order indicated by the index designation value. It is determined whether or not: If the execution order indicated by the index of the update interruption information 302 is greater than that of the index specified value, it means that the update processing for the system has already been completed before the previous interruption. Therefore, when it is determined in step S122 that the execution order is not equal to or lower than the index designation value (NO), the re-update process of the primary system is skipped and the process branches to step S127.

  On the other hand, if it is determined in step S122 that the index specified value is equal to or lower than the execution order (YES), the control branches to step S124, and the rescue flag 300 and module ID stored in the NV-RAM 26 are branched. And the index are set to the acquired rescue flag specified value, module ID, and index specified value, respectively, and re-update processing of the primary system is started by the rewrite unit 218 in step S125. In step S126, a response from the rewriting unit 218 is waited to determine whether or not the re-update process for the primary system has been completed. If not completed (NO), the control is looped in step S126. If a normal completion response is received from the rewrite unit 218 and it is determined in step S126 that the update process has been completed (YES), the control is branched to step S127.

  In step S127, the update destination address, the update destination area length, the rescue flag specified value, and the index specified value are acquired from the secondary system header. In step S128, the rescue flag 300, module ID, and index stored in the NV-RAM 26 are set to the obtained rescue flag designated value, module ID, and index designated value, respectively. Start re-update process. In step S130, a response from the rewriting unit 218 is waited to determine whether or not the re-update process for the secondary system is completed. If not completed (NO), the control is looped in step S130. When a normal completion response is received from the rewrite unit 218 and it is determined in step S130 that the update process has been completed (YES), control is branched to point B, that is, step S113 in FIG. Is deleted from the NV-RAM 26, the operation panel 42 is notified of the normal completion of program update in step S114, and the control is terminated in step S115.

  Hereinafter, the user notification screen displayed on the operation panel 42 by the control flow shown in FIGS. 6 and 7 will be described. FIG. 11A shows an example of a GUI screen 420 displayed on the operation panel 42 in order to notify that the update process has been normally completed by the process of step S114 of FIG. The GUI screen 420 shown in FIG. 11A includes a message 422 that the program update has been completed normally, a message 424 that indicates the module ID that has been updated, and a confirmation button 426 that waits for confirmation from the operator. Consists of.

  FIG. 11B shows a GUI screen 440 displayed on the operation panel 42 in order to notify the error that the validity of the update entity data of the update file 304 has not been confirmed in the process of step S116 of FIG. An example is shown. The GUI screen 440 shown in FIG. 11B includes a message 442 that the validity of the update file 304 could not be confirmed, and a confirmation button 444 that waits for confirmation from the operator.

  In the present embodiment, user notification via the operation panel 42 is described as an example, but the functional means for performing user notification is not limited to the operation panel 42. In other embodiments, notification that an interruption during program update has been detected, notification that update processing has been completed, notification of an update error, etc. are made by mail transmission using the NIC 30 or service using the engine unit 46 It may be performed by printing. With the configuration including the notification means, the operator can easily grasp the status of the program update, and convenience is improved.

  Hereinafter, the rescue flag, the module ID, and the index that change as the update process proceeds will be described with reference to FIG. FIG. 8 is a diagram schematically showing transitions in accordance with the progress of update processing of the control information stored in the NV-RAM 26. FIG. 8 shows how the values of the control information for each item of the rescue flag, module ID, and index control information transition. In FIG. 8, the arrows indicate the passage of time, and the values in a total of four time intervals are shown for each control information sliced at the timing of the primary system update start, secondary system update start and update completion.

  Referring to FIG. 8, before the update of the primary system is started, that is, before the update process itself is started, the rescue flag is set to [OFF] which is a default value, and the module ID and the index are set. , It does not exist on the NV-RAM 26. Then, at the timing when the update of the primary system is started, the rescue flag is set to [ON] and the update interruption information 302 is set. In FIG. 8, the module ID has a value of [SYSTEM] and the index has [1]. / 2] is set.

  Further referring to FIG. 8, when the update of the primary system is completed and the update of the secondary system is started, the rescue flag is reset to [OFF] and the index is reset to [2/2]. It has been shown. Further, after the update of the secondary system is completed, that is, after all the update processes are completed, the update interruption information 302 including the index and the module ID is erased from the NV-RAM 26, and the rescue flag is set to the default value [ON]. Has been returned to

  As described above, the control information such as the rescue flag, the module ID, and the index stored in the NV-RAM 26 changes according to the progress of the update process, and the multifunction machine 10 operates according to these control information. In the following, the operation of the multifunction machine 10 when the program update is interrupted due to power interruption or the like in the time interval I and the time interval II shown in FIG.

  FIG. 9 is a flowchart illustrating the operation of the multifunction machine 10 when the update process is interrupted. FIG. 9A shows a flowchart when the update processing is interrupted in the time interval I shown in FIG. The operation shown in FIG. 9A is interrupted in the time interval I, and then starts from step S200 upon receiving power-on from the operator. First, when the update process is interrupted during the update of the primary system, the rescue flag is set to [ON], and therefore in step S201, the multifunction machine 10 is activated by the secondary system. Thereafter, the re-updating process is started. In step S202, the common header of the update file 304 is analyzed. In step S203, electronic authentication is performed using the digital certificate included in the update file 304.

  In step S204, the primary system header is analyzed. When interrupted in the time interval I, since [1/2] is set in the index of the update interrupt information 302, the index execution order of the index of the update interrupt information 302 is the index designation value of the primary system header. In step S205, the primary system is updated. Subsequently, in step S206, the secondary system header is analyzed, the secondary system is updated in step S207, and the update process is completed in step S208. In this way, even if there is an update interruption during the update of the primary system, at least one of the systems is started by the secondary system and re-update is performed from the primary system that was being updated at the time of the previous interruption. Activation by is guaranteed.

FIG. 9B shows a flowchart when the update process is interrupted in the time interval II shown in FIG. The operation shown in FIG. 9A is interrupted in the time interval II, and then starts from step S300 in response to power-on from the operator. In step S301,
If the update process is interrupted during the update of the secondary system, the rescue flag is set to [OFF], so the multifunction machine 10 is activated by the primary system. Thereafter, the re-updating process is started. In step S302, the common header of the update file 304 is analyzed. In step S303, electronic authentication is performed using the digital certificate included in the update file 304.

  In step S304, the primary system header is analyzed. In this case, since [2/2] is set in the index of the update interruption information 302, the execution order of the index of the update interruption information 302 becomes larger than the execution order of the index designation value of the primary system header, and the primary System update is skipped. In step S305, the secondary system header is analyzed. In step S306, the secondary system is updated. In step S307, the update process is completed. In this way, even if there is an update interruption during the update of the secondary system, the primary system starts up, the update of the previously completed primary system is skipped, and the update is restarted from the interrupted secondary system. As a result, activation by at least one system is guaranteed.

  Even if there is further interruption during the update of the primary system in step S204 in FIG. 9A, the multifunction machine 10 performs the same operation as in FIG. 9A again, and in step S206 in FIG. 9A. Even if there is an interruption when the secondary system is updated, the multifunction machine 10 operates in the same manner as in FIG. 9B, and even if there is an interruption when the secondary system is updated in step S305 in FIG. The multifunction device 10 performs the same operation as that in FIG. 9B, and is guaranteed to be activated by at least one system.

  In the control flow shown in FIG. 6 and FIG. 7, before starting the update process, the rescue flag is set to a value that specifies activation by another system that is different from the system to be processed. Even when the power is cut off, it can be started by a normal other system that is not the target of the update process at the next startup. When the system is restored by re-updating, the index indicating the progress of the update process is referred to, the update is interrupted from the system where the update is interrupted, and the update process for other systems starts sequentially after the completion. As a result, the situation where both the primary system and the secondary system are interrupted before the recovery is suitably prevented. In this way, even when the update process is interrupted at any timing, or even when the update process is continuously generated, it is possible to guarantee activation by at least one system. .

  As described above, according to the present embodiment, the update process is interrupted at any timing in the program update of the software module that may cause the system failure due to the interrupt of the update process such as the system firmware. Even if the system is interrupted or if interruptions occur continuously, at least one system can be activated and the system that has been damaged can be recovered, so that the program update process can be performed safely. Image forming apparatus, program, and recording medium can be provided.

  The system firmware consisting of the operating system, platform layer software modules, etc. is prone to cause a fatal error when a failure occurs due to interruption of the update process. The present invention can be preferably applied when updating software modules constituting such system firmware.

  The image forming apparatus is not limited to the multifunction apparatus having the complex function of the above-described embodiment, and can be configured as a copying machine, a printer, a printing machine, a facsimile machine, or the like according to a specific application. . The storage means for storing the control program of each system is not limited to the HDD of the above-described embodiment, but a nonvolatile storage medium such as a flash memory, an SD memory card or a CF (Compact Flash (registered trademark)) card. In addition, each system may be stored in different storage means.

  Further, the above function can be realized by a device executable program described in a legacy programming language such as assembler, C, C ++, C #, Java (registered trademark), an object-oriented programming language, or the like. ROM, EEPROM, EPROM , Stored in a device-readable recording medium such as a flash memory, a flexible disk, a CD-ROM, a CD-RW, a DVD, an SD memory, or an MO.

  Although specific embodiments of the present invention have been described above, the embodiments of the present invention are not limited to the above-described embodiments, and those skilled in the art will conceive other embodiments, additions, modifications, deletions, and the like. It can be changed within the range that can be achieved, and any aspect is included in the scope of the present invention as long as the effects and effects of the present invention are exhibited.

1 is a diagram illustrating an embodiment of a hardware configuration of a multifunction machine. FIG. 2 is a diagram illustrating a software and hardware configuration of a multifunction machine according to the present embodiment. FIG. 3 is a block diagram illustrating a main functional configuration related to the activation process of the multifunction machine according to the present embodiment. FIG. 3 is a block diagram illustrating a main functional configuration related to program update in the multifunction peripheral according to the embodiment. The figure which shows an example of the data structure of an update file. The flowchart (1/2) of the control in the program update which the update control part of this embodiment performs. The flowchart (2/2) of the control in the program update which the update control part of this embodiment performs. The figure which shows typically the transition according to the update process progress of the control information memorize | stored in NV-RAM. 6 is a flowchart illustrating the operation of the multifunction peripheral when update processing is interrupted. The figure which shows an example of the GUI screen displayed on an operation panel when the interruption of an update process is detected. The figure which shows an example of the GUI screen displayed on the operation panel.

Explanation of symbols

10 ... MFP, 12 ... Controller, 14 ... CPU, 16 ... System memory, 18 ... NB (North Bridge), 20 ... ASIC, 22 ... Local memory, 24 ... HDD, 26 ... NV-RAM, 28 ... SB ( South Bridge), 30 ... NIC, 32 ... Slot, 34 ... USB I / F, 36 ... IEEE 1394 I / F, 38 ... Centronics I / F, 42 ... Operation Panel, 44 ... FCU, 46 ... Engine, 48 ... AGP 50, 52 ... PCI bus, 54 ... SD memory card, 58 ... MFP start-up unit, 60 ... Application layer, 62 ... Copy application, 64 ... Fax application, 66 ... Scanner application, 68 ... Printer application, 70 ... Remote update application, 72 ... AP 74 ... ECS, 76 ... MCS, 78 ... OCS, 80 ... FCS, 82 ... NCS, 84 ... SCS, 90 ... SRM, 92 ... IMH, 94 ... OS, 98 ... Engine I / F, 100 ... Platform layer, 102 ... Hardware resources 210 ... Boot loader 212 ... Update interruption detection unit 214 ... Update unit 216 ... Update control unit 218 ... Rewrite unit 220 ... Analysis unit 250 ... Startup system 300 ... Rescue flag 302 ... Update interruption information, 304 ... update file, 310 ... system control program, 312 ... update part, 400, 420, 440 ... GUI screen, 402, 404, 422, 424, 442 ... message, 406, 408, 426, 444 ... button

Claims (10)

An image forming apparatus multiplexed by a plurality of systems, wherein the image forming apparatus includes:
A startup control unit that reads a control program corresponding to the specified system and executes a startup process with reference to a startup control flag that specifies a system to be started out of the plurality of systems;
In accordance with externally acquired update data, a specified value of another system that is different from the target system that starts the update is set in the start control flag, and update progress information that indicates the target system and the system that has been updated is set And an update control means for starting update processing of the control program for the target system.   The update control means refers to the update progress information, detects that the update process has been interrupted, and is updating the system at the time of the interruption and the system that has been updated by the interruption The image forming apparatus according to claim 1, wherein update processing for an incomplete system is started sequentially from the system being updated.   3. The update control unit according to claim 1, wherein the update control unit sets the activation control flag to a predetermined value and deletes the setting of the update progress information when update processing for all the plurality of systems is completed. The image forming apparatus described.   The update control means compares the update target module identification value included in the update data with the updating module identification value set together with the update progress information before starting the update, and updates before and after the interruption. The image forming apparatus according to claim 2, wherein the matching of the target modules is confirmed.   The image forming apparatus according to claim 1, wherein the update control unit determines the validity of the update data with reference to an electronic signature included in the update data.   The image forming apparatus according to claim 1, further comprising a notification unit that notifies the failure and the reason for the failure in response to the failure of the update process. The image forming apparatus analyzes a data structure of the acquired update data, defines an operation when starting update processing of each system, a specified value for setting the activation control flag, and for each system An analysis means for extracting the execution order of the update process;
The update control means sets the extracted designated value in the activation control flag, sets the extracted execution order as the update progress information, and starts the update process for each system. Item 7. The image forming apparatus according to any one of Items 1 to 6.   An apparatus-executable program for causing an image forming apparatus to function as each unit according to any one of claims 1 to 7.   8. A device-readable recording medium on which a device-executable program for causing an image forming apparatus to function is recorded as each unit according to claim 1. A recording medium used by the image forming apparatus according to claim 1,
Specify an update module control program, an electronic signature that guarantees the correctness of the control program, a module identification value associated with the control program, and activation by another system different from the system for each system A computer-readable recording medium on which update data having a data structure including a specified value and an execution order of update processing for the system is recorded.

Images