JP5447112B2 - Image forming apparatus - Google Patents

Description

  The present invention relates to an image forming apparatus having a function for dealing with abnormal operation.

  The computer system starts by performing a startup process called boot, and if the startup process fails due to some abnormality, the computer system cannot be started. Since the boot error that falls into the unbootable state is important in troubleshooting the system, various coping techniques have been devised.

  For example, two flash ROMs (Read Only Memory) that store boot programs (startup programs) with the same contents are installed, boot control based on the boot program in one flash ROM is abnormal, and boot in the other flash ROM When boot control based on a program is normal, there is a technique for updating and repairing an abnormal boot program with a normal boot program (see Patent Document 1).

  Further, in an information processing apparatus having two processing and monitoring CPUs (Central Processing Units), the processing CPU stores the boot state (log, message, etc.) in the flash memory. When a boot error occurs and the boot recovery button is operated, the monitoring CPU connects the information processing apparatus to the service center via the telephone line, reads the data in the flash memory, and transmits it to the service center. From this data, the service center staff analyzes the cause of the boot error, and in the case of a software failure, there is a technology for transmitting a predetermined command to a processing CPU via a telephone line and executing failure removal processing (patent) Reference 2).

  When the computer fails to boot, the CPU executes a predetermined code in the BIOS to establish communication with the remote diagnosis / repair computer. There is a technique in which this remote diagnosis / repair computer causes an internal diagnosis / repair program to be executed by an operator's operation or automatically on a communication partner computer that has failed to boot (see Patent Document 3).

JP 2007-122151 A JP-A-10-161900 Japanese National Patent Publication No. 11-50459

  The technique of Patent Document 1 in which the same boot program is stored in two flash ROMs, and the abnormal one is updated and repaired with the normal one, cannot deal with when both boot programs are abnormal. In addition, since the same boot program is stored, the storage capacity is wasted.

  Patent Document 2 in which an information processing apparatus in which a boot error has occurred communicates with a service center for diagnosis and repair, and Patent Document 2 in which a computer that fails to boot communicates with a remote diagnosis repair computer to execute a diagnosis repair program The third technique cannot self-diagnose and repair boot errors. Also, a device without a communication function cannot diagnose and repair a boot error.

  Further, abnormalities in operation in the computer system include system errors due to abnormalities in hardware, firmware, etc. in addition to boot errors. The techniques disclosed in Patent Documents 1 to 3 cannot cope with this system error.

  SUMMARY An advantage of some aspects of the invention is that it provides an image forming apparatus capable of self-measuring abnormal operations such as a boot error and a system error.

  The gist of the present invention for achieving the object lies in the inventions of the following items.

[1] An image forming unit that forms an image based on image data on a recording sheet;
A first CPU for controlling the image forming unit;
A second CPU for monitoring the operation of the first CPU;
Equipped with a,
The first CPU executes a startup process according to a boot program stored in a predetermined area,
When the second CPU detects an abnormality in the operation of the startup process by the first CPU by the monitoring, the first program executed by the first CPU after the restart is determined from the boot program. Switch to a diagnostic program that diagnoses whether the cause of the abnormality is a hardware abnormality and notifies the diagnosis result, and restarts the first CPU.
An image forming apparatus.

  In the above invention, the second CPU monitors the operation of the first CPU that controls the image forming unit. The second CPU sets the program corresponding to the monitoring result to be executed by the first CPU after the restart, and restarts the first CPU.

  For example, even if the operation of the first CPU becomes abnormal and the first CPU itself becomes unable to diagnose or repair the abnormality (for example, a program runaway state), the second CPU It is possible to set a program according to the result of monitoring the operation by the CPU, restart the first CPU, and cause the first CPU to execute the program. As this program, for example, a program for diagnosing an abnormality or a program for repairing an abnormality is set according to the result of monitoring the operation by the first CPU. As a result, the image forming apparatus can cope with an abnormal operation such as a boot error or a system error.

In the above invention, when an abnormality in the operation of the startup process by the first CPU is detected, the second CPU restarts a program for diagnosing whether the cause of the abnormality is a hardware abnormality . The first CPU is executed . This ensures that the image forming apparatus is self-diagnose abnormality of the operation of the activation process by the first CPU, the self can deal depending on the diagnosis result.

[2] When the diagnosis result notified from the first CPU that has executed the diagnostic program indicates that the hardware is normal, the second CPU is the first CPU after the restart The program to be executed is switched to a rewrite program for rewriting the boot program and the first CPU is restarted. After the restart, the rewrite program is executed by the first CPU. When the boot program for rewriting acquired from the storage location is overwritten on the boot program, the first program executed by the first CPU after restarting is stored in the predetermined area by the overwriting. Switch to the program and restart the first CPU
The image forming apparatus according to [1] , wherein

[3] The firmware executed by the first CPU after the start-up process is completed has a function of detecting an abnormal operation by the first CPU executing the firmware and notifying the second CPU. the error check program to be executed by the 1 of the CPU only including,
When the second CPU recognizes an abnormality in the operation of the first CPU that executes the firmware by the notification, the first CPU executes a program to be executed first after the restart from the boot program. The first CPU that diagnoses whether or not the cause of the abnormality is a hardware abnormality, switches to a diagnostic program that notifies the diagnosis result, restarts the first CPU, and executes the diagnostic program If the diagnosis result notified from the hardware indicates normal hardware, the first program executed by the first CPU after restart is switched to the second rewrite program for rewriting the firmware. The first CPU is restarted, and after the restart, the second rewriting program is executed by the first CPU. When the firmware is overwritten with the rewriting firmware obtained from a predetermined storage location, the first program executed by the first CPU after restart is switched to the boot program and the first CPU is re-executed. The image forming apparatus according to [1] or [2] , which is activated .

  In the above invention, when the first CPU executes the firmware after the start-up is completed, it executes an error check program included in the firmware, detects an abnormal operation by the first CPU, and notifies the second CPU. As a result, the processing load of the second CPU is reduced and the processing capacity of the second CPU is lower than that of the first CPU, as compared with the case where the second CPU detects an abnormal operation by the first CPU. In this case, the performance degradation of the entire apparatus can be suppressed.

[4] The first CPU notifies the second CPU of the state of operation by the first CPU,
The image forming apparatus according to any one of [1] to [3] , wherein the second CPU performs the monitoring based on the notification.

  In the above invention, the first CPU notifies the second CPU of the state of operation by the first CPU, and the second CPU monitors the operation by the first CPU based on this notification. For example, when the first CPU detects an abnormality in the operation by the first CPU and notifies the second CPU, the second CPU recognizes the abnormality in the operation by the first CPU. If the first CPU falls into a program runaway state and cannot notify the second CPU of the operation status, for example, the second CPU does not receive a notification from the first CPU, and therefore the first CPU Recognize the runaway state of the program.

[5] The image forming apparatus according to [3] or [4] , wherein the first CPU notifies the second CPU via a memory.

  In the above invention, the first CPU notifies the second CPU via the memory, so that the first CPU and the second CPU operate individually and access the memory at each arbitrary timing. Can be notified.

  According to the image forming apparatus of the present invention, it is possible to cope with an abnormal operation such as a boot error or a system error.

1 is a block diagram illustrating a configuration of a multifunction peripheral as an image forming apparatus according to an embodiment of the present invention. It is a figure which shows an example of the information notified to CPU (A) from a some memory location in a shared memory, and CPU (A) through each memory location. It is a flowchart which shows the operation | movement of the starting process by CPU (A) of a multifunctional device. It is a flowchart which shows the hardware check operation | movement by CPU (A) of a multi-function device. 6 is a flowchart showing a boot program rewriting operation by the CPU (A) of the multifunction machine. 6 is a flowchart showing a firmware rewriting operation by the CPU (A) of the multifunction machine. 6 is a flowchart showing an operation of error handling processing by a CPU (B) of the multifunction machine. It is a flowchart which shows operation | movement of the subroutine of the boot error handling process by S503 of FIG. It is a flowchart which shows operation | movement of the subroutine of the system error countermeasure process by S505 of FIG.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 is a block diagram showing a configuration of a multifunction machine 10 as an image forming apparatus according to an embodiment of the present invention.

  The multifunction device 10 optically reads an image of a document, prints a duplicate image on a recording sheet, and outputs it. The multifunction device 10 saves the image data of the read document as a file or transfers it to a terminal device or a server. A scanning function, a printer function for printing an image relating to print data received from a terminal device or an image relating to image data stored in the multifunction peripheral 10 on a recording sheet, a facsimile function for transmitting / receiving image data, etc. It has.

  The multi-function device 10 is a multiprocessor system device including two CPUs. The main CPU (first CPU) that activates the multi-function device 10 and controls the operation of the multi-function device 10 and the operation by the main CPU. And a sub CPU (second CPU) for restarting the main CPU by setting the program corresponding to the monitoring result to be executed by the restarted main CPU. The processing capabilities of the two CPUs may be the same or different. If the processing capabilities are different, the main CPU has the higher processing capability and the sub CPU has the lower processing capability.

  The main CPU has a function of executing a boot program to perform startup processing (booting) to start up the multifunction device 10 and a function of executing firmware after the startup is completed to control the operation of the multifunction device 10. Yes. When the sub CPU detects a start processing abnormality (boot error) or an operation abnormality (system error) by the main CPU through the above monitoring, a program for dealing with the abnormality (an abnormality coping program) is restarted. A function for setting the main CPU to be executed (by switching the startup program) and restarting the main CPU is provided. When the main CPU is restarted by the sub CPU, the main CPU executes an abnormality handling program set by the sub CPU and performs an operation for dealing with the abnormality.

  The trouble handling program is a hardware check program that checks the hardware in the MFP 10 and notifies (reports) the check result to the sub CPU, a boot program rewrite program that rewrites the boot program, and a firmware rewrite that rewrites the firmware. Such as a program.

  Note that the types of abnormality handling programs are not limited to these. The abnormality can be dealt with by using various countermeasure programs according to the content of the abnormality (error).

  The multi function device 10 includes a CPU (A) 11 as a main CPU, a CPU (B) 12 as a sub CPU, a ROM (Read Only Memory (BIOS ROM)), a RAM (Random Access Memory) 14, a nonvolatile memory 15, a hard disk drive (HDD; Hard Disk Drive) 16, a display unit 17, an operation unit 18, a facsimile communication unit 19, a network communication unit 20, and an image processing unit 21, a scanner unit 22, and a printer unit 23 are connected to a bus 24, and a shared memory (communication memory) 25 is connected to a CPU (A) 11 and a CPU (B) 12.

  The CPU (A) 11 executes a boot program stored in the ROM 13 to perform startup processing, and starts up the multifunction machine 10. When the activation of the multifunction device 10 is completed, the firmware stored in the ROM 13 is executed to control the operation of the multifunction device 10.

  The CPU (B) 12 executes the program stored in the ROM 13 to monitor the operation (including activation) by the CPU (A) 11, and switches the activation program and the CPU (A) 11 according to the monitoring result. Perform a restart.

  Note that the CPU (B) 12 (sub CPU) is always supplied with power from the power source even when power is not supplied from the power source to the CPU (A) 11 (main CPU) (power off state). It is good also as a structure which can be performed.

  The shared memory 25 is a memory that is accessed by the CPU (A) 11 and the CPU (B) 12, and is used for performing communication (interprocess communication) between both CPUs. In the present embodiment, the CPU (B) 12 is used to notify the CPU (B) 12 of information for monitoring the operation of the CPU (A) 11 from the CPU (A) 11.

  The ROM 13 is a flash ROM (flash memory) capable of rewriting stored contents, and a program (boot program, firmware, etc.) executed by the CPU (A) 11 and a program (CPU (B)) executed by the CPU (B) 12. A) A program for monitoring the operation according to 11) is stored. The RAM 14 is used as a work memory for temporarily storing various data when the CPU (A) 11 and the CPU (B) 12 execute programs, and an image memory for temporarily storing image data. Also used for.

  The nonvolatile memory 15 is a memory that retains memory even when the power is turned off, and stores device-specific information and various setting information. The hard disk device 16 stores abnormality handling programs and various types of saved data, and also saves input image data and the like.

  The abnormality handling program may be stored in the ROM 13 instead of the hard disk device 16. The abnormality handling program may be stored in an external storage device (storage) connected to the multifunction device 10 via a network, and the multifunction device 10 may access and execute the external storage device. A boot program for rewriting used by the boot program rewriting program in the abnormality handling program to rewrite the boot program in the ROM 13 may be stored in the built-in hard disk device 16 or may be obtained from an external storage device. May be. The rewriting firmware used by the firmware rewriting program in the abnormality handling program to rewrite the firmware in the ROM 13 may be stored in the hard disk device 16 or may be acquired from an external storage device.

  The display unit 17 is configured by a liquid crystal display or the like, and displays various screens such as an operation screen, a setting screen, and a guidance screen. The operation unit 18 includes various buttons such as a start button, a stop button, and a numeric keypad, and a touch panel that is provided on the surface of the liquid crystal display and detects a pressed coordinate position. Accepts various operations to be performed.

  The facsimile communication unit 19 transmits / receives image data to / from an external apparatus having a facsimile function through a public line. The network communication unit 20 communicates with a terminal device or a server through a network such as a LAN (Local Area Network).

  The image processing unit 21 performs various kinds of image processing such as image correction, rotation, enlargement / reduction, compression / expansion on the image data.

  The scanner unit 22 optically reads a document and acquires image data. The scanner unit 22 sequentially moves, for example, a light source that irradiates light on a document, a line image sensor that receives the reflected light for one line in the width direction, and a line-by-line reading position in the length direction of the document. An optical path composed of a lens, a mirror and the like for guiding the reflected light from the document to the line image sensor to form an image, a conversion unit for converting the analog image signal output from the line image sensor into digital image data, etc. It is configured with.

  The printer unit 23 forms and outputs an image based on the image data on a recording sheet by an electrophotographic process. The printer unit 23 includes, for example, a recording paper transport device, a photosensitive drum, a charging device, an LD (Laser Diode) that is controlled to be turned on according to input image data, and laser light emitted from the LD. It is configured as a so-called laser printer having a scanning unit that scans on a photosensitive drum, a developing device, a transfer separating device, a cleaning device, and a fixing device. Instead of an LED printer that irradiates a photosensitive drum with an LED (Light Emitting Diode) instead of a laser beam, other types of printers may be used.

  As described above, when the activation of the multifunction device 10 is completed, the CPU (A) 11 executes the firmware in the ROM 13 to control the operation of the multifunction device 10. The firmware includes a program (system error check program) for checking a system abnormality (error) at a predetermined timing. The system check includes a hardware check for checking that no abnormality has occurred in the hardware in the multifunction machine 10 and a firmware check for checking that no abnormality (bug) has occurred in the firmware.

  Hardware to be checked in the hardware check includes a RAM 14, a hard disk device 16, a control board, a DMA controller (Direct Memory Access controller), a FAN (cooling fan), and the like. The hardware check in this case includes a memory check for the RAM 14, an HDD check for the hard disk device 16, a board check for the control board, a chip check for a control chip such as a DMA controller, and the like.

  For example, in the memory check and the HDD check, it is checked that no abnormality has occurred by performing write / read. In the board check, the CPU (A) 11 checks that no abnormality has occurred by monitoring signals input to the terminals of the control board. By confirming the input / output of the signal for each terminal, it is possible to identify at which part of the control board an abnormality has occurred. In the board check, the CPU (A) 11 sends an error check command to a control board such as a FAX board and receives a response to check that no abnormality has occurred, or the CPU (A) 11 performs control. An error occurrence notification may be received from the board by an interrupt or the like to recognize that an abnormality has occurred. In the chip check for the DMA controller, the CPU (A) 11 recognizes that an abnormality has occurred when the internal register cannot be read.

  As for the timing of performing the hardware check, the memory check and the HDD check are performed regularly or between jobs. The board check and chip check are performed when the hardware is actually used or between jobs.

  When the CPU (A) 11 performs a hardware check in the system check and detects a hardware abnormality, it is determined that a system error has occurred due to a hardware abnormality.

  In the firmware check in the system check, the CPU (A) 11 assumes other values (such as 4 and 5) while assuming 1 to 3 as possible values of firmware parameters. If there is no abnormality in the hardware, it is determined that a system error has occurred due to a firmware bug.

  The CPU (A) 11 performs the above system check, and if it is determined that a system error has occurred, it notifies the CPU (B) 12 that a system error has occurred.

  In addition, when the CPU (A) 11 executes a hardware check program, the CPU (A) 11 checks (diagnose) a hardware abnormality in the multifunction peripheral 10 based on the program. The hardware to be checked and the check method are the same as the hardware check in the system check. The CPU (A) 11 executes a hardware check program to check for hardware abnormalities. If no abnormalities are detected, the CPU (A) 11 notifies the CPU (B) 12 that the hardware is normal and detects abnormalities. Notify CPU (B) 12 of hardware abnormality.

  FIG. 2 is a diagram illustrating an example of a plurality of memory locations (addresses) in the shared memory 25 and information (notification information) notified from the CPU (A) 11 to the CPU (B) 12 through each memory location.

  Here, the CPU (A) 11 writes the notification information to the shared memory 25, and the CPU (B) 12 reads the notification information from the shared memory 25. The notification information is communicated (transmitted) from the CPU (A) 11 to the CPU (B) 12 by associating the notification information with the memory location.

  The notification information is information indicating the state of operation by the CPU (A) 11 (boot error / system error / check result by execution of hardware check program / program rewriting completion, etc.). For example, information indicating the activation status of the MFP 10 by the CPU (A) 11 (activation completion), information indicating the status of hardware used in the operation control of the MFP 10 by the CPU (A) 11 (memory abnormality) , HDD error), information indicating that a hardware error was not detected (hardware normal) or a hardware error was detected (hardware error and abnormal location) as a result of executing the hardware check program, Information indicating that the boot program rewriting program has been executed and the boot program has been rewritten (boot program rewriting completion), information indicating that the firmware rewriting program has been executed and firmware rewriting has been completed (firmware rewriting completion), etc. is there.

  In this example, the CPU (A) 11 sets a flag (normal flag) at the memory location 1 in the shared memory 25 when the activation of the multifunction machine 10 is completed. When an abnormality of the RAM 14 is detected by a hardware check in the system check and a hardware check by execution of the hardware check program, a flag (abnormal flag) is set at the memory location 2 in the shared memory 25. When an abnormality of the hard disk device 16 is detected, a flag (abnormal flag) is set at the memory position 3 in the shared memory 25.

  If a hardware abnormality is not detected by the hardware check by the execution of the hardware check program, the CPU (A) 11 sets a flag (normal flag) at a predetermined memory location (for example, memory location n1). A flag (normal flag) is set at a predetermined memory location (for example, memory location n2) even when rewriting of the boot program is completed, and a flag (normal flag) is set at a predetermined memory location (for example, memory location n3) even when the rewriting of firmware is completed. set.

  When the CPU (B) 12 confirms that the flag is set in the memory location 1 of the shared memory 25 from the start of the start of the multifunction machine 10 (power on) until the predetermined time has elapsed, the CPU (B) 12 starts up. It recognizes that it succeeded and resets its flag. If it is confirmed that the flag is not set in the memory location 1 of the shared memory 25 even after a predetermined time has elapsed since the start of the multifunction device 10, it is recognized that the activation has failed.

  If the CPU (B) 12 confirms that the flag is not set in the memory location 2 of the shared memory 25 during the normal operation of the multifunction machine 10, the CPU 14 recognizes that the RAM 14 is normal and sets the flag. When it is confirmed that an abnormality has occurred, it is recognized that an abnormality has occurred in the RAM 14, and the flag is reset. In addition, when it is confirmed that the flag is not set in the memory location 3 of the shared memory 25 during the normal operation of the multifunction machine 10, the hard disk device 16 is recognized as normal and the flag is set. Is confirmed, it is recognized that an abnormality has occurred in the hard disk device 16, and the flag is reset.

  When the CPU (A) 11 periodically sets a normal flag at a predetermined memory location of the shared memory 25 by a watchdog timer or the like, and the CPU (B) 12 confirms the normal flag at the predetermined memory location. Reset. If the normal flag is not set at the predetermined memory position when the CPU (B) 12 reads the shared memory 25, it is determined that the processing abnormality of the CPU (A) 11 (running out of control due to firmware abnormality) is detected. May be.

  When the CPU (B) 12 executes the hardware check program and confirms that a flag is set at a predetermined memory location (for example, the memory location n1) of the shared memory 25, the CPU (B) 12 Recognize that the hardware is normal and reset the flag. When it is confirmed that a flag is set in the memory location 2 of the shared memory 25, it is recognized that an abnormality has occurred in the RAM 14, and the flag is reset. When it is confirmed that the flag is set at the memory position 3, it is recognized that an abnormality has occurred in the hard disk device 16, and the flag is reset.

  When the CPU (B) 12 executes the boot program rewriting program and confirms that a flag is set at a predetermined memory location (for example, memory location n2) of the shared memory 25, the CPU (B) 12 Recognize that the boot program has been rewritten and reset the flag. When the CPU (A) 11 executes the firmware rewriting program and confirms that the flag is set at a predetermined memory location (for example, memory location n3) of the shared memory 25, the firmware rewriting is completed. Recognize and reset its flag.

  Next, the operation of the multifunction machine 10 will be described.

In the present embodiment, a coping operation in the following two cases will be described.
Case 1. The firmware does not start because of a hardware or boot program problem.
Case 2. An internal error occurs due to a problem with the hardware or embedded firmware.

  The outline of the coping operation in case 1 is as follows.

1. When the power of the multifunction device 10 is turned on, the CPU (B) 12 confirms whether or not the activation process is completed within a predetermined time.

2. If the CPU (A) 11 does not receive a start completion notification within a predetermined time from the shared memory 25, the CPU (B) 12 recognizes that a boot error has occurred.

3. The CPU (B) 12 first executes the hardware check program by the CPU (A) 11 after restarting in order to determine whether the cause of the boot error is a hardware abnormality or a boot program abnormality. Then, the CPU (A) 11 is restarted.

4). A notification of normal hardware is received from the CPU (A) 11 via the shared memory 25 within a predetermined time from the restart of the CPU (A) 11 (or the execution of the hardware check program by the CPU (A) 11). When the notification of the hardware abnormality is received (when the hardware check program cannot be started or the operation is abnormal), the CPU (B) 12 notifies the service center of the occurrence of the abnormality. When the hardware normality notification is received, the CPU (B) 12 recognizes that there is a possibility that the hardware is normal and an abnormality has occurred in the boot program, and the CPU (A) after restarting the boot program rewriting program 11 is set to execute, and the CPU (A) 11 is restarted.

5. Notification of completion of rewriting of boot program from the CPU (A) 11 via the shared memory 25 within a predetermined time from the start of restart of the CPU (A) 11 (or the start of execution of the boot program rewriting program by the CPU (A) 11) Is not received (boot program rewriting program cannot be started or operation is abnormal), the CPU (B) 12 notifies the service center of the occurrence of the abnormality. When the notification of completion of rewriting of the boot program is received, the CPU (B) 12 sets the boot program to be executed by the CPU (A) 11 after restarting, and restarts the CPU (A) 11 .

  The outline of the coping operation in Case 2 is as follows.

1. When the CPU (A) 11 completes the startup process, the CPU (A) 11 executes the firmware to control the operation of the multifunction machine 10 and performs a system check (such as a hardware check) periodically or between jobs.

2. When the CPU (A) 11 detects a system error such as an internal abnormality (hardware abnormality / firmware abnormality), the abnormality of the system error is written in the shared memory 25.

3. The CPU (B) 12 periodically checks for abnormal system errors.

4). When the notification of the abnormality of the system error is received from the CPU (A) 11 via the shared memory 25, the CPU (B) 12 recognizes that the system error has occurred.

5. The CPU (B) 12 sets the hardware check program to be executed by the CPU (A) 11 after restarting in order to specify the cause (abnormal part) of the system error in detail, and the CPU (A) 11 is restarted.

6). A notification of normal hardware is received from the CPU (A) 11 via the shared memory 25 within a predetermined time from the restart of the CPU (A) 11 (or the execution of the hardware check program by the CPU (A) 11). If not received and a notification of hardware abnormality (notification that the abnormal part has been identified) is received (hardware check program cannot be started or operation is abnormal), the CPU (B) 12 notifies the occurrence of the abnormality to the service center. . When the hardware normality notification is received, the CPU (B) 12 recognizes that there is a possibility that the hardware is normal and the firmware is abnormal, and the CPU (A) 11 after restarting the firmware rewriting program The CPU (A) 11 is restarted by setting to execute.

7). Notification of completion of rewriting of firmware is received from the CPU (A) 11 via the shared memory 25 within a predetermined time from the start of restart of the CPU (A) 11 (or the start of execution of the firmware rewriting program by the CPU (A) 11). If not (the firmware rewriting program cannot be started or operation is abnormal), the CPU (B) 12 notifies the service center of the occurrence of the abnormality. When the notification of completion of the firmware rewriting is received, the CPU (B) 12 sets the boot program to be executed by the CPU (A) 11 after restarting, and restarts the CPU (A) 11. After completing the startup process by restart, the CPU (A) 11 is caused to execute the rewritten firmware.

  Details of the coping operation in the above case 1 and case 2 will be described with reference to FIGS. In the drawing, hardware is represented as “HW”, boot program as “BP”, and firmware as “FW”.

  In addition, the switching of the startup program performed by the CPU (B) 12 (setting of a program to be executed by the CPU (A) 11 after restart) is performed by using information (vector) indicating the storage destination of the program to be executed after startup as the CPU (B ) 12 is performed by rewriting. The notification performed by the CPU (B) 12 to the service center is performed using e-mail or the like.

  FIG. 3 is a diagram illustrating a flow of the activation process performed by the CPU (A) 11 of the multifunction machine 10.

  When the power of the multifunction machine 10 is turned on, the CPU (A) 11 executes a boot program and starts a startup process (step S101). When the activation is completed, an activation completion notification is made (step S102). This notification is performed by setting a flag in the memory location 1 of the shared memory 25 as shown in FIG.

  Subsequently, the CPU (A) 11 executes the firmware to control the operation of the multifunction machine 10 and performs a system check at a predetermined timing (step S103) and monitors the occurrence of a system error (step S104; No). . When the occurrence of a system error is detected (step S104; Yes), a system error occurrence notification is made (step S105 / End). This notification is performed by setting a flag at the memory location of the shared memory 25 corresponding to the detected abnormality as shown in FIG.

  FIG. 7 is a flowchart showing the operation of error handling processing by the CPU (B) 12 of the multifunction machine.

  When the multifunction device 10 is turned on, the CPU (B) 12 monitors whether or not the activation completion notification is received from the CPU (A) 11 within a predetermined time (step S501; No → step S502; No ). If the predetermined time has elapsed without receiving the activation completion notification from the CPU (A) 11 (step S502; Yes), the CPU (B) 12 determines that the activation has failed and performs the boot error handling process in a subroutine. (Step S503).

  If the activation completion notification is received from the CPU (A) 11 within a predetermined time (step S501; Yes (check flag set of the memory location 1 of the shared memory 25)), the CPU (B) 12 has been successfully activated. Judgment is made and whether or not a system error occurrence notification is received from the CPU (A) 11 during normal operation of the multifunction machine 10 is monitored (No in step S504). When the system error occurrence notification is received from the CPU (A) 11 (step S504; Yes (flag set confirmation of a predetermined memory location in the shared memory 25)), the CPU (B) 12 performs the system error handling process in a subroutine. This is performed (step S505).

  FIG. 8 is a flowchart showing the operation of a subroutine for boot error handling processing in S503 of FIG.

  The CPU (B) 12 changes the startup program executed by the CPU (A) 11 after the restart to the hardware check program (step S601), and restarts the CPU (A) 11 (step S602). Here, the CPU (B) 12 rewrites the information indicating the storage destination of the program to be executed after startup from the information indicating the boot program to the information indicating the hardware check program, and restarts the CPU (A) 11.

  The CPU (A) 11 executes a hardware check program upon this restart, and checks whether any abnormality has occurred in the hardware (see FIG. 4).

  If the CPU (B) 12 does not receive a notification of the hardware check result (normal / abnormal) from the CPU (A) 11 within a predetermined time (step S603; No), the service center issues an abnormality of the MFP 10 Occurrence (abnormal start-up abnormality) is notified (step S610 / End). A notification of the hardware check result is received from the CPU (A) 11 within a predetermined time (step S603; Yes). If the received notification is a hardware abnormality (step S604; No), the CPU (B ) 12 notifies the service center of the hardware abnormality of the MFP 10 (step S610 / End). In this case, the CPU (A) 11 notifies the hardware abnormality location, so the CPU (B) 12 also notifies the service center of the hardware abnormality location.

  The CPU (B) 12 receives a hardware check result notification from the CPU (A) 11 within a predetermined time (step S603; Yes), and if the received hardware normality notification is received (step S603). S604; Yes), the startup program executed by the CPU (A) 11 after the restart is changed to a boot program rewriting program (step S605), and the CPU (A) 11 is restarted (step S606). Here, the CPU (B) 12 rewrites the information indicating the storage destination of the program to be executed after startup from the information indicating the hardware check program to the information indicating the boot program rewriting program, and restarts the CPU (A) 11.

  The CPU (A) 11 executes the boot program rewriting program by this restart and rewrites the boot program (see FIG. 5).

  When the CPU (B) 12 does not receive a boot program rewrite completion notification from the CPU (A) 11 within a predetermined time (step S607; No), an abnormality of the MFP 10 occurs in the service center (boot program rewrite impossible abnormality). ) Is notified (step S610). When a boot program rewrite completion notification is received from the CPU (A) 11 within a predetermined time (step S607; Yes), the CPU (B) 12 rewrites the boot program executed by the CPU (A) 11 after the reboot. (Step S608), and the CPU (A) 11 is restarted (step S609 / Return). Here, the CPU (B) 12 rewrites the information indicating the storage destination of the program to be executed after startup from the information indicating the boot program rewriting program to the information indicating the boot program, and restarts the CPU (A) 11.

  The CPU (A) 11 executes the boot program after rewriting by this restart, and performs start-up processing based on the boot program (see FIG. 3). When the boot error is caused by an abnormality (bug) in the boot program and is repaired by rewriting the boot program, the CPU (A) 11 executes the boot program after the rewriting to complete the startup normally.

  FIG. 9 is a flowchart showing the operation of the subroutine of the system error handling process in S505 of FIG.

  Steps S701 to S704 and S710 in FIG. 7 are the same as steps S601 to S604 and S610 in FIG.

  The CPU (B) 12 receives a hardware check result notification from the CPU (A) 11 within a predetermined time (step S703; Yes), and when the received hardware normality notification is received (step S704). Yes), the activation program executed by the CPU (A) 11 after the reboot is changed to a firmware rewriting program (step S705), and the CPU (A) 11 is rebooted (step S706). Here, the CPU (B) 12 rewrites the information indicating the storage destination of the program to be executed after activation from the information indicating the hardware check program to the information indicating the firmware rewriting program, and restarts the CPU (A) 11.

  The CPU (A) 11 executes the firmware rewriting program by this restart and rewrites the firmware (see FIG. 6).

  When the CPU (B) 12 does not receive the firmware rewrite completion notification within a predetermined time from the CPU (A) 11 (step S707; No), the service center reports an abnormality occurrence (firmware rewrite failure abnormality) to the service center. Notification is made (step S710). When the firmware rewrite completion notification is received from the CPU (A) 11 within a predetermined time (step S707; Yes), the CPU (B) 12 uses the boot program executed by the CPU (A) 11 after the reboot as the boot program. The change is made (step S708), and the CPU (A) 11 is restarted (step S709 / Return). Here, the CPU (B) 12 rewrites the information indicating the storage destination of the program to be executed after startup from the information indicating the firmware rewriting program to the information indicating the boot program, and restarts the CPU (A) 11.

  The CPU (A) 11 executes the boot program by this restart, and performs a startup process based on the boot program (see FIG. 3). When the activation is completed, the CPU (A) 11 executes the rewritten firmware. When the cause of the system error is an abnormality (bug) in the firmware and is repaired by rewriting the firmware, when the CPU (A) 11 executes the firmware after the rewriting, the MFP 10 operates normally.

  FIG. 4 is a flowchart showing the hardware check operation by the CPU (A) 11.

  The CPU (A) 11 executes a hardware check program, and checks whether an abnormality has occurred in the hardware of the multifunction machine 10 based on the program (step S201). If no hardware abnormality is detected (step S202; No), the CPU (B) 12 is notified of hardware normality (step S203 / End). When a hardware abnormality is detected (step S202; Yes), a hardware abnormality is notified to the CPU (B) 12 (step S204 / End). In the notification of hardware abnormality, the identified abnormality part is also notified.

  FIG. 5 is a flowchart showing the boot program rewriting operation by the CPU (A) 11.

  The CPU (A) 11 executes the boot program rewriting program and performs a boot program rewriting process based on the program (step S301). Here, the boot program stored in the ROM 13 is overwritten with the boot program for rewriting acquired from the hard disk device 16 in the multifunction machine 10 or the external storage device.

  When the rewriting of the boot program is completed, the CPU (A) 11 notifies the CPU (B) 12 of the completion of the rewriting of the boot program (Step S302 / End).

  FIG. 6 is a flowchart showing the firmware rewriting operation by the CPU (A) 11.

  The CPU (A) 11 executes a firmware rewriting program and performs a firmware rewriting process based on the program (step S401). Here, the firmware stored in the ROM 13 is overwritten with the rewriting firmware acquired from the hard disk device 16 or the external storage device in the multifunction machine 10.

  When the CPU (A) 11 completes the firmware rewriting, the CPU (A) 11 notifies the CPU (B) 12 of the firmware rewriting completion (step S402 / End).

  As described above, in the MFP 10 according to the present embodiment, a boot error occurs in the startup process by the CPU (A) 11 (main CPU), and the CPU (A) 11 itself cannot diagnose or repair the boot error ( The CPU (B) 12 (sub CPU) sets the hardware check program and the boot program rewrite program to be executed by the restarted CPU (A) 11 even if the boot program is in a runaway state, etc. The CPU (A) 11 can be restarted to cause the CPU (A) 11 to execute the program. In addition, even when a system error occurs during execution of firmware by the CPU (A) 11 (during normal operation), the CPU (A) after restarting the hardware check program or firmware rewrite program by the CPU (B) 12 11 is set to be executed, the CPU (A) 11 is restarted, and the CPU (A) 11 can execute the program. As a result, the multifunction machine 10 can cope with an abnormal operation such as a boot error or a system error.

  In addition, when the CPU (B) 12 causes the CPU (A) 11 to execute the hardware check program, the CPU (B) 12 performs a countermeasure operation according to the notification (including non notification) of the hardware check result from the CPU (A) 11. Do. When the hardware normality notification is received, a program (boot program rewriting program / firmware rewriting program) to be executed by the CPU (A) 11 is determined, and the CPU (A) 11 after the restart is executed. . As a result, the multifunction device 10 can self-diagnose an abnormality in the operation of the CPU (A) 11 and can cope with the abnormality according to the diagnosis result.

  Further, when the CPU (A) 11 is caused to execute the boot program rewriting program, the boot program can be rewritten and self-repaired to recover from a boot error. When the CPU (A) 11 is caused to execute the firmware rewriting program, the firmware can be rewritten and self-repaired to recover from a system error.

  Further, when the CPU (A) 11 executes the firmware after the start-up is completed, the system error check program included in the firmware is executed to perform a system check, and a system error (abnormal operation by the CPU (A) 11) is detected. Then, the CPU (B) 12 is notified. As a result, the processing load of the CPU (B) 12 is reduced as compared with the case where the CPU (B) 12 performs a system check, and the processing capability of the CPU (B) 12 is lower than that of the CPU (A) 11. The performance degradation of the entire device can be suppressed.

  Further, the notification to the CPU (B) 12 by the CPU (A) 11 is performed via the shared memory 25, so that the CPU (A) 11 and the CPU (B) 12 operate individually and at any arbitrary timing. Notification (communication) can be performed by accessing the shared memory 25.

  The embodiment of the present invention has been described with reference to the drawings. However, the specific configuration is not limited to that shown in the embodiment, and the present invention can be changed or added without departing from the scope of the present invention. Included in the invention.

  For example, the order of programs executed when an operation abnormality (boot error / system error (hardware abnormality / firmware abnormality)) by the CPU (A) 11 is detected is not limited to the order described in the embodiment. For example, when a boot error is detected, the boot program rewriting program is executed first. If the boot error is not resolved even after rewriting the boot program, the hardware check program may be executed. If a system error is detected, the firmware rewriting program is executed first. If the system error is not resolved even after rewriting the firmware, a hardware check program may be executed.

  Further, the information notified by the service center when the CPU (B) 12 detects an abnormal operation by the CPU (A) 11 is not limited to that described in the embodiment. For example, when the CPU (B) 12 causes the CPU (A) 11 to execute the boot program rewriting program, when the CPU (A) 11 actually rewrites the boot program, the CPU (B) 12 has the CPU (A When CPU 11 executes the firmware rewriting program, CPU (B) 12 may notify the service center of the information when the firmware is actually rewritten by CPU (A) 11.

  In addition to the CPU (B) 12 notifying the service center by e-mail or the like, the CPU (B) 12 displays the contact information of the service center on the display unit 17 of the multifunction machine 10, and the user or the administrator The center may be notified of the abnormality of the multifunction device 10.

  Further, the present invention is not limited to the multi-function device described in the embodiment, and can also be applied to other image forming apparatuses such as a copying machine, a printer, and a facsimile machine.

10. Multifunction machine 11 ... CPU (A)
12 ... CPU (B)
13 ... ROM
14 ... RAM
DESCRIPTION OF SYMBOLS 15 ... Non-volatile memory 16 ... Hard disk device 17 ... Display part 18 ... Operation part 19 ... Facsimile communication part 20 ... Network communication part 21 ... Image processing part 22 ... Scanner part 23 ... Printer part 24 ... Bus 25 ... Shared memory

Claims (5)

An image forming unit that forms an image based on image data on a recording sheet;
A first CPU for controlling the image forming unit;
A second CPU for monitoring the operation of the first CPU;
Equipped with a,
The first CPU executes a startup process according to a boot program stored in a predetermined area,
When the second CPU detects an abnormality in the operation of the startup process by the first CPU by the monitoring, the first program executed by the first CPU after the restart is determined from the boot program. Diagnose whether the cause of the abnormality is a hardware abnormality, switch to a diagnostic program that notifies the second CPU of the diagnosis result, and restart the first CPU
An image forming apparatus. When the diagnosis result notified from the first CPU that has executed the diagnostic program indicates that the hardware is normal, the second CPU executes the first CPU first after the restart. By switching the program to a rewriting program for rewriting the boot program and restarting the first CPU, and after the restarting, the rewriting program is executed by the first CPU, so that the program is rewritten from a predetermined storage location. When the acquired rewrite boot program is overwritten on the boot program, the first program executed by the first CPU after the restart is switched to the rewrite boot program stored in the predetermined area by the overwriting. to restart the first CPU Te
The image forming apparatus according to claim 1. The firmware executed by the first CPU after completion of the start-up process has a function of detecting an abnormality in the operation of the first CPU executing the firmware and notifying the second CPU. the error check program to be executed by only including,
When the second CPU recognizes an abnormality in the operation of the first CPU that executes the firmware by the notification, the first CPU executes a program to be executed first after the restart from the boot program. The first CPU that diagnoses whether or not the cause of the abnormality is a hardware abnormality, switches to a diagnostic program that notifies the diagnosis result, restarts the first CPU, and executes the diagnostic program If the diagnosis result notified from the hardware indicates normal hardware, the first program executed by the first CPU after restart is switched to the second rewrite program for rewriting the firmware. The first CPU is restarted, and after the restart, the second rewriting program is executed by the first CPU. When the firmware is overwritten with the rewriting firmware obtained from a predetermined storage location, the first program executed by the first CPU after restart is switched to the boot program and the first CPU is re-executed. The image forming apparatus according to claim 1 or 2 , wherein the image forming apparatus is activated . The first CPU notifies the second CPU of the state of operation by the first CPU;
It said second CPU, the image forming apparatus according to any one of claims 1 to 3, characterized in that performing the monitoring on the basis of the notification. The image forming apparatus according to claim 3, wherein the first CPU notifies the second CPU through a memory.

Images