Image forming device

Abstract

To provide a technique that makes it possible to prevent an incorrect main program from being executed and then restore the correct main program. [Solution] If the CPU 21 determines that the main program 35 stored in the flash ROM 42 is not the correct main program, it operates the MFP 11 in recovery mode, and the MFP 11 in recovery mode is unable to execute image formation processing. The MFP 11 can receive the correct main program 35' via the USBIF 28, store the main program 35' in the flash ROM 42, and then restart the MFP 11. Upon restart, the MFP 11 can be operated in normal mode by executing processing in accordance with the main program 35' stored in the flash ROM 42.

Description

[Technical Field]

[0001] The present application relates to a technique for updating firmware of an image forming apparatus. [Background technology]

[0002] Patent Document 1 describes a technique for updating (or updating) the firmware of a printer with update firmware downloaded from a server to a PC. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Publication No. 2019-16221 Summary of the Invention [Problem to be solved by the invention]

[0004] However, Patent Document 1 does not describe how the printer can be prevented from executing incorrect firmware and then restored to the correct firmware.

[0005] An object of the present application is to provide a technology that makes it possible to prevent an incorrect main program from being executed and to restore the correct main program. [Means for solving the problem]

[0006] In order to achieve the above object, the image forming apparatus of the present application is an image forming apparatus comprising a non-volatile memory, a communication interface, and a controller, wherein when the image forming apparatus is started up, the controller determines whether the main program stored in the non-volatile memory is the correct main program, and if it determines that the main program stored in the non-volatile memory is the correct main program, it executes processing in accordance with the main program stored in the non-volatile memory, causing the image forming apparatus to operate in normal mode, and the image forming apparatus in normal mode is capable of executing image formation processing; when it determines that the main program stored in the non-volatile memory is not the correct main program, it operates the image forming apparatus in recovery mode, and the image forming apparatus in recovery mode is unable to execute image formation processing; it is capable of receiving the correct main program via the communication interface, storing the main program in the non-volatile memory, and then restarting the image forming apparatus; and upon restarting, it is capable of operating the image forming apparatus in normal mode by executing processing in accordance with the main program stored in the non-volatile memory. [Effects of the Invention]

[0007] According to the present invention, it is possible to prevent an incorrect main program from being executed and then restore the correct main program. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 is a block diagram of a printing system according to an embodiment. [Figure 2] FIG. 10 is a sequence diagram of a main program update process. [Figure 3] FIG. 10 is a sequence diagram of a recovery download process when a main program update process fails. [Figure 4] FIG. 10 is a sequence diagram of a recovery download process when the tampering check process fails. [Figure 5]10 is a flowchart showing the procedure of an MFP startup process. [Figure 6] 10 is a flowchart showing the procedure of a recovery download process. DETAILED DESCRIPTION OF THE INVENTION

[0009] Hereinafter, embodiments of the present application will be described in detail with reference to the drawings.

[0010] FIG. 1 shows a printing system 10 according to one embodiment. As shown in FIG. 1, the printing system 10 includes an MFP (an abbreviation for Multifunction Peripheral) 11 and a terminal device 12. The MFP 11 is an example of an image forming device. The MFP 11 includes a CPU 21, a memory 40, a print engine 23, a reading engine 25, a FAX engine 26, a user IF 27, a USB IF 28, and a LAN IF 29. These components are capable of communicating with each other via a bus 31. The CPU 21 executes processing in accordance with firmware 33 stored in the memory 40. The CPU 21 is an example of a controller. "IF" is an abbreviation for interface. The USB IF 28 and LAN IF 29 are examples of communication interfaces.

[0011] The print engine 23 prints an image on a sheet (for example, recording paper or an OHP sheet). The print engine 23 can be configured to print using an inkjet method or an electrophotographic method. The read engine 25 includes a read sensor (CIS or CCD) that reads an image from an original document, and controls the read sensor to read the image of the original document. The FAX engine 26 transmits and receives FAX data to and from other facsimile devices via a telephone line (not shown).

[0012] The user IF 27 includes, for example, a touch panel or a push button switch, and receives user input operations and displays information to the user. The user IF 27 is an example of a display. The USBIF 28 is an interface capable of communication conforming to the USB standard, and can be connected to a USB device such as a USB memory or another device (such as the terminal device 12) equipped with a USBIF via a USB cable 14. The LANIF 29 is connected to the terminal device 12 and the network 15 via, for example, the router 13. Note that the communication connecting the MFP 11 and the terminal device 12 may be wired or wireless.

[0013] The memory 40 is configured by, for example, a RAM 41, a flash ROM 42, and an E2PROM 43. The flash ROM 42 is an example of a nonvolatile memory, and the E2PROM 43 is an example of a second nonvolatile memory. These may include an HDD, an SSD, or the like.

[0014] The RAM 41 is used as a working area from which various control programs are read and as a storage area for temporarily storing a tampering flag 41A. The CPU 21 controls each part of the MFP 11 in accordance with firmware 33 read from the flash ROM 42 and operation input from the user IF 27, while storing the processing results in the RAM 41. The role of the tampering flag 41A will be described later.

[0015] The flash ROM 42 stores firmware 33. The firmware 33 includes a main program 35 and a boot loader 37. When the CPU 21 executes the main program 35, the MFP 11 operates in normal mode. The main program 35 is a control program that executes printing, scanning, fax sending and receiving, and MFP 11 setting processes. The boot loader 37 is a program that is executed by the CPU 21 when the MFP 11 starts up. The main program 35 also includes a main program update program 35A. The main program update program 35A is a program for updating the main program 35. The boot loader 37 also includes a recovery program 37A. When the CPU 21 executes the recovery program 37A, the MFP 11 operates in recovery mode. The recovery program 37A is a program for causing the MFP 11 to perform a recovery operation. The recovery program 37A limits the functions of the MFP 11 during the recovery operation, for example, by displaying the message "In recovery mode" on the user IF 27 and not accepting any operations on the user IF 27. Furthermore, the recovery program 37A does not perform communication via the LANIF 29, but only performs communication via the USBIF 28.

[0016] A recovery possibility flag 43A and a download flag 43B are stored in the E2PROM 43. The respective roles of the recovery possibility flag 43A and the download flag 43B will be described later.

[0017] The medium for storing firmware 33 is not limited to ROM 42, 43, RAM 41, HDD, etc., built into MFP 11, but may be a computer-readable and writable storage medium. A computer-readable storage medium is a non-transitory medium. In addition to the above examples, non-transitory media also include storage media such as CD-ROMs and DVD-ROMs. Non-transitory media are also tangible media. On the other hand, an electrical signal carrying a program downloaded from a server on the Internet is a computer-readable signal medium, which is a type of computer-readable medium, but is not included in non-transitory computer-readable storage media.

[0018] The terminal device 12 is, for example, a personal computer (hereinafter abbreviated as "PC"). The terminal device 12 is not limited to a PC, and may be other terminals capable of information processing, such as a smartphone or a tablet terminal. The terminal device 12 includes a CPU 51, a memory 52, an LCD 53, an input IF 55, a USB IF 58, and a LAN IF 59. These components are capable of communicating with each other via a bus 61.

[0019] The memory 52 stores an OS 63 and an update application 64. The OS 63 is a program that performs overall control of the terminal device 12, and provides basic functions and services to application programs such as the update application 64. The OS 63 is, for example, a Windows (registered trademark) operating system. Note that the OS 63 is not limited to a Windows (registered trademark) OS, and may be an OS such as MacOS (registered trademark), Linux (registered trademark), Android (registered trademark), or iOS (registered trademark).

[0020] The update application 64 is, for example, a program provided by the vendor of the MFP 11, and is a program that executes USB communication with the MFP 11 during recovery operation and updates (rewrites) the main program 35 of the firmware 33. The memory 52 also includes a nonvolatile storage area 65. The nonvolatile storage area 65 is, for example, a storage area of ​​a hard disk or an SSD.

[0021] The LCD 53 functions as a display device that displays various information of the terminal device 12. The display device of the terminal device 12 is not limited to an LCD, and may be another display device such as an organic EL display. The input IF 55 is, for example, an input device such as a keyboard or a mouse. The input IF 55 of the terminal device 12 is not limited to a keyboard or a mouse, and may be, for example, a touch panel.

[0022] A server 17 is connected to the network 15. The network 15 is, for example, the Internet. Note that the network 15 is not limited to a WAN such as the Internet, and may be a LAN. The server 17 is, for example, a server managed by the vendor of the terminal device 12. The server 17 stores a firmware main program 35′, a driver installer 71, and a product DB 74. The server 17 stores a main program 35′ corresponding to each model of the MFP 11. The driver installer 71 is an installer that installs a printer driver 72 for executing communication with the MFP 11 via the LANIF 29 or the USBIF 28. The printer driver 72 is, for example, a device driver provided by the vendor of the MFP 11, and is a program that is installed in the terminal device 12 and transmits a print command from the terminal device 12 to the MFP 11 and executes setting processing for the MFP 11.

[0023] The printing system 10 is a system in which a printer driver 72 is installed in the terminal device 12, so that the terminal device 12 can issue a print instruction to the MFP 11 and execute printing or the like using the MFP 11. The following explanation will mainly focus on the printer driver 72 that issues the print instruction. Note that a scanner driver for issuing a scan instruction, an application program for issuing a FAX transmission instruction, and the like may be installed at the same time as the printer driver 72 is installed. Alternatively, the scanner driver, etc. may be installed in the MFP 11 in a process separate from the installation of the printer driver 72.

[0024] Next, the update process of the main program 35 of the firmware 33 executed by the MFP 11 in cooperation with the server 17 or the terminal device 12 will be described with reference to FIGS.

[0025] FIG. 2 is a sequence diagram when the main program update process is completed normally. FIG. 3 is a sequence diagram when the power of MFP 11 is turned off during the main program update process and the main program update process is not completed normally. FIG. 4 is a sequence diagram of the main program update process when main program 35 has been tampered with. FIG. 5 is a flowchart showing the detailed procedure of the MFP startup process in FIGS. 2 to 4. FIG. 6 is a flowchart showing the detailed procedure of the recovery download process in FIG. 5. Note that the content and order of the processes shown in FIGS. 2 to 4 are examples. Furthermore, MFP 11 and terminal device 12 are capable of LAN communication via LANIF 29, 59 and USB communication via USBIF 28, 58. For this reason, in FIGS. 2 to 4, the characters "LAN" and "USB" are used to indicate which communication method the process is being executed for. Furthermore, for each step in the sequence diagram (hereinafter simply referred to as "S"), the same reference numerals are used for similar processes such as data reception, but steps related to "USB communication" are preceded by a dash (') to distinguish them from steps related to "LAN communication." Furthermore, each step in the flowchart is also simply referred to as "S."

[0026] 2 to 6 basically represent processing by the CPUs 21, 51, etc. (including the server 17) in accordance with instructions written in the firmware 33, the update application 64, etc. In other words, in the following description, processes such as "accept," "request," "execute," "acquire," "determine," and "instruct" represent processing by the CPUs 21, 51, etc. Processing by the CPUs 21, 51, etc. also includes hardware control. In the following description, for example, processing by the CPUs 21, 51, etc. in accordance with instructions written in a program may be described in abbreviated terms. For example, the statement "MFP 11 acquires main program 35' via LANIF 29" may mean "MFP 11 executes main program update program 35A of main program 35 with CPU 21 and controls LANIF 29 to acquire main program 35'." The same applies to the terminal device 12 and the server 17. In addition, processing by the CPUs 21, 51, etc. in accordance with instructions written in a program may be described with the program name as the subject, such as "executed by the program."

[0027] Furthermore, in this disclosure, "acquire" is used as a concept that does not necessarily require a request. In other words, the process of the MFP 11 or the like receiving data without a request is also included in the concept of "the MFP 11 or the like acquiring data." Furthermore, "data" in this application is represented by a bit string that can be read by a computer. Data that has the same substantial meaning but different formats is treated as the same data. The same applies to "information" in this application. Furthermore, "instruct" is a concept that indicates outputting information indicating that an instruction is being given to the other party. Furthermore, information indicating that an instruction is being given is also simply referred to as "instruction."

[0028] When the MFP 11 is powered on in S11 of Fig. 2, the CPU 21 executes the boot loader 37, and the MFP startup process begins (S12). For example, a user powers on the MFP 11 with the LANIF 29 of the terminal device 12 and the LANIF 59 of the MFP 11 connected via a LAN cable. Note that in the operation column of the MFP 11 in Fig. 2, parts related to the update process of the main program 35 are indicated by dotted, shaded boxes, and other parts are indicated by white boxes. The same applies to Figs. 3 and 4.

[0029] Fig. 5 shows the detailed procedure of the MFP startup process. In Fig. 5, the CPU 21 executes a tampering check of the main program 35 (S100). For example, a digital signature is attached to the main program 35, and the CPU 21 checks the main program 35 for tampering based on the digital signature. Note that the method of checking for tampering is not limited to a method based on a digital signature, and other methods may also be used. This is because it is sufficient to determine whether the main program 35 has been tampered with.

[0030] Next, CPU 21 determines whether main program 35 has been tampered with (S101). The sequence diagram of FIG. 2 is a sequence diagram when the main program update process has been completed normally. In the example shown in the sequence diagram of FIG. 2, CPU 21 determines in S101 that main program 35 has not been tampered with (S101: YES), decompresses main program 35 on RAM 41 (S102), starts execution of the decompressed main program 35, starts processing based on main program 35 (S103), and then ends the MFP startup process. Note that starting execution of the main program may also be referred to as jumping to the main program.

[0031] Returning to FIG. 2, when the MFP startup process in S12 ends, CPU 21 writes the setting of recovery possibility flag 43A (see FIG. 1) to EEPROM 43 (S13). Recovery possibility flag 43A is a flag that indicates whether main program 35 can be recovered by downloading it through a recovery download process when the main program 35 is not the correct main program. Whether the main program 35 can be recovered is predetermined for each model of MFP 11. For example, for a recoverable model, the value of recovery possibility flag 43A is set to “1,” and for an unrecoverable model, the value of recovery possibility flag 43A is set to “0.” Therefore, if MFP 11 is an unrecoverable model, it will never become recoverable midway through, and conversely, if MFP 11 is a recoverable model, it will never become unrecoverable midway through. However, this is not a limitation, and by rewriting the value of recovery possibility flag 43A midway, an unrecoverable model may become recoverable midway through, or conversely, a recoverable model may become unrecoverable midway through.

[0032] Next, CPU 21 transmits a main program update request from LANIF 29 to server 17 (S14). This main program update request may be transmitted directly from MFP 11 to server 17, or may be transmitted to server 17 via terminal device 12. Having received the main program update request, server 17 transmits main program 35' to MFP 11 directly or via terminal device 12 (S15). In the example of FIG. 2, server 17 transmits main program 35' in response to the main program update request from MFP 11, but this is not limiting. Server 17 may also transmit main program 35' to MFP 11 on its own initiative, even if no main program update request is transmitted from MFP 11, for example, when the main program 35' has been upgraded.

[0033] When the CPU 21 starts receiving the main program 35′ transmitted from the server 17, it sets the download flag 43B (see FIG. 1) to “1” and writes it to the EEPROM 43 (S20). For example, when the download flag 43B has a value of “1,” it indicates that a program is being downloaded or updated, and when the value of the download flag 43B is “0,” it indicates that a program is not being downloaded or updated. The CPU 21 then writes the main program 35′ to the RAM 41 while receiving it (S21). Once reception of the main program 35′ is complete, the CPU 21 writes the main program 35′ written in the RAM 41 to a predetermined area of ​​the flash ROM 42, i.e., the area where the main program 35 to be updated is stored (S22). If the write is successful, i.e., if the main program 35 has been successfully rewritten to the main program 35′ (S50), the CPU 21 reboots (S51). After rebooting, the MFP 1 starts up, and executes the boot loader 37 in the CPU 21, in the same way as when the power is turned on, and starts the MFP startup process (S52). The MFP startup process in S52 is the same as the MFP startup process in S12.

[0034] Furthermore, similarly to S13 above, the CPU 21 writes the setting of the recovery possibility flag 43A to the EEPROM 43 (S53), and sets the download flag 43B to "0" and writes this to the EEPROM 43 (S54). The above is the sequence when the main program update process is completed normally.

[0035] 3 shows an example of a sequence when the power of the MFP 11 is turned off during the main program update process and the main program update process does not complete normally. In FIG. 3, the same steps as those in FIG. 2 are assigned the same step numbers, and descriptions of those steps will be omitted as appropriate. In FIG. 3, an example is shown in which the power of the MFP 11 is turned off during writing of the main program 35' written in RAM 41 to a predetermined area in flash ROM 42 in S22.

[0036] 3, when the power of the MFP 11 is turned on after being turned off (S31), the CPU 21 executes the boot loader 37 in the same manner as in S12, and starts the MFP startup process (S32). When the MFP startup process starts, the CPU 21 proceeds to S100 in FIG. 5. In S100, the CPU 21 checks whether the main program 35 has been tampered with, as described above. Since the update of the main program 35 was interrupted while it was being updated to the main program 35′, the electronic signature is not properly attached. Therefore, even if the main program 35 has not actually been tampered with, the determination in S101 is “NO,” and the CPU 21 sets the tampering flag 41A (see FIG. 1) to “1” (S110). For example, when the value of the tampering flag 41A is “1,” it indicates that the main program 35 has been tampered with, and when the value is “0,” it indicates that the main program 35 has not been tampered with. Of course, indicating that the main program 35 has been tampered with also includes the concept of indicating that the update was interrupted midway through the update to the main program 35'. The process from S100 through the determinations of S101 to S110 corresponds to S33 in Figure 3.

[0037] Next, CPU 21 executes recovery download processing (S111). Figure 6 shows detailed steps of the recovery download processing. In Figure 6, CPU 21 determines whether download flag 43B = 1 (S120). Since download flag 43B = 1 now (see S20 in Figure 3), the determination in S120 is "YES," and CPU 21 proceeds to processing in S140. Note that the determination in S120 and the determination of "YES" in that determination correspond to S34 in Figure 3.

[0038] In S140, the CPU 21 determines whether the recovery possibility flag 43A is 1. For example, if the MFP 11 is a model in which the main program 35 can be recovered, the recovery possibility flag 43A is 1, and the determination in S140 is "YES." Therefore, the CPU 21 advances the process from S140 to S141, displays, for example, "Download failed Please access https: / / brother / xxx" on the user IF 27, and waits until the main program 35' is received from the terminal device 12 (S132: NO). Note that the determination in S140 and the determination of "YES" in that determination correspond to S35 in FIG. 3. Also, S141 corresponds to S36 in FIG. 3, and waiting in S132 corresponds to S37 in FIG. 3.

[0039] When a user accesses the URL "https: / / brother / xxx" using a web browser on the terminal device 12, for example, a web page is displayed on the web browser that describes the operation procedure for updating the firmware (in this embodiment, the main program 35 of the firmware 33). For example, the operation procedure is as follows: 1. Connect this unit to your computer with a USB cable. 2. If you are using Windows, download and install the full package driver for your product from Software Downloads. 3. Download the "Firmware Update Tool" for your product from Software Downloads and update the firmware using a USB connection.

[0040] Assume that, following this operating procedure, the user downloads the full package driver and firmware update tool for the MFP 11 from the server 17 to the terminal device 12 and connects the MFP 11 and the terminal device 12 via the USB cable 14 (see FIG. 1). When the firmware update tool is executed in this state, the main program 35′ is transmitted from the terminal device 12. The CPU 21 receives the main program 35′ transmitted from the terminal device 12 (S132: YES). The CPU 21 writes the received main program 35′ to the RAM 41 while receiving it, as described above in S12 of FIG. 2. Upon completion of reception of the main program 35′, the CPU 21 writes the main program 35′ written in the RAM 41 to a predetermined area of ​​the flash ROM 42, i.e., the area where the main program 35 to be updated is stored (S133). Upon completion of writing the main program 35′ to the flash ROM 42, the CPU 21 reboots the MFP 11 (S134) and ends the recovery download process. After rebooting, the MFP 1 starts up, and executes the boot loader 37 in the CPU 21, in the same way as when the power is turned on, to start the MFP startup process (S52). The processes of S100, S101, S110, S111, S120, S140, S141, S132, S133, and S134 are executed by the MFP 11 (CPU 21) in recovery mode. Note that the process from the determination of "YES" in S132 to the completion of the process of S133 corresponds to S39, S40, and S50 in FIG. 3.

[0041] In the present embodiment, the URL of the access destination ("https: / / brother / xxx") itself is displayed on the user IF 27 to guide the user to the display of a web page containing operating procedures for updating the firmware. However, the present invention is not limited to this. A two-dimensional code (e.g., a QR code (registered trademark) or a barcode) to guide the user to the display of the web page may be displayed. Alternatively, an error code or a keyword to guide the user to the display of the web page may be displayed. When a two-dimensional code is displayed on the user IF 27, if the terminal device 12 is equipped with a camera, the camera can capture an image of the two-dimensional code, and the CPU 51 of the terminal device 12 can analyze the captured two-dimensional code to display the target web page on the LCD 53 of the terminal device 12. When an error code or a keyword is displayed on the user IF 27, for example, the terminal device 12 can search for web pages stored in the server 17 in association with the error code or the keyword, and the target web page can be displayed on the LCD 53 of the terminal device 12.

[0042] Figure 4 shows an example of the sequence of the main program update process when the main program 35 has been tampered with. In Figure 4, the same processes as those in Figures 2 and 3 are given the same step numbers, and descriptions of those processes will be omitted as appropriate. Figure 4 shows an example in which it is determined that the main program 35 has been tampered with in the MFP startup process of S12.

[0043] In S11 of FIG. 4, when the MFP 11 is powered on, the CPU 21 executes the boot loader 37 and starts the MFP startup process (S12). When the MFP startup process starts, the CPU 21 proceeds to S100 of FIG. 5 above. In S100, the CPU 21 checks whether the main program 35 has been tampered with, as described above. Since the main program 35 has been tampered with, the determination in S101 is "NO," and the CPU 21 sets the tampering flag 41A to "1" (S110) as described above, and then executes the recovery download process (S111). Note that the determination in S100 and the determination of "NO" in this determination correspond to S60 of FIG. 4. Also, S110 corresponds to S61 of FIG. 4.

[0044] When the recovery download process is executed, the CPU 21 advances the process from S111 to S120 in FIG. 6. At this time, since the download flag 43B=0, the determination in S120 is "NO," and the CPU 21 determines whether the tampering flag 41A=1 (S121). Since the tampering flag 41A=1 now (see S110 in FIG. 5), the determination in S121 is "YES," and the CPU 21 determines whether the recovery feasibility flag 43A=1 (S130), similar to S140 above. If the MFP 11 is a model in which the main program 35 can be recovered, as described above, since the recovery feasibility flag 43A=1, the determination in S130 is "YES." Therefore, the CPU 21 advances the process from S130 to S131, and displays, for example, "Boot failed Please access https: / / brother / xxx" on the user IF 27. The determination of S130 and the determination of "YES" in that determination correspond to S62 in Fig. 4. Also, S131 corresponds to S63 in Fig. 4.

[0045] For example, when a user accesses the URL "https: / / brother / xxx" using the web browser of the terminal device 12, a web page containing operating procedures for updating the firmware is displayed on the web browser. The operating procedures may be the same as those used when the access destination displayed on the user IF 27 in S141 above was displayed using the web browser of the terminal device 12, and therefore a description of the operating procedures will be omitted. However, the error content displayed when the access destination displayed in S131 is displayed using the web browser of the terminal device 12 is different from that displayed when the access destination displayed in S141 is displayed. Specifically, when the access destination displayed in S131 is displayed, "Boot failed" is displayed as the error content, whereas when the access destination displayed in S141 is displayed, "Download failed" is displayed as the error content. The subsequent processes of S132 to S135 have been described above, and therefore a description thereof will be omitted.

[0046] On the other hand, in S130 of FIG. 6, if the recovery possibility flag 43A=0 (S130: NO), that is, if the MFP 11 is a model in which the main program 35 cannot be recovered, the CPU 21 advances the process from S130 to S122 and displays, for example, "Machine Error Please call service" on the user IF 27. The CPU 21 then continues this display (S122). In this way, the MFP 11 remains in a state where the control process is stopped, and the user must call the service line of the MFP 11 vendor to have the main program 35 updated. The determination of S130 and the determination of "NO" in that determination correspond to S72 of FIG. 4. Also, S122 corresponds to S73 of FIG. 4. Furthermore, continuing S122 corresponds to S74 of FIG. 4.

[0047] Furthermore, if the determination in S140 above indicates that the recovery feasibility flag 43A is 0 (S140: NO), that is, if the MFP 11 is a model in which the main program 35 cannot be recovered, the CPU 21 advances the process from S140 to S122 and displays, for example, "Machine Error Please call service" on the user IF 27. The CPU 21 then continues this display (S122). Here, the case where the determination in S120 is "YES" and the process advances from S120 to S140 is an example shown in the sequence diagram of FIG. 3. However, the sequence diagram of FIG. 3 illustrates the case where the determination in S140 indicates that the recovery feasibility flag 43A is 1 (S140: YES), but does not illustrate the case where the recovery feasibility flag 43A is 0 (S140: NO). This is merely omitted for convenience's sake. That is, although not shown in the sequence diagram of FIG. 3, as shown in the flowchart of FIG. 6, the process is also actually executed when the recovery possibility flag 43A=0 (S140: NO).

[0048] As described above, the MFP 11 of this embodiment includes the flash ROM 42, the USBIF 28, and the CPU 21. When the MFP 11 is started up, the CPU 21 determines whether the main program 35 stored in the flash ROM 42 is the correct main program. If it determines that the main program 35 stored in the flash ROM 42 is the correct main program, the CPU 21 executes processing in accordance with the main program 35 stored in the flash ROM 42, causing the MFP 11 to operate in normal mode, and the MFP 11 in normal mode is capable of executing image formation processing. If it determines that the main program 35 stored in the flash ROM 42 is not the correct main program, the CPU 21 executes the MFP 11 in recovery mode, and the MFP 11 in recovery mode is unable to execute image formation processing. The CPU 21 can receive the correct main program 35′ via the USBIF 28, store the main program 35′ in the flash ROM 42, and then restart the MFP 11. Upon restart, the CPU 21 executes processing in accordance with the main program 35′ stored in the flash ROM 42, causing the MFP 11 to operate in normal mode.

[0049] In this way, the MFP 11 of this embodiment can prevent the incorrect main program 35 from being started and can restore the correct main program 35'.

[0050] Here, an incorrect main program 35 refers to a case where the power of MFP 11 is turned off during an update, causing the main program 35 to be stored in an incomplete state in flash ROM 42, or where the main program 35 is corrupted for some reason, or a case where the main program 35 has been tampered with and a main program different from the original main program 35 is stored in flash ROM 42. Furthermore, the MFP 11 in recovery mode remains in a standby state until it receives the correct main program 35′ in S132 of Fig. 6, and is therefore unable to execute image formation processing.

[0051] Furthermore, when the MFP 11 is in recovery mode, it is possible to receive the correct main program 35' via the USBIF 28 from the terminal device 12 connected to the USBIF 28 using the USB cable 14, but it is not possible to receive the correct main program 35' via the LANIF 29. This reduces the risk that an incorrect main program will be written to the flash ROM 42 remotely via the LANIF 29. Furthermore, by not providing a network function within the recovery program 37A, the size of the recovery program 37A can be reduced, thereby reducing the storage capacity of the flash ROM 42.

[0052] Furthermore, EEPROM 43 can store information indicating that MFP 11 is a target for operation in recovery mode. When CPU 21 determines that main program 35 stored in flash ROM 42 is not the correct main program, if EEPROM 43 stores information indicating that MFP 11 is a target for operation in recovery mode, CPU 21 operates MFP 11 in recovery mode, and if EEPROM 43 does not store information indicating that MFP 11 is a target for operation in recovery mode, CPU 21 does not operate MFP 11 in the recovery mode. This makes it possible to accommodate both MFPs 11 with specifications that make it appropriate to use recovery mode and MFPs 11 with specifications that make it appropriate not to use recovery mode.

[0053] The present invention is not limited to the above-described embodiment, and various modifications are possible without departing from the spirit of the present invention.

[0054] (1) In the above embodiment, an image forming apparatus is exemplified as a multifunction peripheral such as the MFP 11, but this is not limiting. For example, the image forming apparatus may be a printer, a fax machine, or a scanner. Therefore, the image forming function of the present disclosure is not limited to a printing function, but may also be a fax function or a scanner function. Furthermore, multiple functions including the image forming function may include image forming functions such as a printing function, a fax function, and a scanner function, as well as other functions (not limited to image forming functions, but functions realized by executing the main program 35 of the firmware 33). Furthermore, the image forming system of the present disclosure is not limited to a printing system, but may be a scanning system capable of only a scanning function, or a fax system capable of only a fax function. Furthermore, the driver of the present disclosure is not limited to a driver capable of multiple functions such as printing, scanning, and faxing, but may be a driver capable of only a printing function or a driver capable of only a scanning function.

[0055] (2) In the above embodiment, the MFP 11 updates the firmware 35 using the update application 64. That is, the MFP 11 of this embodiment is configured to receive the correct main program 35′ via the USBIF 28 from the terminal device 12 connected to the USBIF 28 using the USB cable 14 when in recovery mode. In addition to this configuration, the MFP 11 may also be configured to receive the correct main program 35′ via the LANIF 29. In this configuration, the recovery program 37A must include processing for network communication, which increases the program size. That is, if the MFP 11 is configured to receive the correct main program 35′ via the LANIF 29, the cost of increasing the storage capacity of the flash ROM 42 to store the large recovery program 37A is incurred. Furthermore, the MFP 11 may also be configured to update the main program 35′ by reading it from a USB memory. In this configuration, the size of the recovery program 37A increases, which increases the cost of increasing the storage capacity of the flash ROM 42.

[0056] (3) In the above embodiment, CPU 21 executes boot loader 37 and recovery program 37A. However, this is not a limitation. MFP 11 may include a CPU other than CPU 21 in addition to CPU 21, and the CPU may execute boot loader 37 and recovery program 37A. Furthermore, in the above embodiment, recovery program 37A is included in boot loader 37, but this is not a limitation. The recovery program may be stored separately from boot loader 37. In this case, boot loader 37 may be executed by a CPU other than CPU 21, and CPU 21 may execute the recovery program. Furthermore, in the above embodiment, main program update program 35A is included in main program 35, but this is not a limitation. The main program update program may be stored separately from main program 35.

[0057] (4) In the above embodiment, the LANIF 29 is used as the communication interface, but this is not limiting. The communication interface may be a wireless LANIF or a Bluetooth (registered trademark) IF.

[0058] (5) In the above embodiment, the CPU 21 is used as an example of a controller, but this is not limiting. The controller may be an ASIC or other logic integrated circuit, or may be configured in such a way that the CPU, ASIC, and other logic integrated circuit work together. [Explanation of symbols]

[0059] 10...printing system, 11...MFP, 12...terminal device, 17...server, 21...CPU, 28...USBIF, 29...LANIF, 33...firmware, 35...main program, 37...boot loader, 37A...recovery program, 40...memory, 41...RAM, 41A...tampering flag, 42...flash ROM, 43...E2PROM, 43A...recovery possible / not possible flag, 43B...download flag, 72...printer driver

Claims

1. a non-volatile memory; a communication interface; A controller; An image forming apparatus comprising: The controller When the image forming apparatus is started up, it is determined whether the main program stored in the nonvolatile memory is a correct main program; When it is determined that the main program stored in the nonvolatile memory is a correct main program, the image forming device is operated in a normal mode by executing processing in accordance with the main program stored in the nonvolatile memory, and the image forming device in the normal mode is capable of executing an image formation process; If it is determined that the main program stored in the nonvolatile memory is not a correct main program, the image forming device is operated in a recovery mode, and the image forming device in the recovery mode is unable to execute image formation processing, and is capable of receiving a correct main program via the communication interface, storing the main program in the nonvolatile memory, and then restarting the image forming device; Upon restarting, the image forming apparatus can be operated in a normal mode by executing a process according to the main program stored in the nonvolatile memory. An image forming apparatus characterized by:

2. the communication interface includes a network interface and a local interface; The controller When the image forming apparatus is in the recovery mode, the correct main program can be received via the local interface, but the correct main program cannot be received via the network interface.

2. The image forming apparatus according to claim 1, wherein the image forming apparatus is a recording medium.

3. the local interface includes a USB (Universal Serial Bus) interface; The controller When the image forming apparatus is in the recovery mode, the correct main program can be received via the USB interface from a terminal device connected to the USB interface using a USB cable, but the correct main program cannot be received via the network interface.

3. The image forming apparatus according to claim 2, wherein the image forming apparatus is a recording medium.

4. The controller When the correct main program is stored in the nonvolatile memory, signature information for verifying that the main program stored in the nonvolatile memory is the correct main program can be stored in the nonvolatile memory, the process of determining whether the main program stored in the nonvolatile memory is a correct main program at the time of startup of the image forming apparatus includes a process of determining whether the main program stored in the nonvolatile memory is a correct main program based on the signature information.

2. The image forming apparatus according to claim 1, wherein the image forming apparatus is a recording medium.

5. The image forming apparatus further comprises: display, Equipped with The controller when the image forming apparatus is in the recovery mode, causing the display to display a message regarding reception of the correct main program by the image forming apparatus; 2. The image forming apparatus according to claim 1, wherein the image forming apparatus is a recording medium.

6. The image forming apparatus further comprises: display, Equipped with The controller When the image forming apparatus is in the recovery mode, displaying on the display a keyword for searching a method for causing the image forming apparatus to receive the correct main program.

2. The image forming apparatus according to claim 1, wherein the image forming apparatus is a recording medium.

7. The image forming apparatus further comprises: display, Equipped with The controller When the image forming apparatus is in the recovery mode, a screen including an error code corresponding to a web page carrying a method for causing the image forming apparatus to receive the correct main program is displayed on the display.

2. The image forming apparatus according to claim 1, wherein the image forming apparatus is a recording medium.

8. The image forming apparatus further comprises: display, Equipped with The controller When the image forming apparatus is in the recovery mode, a screen including a URL of a web page carrying a method for causing the image forming apparatus to receive the correct main program is displayed on the display.

2. The image forming apparatus according to claim 1, wherein the image forming apparatus is a recording medium.

9. The image forming apparatus further comprises: display, Equipped with The controller When the image forming apparatus is in the recovery mode, a screen including a two-dimensional code corresponding to a web page carrying a method for causing the image forming apparatus to receive the correct main program is displayed on the display.

2. The image forming apparatus according to claim 1, wherein the image forming apparatus is a recording medium.

10. The controller When it is determined that the main program stored in the nonvolatile memory is not a correct main program, If the image forming apparatus is a target for operation in the recovery mode, operate the image forming apparatus in the recovery mode; If the image forming apparatus is not a target for operation in the recovery mode, the image forming apparatus is not operated in the recovery mode.

2. The image forming apparatus according to claim 1, wherein the image forming apparatus is a recording medium.

11. The image forming apparatus further comprises: display, Equipped with The controller When the image forming apparatus is operated in the recovery mode, a message corresponding to the recovery mode is displayed on the display of the image forming apparatus in the recovery mode; If the image forming apparatus is not operated in the recovery mode, a message that does not correspond to the recovery mode is displayed on the display of the image forming apparatus that is not in the recovery mode.

11. The image forming apparatus according to claim 10.

12. The image forming apparatus further comprises: a second non-volatile memory different from the non-volatile memory storing the main program; Equipped with the second nonvolatile memory is capable of storing information indicating that the image forming apparatus is a target for operation in the recovery mode; The controller When it is determined that the main program stored in the nonvolatile memory is not a correct main program, If information indicating that the image forming apparatus is a target for operation in the recovery mode is stored in the second nonvolatile memory, the image forming apparatus is operated in the recovery mode; If the second nonvolatile memory does not store information indicating that the image forming apparatus is a target for operation in the recovery mode, the image forming apparatus is not operated in the recovery mode.

11. The image forming apparatus according to claim 10.

13. The nonvolatile memory stores a boot program; The controller When the image forming apparatus is started up, executes a startup process, including a process of determining whether the main program stored in the nonvolatile memory is a correct main program, in accordance with the boot program stored in the nonvolatile memory; In the startup process, if it is determined that the main program stored in the nonvolatile memory is the correct main program, Whether the main program stored in the nonvolatile memory is a main program for an image forming apparatus that is a target of operation in the recovery mode or a main program for an image forming apparatus that is not a target of operation in the recovery mode, the image forming apparatus can be operated in a normal mode by executing processing in accordance with the main program stored in the nonvolatile memory.

13. The image forming apparatus according to claim 12.

14. The controller It is possible to determine whether or not a process of receiving the main program via the communication interface and storing the main program in the nonvolatile memory was incomplete at the time of startup of the image forming apparatus, and operating the image forming apparatus in the recovery mode even when it is determined that the process of receiving the main program via the communication interface and storing the main program in the nonvolatile memory is incomplete.

2. The image forming apparatus according to claim 1, wherein the image forming apparatus is a recording medium.

15. The image forming apparatus further comprises: display, Equipped with The controller When the image forming apparatus is operated in recovery mode, When it is determined that the main program stored in the nonvolatile memory is not a correct main program, and when it is determined that the process of receiving the main program via the communication interface and storing the main program in the nonvolatile memory was incomplete, displaying different messages on the display depending on whether or not it is determined that the process of receiving the main program via the communication interface and storing the main program in the nonvolatile memory is incomplete; 15. The image forming apparatus according to claim 14.

Images