Program update device

Abstract

To provide a program update apparatus configured to automatically repair a program when update of the program in an external device fails, the external device having no program backup function.SOLUTION: A microcomputer system M serving as a program update apparatus includes: a flash memory 2 for code, which serves as a first storage unit, having regions 2B, 2C one of which stores backup FW (firmware) and the other stores update FW; and a microcomputer 1, which serves as a control unit, configured to update FW by transmitting the update FW to an electronic device D. The microcomputer 1 determines whether the FW of the electronic device D has been updated successfully with the update FW, repairs, when a determination is made that the update failed, the FW of the electronic device D by transmitting the backup FW to the electronic device D, or treats the update FW as new backup FW when success of the update is determined.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a program updating device for updating a program in an external device. [Background technology]

[0002] Patent Document 1 describes an information processing device, which is an electronic device capable of updating system setting information by executing firmware, which is a program. This device includes a first processor that executes the firmware, a second processor that updates the firmware, a first memory that stores the current firmware, a second memory that stores firmware to be updated, and a switch that connects one of the first and second memories to the first processor and the other to the second processor.

[0003] In the configuration described in Patent Document 1, even if the second memory fails to store the firmware for update (i.e., if the firmware update fails), the firmware before the update can be stored (i.e., backed up) in the first memory, so the first processor can operate according to the firmware stored in the first memory. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Laid-Open No. 2011-90481 Summary of the Invention [Problem to be solved by the invention]

[0005] However, from the viewpoint of reducing the memory capacity of electronic devices, it is preferable that electronic devices do not have a configuration for backing up firmware, which is a program. However, when such a configuration is adopted, there is a problem in that if an update of a program in the electronic device fails, the program cannot be automatically restored.

[0006] The present invention has been made in consideration of the above circumstances, and has an object to provide a program update device that can automatically repair a program when an update of a program in an external device that does not have a function to back up programs fails. [Means for solving the problem]

[0007] In order to solve the above problem, the program update device of the present invention comprises a first memory unit having a backup area for storing a backup program and an update area for storing an update program, and a control unit that updates the program of the external device by sending the update program to the external device, wherein the control unit determines whether the update of the program of the external device by the update program was successful, and if it determines that the update was unsuccessful, it repairs the program of the external device by sending the backup program to the external device, while if it determines that the update was successful, it treats the update program as the new backup program.

[0008] With this configuration, if an update of a program in an external device that does not have a program backup function fails, the program in the external device can be automatically restored using the backup program. Furthermore, even if the update fails when the control unit repeatedly updates the program in the external device, the program in the external device can be restored using the new backup program.

[0009] In the above program update device, it is preferable that the control unit determines whether the repair of the program of the external device using the backup program was successful, and if it determines that the repair was unsuccessful, obtains a new update program and sends the update program to the external device to update the program of the external device.

[0010] It is preferable that the above program update device further comprises a second storage unit having an update result storage area for storing a program update result of the external device by the update program.

[0011] In the above program update device, it is preferable that the second storage section further includes a repair result storage area for storing a result of program repair of the external device by the backup program.

[0012] In the above program update device, it is preferable that the first storage section further has a system-specific area for storing a system-specific program for operating the control section. [Effects of the Invention]

[0013] According to the present invention, it is possible to provide a program update device that can automatically repair a program when an update of a program in an external device that does not have a function for backing up programs fails. [Brief explanation of the drawings]

[0014] [Figure 1] 1 is a schematic configuration diagram of a program update device according to an embodiment of the present invention; [Figure 2] 10A is a flowchart showing a program update process according to the embodiment, and FIG. 10B is a timing chart illustrating an example of the operation of the program update device. [Figure 3] 10 is a flowchart illustrating a program repair process according to the embodiment. [Figure 4]10A and 10B are timing charts illustrating an example of the operation of the program update device. [Figure 5] 10 is a flowchart showing a program re-repair process according to the embodiment; [Figure 6] 4 is a timing chart for explaining an example of an operation of the program update device. [Figure 7] 10 is a flowchart showing a state determination process according to the embodiment; [Figure 8] 4 is a timing chart for explaining an example of an operation of the program update device. [Figure 9] FIG. 10 is a schematic configuration diagram of a program updating device according to a modified example. DETAILED DESCRIPTION OF THE INVENTION

[0015] A firmware update device, which is a program update device according to one embodiment of the present invention, will be described below with reference to the drawings. Hereinafter, firmware, which is the "program" of the present invention, will be abbreviated as "FW," a microcomputer as "micon," and a backup as "BU."

[0016] 1, the FW update device is configured by a microcomputer system M. The microcomputer system M is connected to a controller C that provides the microcomputer system M with FW and FW information, and to an electronic device D that serves as an "external device" of the present invention.

[0017] The controller C transmits the FW for the microcomputer system M, the FW for the electronic device D, and FW information related to the FW for the electronic device D to the microcomputer system M. After the transmission of the FW from the controller C to the microcomputer system M is completed, the connection between the controller C and the microcomputer system M may be disconnected.

[0018] The microcomputer system M comprises a microcomputer 1 as the "control unit" of the present invention, a code flash memory 2 as the "first memory unit" of the present invention, and a data flash memory 3 as the "second memory unit" of the present invention.

[0019] The microcomputer 1 operates in accordance with the FW for its own system stored in the code flash memory 2, thereby performing a FW update process for updating the FW of the electronic device D, a FW repair process for repairing the FW of the electronic device D, a FW re-repair process for repairing the FW of the electronic device D after the FW repair process, and a status determination process for determining the status of the electronic device D. Each process performed by the microcomputer 1 will be described later with reference to Figure 2 onwards.

[0020] The code flash memory 2 is a firmware storage memory configured using NOR flash memory. The code flash memory 2 has three divided areas 2A, 2B, and 2C, and is configured to allow simultaneous processing of data reading and writing.

[0021] Area 2A, which is the "area for own system" of the present invention, stores FW for the own system received from controller C. The FW stored in area 2A can be rewritten by controller C, thereby updating the FW of microcomputer system M.

[0022] Areas 2B and 2C store external device FW received from controller C. One of areas 2B and 2C stores BU FW for electronic device D, and the other stores update FW. Hereinafter, of areas 2B and 2C, the one storing BU FW will be referred to as the "backup area (BU area) X1," and the other storing update FW will be referred to as the "update area X2." If external device FW is stored in only one of areas 2B and 2C, that external device FW is the BU FW. Also, if external device FW is stored in both areas 2B and 2C, the external device FW with the incremented ID is the update FW, and the external device FW with the non-incremented ID is the BU FW. IDs for distinguishing these external device FWs are included in the FW information, which will be described later.

[0023] The data flash memory 3 is a data storage memory configured by a NAND flash memory, and has three divided blocks 3A, 3B, and 3C.

[0024] Blocks 3A and 3B, which are "update result storage areas" of the present invention, store FW information related to FW for external devices. One of blocks 3A and 3B stores BU FW information, which is FW information related to BU FW (i.e., FW for external devices stored in BU area X1), and the other stores update FW information, which is FW information related to update FW (i.e., FW for external devices stored in update area X2). Hereinafter, of blocks 3A and 3B, the one storing BU FW information will be referred to as the "first block Y1," and the one storing update FW information will be referred to as the "second block Y2."

[0025] The FW information stored in blocks 3A and 3B stores information related to the ID, storage location, version, checksum, and size associated with each external device FW. The ID is an identification number for identifying the external device FW, and is a number ranging from 0x0000 to 0xFFFF, for example, and is incremented each time the external device FW is written (stored) to the code flash memory 2, and after reaching 0xFFFF, it is returned to 0x0000. The storage location is the area in the code flash memory 2 where the external device FW is stored, the version is the version number of the external device FW, the checksum is an error correction code for the external device FW, and the size is the program size of the external device FW.

[0026] Either of the blocks 3A and 3B that does not store BU FW information (i.e., the second block Y2) does not always store update FW information, but stores update FW information from the time of the FW update process by the microcomputer 1. If the FW update of the electronic device D by the FW update process by the microcomputer 1 is successful, the existing BU FW information is erased and the update FW information becomes new BU FW information, and the microcomputer 1 treats the update FW as the new BU FW. That is, the second block Y2 becomes the first block Y1, and the update area X2 becomes the BU area X1. On the other hand, if the FW update of the electronic device D by the FW update process by the microcomputer 1 fails, neither the BU FW information nor the update FW information is erased. In this way, if the FW update of the electronic device D with the update FW is successful, the blocks 3A and 3B store only the new BU FW information as the FW update result, and if the FW update of the electronic device D with the update FW fails, they store both the BU FW information and the update FW information as the FW update result.

[0027] Also, the update FW information is configured to be erased if the FW of the electronic device D is successfully restored in the FW restoration process by the microcomputer 1. Furthermore, if the FW of the electronic device D is successfully restored in the FW re-restoration process by the microcomputer 1, the existing BU FW information is erased and the update FW information becomes new BU FW information, just as in the case where the FW of the electronic device D is successfully updated in the FW renewal process, and the microcomputer 1 treats the update FW as the new BU FW.

[0028] Block 3C, which is the "repair result storage area" of the present invention, is normally blank, but if the FW update of electronic device D fails in the FW update process by microcomputer 1 and the FW repair of electronic device D fails in the FW repair process by microcomputer 1, it stores the ID of the update FW sent to electronic device D in the FW update process as failure information. In this way, if the repair of the FW of electronic device D using the BU FW fails, block 3C stores the ID of the update FW as the FW repair result.

[0029] The electronic device D receives FW for the electronic device D from the microcomputer system M. The electronic device D has a memory (not shown) for storing the received FW, and operates according to the FW stored in that memory. The microcomputer system M is configured to be able to update the FW of the electronic device D by rewriting the FW stored in the memory of the electronic device D. The electronic device D does not have a function for backing up its own FW.

[0030] (FW update process) Next, the FW update process executed by the microcomputer 1 will be described with reference to FIG. 2(A), first, the microcomputer 1 receives FW for electronic device D from the controller C as FW for external device, and stores the received FW for external device as update FW in one of the areas 2B and 2C that does not store FW for BU (step S1). Also, the microcomputer 1 receives FW information related to the FW for external device received in step S1 from the controller C as update FW information, and stores the update FW information in one of the blocks 3A and 3B that does not store FW information for BU.

[0031] Next, the microcomputer 1 transmits the update FW stored in the update area X2 to the electronic device D at any timing while the microcomputer system M and the electronic device D are connected, and starts updating the FW of the electronic device D (step S2).

[0032] Then, the microcomputer 1 completes the transmission of the update FW and determines whether the update of the FW of the electronic device D using the update FW has been successful (step S3). If the microcomputer 1 determines that the update of the FW of the electronic device D using the update FW has been successful (step S3: YES), it deletes the FW information for BU from the first block Y1 and ends the FW update process (step S4).

[0033] On the other hand, if the microcomputer 1 determines that updating the FW of the electronic device D using the update FW has failed (step S3: NO), it ends the FW update process without deleting the FW information for BU from the first block Y1.

[0034] 2(B), the FW and information stored in each of the flash memories 2 and 3 during the FW update process will be described. The following description is based on the premise that, before the FW update process starts, the FW for the BU is stored in the area 2B and the FW information for the BU is stored in the block 3A.

[0035] As shown in FIG. 2B, when the microcomputer 1 starts receiving the update FW and update FW information at time T1, it starts storing the update FW in area 2C, which does not store BU FW. Then, when the reception of the update FW and update FW information is completed and the storage of the update FW in area 2C is completed at time T2, the update FW information is stored in block 3B, which does not store BU FW information. Immediately thereafter, transmission of the update FW from area 2C, which is the update area X2, to electronic device D begins. When the transmission of the update FW is completed and the FW update of electronic device D is successful at time T3, the BU FW information stored in block 3A, which is the first block Y1, is erased, and invalid FW is stored in area 2B. As a result, the update FW information stored in block 3B becomes the new BU FW information, and the update FW stored in area 2C becomes the new BU FW. Therefore, after time T3, area 2C functions as BU area X1, and area 2B functions as update area X2.

[0036] (FW repair process) Next, the FW restoration process executed by the microcomputer 1 will be described with reference to FIG. As shown in FIG. 3, if the microcomputer 1 determines that the FW update of the electronic device D has failed in the FW update process, it sends the BU FW stored in the BU area X1 to the electronic device D at any time when the microcomputer system M and the electronic device D are connected, and repairs the FW of the electronic device D (step S11).

[0037] Then, the microcomputer 1 completes the transmission of the BU FW and determines whether the BU FW has successfully restored the FW of the electronic device D (step S12). If the microcomputer 1 determines that the BU FW has successfully restored the FW of the electronic device D (step S12: YES), it deletes the update FW information from the second block Y2 and ends the FW restoration process (step S13).

[0038] On the other hand, if the microcontroller 1 determines that the repair of the FW of the electronic device D using the BU FW has failed (step S12: NO), the microcontroller 1 stores the ID of the update FW that failed to update in the FW update process in block 3C (step S14), and terminates the FW repair process without deleting the update FW information from the second block Y2.

[0039] 4(A) and 4(B), the FW and information stored in each of the flash memories 2 and 3 during the FW update process and the FW repair process will be described. As with the description of the FW update process above, it is assumed that the FW for the BU is stored in the area 2B and the FW information for the BU is stored in the block 3A, and the description of the FW update process will be simplified.

[0040] 4A, when the microcomputer 1 starts the FW update process, immediately after time T2, transmission of the update FW from area 2C to electronic device D begins. If it is determined at time T5 that the update of the FW of electronic device D has failed after the transmission of the update FW is completed, transmission of the BU FW from area 2B, which is BU area X1, to electronic device D begins. If the transmission of the BU FW is completed and the FW of electronic device D is successfully restored at time T6, the update FW information stored in block 3B, which is the second block Y2, is erased, and area 2C becomes a state in which invalid FW is stored. Therefore, after time T6, area 2B functions as BU area X1, and area 2C functions as update area X2, just as at the start of the FW update process.

[0041] Also, as shown in Figure 4(B), if it is determined at time T5 that the update of the FW of electronic device D has failed after the transmission of the update FW has been completed, and then it is determined at time T7 that the repair of the FW of electronic device D has failed after the transmission of the FW for BU has been completed, the ID of the update FW stored in area 2C is stored in block 3C.

[0042] (FW re-repair process) Next, the FW re-restoring process executed by the microcomputer 1 will be described with reference to FIG. 5, if the microcomputer 1 determines that the restoration of the FW of the electronic device D has failed in the FW restoration process, it deletes the update FW information from the second block Y2, and similarly to step S1, receives the external device FW from the controller C and stores the received external device FW in the update area X2 as new update FW (step S21). The microcomputer 1 also receives FW information related to the external device FW received in step S21 from the controller C as new update FW information and stores the new update FW information in the second block Y2. That is, in step S21, the microcomputer 1 acquires the new update FW and the new update FW information from the controller C. At this time, the ID of the update FW included in the new update FW information is incremented from the ID of the update FW whose FW update failed in the FW update process.

[0043] Next, the microcontroller 1 deletes the ID of the old update FW (i.e., the ID of the update FW stored in step S14 of the FW repair process) from block 3C (step S22), and, as in step S2, sends the new update FW stored in the update area X2 to the electronic device D at any timing, and starts repairing the FW of the electronic device D (step S23).

[0044] Then, the microcomputer 1 determines whether the FW of the electronic device D has been successfully restored (updated) using the new update FW (step S24). If the microcomputer 1 determines that the FW of the electronic device D has been successfully restored using the new update FW (step S24: YES), it deletes the FW information for BU and ends the FW re-restoration process (step S25).

[0045] On the other hand, if the microcontroller 1 determines that the repair of the FW of the electronic device D using the new update FW has failed (step S24: NO), it stores the ID of the new update FW in block 3C without deleting the FW information for BU from the first block Y1, and terminates the FW re-repair process (step S26).

[0046] 6, the FW and information stored in each of the flash memories 2 and 3 during FW re-repair will be described. The following description is based on the assumption that, before the start of the FW re-repair process, the BU FW is stored in area 2B, the update FW is stored in area 2C, the BU FW information is stored in block 3A, the update FW information is stored in block 3B, and the ID of the update FW is stored in block 3C.

[0047] 6, when the microcomputer 1 starts receiving new update FW and new update FW information at time T8, the update FW information stored in block 3B is erased before time T8, and storage of the new update FW in area 2C begins. Then, when reception of the new update FW and new update FW information is completed and storage of the new update FW in area 2C is completed at time T9, the new update FW information is stored in block 3B, which does not store BU FW information. After storage of the new update FW information in block 3B is completed, the ID of the old update FW stored in block 3C is erased at time T10. Immediately thereafter, transmission of the new update FW from area 2C, which is the update area X2, to electronic device D begins. When transmission of the new update FW is completed and the restoration (update) of the FW of electronic device D is successful at time T11, the BU FW information stored in block 3A, which is the first block Y1, is erased, and invalid FW is stored in area 2B. As a result, the update FW information stored in block 3B becomes the new BU FW information, and the update FW stored in area 2C becomes the new BU FW.

[0048] (Status determination process) 7, a description will be given of the state determination process executed by the microcomputer 1 when the microcomputer system M is started up. The state determination process is a process for determining whether the state of the electronic device D is a normal state in which the electronic device D operates normally, and whether the state is an abnormal state in which the firmware of the electronic device D cannot be updated or repaired by the operation of the microcomputer system M alone, or a recoverable state in which the firmware of the electronic device D can be updated or repaired by the operation of the microcomputer system M alone.

[0049] 7, first, the microcomputer 1 determines whether or not the block 3C stores the ID of the FW to be updated (step S31). If the ID of the FW to be updated is stored in the block 3C when the microcomputer system M is started up, this means that a power interruption has occurred between step S14 in the FW repair process and step S22 in the FW re-repair process (for example, after time T7 in FIG. 4B and before time T10 in FIG. 6), causing the microcomputer system M to shut down.

[0050] If the microcomputer 1 determines in step S31 that the block 3C does not store the ID of the update FW (step S31: NO), it determines whether the blocks 3A and 3B store the BU FW information and the update FW information (step S32).Furthermore, if the microcomputer 1 determines that the blocks 3A and 3B do not store the BU FW information and the update FW information (step S32: NO), it determines whether either the block 3A or 3B stores the BU FW information (step S33).

[0051] If the microcomputer 1 determines in step S32 that the blocks 3A and 3B store BU FW information and update FW information (step S32: YES), the electronic device D is in a state where the FW of the electronic device D can be updated or repaired by transmitting the update FW or BU FW, and thus determines that the electronic device D is in a recoverable state (step S34). That is, if the microcomputer 1 determines in step S32 that the blocks 3A and 3B store BU FW information and update FW information, this means that a power outage occurred during FW update (e.g., after time T2 and before time T3 in FIG. 2B, after time T2 and before time T5 in FIG. 4, or after time T10 and before time T11 in FIG. 6) or during FW repair (e.g., after time T5 and before times T6 or T7 in FIG. 4), and the FW of the electronic device D can be updated or repaired by the operation of the microcomputer system M alone. In this case, the microcomputer 1 automatically starts transmitting the update FW to update the FW of the electronic device D.

[0052] Furthermore, if the microcomputer 1 determines in step S33 that either block 3A or 3B stores FW information for BU (step S33: YES), the FW update process or FW repair process has been completed, and therefore the microcomputer 1 determines that the electronic device D is in a normal state (step S35).

[0053] Furthermore, if the microcomputer 1 determines in step S33 that neither block 3A nor 3B stores FW information for BU (step S33: NO), the microcomputer 1 determines that the electronic device D is in an abnormal state (step S36) because the FW update process and FW repair process cannot be performed.

[0054] On the other hand, if the microcomputer 1 determines in step S31 that the block 3C stores the ID of the update FW (step S31: YES), it determines whether the blocks 3A and 3B store BU FW information and update FW information (step S37), as in step S32. Furthermore, if the microcomputer 1 determines that the blocks 3A and 3B store BU FW information and update FW information (step S37: YES), it determines whether either the block 3A or 3B stores new update FW information (step S38). The new update FW information here refers to update FW information having an ID that is incremented with respect to the ID stored in block 3C.

[0055] If the microcomputer 1 determines in step S37 that the blocks 3A and 3B do not store the BU FW information and the update FW information (step S37: NO), the reception of the new update FW and the new update FW information has not been completed in the FW re-repair process, and therefore determines that the electronic device D is in an abnormal state (step S39). That is, if it is determined in step S37 that the blocks 3A and 3B do not store the BU FW information and the update FW information, this means that a power outage has occurred between the deletion of the update FW information in the FW re-repair process and the storage of the new update FW information (for example, after time T8 and before time T9 in FIG. 6), and the FW of the electronic device D cannot be updated or repaired by the operation of the microcomputer system M alone. In this case, the microcomputer 1 starts the FW re-repair process while connected to the controller C, thereby repairing the FW of the electronic device D.

[0056] Furthermore, if the microcomputer 1 determines in step S38 that neither block 3A nor 3B stores new update FW information (step S38: NO), it determines that the electronic device D is in an abnormal state (step S40), as in step S39. If it determines in step S38 that neither block 3A nor 3B stores new update FW information, this means that a power outage occurred between the completion of the FW repair process and the deletion of the update FW information in the FW re-repair process (for example, before time T8 in FIG. 6), and the FW of the electronic device D cannot be updated or repaired by the operation of the microcomputer system M alone. In this case, the microcomputer 1 repairs the FW of the electronic device D by starting the FW re-repair process while connected to the controller C.

[0057] Furthermore, if the microcomputer 1 determines in step S38 that either block 3A or 3B stores new update FW information (step S38: YES), the microcomputer 1 determines that the electronic device D is in a recoverable state because the reception of the new update FW and the new update FW information has been completed in the FW re-repair process (step S41). If it determines in step S38 that either block 3A or 3B stores new update FW information, this means that a power outage occurred between the reception of the new update FW information in the FW re-repair process and the erasure of the ID of the update FW stored in block 3C (for example, after time T9 and before time T10 in FIG. 6), and the FW of the electronic device D can be updated by the operation of the microcomputer system M alone. In this case, the microcomputer 1 updates or repairs the FW of the electronic device D by automatically starting transmission of the new update FW after removing the ID of the update FW from block 3C.

[0058] 8, the FW and information stored in each of the flash memories 2 and 3 when the FW of the electronic device D is updated or restored after step S34, and after step S41 and after erasing the ID of the update FW from block 3C will be described. The following description is based on the premise that the FW for BU is stored in area 2B, the update FW is stored in area 2C, the FW information for BU is stored in block 3A, and the update FW information is stored in block 3B.

[0059] 8, at any time T13 when the power outage is resolved, transmission of the update FW from area 2C, which is update area X2, to electronic device D begins. When the transmission of the update FW is completed and the update of the FW of electronic device D is successful at time T14, the BU FW information stored in block 3A, which is first block Y1, is erased, and the invalid FW is stored in area 2B. In this way, a process similar to the FW update process described above is performed. If it is determined that the update of the FW of electronic device D has failed in this process, the microcomputer 1 performs the FW repair process described above to repair the FW of electronic device D.

[0060] The present embodiment provides the following effects. (1) A microcomputer system M (program update device) includes a code flash memory 2 (first storage unit) having a BU area X1 for storing BU FW (backup program) and an update area X2 for storing update FW (update program), and a microcomputer 1 (control unit) for updating the FW (program) of an electronic device D (external device) by transmitting the update FW to the electronic device D. The microcomputer 1 determines whether the update of the FW of the electronic device D using the update FW was successful, and if it determines that the update failed, it restores the FW of the electronic device D by transmitting the BU FW to the electronic device D. Therefore, if an update of the FW of the electronic device D, which does not have a function for backing up FW, fails, the FW of the electronic device D can be automatically restored using the BU FW. Furthermore, if it determines that the update was successful, the microcomputer 1 treats the update FW as new BU FW. Therefore, even if the update fails when the microcomputer 1 repeatedly updates the FW of the electronic device D, the FW of the electronic device D can be restored (restored) using the new BU FW.

[0061] (2) The microcomputer 1 determines whether the restoration of the FW of the electronic device D using the BU FW was successful, and if it determines that the restoration was unsuccessful, it acquires new update FW and restores the FW of the electronic device D by sending the update FW to the electronic device D. Therefore, if the restoration of the FW of the electronic device D using the BU FW fails, the FW of the electronic device D can be automatically restored using the new update FW.

[0062] (3) The microcomputer system M further includes a data flash memory 3 (second storage unit) having blocks 3A and 3B (update result storage areas) that store the FW update results (program update results) of the electronic device D using the update FW. Therefore, even if the microcomputer system M is shut down due to a power outage or other reason, the microcomputer 1 can determine whether the FW update of the electronic device D was successful before the shutdown based on the FW update results (i.e., FW information) stored in the blocks 3A and 3B.

[0063] (4) The data flash memory 3 further includes a block 3C (a repair result storage area) that stores the FW repair results of the electronic device D using the BU FW. Therefore, even if the microcomputer system M is shut down due to a power outage or other reason, the microcomputer 1 can determine whether the FW of the electronic device D was successfully repaired before the shutdown based on the FW repair results stored in the block 3C.

[0064] (5) The code flash memory 2 further has an area 2A (local system area) for storing local system programs for operating the microcomputer 1. Therefore, the microcomputer 1 can operate even when the controller C and the microcomputer system M are not connected, and the firmware of the electronic device D can be updated and repaired using the microcomputer system M alone.

[0065] The present invention is not limited to the above-described embodiment, and the above configurations can be modified. For example, the following modifications can be made, or the following modifications can be combined to make the present invention.

[0066] (Variation 1) 9, the code flash memory 2 may include a plurality of switchable banks 2a and 2b. This configuration can reduce the size of the address bus and also make the microcomputer system M redundant.

[0067] The multiple banks 2a, 2b according to the first modification each have areas 2A, 2B, and 2C, and the banks 2a, 2b are configured so that when a read operation is possible from one of them, a write operation is possible to the other. With this configuration, when the microcomputer 1 operates in accordance with the system-specific FW stored in area 2A of one of the banks 2a, 2b (hereinafter referred to as the "first bank Z1"), it stores the system-specific FW and external device FW in areas 2A-2C of the other bank (hereinafter referred to as the "second bank Z2"). By operating in accordance with the system-specific FW stored in area 2A of the second bank Z2, the microcomputer 1 can then update and repair the FW of the electronic device D using the external device FW stored in areas 2B and 2C of the second bank Z2, and store the system-specific FW and external device FW in areas 2A-2C of the first bank Z1.

[0068] (Variation 2) The area in which external device FW is stored is not limited to the two divided areas 2B and 2C. That is, the area in the code flash memory 2 for storing external device FW can be increased. Also, the number of blocks in the data flash memory 3 can be increased depending on the number of areas for storing external device FW. Also, the number of banks according to the first modification can be increased. [Explanation of symbols]

[0069] C Controller D Electronic equipment (external equipment) M Microcomputer System (Program Update Device) 1 Microcomputer (control unit) 2. Code flash memory (first storage unit) 2A area (area for own system) 2B, 2C areas (backup area, update area) 2a, 2b banks 3 Data flash memory (second memory section) Blocks 3A and 3B (update result storage area) 3C block (area for storing repair results)

Claims

1. a first storage unit having a backup area for storing a backup program and an update area for storing an update program; a control unit that updates a program of an external device by transmitting the update program to the external device; a second storage unit having an update result storage area for storing a program update result of the external device by the update program, and a repair result storage area for storing a program repair result of the external device by the backup program, the control unit determines whether the update of the program of the external device by the update program has been successful, and if it determines that the update has failed, restores the program of the external device by sending the backup program to the external device, while if it determines that the update has been successful, treats the update program as a new backup program; a process of determining whether the restoration of the program of the external device by the backup program has been successful, and when it is determined that the restoration has failed, storing an ID of the update program whose update has been determined to have failed in the restoration result storage area, acquiring a new update program from an external controller, storing the ID of the new update program in the restoration result storage area, and transmitting the new update program to the external device, thereby restoring the program of the external device; At the time of startup, a process is performed to determine whether or not the program of the external device can be restored by a standalone operation without acquiring a new program for updating from the external controller, based on the ID of the program for updating stored in the restoration result storage area and the ID of the program for updating stored in the restoration result storage area. A program updating device characterized by:

2. The ID of the update program is an identification number, The control unit determines that the program of the external device can be repaired by a standalone operation when an incremented identification number for the identification number stored in the repair result storage area is stored in the update result storage area.

2. The program update device according to claim 1.

3. The first storage unit further has a system area for storing a system program for operating the control unit.

3. The program update device according to claim 1 or 2.

Images