JP2005004608A - Firmware update method and firmware-equipped device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a firmware update method by which firmware is safely updated with a feeling of being safe. <P>SOLUTION: A communication section 11 receives the firmware to be updated. A temporary storage section 12 temporarily stores the received firmware. The firmware stored on the temporary storage section 12 is written as a temporary data file on a nonvolatile storage section 13. When the writing of the temporary data file is completed, the temporary data file is replaced with the existing firmware. The firmware is protected against file corruption, including a failure in file writing, unexpected power interruption. Furthermore, an authentication section 15 determines whether or not a control command is transmitted from an authorized person in charge of control when the communication section 11 receives the control command spelling update instructions. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a firmware updating method for a firmware mounting apparatus, and the firmware mounting apparatus is typically a control apparatus having a microprocessor.
[0002]
[Prior art]
FIG. 5 shows an example of a configuration related to firmware update of a conventional control device. As shown in FIG. 5, the control device 21 includes a buffer 22 that temporarily stores firmware data and a ROM 23 that stores firmware data. The control device 21 is communicably connected to a host device 24 that transmits firmware. And the firmware of the control apparatus 21 is updated from the high-order apparatus 24 which is an external device as follows.
[0003]
In the firmware update process, after the buffer 22 is cleared, the host device 24 transmits a write command to the control device 21, whereby the firmware data is transferred to the buffer 22. After confirming that the transfer of all the firmware data has been completed, the host device 24 transmits a command for writing the firmware data from the buffer 22 to the ROM 23 to the control device 21. Firmware data is written from the buffer 22 to the ROM 23, and updating of the firmware data is completed (see, for example, Patent Document 1).
[0004]
[Patent Document 1]
JP 2000-148502 A (2nd page, FIG. 7)
[0005]
[Problems to be solved by the invention]
However, in the conventional firmware update method, the writing process of the firmware data from the buffer 22 to the ROM 23 may fail. For example, when performing firmware update work from a remote location through the network, there is a possibility that an unexpected situation such as the power of the control device 21 being turned off during the update work may occur and the writing process to the ROM 23 cannot be completed. There is. When such a situation occurs, the content of the ROM 23 of the control device 21 becomes incomplete, and the control device 21 may fall into an unbootable state from the next time. In order to restore the starting ability, it may be necessary to replace the ROM 23 of the control device 21 or the entire control device.
[0006]
The present invention has been made to solve the conventional problems, and an object thereof is to provide a firmware update method capable of updating firmware data safely and safely.
[0007]
[Means for Solving the Problems]
The firmware update method of the present invention includes a step of receiving firmware to be updated, a step of temporarily storing the received firmware in a temporary storage unit, and a firmware stored in the temporary storage unit as a temporary data file in a nonvolatile storage unit And a step of replacing the temporary data file with the existing firmware when the writing of the temporary data file is completed.
[0008]
With this configuration, the step of writing the temporarily stored firmware as a temporary data file in the nonvolatile storage means and the step of replacing the temporary data file with the existing firmware are provided, so that the time for rewriting the existing firmware file is short. Become. Therefore, the firmware that operates the device is destroyed even when, for example, an unexpected power interruption or power interruption or power failure occurs, or when an event such as a write failure of the nonvolatile storage means occurs. The occurrence of a situation where the device cannot be started can be almost prevented. Thereby, the firmware data can be updated safely and safely.
[0009]
In addition, according to the above configuration, the step of temporarily storing the received firmware file in the temporary storage unit and the step of updating the nonvolatile storage unit with the temporarily stored firmware file are provided. After the data is transferred to the temporary storage means, the nonvolatile storage means can be updated in the plurality of apparatuses. Therefore, there is also an advantage that firmware update operations on a plurality of devices can be performed at substantially the same timing.
[0010]
Note that the firmware may be updated to new firmware or may be updated to old firmware.
[0011]
The firmware update method of the present invention includes a step of receiving a control command indicating a firmware update instruction, and an authentication step of determining whether or not the received control command is transmitted from a valid controller. .
[0012]
With this configuration, since a step of performing user authentication is performed when updating the firmware, it is possible to prevent unauthorized firmware update work from a user other than the user who has been registered in advance. Even when a command for updating firmware is erroneously transmitted from an external device, the user authentication step is provided, so that the apparatus and existing firmware can be protected. In this way, the security of the firmware update operation can be ensured even when the device is connected to the network.
[0013]
The firmware loading apparatus of the present invention includes a rewritable non-volatile storage means for storing firmware, a communication means for receiving firmware to be updated, a temporary storage means for temporarily storing received firmware, and a temporary storage means. Update control means for writing the stored firmware as a temporary data file into the nonvolatile storage means and replacing the temporary data file with the existing firmware.
[0014]
With this configuration, as described in the aspect of the update method described above, the firmware stored in the temporary storage unit is written into the nonvolatile storage unit as a temporary data file, and the temporary data file and the existing firmware are replaced. The time to rewrite the firmware file is shortened. As a result, it is possible to prevent the firmware from being destroyed and being unable to start up when an event such as an unexpected power failure occurs, and thus the firmware data can be updated safely and safely.
[0015]
Further, according to the above configuration, as described in the above-described update method, the firmware of a plurality of firmware-installed apparatuses can be updated at almost the same timing.
[0016]
Within the scope of the present invention, the non-volatile storage means may be composed of one memory or a plurality of memories. The temporary file may be written in one memory, and an existing firmware file in another memory may be replaced with the temporary file.
[0017]
In addition, the firmware mounting apparatus of the present invention is an authentication for determining whether or not the received control command is transmitted from a legitimate controller when the communication means receives a control command indicating a firmware update instruction. Have means.
[0018]
With this configuration, as described in the aspect of the updating method described above, the authentication unit is provided, so that the firmware mounting apparatus and the existing firmware can be protected. Even when the firmware-equipped device is connected to the network, the security of the firmware update operation can be ensured.
[0019]
In the firmware loading apparatus of the present invention, the nonvolatile storage means is a first bank that is a read-only nonvolatile storage means for storing firmware, and a second bank that is a readable / writable firmware storage nonvolatile storage means. And selecting means for selecting whether the firmware is to be activated from the first bank or the second bank.
[0020]
With this configuration, it is possible to store in advance firmware that operates normally in both banks. In normal times, one bank can be used to operate the firmware loaded device and update the firmware, and the other bank can be used to store emergency startup firmware. Therefore, for example, if an unexpected power failure, power interruption, or power failure occurs during a firmware update operation, or if an event such as a failure to write to the nonvolatile storage means occurs, temporarily update one firmware. Even if the used device cannot be activated, the bank to be activated can be switched by the selection means, and the device can be activated normally.
[0021]
In addition, the firmware loading apparatus of the present invention has monitoring means for monitoring whether or not the control means is operating normally, and automatically causing the selection means to switch banks when it is determined that there is an abnormality. The control means using firmware typically comprises a microprocessor, and this microprocessor also functions as the above-described update control means.
[0022]
With this configuration, since the monitoring unit monitors whether or not a firmware installation apparatus using firmware in one bank can not be activated, the bank can be automatically switched when an abnormality occurs.
[0023]
The firmware loading device of the present invention is typically a control device. The present invention is preferably applicable when the control device is connected to the outside via a network and the firmware is updated via the network. However, the firmware loading device of the present invention is not limited to the control device.
[0024]
Further, the present invention is not limited to the above-described firmware update method and firmware loading apparatus. Another aspect of the present invention is a system including, for example, a firmware loading device and an external device that transmits firmware to the firmware loading device. It is also preferable that this system is composed of a plurality of firmware loading apparatuses, and the firmware of the plurality of firmware loading apparatuses is updated according to the present invention. Another aspect of the present invention may be a program for executing the above-described firmware update method or a recording medium on which the program is recorded.
[0025]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, a control device and a firmware update method according to an embodiment of the present invention will be described with reference to the drawings. The control device is a typical example of a firmware embedded device. The control device is, for example, a control device for an MPEG encoder and decoder, and is provided in an image-related device.
[0026]
FIG. 1 shows a control apparatus according to the first embodiment. In FIG. 1, a control device 10 includes a communication unit 11 that performs communication processing between the control device 10 and an external device 16, a temporary storage unit 12 that includes a RAM (Random Access Memory), and a flash ROM (Read Only). A non-volatile storage unit 13 configured by a memory, a control unit 14 configured by a microprocessor, and an authentication unit 15 that performs user authentication using a user name and a password. The external device 16 is a personal computer or the like, and updates the firmware of the control device 10 by sending a command from the outside. In the control device 10, the control unit 14 functions as an update control unit, controls various components, and performs an update operation.
[0027]
FIG. 2 shows a firmware update process by the control device 10 of FIG. First, the control device 10 is in a command reception waiting state (S10). When updating the firmware from the external device 16 to the control device 10, the external device 16 transmits a login request to the control device 10. When the control device 10 receives the login request (S12, YES), the control unit 14 uses the authentication unit 15 to confirm that the login request is an access from a legitimate user registered in advance (S14). Here, the authentication unit 15 determines whether the received control command is a command sent from a valid controller. If the authentication is not successful (S16, NO), the control device 10 returns to the command reception waiting state (S10). If the authentication is successful (S16, YES), the control device 10 confirms the authentication that the authentication has been successful. Reply (S18). Then, the control unit 14 can execute command control necessary for updating the firmware, and the control device 10 enters a command reception waiting state (S20).
[0028]
Next, when receiving a command for requesting firmware file transfer from the authenticated external device 16 (S22, YES), the control device 10 transfers the firmware file to the temporary storage unit 12 through the communication unit 11. (S24).
[0029]
When the transfer is normally completed (S26, YES), the control device 10 returns a message indicating that the transfer is completed to the external device 16 (S28), and waits for reception of the next command (S20). On the other hand, when the transfer is abnormally terminated (S26, NO), the control device 10 transmits a message indicating that the transfer has failed to the external device 16 (S30), and waits for the next command reception (S20).
[0030]
When receiving a command for requesting firmware update from the authenticated external device 16 (S32, YES), the control device 10 confirms that a valid firmware file exists in the temporary storage unit 12 (S34). If there is no file in the temporary storage unit 12 or an abnormal file exists (S34, NO), the control device 10 returns a message to the effect that update has failed to the external device 16 (S36).
[0031]
If the file in the temporary storage unit 12 is normal (S34, YES), the control device 10 executes a process of transferring the firmware file stored and held in the temporary storage unit 12 to the nonvolatile storage unit 13 ( S38). Here, the firmware file in the temporary storage unit 12 is transferred to the nonvolatile storage unit 13 as a new temporary file. This temporary file corresponds to the temporary data file of the present invention.
[0032]
Next, the result of the file transfer to the nonvolatile storage unit 13 is confirmed (S40). When the transfer fails (S40, NO), the control device 10 transmits a message indicating that the update has failed to the external device 16 (S42).
[0033]
When the transfer of the file is successful (S40, YES), the control device 10 performs an operation to replace the firmware file stored in the nonvolatile storage unit 13 with the temporary file to be updated in the nonvolatile storage unit 13. Execute (S44). Next, the result of the replacement work is confirmed (S46). When the replacement has failed (S46, NO), the control device 10 transmits a message indicating that the update has failed to the external device 16 (S42), and waits for reception of the next command (S20). On the other hand, when the replacement is successful (S46, YES), the control device 10 transmits a message indicating that the update has been successful to the external device 16 (S48), and waits for reception of the next command (S20).
[0034]
When receiving a command for requesting logout from the control device 10 from the authenticated external device 16 (S50, YES), the control device 10 ends the firmware update process. The control device 10 does not receive a command for requesting firmware file transfer from the authenticated external device 16 (S22, NO), and does not receive a command for requesting firmware update (S32, NO). If a command requesting logout from the terminal is not received (S50, NO), the next command is repeatedly received (S20).
[0035]
As described above, according to the first embodiment, by providing the authentication unit 15, a step of clearing user authentication is performed when performing the firmware update operation. As a result, it is possible to prevent an unauthorized firmware update work from a user other than the user who is registered in advance. Even if a command for updating the firmware is erroneously transmitted from the host device, an erroneous update can be prevented by the step of authenticating the user. Thus, according to the present embodiment, the control device and the installed firmware can be protected.
[0036]
Further, according to the first embodiment, the provision of the temporary storage unit 12 provides the following advantages. Consider the case where multiple control devices have firmware to be updated. In general, it takes a certain amount of time to transfer the firmware from the host device to the control device. Therefore, when there are a plurality of control devices to be updated, only the firmware to be updated is sequentially transferred to all the control devices in advance. When the transfer to all the control devices is completed, or when the update date and time after the transfer is completed, the update work of all the control devices is executed in parallel at substantially the same timing. In this way, it is possible to perform update operations for a plurality of control devices at substantially the same timing.
[0037]
In order to actually perform the simultaneous update described above, the external device issues an instruction to a plurality of control devices so that the update is performed at the same timing. Each of the plurality of control devices performs an update operation using the firmware already received at a timing instructed from the outside. For example, the external device transmits an update instruction (S32 in FIG. 2) to a plurality of control devices at the same time. At this time, the external device may send an update instruction to the control devices when the file transfer to the plurality of control devices is completed, or may send an update instruction after the completion time.
[0038]
In addition, the external device may transmit update time information to a plurality of control devices in advance. Each of the plurality of control devices stores the update time, and when the update time comes, the update operation using the file in the temporary storage unit 12 is performed.
[0039]
Further, according to the first embodiment, when updating to the nonvolatile storage unit 13, a step of temporarily transferring a firmware file to be updated to the nonvolatile storage unit 13 as a temporary file, and the transferred temporary file, By preparing a step for replacing the firmware that is actually operating, the timing for rewriting the file of the firmware that is actually operating becomes extremely short. As a result, the firmware that operates the control device is destroyed and controlled even when an unexpected power failure, power interruption, or power failure occurs, or when an event such as a write failure of the nonvolatile memory occurs. Occurrence of a situation where the apparatus cannot be started can be almost prevented.
[0040]
Next, a second embodiment of the present invention will be described.
[0041]
FIG. 3 shows a control device according to the second embodiment. 3, components similar to those in FIG. 1 are denoted by the same reference numerals as in FIG. Hereinafter, the description of the already described items will be omitted as appropriate.
[0042]
As shown in FIG. 3, in the present embodiment, the nonvolatile storage unit 13 includes a first bank 18 and a second bank 19. The first bank 18 is used as a read-only nonvolatile storage unit for storing firmware. On the other hand, the second bank 19 is used as a nonvolatile storage unit for storing firmware that can be read and written.
[0043]
The control device 10 is further provided with a selection unit 17. The selection unit 17 determines which of the first bank 18 and the second bank 19 is selected. That is, the selection unit 17 selects from which of the first bank 18 and the second bank 19 the firmware is activated.
[0044]
The operation of the control device 10 in FIG. 3 will be described. The selection unit 17 issues an instruction as to which of the first bank 18 and the second bank 19 is selected. When the selection unit 17 indicates the first bank 18 in accordance with this instruction, the first bank 18 is operated as a firmware storage unit that is referred to when the control device 10 is activated. On the other hand, when the selection unit 17 designates the second bank 19, the second bank 19 is operated as a firmware storage unit that is referred to when the control device 10 is activated.
[0045]
As described above, according to the second embodiment, the first bank 18 and the second bank 19 are provided in the non-volatile storage unit 13, and the selection unit 17 for selecting them is provided, so that the firmware is updated. Having two redundantly increases the capacity of the non-volatile storage unit. Although the capacity increases, both the first bank 18 and the second bank 19 can store in advance firmware that operates normally. During normal operation, only one bank is used to operate the control device 10 and update the firmware, and the other bank can be used to store emergency startup firmware. Even if the controller 10 becomes unbootable if an unexpected power failure, power interruption, or power failure occurs during firmware update, or if an event such as a failure to write to the nonvolatile memory occurs. The control unit 10 can be normally started by switching the bank to be started by the selection unit 17. The unbootable state caused by the update operation can be avoided, that is, the update operation can be performed without causing a problem, so that the firmware data can be updated safely and safely.
[0046]
Next, a control device according to a third embodiment of the present invention will be described.
[0047]
FIG. 4 shows a control device according to the third embodiment. 4, components similar to those in FIGS. 1 and 3 are given the same reference numerals as in FIGS. Hereinafter, the description of the matters already described with reference to FIGS. 1 and 3 will be omitted as appropriate.
[0048]
As shown in FIG. 4, in the present embodiment, a monitoring unit 20 is provided in the control device 10 in addition to the configuration of FIG. 3. The monitoring unit 20 monitors the control unit 14 and controls the selection unit 17. That is, the monitoring unit 20 monitors whether or not the control unit 14 is operating normally, and when it is determined that there is an abnormality, controls the selection unit 17 to automatically switch the bank.
[0049]
The operation of the control device 10 in FIG. 4 will be described. For example, it is assumed that the first bank 18 is normally used for starting the control device 10. The monitoring unit 20 monitors the control unit 14 as described above. When the monitoring unit 20 detects that the control unit 14 is not operating normally for some reason while the control device 10 is operating, the monitoring unit 20 instructs the selection unit 17 to switch banks. Thereby, the selection unit 17 performs a process for switching from the first bank 18 to the second bank 19. Further, the monitoring unit 20 controls the control unit 14 to restart. As a result, the control unit 14 performs a restart process using the firmware stored in the switched bank.
[0050]
In the above description, the first bank 18 is a nonvolatile storage means that is normally operated, and the firmware of the first bank 18 is used for activation. However, it goes without saying that the second bank 19 may be a non-volatile storage unit that is normally operated.
[0051]
As described above, according to the third embodiment, the following advantages can be obtained by providing the monitoring unit 20 that monitors the operation of the control unit 14. Suppose that the control device 10 is in an inoperable state in the event of an unexpected power failure, power interruption, or power failure during firmware update, or when an event such as a non-volatile memory write failure occurs. . In addition, there is a possibility that the updated firmware is defective and the control device 10 does not operate. In such a case, according to the present embodiment, it is possible to automatically detect an abnormality, perform switching, and restart the control apparatus 10 with firmware that operates normally. Therefore, it is possible to prevent the situation where the control device 10 does not operate. Therefore, it is possible to avoid the unbootable state caused by the update, and the firmware data can be updated safely and safely.
[0052]
The preferred embodiment of the present invention has been described above, but it is needless to say that the above embodiment can be modified by those skilled in the art within the scope of the present invention.
[0053]
【The invention's effect】
As described above, the present invention writes the temporarily stored firmware as a temporary data file in the nonvolatile storage means, and replaces the temporary data file with the existing firmware, thereby shortening the time for rewriting the existing firmware file. Therefore, it is possible to almost prevent the firmware from being destroyed by the update operation, and to provide a firmware update method having an excellent effect that the firmware data can be updated safely and safely. is there.
[Brief description of the drawings]
FIG. 1 is a block diagram of a control device according to a first embodiment of the present invention. FIG. 2 is a flowchart showing an operation of the control device according to the first embodiment of the present invention. FIG. 4 is a block diagram of a control device according to a third embodiment of the present invention. FIG. 5 is a block diagram of a conventional control device.
11 Communication Unit 12 Temporary Storage Unit 13 Non-Volatile Storage Unit 14 Control Unit 15 Authentication Unit 16 External Device 17 Selection Unit 18 First Bank 19 Second Bank 20 Monitoring Unit

Claims (6)

Receiving the firmware to be updated; and
Temporarily storing the received firmware in a temporary storage means;
Writing the firmware stored in the temporary storage means into the nonvolatile storage means as a temporary data file;
Replacing the temporary data file and existing firmware when the writing of the temporary data file is completed;
A firmware update method characterized by comprising: Receiving a control command indicating a firmware update instruction;
An authentication step of determining whether the received control command is transmitted from a legitimate controller;
The firmware update method according to claim 1, further comprising: Rewritable nonvolatile storage means for storing firmware;
A communication means for receiving firmware to be updated;
Temporary storage means for temporarily storing received firmware;
Update control means for writing firmware stored in the temporary storage means to the nonvolatile storage means as a temporary data file, and replacing the temporary data file with existing firmware;
A firmware loading apparatus characterized by comprising: The authentication means for determining whether or not the received control command is transmitted from a legitimate controller when the communication means receives a control command indicating a firmware update instruction. 4. The firmware loading device according to 3. The nonvolatile storage means includes a first bank that is a read-only nonvolatile storage means for storing firmware, and a second bank that is a readable and writable firmware storage nonvolatile storage means,
4. The firmware mounting apparatus according to claim 3, further comprising selection means for selecting whether to start firmware from the first bank or the second bank. 6. The monitoring unit according to claim 5, further comprising: a monitoring unit that monitors whether the control unit is operating normally and automatically switches the bank to the selection unit when it is determined that there is an abnormality. Firmware loaded device.

Images